Impossible to update REST API responses via hooks

[juanpablob]

Link to reproduction

No response

Describe the Bug

Hooks manipulate and return a hard object, impossible to manipulate and runs in strange behaviour.

To Reproduce

I do have a fresh install of Payload CMS 2.30, I have a couple of collections, among them Organizations and Users, which relates to Organizations collection through the field organization. Out of the box, I'm using the authentication provided by the REST API at /users/login — Upon login, the response I get is this one:

{
    "exp": 1729882853,
    "message": "Auth Passed",
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MiwiY29sbGVjdGlvbiI6InVzZXJzIiwiZW1haWwiOiJlcmlrYS5tdXN0ZXJtYW5uQHN0YXJidWNrcy5kZSIsImlhdCI6MTcyOTg4MTk1MywiZXhwIjoxNzI5ODgyODUzfQ.SmM1wrsjhSWQSvlZbQfctmHzzgx55ESHiuzwJvehr6c",
    "user": {
        "id": 2,
        "firstName": "Erika",
        "lastName": "Mustermann",
        "updatedAt": "2024-10-22T16:32:22.884Z",
        "createdAt": "2024-07-26T19:54:11.004Z",
        "email": "[email protected]",
        "loginAttempts": 0
    }
}

At this point, there is no way to configure whether the response of the user object can be at a certain depth, like for example, including the associated fields, which leads me to use the hook afterLogin. When I use the hook, if I log user, I get this:

afterLogin: [
   async ({ user }) => {
     console.log(user.organization); // will log the correct relationship

     return user; // this will return a "short" or "simplified" version of the user, just like the json response posted above;

     // if I do this:
     user.whateverName = 'hello world';
     return user; // will return the "short" or "simplified" object, appending the "whateverName" to the user object, but I can't figrue HOW to make Payload to show the `organization` within the `user` object.

     // If I do:
     user.organization = 'hello world'; // this won't work and it won't show up under the `user` object, because I do have the impression that Payload is filtering out the property names that matches with associated fields to the collection.
   },
],

Since I can't get to update the response of /users/login, I want to rely on the method /users/me to query basic data like the user data, the organization field and other stuff, then again, /users/me returns the same "simplified" short version of the user data, without their fields like organization. So I am going to use afterRead hook, so I can "manipulate" the response. It turns out that when I do this:

afterRead: [
      async ({ doc }) => {
        console.log('doc', doc);
      },
],

the console outputs this:

// first time
doc {
  id: 2,
  firstName: 'Erika',
  lastName: 'Mustermann',
  roles: [ 'user' ],
  organization: {
    organization: {
      id: 1,
      name: 'Starbucks Deutschland GmbH',
      logo: 'www.google.com',
      updatedAt: '2024-10-02T19:15:21.088Z',
      createdAt: '2024-07-26T19:53:31.064Z'
    },
    roles: [ 'admin' ]
  },
  updatedAt: '2024-10-22T16:32:22.884Z',
  createdAt: '2024-07-26T19:54:11.004Z',
  email: '[email protected]',
  password: undefined,
  loginAttempts: 0
}
// second time
doc {
  id: 2,
  firstName: 'Erika',
  lastName: 'Mustermann',
  updatedAt: '2024-10-22T16:32:22.884Z',
  createdAt: '2024-07-26T19:54:11.004Z',
  email: '[email protected]',
  password: undefined,
  loginAttempts: 0
}

it runs TWICE, the first time with the full doc/collection in depth, and the second time with the "short" or "simplified" version, so then AGAIN, I can not update the response to the REST API as I want.

Can a good soul explain to me why is that? Is this a bug? (it seems so to me). Is there any way I can fix this without much overhead? Any help would be very much appreciated! <3 Thank you so much!

