From 529a9573b23443982dff9d93e96e66dbaaa04446 Mon Sep 17 00:00:00 2001
From: Z8MB1E <jason@onyxsimple.com>
Date: Tue, 22 Sep 2026 14:52:48 -0400
Subject: [PATCH] feat(admin): hide compose settings and API keys from
 non-superusers

---
 src/payload.config.ts | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/src/payload.config.ts b/src/payload.config.ts
index 2db0408..bfac232 100644
--- a/src/payload.config.ts
+++ b/src/payload.config.ts
@@ -82,12 +82,14 @@ import { CustomMinefieldScores } from "@/collections/minigames/CustomMinefieldSc
 import { CustomRadioTests } from "@/collections/minigames/CustomRadioTests";
 import { CustomRadioTestScores } from "@/collections/minigames/CustomRadioTestScores";
 import { RibbonSubmissions } from "@/collections/users/RibbonSubmissions";
+import hasRoles from "@/utils/access-control/hasRoles";
 import { scopedAdminPageAccess } from "@/utils/access-control/divisionAccess";
 import { payloadAiPlugin, PayloadAiPluginLexicalEditorFeature } from "@ai-stack/payloadcms";
 import type { SeedPromptFunction } from "@ai-stack/payloadcms/types";
 import { mcpPlugin } from "@payloadcms/plugin-mcp";
 import { createOpenAI } from "@ai-sdk/openai";
 import { createTextStreamResponse, jsonSchema, streamObject } from "ai";
+import type { User } from "@/payload-types";
 
 const unslothProvider = createOpenAI({
   apiKey: process.env.UNSLOTH_API_KEY,
@@ -449,7 +451,23 @@ export default buildConfig({
   plugins: [
     // payloadCloudPlugin(),
     // storage-adapter-placeholder
-    mcpPlugin({ collections: mcpCollections }),
+    mcpPlugin({
+      collections: mcpCollections,
+      overrideApiKeyCollection: (collection) => ({
+        ...collection,
+        admin: {
+          ...collection.admin,
+          hidden: ({ user }) => !hasRoles(["admin", "developer"], user as User),
+        },
+        access: {
+          ...collection.access,
+          read: ({ req }) => hasRoles(["admin", "developer"], req.user as User),
+          update: ({ req }) => hasRoles(["admin", "developer"], req.user as User),
+          create: ({ req }) => hasRoles(["admin", "developer"], req.user as User),
+          delete: ({ req }) => hasRoles(["admin", "developer"], req.user as User),
+        },
+      }),
+    }),
     payloadAiPlugin({
       seedPrompts: aiFieldSeedPrompts,
       collections: {
@@ -515,6 +533,17 @@ export default buildConfig({
         [Labels.slug]: true,
       },
       debugging: true,
+      overrideInstructions: {
+        admin: {
+          hidden: ({ user }) => !hasRoles(["admin", "developer"], user as User),
+        },
+        access: {
+          read: ({ req }) => hasRoles(["admin", "developer"], req.user as User),
+          update: ({ req }) => hasRoles(["admin", "developer"], req.user as User),
+          create: ({ req }) => hasRoles(["admin", "developer"], req.user as User),
+          delete: ({ req }) => hasRoles(["admin", "developer"], req.user as User),
+        },
+      },
       generationModels: [
         {
           id: "unsloth-text",