The four public globals (site-settings, home, metadata, privacy-policy)
spelled update access as "any authenticated user" — and campaign JWTs
authenticate against /api/*, so any campaign session (leader included)
could PATCH the public site. payloadAdminOnly matches the collection
lockdown precedent; editors lose config-global writes deliberately
(content editing stays on canManagePublishedContent collections).
Pins: identity + deny (coordinator/editor) + allow (admin fn) + anonymous
read in collectionAccessLockdown.int.spec.ts. Recurrence guard:
globalAccessConventions.unit.spec.ts bans the Boolean(user) shape in
src/globals.
Co-authored-by: Francisco Solla <fsolla@users.noreply.github.com>
- add new metadata global with URL, title, description, keywords, Open Graph, Twitter, and image fields
- register Metadata global in payload.config.ts
- switch frontend layout to generateMetadata() and load metadata values from Payload globals
- resolve metadata image relation (ID or populated media) for OG/Twitter images
- update live preview globals config to use SiteSettings.slug and HomePage.slug
- keep SiteSettings revalidation hook in consistent position within config
- regenerate payload-types.ts for new global/schema types