PS: To me, it doesn't make sense the criteria used to set up the API responses for the user collection at the REST endpoints. Just compare the response at the beginning of my message from /users/login versus this one: /users/refresh-token:

{
    "message": "Token refresh successful",
    "exp": 1729884498,
    "refreshedToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MiwiY29sbGVjdGlvbiI6InVzZXJzIiwiZW1haWwiOiJlcmlrYS5tdXN0ZXJtYW5uQHN0YXJidWNrcy5kZSIsImlhdCI6MTcyOTg4MzU5OCwiZXhwIjoxNzI5ODg0NDk4fQ.9zIN4TNhNxzZsmbp67sETTjcf1PON3cUyREXaJV8O6Q",
    "strategy": "local-jwt",
    "user": {
        "id": 2,
        "firstName": "Erika",
        "lastName": "Mustermann",
        "roles": [
            "user"
        ],
        "organization": {
            "organization": {
                "id": 1,
                "name": "Starbucks Deutschland GmbH",
                "logo": "www.google.com",
                "updatedAt": "2024-10-02T19:15:21.088Z",
                "createdAt": "2024-07-26T19:53:31.064Z"
            },
            "roles": [
                "admin"
            ]
        },
        "updatedAt": "2024-10-22T16:32:22.884Z",
        "createdAt": "2024-07-26T19:54:11.004Z",
        "email": "[email protected]",
        "loginAttempts": 0
    }
}

The refresh-token endpoint returns a full in depth user object, while the /users/login does not. Why would you like to have this information under refresh-token ? Far from questioning whether you need it or not under /users/refresh-token, my question is: Why it is not provided under /users/login ? Which is more crucial, in my opinion. Or even at /users/me!

Thx!

Payload Version

2.30.0

Adapters and Plugins

db-postgres, bundler-webpack

[jmikrut]

Hey @juanpablob I think there are three or four questions here and I am going to try to respond to one at a time.

Depth in general

You seem to be asking about the depth aspect of Payload. You are wondering why the user doesn't have a populated organization when you log it in the afterLogin hook. Same with /me. The Payload APIs will populate relationships differently at different levels all over, and you should not write code that expects populations to take place. Someone could query with ?depth=0, and then, no matter what API or endpoint you're accessing, relationship documents will not be populated. The data that you receive in hooks may or may not be populated - and it'd be up to you to ensure that if you do indeed need to have that field populated, and it is not, then you'd need to manually fetch that data. This is important for cases where someone says depth=0 or similar.

afterLogin

Here, populations haven't taken place yet so you get the "simplified" version of your user. Populations take place in field afterRead hooks, and afterLogin is before the afterRead field hooks.

me

This operation returns a user with the population depth that you specify on auth.depth for the relevant collection. It will be undefined by default, and therefore fall back to the default depth of your Payload project which is 2. The /me endpoint should return the same user as what you'd see in your access control functions, and our authentication layer runs very frequently. When I test and look at the REST response of the /me endpoint, I see relationships populated accordingly.

it runs TWICE, the first time with the full doc/collection in depth, and the second time with the "short" or "simplified" version, so then AGAIN, I can not update the response to the REST API as I want.

This is because the /me endpoint first fires Payload authentication (which most / all Payload endpoints do) and then it continues on to fire the me operation logic itself (which queries again internally). If you query any Payload API, say, /api/posts, your user will still be queried in Payload's authentication layer.

I can't get the response to return a non-populated (simplified) version when I do tests against the /me endpoint though. If you can reproduce this consistently, we will happily re-open an issue and address accordingly. But these are more of questions about how to use Payload rather than an issue with Payload itself, and we do try to keep Issues to confirmed bugs with reproductions only.

This all being said I am happy to continue to chime in here! What are you trying to do?

Field hooks

If you want to consistently add data to or modify data from the returned user I would consider using field hooks. In 3.0, we have virtual fields, which are truly non-existent in the database and simply allow you to generate virtual data. Maybe that could be interesting to you.

[juanpablob]

@jmikrut First of all, thank you very much for taking the time to provide such nice explanation about the concepts, it is very much appreciated <3 — Indeed, so far it does not seem to be a big but rather the way I'm using Payload.

As for migrating to 3.0 I'm not so sure about that yet since it is in beta :/ I'd rather wait a little bit more for that I guess?

