fix: add collection property to auth documents, fixing multi tenancy access control issue (#15404)

This PR ensures that all documents returned from auth-enabled
collections via local API operations include the `collection` property,
which is essential for multi-tenant access control to function
correctly.
## Motivation
A common pattern in Payload applications is to fetch a user from the
database and pass it to subsequent operations:
```typescript
const sean = (await payload.find({
collection: 'users',
where: { email: { equals: 'sean@payloadcms.com' } }
})).docs[0]
const result = await payload.find({
collection: 'diaries',
overrideAccess: false,
user: sean, // pass fetched user
})
// result.docs[0]: { title: "sean's diary" }
// result.docs[1]: { title: "jarrod's journal" } // Oh no! This is private!
```
This introduces a security vulnerability. The local API expects
`user.collection` to be present, but user documents returned by
`find`/`findByID` did not include this property. Since the `user`
parameter is loosely typed, TypeScript does not catch this error.
In the `@payloadcms/plugin-multi-tenant` plugin, `useTenantAccess`
checks `req.user.collection` to apply tenant-based access control. This
is not an issue within plugin-multi-tenant, because the Payload types
mark `req.user.collection` as required - thus it's reasonable to expect
this property to be there. When `collection` is `undefined`, the
condition `args.req.user.collection === adminUsersSlug` always evaluates
to `false`, bypassing tenant access restrictions.
## Changes
The `collection` property is now injected into auth collection documents
immediately after data is fetched from the database in all collection
operations (`find`, `findByID`, `create`, `update`, `delete`, etc.).
This makes it available throughout all operation hooks.
Type generation has been updated to include `collection` directly in
auth collection schemas, producing cleaner types where `User` contains
`collection: 'users'` without intersection types. Input types have been
updated to make `collection` optional since it's auto-populated.
As a fallback, `createLocalReq` now sets `user.collection` to the
default admin user collection if missing - this is an additional
safeguard. A TODO has been added to throw an error instead in version
4.0. We cannot throw an error now, as this would be a breaking change.
[[Link to internal Slack
discussion]](https://payloadcms.slack.com/archives/C049BR3QBHC/p1769593583792739)

Author: AlessioGr

packages/next/src/auth/login.ts

@@ -1,32 +1,35 @@
 'use server'
 
-importtype{CollectionSlug}from'payload'
+importtype{AuthCollectionSlug,LoginResult,MaybePromise,SanitizedConfig}from'payload'
 
 import{getPayload}from'payload'
 
 import{setPayloadAuthCookie}from'../utilities/setPayloadAuthCookie.js'
 
-typeLoginWithEmail={
-collection: CollectionSlug
-config: any
+typeLoginWithEmail<TSlugextendsAuthCollectionSlug>={
+collection: TSlug
+config: MaybePromise<SanitizedConfig>
 email: string
 password: string
 username?: never
 }
 
-typeLoginWithUsername={
-collection: CollectionSlug
-config: any
+typeLoginWithUsername<TSlugextendsAuthCollectionSlug>={
+collection: TSlug
+config: MaybePromise<SanitizedConfig>
 email?: never
 password: string
 username: string
 }
-typeLoginArgs=LoginWithEmail|LoginWithUsername
-
-exportasyncfunctionlogin({ collection, config, email, password, username }: LoginArgs): Promise<{
-token?: string
-user: any
-}>{
+typeLoginArgs<TSlugextendsAuthCollectionSlug>=LoginWithEmail<TSlug>|LoginWithUsername<TSlug>
+
+exportasyncfunctionlogin<TSlugextendsAuthCollectionSlug>({
+ collection,
+ config,
+ email,
+ password,
+ username,
+}: LoginArgs<TSlug>): Promise<LoginResult<TSlug>>{
 constpayload=awaitgetPayload({ config,cron: true})
 
 constauthConfig=payload.collections[collection]?.config.auth

packages/next/src/auth/logout.ts

@@ -1,6 +1,6 @@
 'use server'
 
