Field-level Access Control

Field Access Control is Access Control used to restrict access to specific Fields within a Document. To add Access Control to a Field, use the access property in your Field Config:

import type { Field } from 'frogbot'

export const FieldWithAccessControl: Field = {
  // ...
  access: {
    // ...
  },
}

Field Access Control does not support returning Query constraints like Collection Access Control does.

Config Options

Access Control is specific to the operation of the request. To add Access Control to a Field, use the access property in the Field Config:

import type { CollectionConfig } from 'frogbot';

export const Posts: CollectionConfig = {
  slug: 'posts',
  fields: [
    {
      name: 'title',
      type: 'text',
      access: {
        create: ({ req: { user } }) => { ... },
        read: ({ req: { user } }) => { ... },
        update: ({ req: { user } }) => { ... },
      },
    };
  ],
};

The following options are available:

Function	Type	Default	Purpose
`create`	`FieldAccess`	Allowed	Allows or denies the ability to set a field’s value when creating a new document. More details.
`read`	`FieldAccess`	Allowed	Allows or denies the ability to read a field’s value. More details.
`update`	`FieldAccess`	Allowed	Allows or denies the ability to update a field’s value More details.

Each function returns boolean or Promise<boolean>. Field access functions don’t accept queries. They don’t run when an operation sets overrideAccess: true.

Create

Returns a boolean which allows or denies the ability to set a field’s value when creating a new document. If false is returned, any passed values will be discarded. Available argument properties:

Option	Type	Default	Description
`req`	`FrogBotRequest`	Always set	The current request, with the signed-in `user` and `req.frogbot`.
`data`	`object`	Always set	The full data passed to create the document.
`siblingData`	`object`	Always set	Immediately adjacent field data passed to create the document.
`blockData`	`JsonObject \| undefined`	—	The nearest parent block’s data, or `undefined` outside a block.
`collection`	`SanitizedCollectionConfig`	—	The collection’s sanitized config, when the field is on a collection.
`global`	`SanitizedGlobalConfig`	—	The global’s sanitized config, when the field is on a global.
`doc`	`object`	—	The existing document. Not meaningful on create.
`id`	`string \| number`	—	Not set on create, because the document doesn’t exist yet.

Read

Returns a boolean which allows or denies the ability to read a field’s value. If false, the entire property is omitted from the resulting document. Available argument properties:

Option	Type	Default	Description
`req`	`FrogBotRequest`	Always set	The current request, with the signed-in `user` and `req.frogbot`.
`id`	`string \| number`	Always set	`id` of the document being read.
`doc`	`object`	Always set	The full document data.
`data`	`object`	Always set	The same value as `doc`.
`siblingData`	`object`	Always set	Immediately adjacent field data of the document being read.
`blockData`	`JsonObject \| undefined`	—	The nearest parent block’s data, or `undefined` outside a block.
`collection`	`SanitizedCollectionConfig`	—	The collection’s sanitized config, when the field is on a collection.
`global`	`SanitizedGlobalConfig`	—	The global’s sanitized config, when the field is on a global.

Update

Returns a boolean which allows or denies the ability to update a field’s value. If false is returned, any passed values will be discarded. If false is returned and you attempt to update the field’s value, the operation will not throw an error however the field will be omitted from the update operation and the value will remain unchanged. Available argument properties:

Option	Type	Default	Description
`req`	`FrogBotRequest`	Always set	The current request, with the signed-in `user` and `req.frogbot`.
`id`	`string \| number`	Always set	`id` of the document being updated.
`data`	`object`	Always set	The full data passed to update the document.
`siblingData`	`object`	Always set	Immediately adjacent field data passed to update the document with.
`doc`	`object`	Always set	The full document data, before the update is applied.
`blockData`	`JsonObject \| undefined`	—	The nearest parent block’s data, or `undefined` outside a block.
`collection`	`SanitizedCollectionConfig`	—	The collection’s sanitized config, when the field is on a collection.
`global`	`SanitizedGlobalConfig`	—	The global’s sanitized config, when the field is on a global.

Start here

Basics

Managing Data

Features

Ecosystem

Deployment

Field-level Access Control

Config Options

Create

Read

Update

​Config Options

​Create

​Read

​Update

Config Options

Create

Read

Update