fix(pages): prevent circular parent references by Copilot · Pull Request #61 · jhb-software/payload-plugins

Copilot · 2026-03-15T15:59:52Z

Original prompt

This section details on the original issue you should resolve

<issue_title>fix: prevent circular parent references</issue_title>
<issue_description>## Problem

The pages plugin has no protection against circular parent references. Setting a document as its own parent, or creating a cycle (A -> B -> C -> A), would cause infinite loops during breadcrumb/path generation as the plugin walks up the ancestor chain.

Proposed Solution

Add a beforeChange hook that validates the parent field by walking up the ancestor chain and detecting cycles using a visited-nodes Set.

Implementation sketch

Inspired by the Payload hierarchy PR which implements this in collectionBeforeChange.ts:
async function validateNoCircularReference({ id, parentId, collection, req }) {
  if (id === parentId) {
    throw new ValidationError({ errors: [{ message: 'A document cannot be its own parent', path: 'parent' }] })
  }

  const visited = new Set([id])
  let currentParentId = parentId

  while (currentParentId) {
    if (visited.has(currentParentId)) {
      throw new ValidationError({ errors: [{ message: 'Circular parent reference detected', path: 'parent' }] })
    }
    visited.add(currentParentId)

    const parent = await req.payload.findByID({ collection, id: currentParentId, depth: 0, select: { parent: true } })
    currentParentId = parent?.parent
  }
}
Cases to cover

Direct self-reference: doc.parent = doc.id

Two-node cycle: A -> B -> A

Deep cycle: A -> B -> C -> A

Testing

Add tests for this.</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes fix: prevent circular parent references #53

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

Add a `beforeChange` hook that validates the parent field by walking up the ancestor chain and detecting cycles using a visited-nodes Set. Handles: - Direct self-reference (doc.parent = doc.id) - Two-node cycles (A -> B -> A) - Deep cycles (A -> B -> C -> A) Tests added for all three cases plus a valid parent scenario. Co-authored-by: jhb-dev <20878653+jhb-dev@users.noreply.github.com>

srjaykikani · 2026-03-22T14:01:27Z

pages/src/collections/PageCollectionConfig.ts

        ...(incomingCollectionConfig.hooks?.afterChange || []),
      ],
+      beforeChange: [
+        preventCircularParentReference,


This looks good for the manually tested admin/API path, but I think the placement here is still fragile. Because this validator runs before consumer beforeChange hooks, a later hook can still modify data.parent and introduce a cycle after this check has already passed. Would it make sense to enforce this at the final authoritative boundary for the resolved parent value instead of relying on early hook order?

srjaykikani

Thanks for putting this together. I manually tested the localized dev app flow for this change:

created a root page
created a child under that root
created a grandchild under that child
edited the child and tried to set its parent to the grandchild

That save was rejected with a validation error, and the persisted parent stayed unchanged, so the tested path is working as expected.

One structural concern I still have: the new cycle check is added as the first beforeChange hook in createPageCollectionConfig. Since consumer-provided beforeChange hooks run after that, a later hook can still rewrite data.parent after this validator has already passed. So this fixes the path I tested, but it does not fully guarantee the invariant at the final authoritative save boundary.

Also, pnpm lint is currently failing only on pages/src/hooks/preventCircularParentReference.ts in this PR.

Overall, the behavior looks correct for the manually tested case, but I think the hook-order piece is still worth tightening so the fix addresses the root cause rather than only the current path.

jhb-dev · 2026-03-24T14:37:44Z

@copilot run pnpm lint and fix any issues. In a separate commit please change the order of the before change hooks to address Jays comments.

Copilot · 2026-03-24T14:37:49Z

@jhb-dev The model claude-sonnet-4.6 is not available for your account. This can happen if the model was disabled by your organization's policy or if your Copilot plan doesn't include access to it.

You can try again without specifying a model (just @copilot) to use the default, or choose a different model from the model picker.