-importtype{SanitizedConfig}from'payload'
+importtype{MaybePromise,SanitizedConfig}from'payload'
 
 import{cookiesasgetCookies,headersasnextHeaders}from'next/headers.js'
 import{createLocalReq,getPayload,logoutOperation}from'payload'
@@ -12,7 +12,7 @@ export async function logout({
  config,
 }: {
 allSessions?: boolean
-config: Promise<SanitizedConfig>|SanitizedConfig
+config: MaybePromise<SanitizedConfig>
 }){
 constpayload=awaitgetPayload({ config,cron: true})
 constheaders=awaitnextHeaders()

packages/next/src/auth/refresh.ts

@@ -1,14 +1,14 @@
 'use server'
 
-importtype{CollectionSlug}from'payload'
+importtype{CollectionSlug,MaybePromise,SanitizedConfig}from'payload'
 
 import{headersasnextHeaders}from'next/headers.js'
 import{createLocalReq,getPayload,refreshOperation}from'payload'
 
 import{getExistingAuthToken}from'../utilities/getExistingAuthToken.js'
 import{setPayloadAuthCookie}from'../utilities/setPayloadAuthCookie.js'
 
-exportasyncfunctionrefresh({ config }: {config: any}){
+exportasyncfunctionrefresh({ config }: {config: MaybePromise<SanitizedConfig>}){
 constpayload=awaitgetPayload({ config,cron: true})
 constheaders=awaitnextHeaders()
 constresult=awaitpayload.auth({ headers })

packages/payload/src/auth/operations/forgotPassword.ts

@@ -6,7 +6,7 @@ import type {
 AuthOperationsFromCollectionSlug,
 Collection,
 }from'../../collections/config/types.js'
-importtype{CollectionSlug}from'../../index.js'
+importtype{AuthCollectionSlug}from'../../index.js'
 importtype{PayloadRequest,Where}from'../../types/index.js'
 
 import{buildAfterOperation}from'../../collections/operations/utilities/buildAfterOperation.js'
@@ -20,7 +20,7 @@ import { initTransaction } from '../../utilities/initTransaction.js'
 import{killTransaction}from'../../utilities/killTransaction.js'
 import{getLoginOptions}from'../getLoginOptions.js'
 
-exporttypeArguments<TSlugextendsCollectionSlug>={
+exporttypeArguments<TSlugextendsAuthCollectionSlug>={
 collection: Collection
 data: {
 [key: string]: unknown
@@ -33,7 +33,7 @@ export type Arguments<TSlug extends CollectionSlug> = {
 
 exporttypeResult=string
 
-exportconstforgotPasswordOperation=async<TSlugextendsCollectionSlug>(
+exportconstforgotPasswordOperation=async<TSlugextendsAuthCollectionSlug>(
 incomingArgs: Arguments<TSlug>,
 ): Promise<null|string>=>{
 constloginWithUsername=incomingArgs.collection.config.auth.loginWithUsername

packages/payload/src/auth/operations/local/forgotPassword.ts

@@ -1,13 +1,13 @@
-importtype{CollectionSlug,Payload,RequestContext}from'../../../index.js'
+importtype{AuthCollectionSlug,Payload,RequestContext}from'../../../index.js'
 importtype{PayloadRequest}from'../../../types/index.js'
 importtype{Result}from'../forgotPassword.js'
 
 import{APIError}from'../../../errors/index.js'
 import{createLocalReq}from'../../../utilities/createLocalReq.js'
 import{forgotPasswordOperation}from'../forgotPassword.js'
 
-exporttypeOptions<TextendsCollectionSlug>={
-collection: T
+exporttypeOptions<TSlugextendsAuthCollectionSlug>={
+collection: TSlug
 context?: RequestContext
 data: {
 email: string
@@ -18,7 +18,7 @@ export type Options<T extends CollectionSlug> = {
 req?: Partial<PayloadRequest>
 }
 
