mirror of
https://github.com/fsolla/teqo.git
synced 2026-11-13 06:43:06 +00:00
473c82d09d
- users/signature/subscription/consent: all operations Payload-admin-only (Payload's default allowed ANY authenticated user, incl. campaign JWTs via /api — privilege escalation + PII exposure) - post/tag/media/petition: public read kept, writes admin-only, readVersions admin-only on drafted collections - leader lockdown: staff gates on /campanha/demandas* and /campanha/planos*; removed the dead leader branch of the demand detail page - fix createLeaderSupporter: scope now asserted via the leader's engaged leadership municipalities (canReadMunicipality always denied leaders) - candidate alignment: supporter area, invite creation, and escalated demand decisions now treat candidate as unrestricted staff consistently - tests: collectionAccessLockdown.int.spec pins the lockdown; leased-consent helpers generalized (supporter keys); fixtures purge deletes residue invites before leaderships; stale leader-phone tests updated to the lockdown model; 'sem Praça' copy renamed to 'sem município'
43 lines
997 B
TypeScript
43 lines
997 B
TypeScript
import { payloadAdminOnly } from '@/utilities/campaignAccess'
|
|
import { CollectionConfig } from 'payload'
|
|
|
|
export const Subscription: CollectionConfig = {
|
|
slug: 'subscription',
|
|
labels: {
|
|
singular: 'Assinatura',
|
|
plural: 'Assinaturas',
|
|
},
|
|
admin: {
|
|
group: 'Contatos',
|
|
},
|
|
// Citizen PII. Public opt-in flows write via the Local API without a user
|
|
// (overrideAccess defaults to true), so admin-only access does not affect them.
|
|
access: {
|
|
create: payloadAdminOnly,
|
|
read: payloadAdminOnly,
|
|
update: payloadAdminOnly,
|
|
delete: payloadAdminOnly,
|
|
},
|
|
fields: [
|
|
{
|
|
type: 'relationship',
|
|
name: 'contact',
|
|
label: 'Contato',
|
|
required: true,
|
|
relationTo: 'contact',
|
|
},
|
|
{
|
|
type: 'relationship',
|
|
name: 'consent',
|
|
label: 'Consentimento',
|
|
required: true,
|
|
relationTo: 'consent',
|
|
},
|
|
{
|
|
name: 'comment',
|
|
type: 'textarea',
|
|
label: 'Comentario',
|
|
maxLength: 1000,
|
|
},
|
|
],
|
|
}
|