I have tried setting auth.depth in my collection it does not have any effect on the response of /users/login and /users/me, for instance:

export const Users: CollectionConfig = {
  slug: 'users',
  auth: {
    tokenExpiration: 900,
    depth: 2, // I've tried different depths and it doesn't change the result in the API response
  },
  ...
};

Regardless of the number passed to auth.depth in my Users collection, the response I get from POST /users/login and GET /users/me is this one:

// /users/login
{
    "exp": 1730150052,
    "message": "Auth Passed",
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MiwiY29sbGVjdGlvbiI6InVzZXJzIiwiZW1haWwiOiJlcmlrYS5tdXN0ZXJtYW5uQHN0YXJidWNrcy5kZSIsImlhdCI6MTczMDE0OTE1MiwiZXhwIjoxNzMwMTUwMDUyfQ.S5A1X6iS47T46z3qpJEYQU_7ZU7kQE1YDAgPiqz8shw",
    "user": {
        "id": 2,
        "firstName": "Erika",
        "lastName": "Mustermann",
        "updatedAt": "2024-10-22T16:32:22.884Z",
        "createdAt": "2024-07-26T19:54:11.004Z",
        "email": "[email protected]",
        "loginAttempts": 0
    }
}

// /users/me
{
    "user": {
        "id": 2,
        "firstName": "Erika",
        "lastName": "Mustermann",
        "updatedAt": "2024-10-22T16:32:22.884Z",
        "createdAt": "2024-07-26T19:54:11.004Z",
        "email": "[email protected]",
        "loginAttempts": 0
    },
    "collection": "users",
    "strategy": "local-jwt",
    "exp": 1730150052,
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MiwiY29sbGVjdGlvbiI6InVzZXJzIiwiZW1haWwiOiJlcmlrYS5tdXN0ZXJtYW5uQHN0YXJidWNrcy5kZSIsImlhdCI6MTczMDE0OTE1MiwiZXhwIjoxNzMwMTUwMDUyfQ.S5A1X6iS47T46z3qpJEYQU_7ZU7kQE1YDAgPiqz8shw"
}

As you can see, there is no population of organization collection 😕

And finally, to answer your quesiton: What I'm trying to do is to return on /users/login the field organization populated in the object of the user, so I don't have to run another query to fetch the user details like the organization they belong to. Even if I wanted to run a separate request to fetch the user details from /users/me it won't work, since the response is not changing despite setting the auth.depth in my collection. And I can't manage to update the response via the hooks either. I've tried using afterRead but it won't work either using the doc. For instance, when I log doc using the afterRead hook, I get this:

doc {
  id: 2,
  firstName: 'Erika',
  lastName: 'Mustermann',
  roles: [ 'user' ],
  organization: {
    organization: {
      id: 1,
      name: 'Starbucks Deutschland GmbH',
      logo: 'www.google.com',
      updatedAt: '2024-10-02T19:15:21.088Z',
      createdAt: '2024-07-26T19:53:31.064Z'
    },
    roles: [ 'admin' ]
  },
  updatedAt: '2024-10-22T16:32:22.884Z',
  createdAt: '2024-07-26T19:54:11.004Z',
  email: '[email protected]',
  password: undefined,
  loginAttempts: 0
}
doc {
  id: 2,
  firstName: 'Erika',
  lastName: 'Mustermann',
  updatedAt: '2024-10-22T16:32:22.884Z',
  createdAt: '2024-07-26T19:54:11.004Z',
  email: '[email protected]',
  password: undefined,
  loginAttempts: 0
}
// this is the last time it logs, therefore the object I will have access to is this last one :/ which comes without population
doc {
  id: 2,
  firstName: 'Erika',
  lastName: 'Mustermann',
  updatedAt: '2024-10-22T16:32:22.884Z',
  createdAt: '2024-07-26T19:54:11.004Z',
  email: '[email protected]',
  password: undefined,
  loginAttempts: 0
}

Do you have any idea how I can get the desired behavior? Thank you very much for your time once again! ❤️

[juanpablob]

@jmikrut Hello :) I wonder if you have any idea about how to achieve that simple thing of extending the API response of /users/login or the fact that adding auth.depth is not working at all? Thank you very much! :)