Roles and access

Every user has one role, set in the Role field of their account:

• The first user is always an admin. After that, only admins create users and set roles, and never their own.
• A user without a role gets what visitors get.
• Form submissions are for editors and admins only: they hold what visitors wrote about themselves.
• In a public demo (DEMO_MODE), the demo login is an editor and nobody but an admin changes an account. See Live demo.

The editor guide describes the roles from the editors' side.

Where the rules live #

• src/access/index.ts has the building blocks: isAdmin, isEditorOrAdmin, isTranslator, and the access functions anyone, authenticated, authenticatedOrPublished, admins and editorsAndAdmins.
• A collection's own access says what visitors and logged-in users may do. Most content collections read authenticatedOrPublished: visitors see published documents, logged-in users see drafts too.
• rolesPlugin (src/access/roles.ts) narrows that per role, for every collection and global, including ones added later and by plugins. That is why it is the last plugin in src/payload.config.ts. The users collection keeps its own rules.
• To narrow further, use admins or editorsAndAdmins in the collection or global itself, as Site settings does for updates.

Translators in detail #

rolesPlugin lets a translator:

• change localized fields only (and everything inside them), and only in a language other than the default;
• save drafts only in collections with drafts: they never publish, and the Publish button is gone;
• never create, delete, restore a version, or upload and replace files in the media library.

Everything else is read-only for them, in the admin and in the API. Where there are no drafts (the header, the footer and Microcopy, and collections such as dealers, product families and media), there is no draft to save: a translator's change to another language's text is live at once.

The AI tools follow the same rules: a translator can ✨ translate into the other languages and use the copy desk there, but not proofread the default language, push blocks to every language, or run Distill and evaluations.

So do the admin's document tools: Clean pasted line breaks (in the ⋮ menu of documents with drafts) and Replace file (on media) are for editors and admins, and show only where their endpoints accept them. One rule serves both, in src/access/tools.ts.

Adding a collection #

1. Give it its own access: what visitors and logged-in users may do. The role rules apply by themselves.
2. Grant visitors only what they need, deliberately. tests/int/roles.int.spec.ts lists what visitors may do (PUBLIC, PUBLIC_GLOBALS) and checks every collection and global for every role. Add the new collection's visitor rights there, or the test fails.
3. If nobody may do something, even an admin (such as changing a form submission), list it in NOBODY; if translators must not even read it, in NOT_TRANSLATORS.

POST /api/revalidate and the other admin endpoints check the role themselves; their tests are in tests/int/adminEndpointAccess.int.spec.ts and tests/int/roles.int.spec.ts.