-exportasyncfunctionforgotPasswordLocal<TextendsCollectionSlug>(
+exportasyncfunctionforgotPasswordLocal<TextendsAuthCollectionSlug>(
 payload: Payload,
 options: Options<T>,
 ): Promise<Result>{

packages/payload/src/auth/operations/local/login.ts

@@ -1,18 +1,17 @@
 importtype{
+AuthCollectionSlug,
 AuthOperationsFromCollectionSlug,
-CollectionSlug,
-DataFromCollectionSlug,
 Payload,
 RequestContext,
 }from'../../../index.js'
 importtype{PayloadRequest}from'../../../types/index.js'
-importtype{Result}from'../login.js'
+importtype{LoginResult}from'../login.js'
 
 import{APIError}from'../../../errors/index.js'
 import{createLocalReq}from'../../../utilities/createLocalReq.js'
 import{loginOperation}from'../login.js'
 
-exporttypeOptions<TSlugextendsCollectionSlug>={
+exporttypeOptions<TSlugextendsAuthCollectionSlug>={
 collection: TSlug
 context?: RequestContext
 data: AuthOperationsFromCollectionSlug<TSlug>['login']
@@ -25,10 +24,10 @@ export type Options<TSlug extends CollectionSlug> = {
 trash?: boolean
 }
 
-exportasyncfunctionloginLocal<TSlugextendsCollectionSlug>(
+exportasyncfunctionloginLocal<TSlugextendsAuthCollectionSlug>(
 payload: Payload,
 options: Options<TSlug>,
-): Promise<{user: DataFromCollectionSlug<TSlug>}&Result>{
+): Promise<LoginResult<TSlug>>{
 const{
 collection: collectionSlug,
  data,

packages/payload/src/auth/operations/local/resetPassword.ts

@@ -1,13 +1,13 @@
-importtype{CollectionSlug,Payload,RequestContext}from'../../../index.js'
+importtype{AuthCollectionSlug,Payload,RequestContext}from'../../../index.js'
 importtype{PayloadRequest}from'../../../types/index.js'
 importtype{Result}from'../resetPassword.js'
 
 import{APIError}from'../../../errors/index.js'
 import{createLocalReq}from'../../../utilities/createLocalReq.js'
 import{resetPasswordOperation}from'../resetPassword.js'
 
-exporttypeOptions<TextendsCollectionSlug>={
-collection: T
+exporttypeOptions<TSlugextendsAuthCollectionSlug>={
+collection: TSlug
 context?: RequestContext
 data: {
 password: string
@@ -17,7 +17,7 @@ export type Options<T extends CollectionSlug> = {
 req?: Partial<PayloadRequest>
 }
 
-exportasyncfunctionresetPasswordLocal<TSlugextendsCollectionSlug>(
+exportasyncfunctionresetPasswordLocal<TSlugextendsAuthCollectionSlug>(
 payload: Payload,
 options: Options<TSlug>,
 ): Promise<Result>{

packages/payload/src/auth/operations/local/unlock.ts

@@ -1,6 +1,6 @@
 importtype{
+AuthCollectionSlug,
 AuthOperationsFromCollectionSlug,
-CollectionSlug,
 Payload,
 RequestContext,
 }from'../../../index.js'
@@ -10,15 +10,15 @@ import { APIError } from '../../../errors/index.js'
 import{createLocalReq}from'../../../utilities/createLocalReq.js'
 import{unlockOperation}from'../unlock.js'
 
-exporttypeOptions<TSlugextendsCollectionSlug>={
+exporttypeOptions<TSlugextendsAuthCollectionSlug>={
 collection: TSlug
 context?: RequestContext
 data: AuthOperationsFromCollectionSlug<TSlug>['unlock']
 overrideAccess: boolean
 req?: Partial<PayloadRequest>
 }
 
-exportasyncfunctionunlockLocal<TSlugextendsCollectionSlug>(
+exportasyncfunctionunlockLocal<TSlugextendsAuthCollectionSlug>(
 payload: Payload,
 options: Options<TSlug>,
 ): Promise<boolean>{

packages/payload/src/auth/operations/local/verifyEmail.ts

@@ -1,18 +1,18 @@
-importtype{CollectionSlug,Payload,RequestContext}from'../../../index.js'
+importtype{AuthCollectionSlug,Payload,RequestContext}from'../../../index.js'
 importtype{PayloadRequest}from'../../../types/index.js'
 
 import{APIError}from'../../../errors/index.js'
 import{createLocalReq}from'../../../utilities/createLocalReq.js'
 import{verifyEmailOperation}from'../verifyEmail.js'
 
