Skip to content

fix: use overrideAccess for parent document fetches in breadcrumb generation#63

Draft
Copilot wants to merge 3 commits intomainfrom
copilot/fix-parent-document-fetch-breadcrumbs
Draft

fix: use overrideAccess for parent document fetches in breadcrumb generation#63
Copilot wants to merge 3 commits intomainfrom
copilot/fix-parent-document-fetch-breadcrumbs

Conversation

Copy link
Copy Markdown

Copilot AI commented Mar 15, 2026

Parent documents fetched during breadcrumb generation were subject to the requesting user's access control, causing breadcrumb chains to fail or be incomplete when a user lacks read access to an ancestor document.

Changes

  • pages/src/utils/getBreadcrumbs.ts — Added overrideAccess: true to the findByID call in findByIDCached:
parentPromise = req.payload.findByID({
  id,
  collection,
  depth: 0,
  disableErrors: true,
  locale,
  overrideAccess: true,  // breadcrumbs must always be complete regardless of user permissions
  req: { ... },
  select: { breadcrumbs: true },
})
  • pages/dev/plugin.test.ts — Added test asserting that the nested findByID call for parent documents always includes overrideAccess: true.
Original prompt

This section details on the original issue you should resolve

<issue_title>fix: use overrideAccess for parent document fetches in breadcrumb generation</issue_title>
<issue_description>## Problem

In getBreadcrumbs.ts, the findByID call for fetching parent documents does not use overrideAccess: true. Additionally, the full req is intentionally not passed (to avoid locale flattening issues), meaning the fetch runs without proper auth context.

If a parent page has access control restrictions, breadcrumb generation for its children could fail or return incomplete data. Breadcrumbs should always be complete regardless of the requesting user's permissions.

Proposed Solution

Add overrideAccess: true to the parent findByID call:

const parent = await req.payload.findByID({
  id: parentId,
  collection: parentCollection,
  depth: 0,
  disableErrors: true,
  locale,
  overrideAccess: true,
  req: {
    transactionID: req.transactionID,
  },
  select: {
    breadcrumbs: true,
  },
})

This ensures breadcrumb/path generation always succeeds even when the current user doesn't have read access to ancestor documents.

Testing

Add tests for this</issue_description>

Comments on the Issue (you are @copilot in this section)


📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

Copilot AI and others added 2 commits March 15, 2026 16:05
…eration

Co-authored-by: jhb-dev <20878653+jhb-dev@users.noreply.github.com>
…tignore

Co-authored-by: jhb-dev <20878653+jhb-dev@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix: use overrideAccess for parent document fetches in breadcrumb generation fix: use overrideAccess for parent document fetches in breadcrumb generation Mar 15, 2026
Copilot AI requested a review from jhb-dev March 15, 2026 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix: use overrideAccess for parent document fetches in breadcrumb generation

2 participants