Dynamic RBAC

About

This plugin adds role-based access control to Payload v3 using permissions instead of hard-coded role checks. When you register it in `plugins`, it injects a `roles` collection and a `permissions` collection (slugs are configurable) and adds a `roles` relationship field to your auth collection, `users` by default. That field is saved to the JWT, so permission checks can read roles without an extra database query. The main helpers are `checkPermission(slug)`, which returns a Payload access function for a collection operation, and `hasPermission(user, slug)` for custom endpoints, hooks, or UI logic. A permission can carry conditions set in the admin UI, such as `sender equals {{user.id}}`. `checkPermission` turns those into a Payload `where` clause, and `getPermissionQuery` returns the same result for manual queries. The supported placeholders are `{{user.id}}`, `{{user.roles}}`, and `{{user.role}}`. Admins can create single permissions or use a Bulk CRUD Generator that creates `create`, `read`, `update`, and `delete` permissions for a collection in one save. The generator's helper fields exist only in the UI and are not stored. Extra fields can be added to the roles and permissions schemas through `rolesFields` and `permissionsFields`. The `hideRoles` and `hidePermissions` options control sidebar visibility per user, and `permissionsAccess` and `rolesAccess` set access rules for the generated collections, which are public by default. Because those defaults are public, production setups should override them.

Package info

Package name

payload-rbac-plugin

Latest version

1.1.0

Unpacked size

91 kB

License

MIT

Weekly downloads

2

Last publish

Jun 8, 2026