-exporttypeOptions<TextendsCollectionSlug>={
-collection: T
+exporttypeOptions<TSlugextendsAuthCollectionSlug>={
+collection: TSlug
 context?: RequestContext
 req?: Partial<PayloadRequest>
 token: string
 }
 
-exportasyncfunctionverifyEmailLocal<TextendsCollectionSlug>(
+exportasyncfunctionverifyEmailLocal<TextendsAuthCollectionSlug>(
 payload: Payload,
 options: Options<T>,
 ): Promise<boolean>{

packages/payload/src/auth/operations/login.ts

@@ -3,7 +3,7 @@ import type {
 Collection,
 DataFromCollectionSlug,
 }from'../../collections/config/types.js'
-importtype{CollectionSlug,TypedUser}from'../../index.js'
+importtype{AuthCollectionSlug,TypedUser}from'../../index.js'
 importtype{PayloadRequest,Where}from'../../types/index.js'
 
 import{buildAfterOperation}from'../../collections/operations/utilities/buildAfterOperation.js'
@@ -28,13 +28,13 @@ import { authenticateLocalStrategy } from '../strategies/local/authenticate.js'
 import{incrementLoginAttempts}from'../strategies/local/incrementLoginAttempts.js'
 import{resetLoginAttempts}from'../strategies/local/resetLoginAttempts.js'
 
-exporttypeResult={
+exporttypeLoginResult<TSlugextendsAuthCollectionSlug>={
 exp?: number
 token?: string
-user?: TypedUser
+user?: DataFromCollectionSlug<TSlug>
 }
 
-exporttypeArguments<TSlugextendsCollectionSlug>={
+exporttypeArguments<TSlugextendsAuthCollectionSlug>={
 collection: Collection
 data: AuthOperationsFromCollectionSlug<TSlug>['login']
 depth?: number
@@ -43,22 +43,22 @@ export type Arguments<TSlug extends CollectionSlug> = {
 showHiddenFields?: boolean
 }
 
-typeCheckLoginPermissionArgs={
+typeCheckLoginPermissionArgs<TSlugextendsAuthCollectionSlug>={
 loggingInWithUsername?: boolean
 req: PayloadRequest
-user: any
+user: DataFromCollectionSlug<TSlug>
 }
 
 /**
  * Throws an error if the user is locked or does not exist.
  * This does not check the login attempts, only the lock status. Whoever increments login attempts
  * is responsible for locking the user properly, not whoever checks the login permission.
  */
-exportconstcheckLoginPermission=({
+exportconstcheckLoginPermission=<TSlugextendsAuthCollectionSlug>({
  loggingInWithUsername,
  req,
  user,
-}: CheckLoginPermissionArgs)=>{
+}: CheckLoginPermissionArgs<TSlug>)=>{
 if(!user){
 thrownewAuthenticationError(req.t,Boolean(loggingInWithUsername))
 }
@@ -68,9 +68,9 @@ export const checkLoginPermission = ({
 }
 }
 
-exportconstloginOperation=async<TSlugextendsCollectionSlug>(
+exportconstloginOperation=async<TSlugextendsAuthCollectionSlug>(
 incomingArgs: Arguments<TSlug>,
-): Promise<{user: DataFromCollectionSlug<TSlug>}&Result>=>{
+): Promise<LoginResult<TSlug>>=>{
 letargs=incomingArgs
 
 if(args.collection.config.auth.disableLocalStrategy){
@@ -381,7 +381,7 @@ export const loginOperation = async <TSlug extends CollectionSlug>(
 }
 }
 
-letresult: {user: DataFromCollectionSlug<TSlug>}&Result={
+letresult: LoginResult<TSlug>={
  exp,
  token,
  user,