#How to restrict read access of a collection based on API key authentication?

7 messages · Page 1 of 1 (latest)

candid nymph
#

Hello,

I have a problem. I want to restrict read access to my collections but at the same time I don't want force users to create accounts in the cms. Since my app is quite self contained, i just wanna protect the content. I don't know how to add this config to collection

static oxideBOT
candid nymph
# 
  const fetchArticles = async () => {
    return (
      await apiClient.get(`short-articles${stringifiedQuery}`, {
        headers: {
          Authorization: `short-articles API-Key key`,
        },
      })
    ).data;
  };

const ShortArticles: CollectionConfig = {
  slug: "short-articles",
  hooks: {
    beforeChange: [
      ({ data, req }) => {
        if (data.content) {
          data.rawContent = extractTextFromSlate(data.content);
        }
      },
    ],
  },
  versions: {
    drafts: true,
  },
  admin: {
    useAsTitle: "title",
    group: "Content",
  },
  access: {
    read: ({ req: { user } }) => { return !!user }
  },
  fields: [
    {
      name: "title",
      type: "text",
      required: true,
      localized: true,
      unique: true,
    },
    {
      name: "content",
      type: "richText",
      required: true,
      localized: true,
    },
    {
      name: "rawContent",
      type: "text",
      localized: true,
      admin: {
        hidden: true,
      },
    },
    {
      name: "urlPath",
      type: "relationship",
      relationTo: "paths",
      hasMany: false,
      required: true,
    },
    {
      name: "branch",
      type: "relationship",
      relationTo: "branches",
      hasMany: false,
      required: true,
    },
  ],
};

export default ShortArticles;
#

do i need to create api key for each collection in this case?

candid nymph
#

is it possible that i can create one user and use his api key to create access control for my collections?

dapper plume
#

I answered this in the other thread, but you can prevent access by return false for each operation

#

Then you can add a custom endpoint to the collection that will check for an API key and then use the local API to get specific data without access control