Z8MB1E c0d00fc113 fix(auth): reject MCP API-key sessions in user auth paths ... With the MCP plugin enabled, payload.auth() can return a payload-mcp-api-keys doc instead of a User. Add an isPayloadUser type guard and use it in every server action, page, and route that treats the auth result as a real user, so API-key sessions can no longer pass user auth checks. hasRoles now explicitly requires a users-collection doc.		2026-08-25 12:27:35 -04:00
..
route.ts	fix(auth): reject MCP API-key sessions in user auth paths	2026-08-25 12:27:35 -04:00