Z8MB1E
c0d00fc113
With the MCP plugin enabled, payload.auth() can return a payload-mcp-api-keys doc instead of a User. Add an isPayloadUser type guard and use it in every server action, page, and route that treats the auth result as a real user, so API-key sessions can no longer pass user auth checks. hasRoles now explicitly requires a users-collection doc.
10 lines
348 B
TypeScript
10 lines
348 B
TypeScript
import { PayloadMcpApiKey, User } from "@/payload-types";
|
|
|
|
export default function hasRoles(
|
|
roles: NonNullable<User["roles"]>,
|
|
user: User | PayloadMcpApiKey | null | undefined,
|
|
) {
|
|
if (!user || user.collection !== "users") return false;
|
|
|
|
return roles.some((role) => user.roles?.some((urole) => urole === role || urole === "developer"));
|
|
}
|