fix: allow access to files reuploaded on a draft (#17209)

#### Problem
On an upload collection with `versions.drafts` enabled, reuploading a
file and saving as a **draft** (without publishing) makes the new file
return `403 Forbidden` from `GET
/api/<collection>/file/<filename>?prefix=<prefix>`.
Publishing the document clears the error. The file itself is uploaded to
storage correctly, only the access check fails.
**Regression window:** surfaced in `3.85.2`

#### Cause
`checkFileAccess` resolves the file's document with
`req.payload.db.findOne(...)`, which only reads the **base collection
row**. When a file is reuploaded on a draft, the new filename is written
to the latest **version** only. The base row still points at the
previously published filename. The lookup therefore misses the draft
filename and access is wrongly denied.

#### Solution
- Fallback to the latest draft via `db.queryDrafts` before throwing
`Forbidden`.
- Added an integration test in `test/uploads` (file access on draft
reupload)
- Publish a file, reupload a different file saved as a draft, then
request the new file with the `prefix` query param. Expects 200 (was
403).
  - A filename matching no document still returns 403

Author: LimChorngUan

packages/payload/src/uploads/checkFileAccess.ts

@@ -3,6 +3,8 @@ import type { PayloadRequest, Where } from '../types/index.js'
 
 import { executeAccess } from '../auth/executeAccess.js'
 import { Forbidden } from '../errors/Forbidden.js'
+import { hasDraftsEnabled } from '../utilities/getVersionsConfig.js'
+import { appendVersionToQueryKey } from '../versions/drafts/appendVersionToQueryKey.js'
 
 export const checkFileAccess = async ({
   collection,
@@ -48,16 +50,38 @@ export const checkFileAccess = async ({
       })
     }
 
+    const where: Where = { and: [filenameCondition, ...constraints] }
+
     const doc = await req.payload.db.findOne({
       collection: config.slug,
       req,
-      where: { and: [filenameCondition, ...constraints] },
+      where,
     })
 
-    if (!doc) {
-      throw new Forbidden(req.t)
+    if (doc) {
+      return doc
+    }
+
+    // Queries the version collection if `hasDraftsEnabled` is true:
+    //
+    // The base collection row only reflects the most recently committed
+    // (published) state. When a file is reuploaded on a draft, the new
+    // filename is written to the latest *version*, while the base row still
+    // points at the previously committed filename. The findOne above therefore
+    // misses the draft-only filename and access is wrongly denied.
+    if (hasDraftsEnabled(config)) {
+      const { docs } = await req.payload.db.queryDrafts({
+        collection: config.slug,
+        limit: 1,
+        req,
+        where: appendVersionToQueryKey(where),
+      })
+
+      if (docs[0]) {
+        return docs[0]
+      }
     }
 
-    return doc
+    throw new Forbidden(req.t)
   }
 }

test/uploads/config.ts

@@ -23,6 +23,7 @@ import {
   audioSlug,
   constructorOptionsSlug,
   customFileNameMediaSlug,
+  draftReuploadMediaSlug,
   enlargeSlug,
   focalNoSizesSlug,
   hideFileInputOnCreateSlug,
@@ -1082,6 +1083,27 @@ export default buildConfigWithDefaults({
         staticDir: path.resolve(dirname, './prefix-media'),
       },
     },
+    {
+      // Drafts + a `prefix` field reproduce the reupload-on-draft access bug:
+      // the file endpoint's access check queries the base row (published state),
+      // which misses a filename that only exists on the latest draft version.
+      slug: draftReuploadMediaSlug,
+      access: {
+        read: () => true,
+      },
+      fields: [
+        {
+          name: 'prefix',
+          type: 'text',
+        },
+      ],
+      upload: {
+        staticDir: path.resolve(dirname, `./${draftReuploadMediaSlug}`),
+      },
+      versions: {
+        drafts: true,
+      },
+    },
   ],
   onInit: async (payload) => {
     if (process.env.SEED_IN_CONFIG_ONINIT !== 'false') {

test/uploads/int.spec.ts

@@ -26,6 +26,7 @@ import {
   adminThumbnailSizeSlug,
   allowListMediaSlug,
   anyImagesSlug,
+  draftReuploadMediaSlug,
   enlargeSlug,
   focalNoSizesSlug,
   focalOnlySlug,
@@ -64,6 +65,74 @@ describe('Collections - Uploads', () => {
     await payload.destroy()
   })
 
+  describe('file access on draft reupload', () => {
+    const createdIDs: (number | string)[] = []
+    const filePrefix = 'test'
+    const staticDir = path.resolve(dirname, `./${draftReuploadMediaSlug}`)
+
+    afterEach(async () => {
+      for (const id of createdIDs) {
+        await payload.delete({ collection: draftReuploadMediaSlug as CollectionSlug, id })
+      }
+      createdIDs.length = 0
+
+      // Deleting the document only removes the base row's file; the draft
+      // version's reuploaded file is orphaned on disk. Clear the whole static
+      // dir so filenames don't collide (and get suffixed) across runs.
+      fs.rmSync(staticDir, { force: true, recursive: true })
+    })
+
+    it('should serve a file reuploaded on a draft over a published document', async () => {
+      const published = await payload.create({
+        collection: draftReuploadMediaSlug as CollectionSlug,
+        data: { prefix: filePrefix },
+        draft: false,
+        file: await getFileByPath(path.resolve(dirname, './image.png')),
+      })
+      createdIDs.push(published.id)
+
+      // Reupload a different file and save as a draft (do not publish). The new
+      // filename is written to the latest version only; the base row still
+      // points at the published file.
+      const draft = await payload.update({
+        collection: draftReuploadMediaSlug as CollectionSlug,
+        id: published.id,
+        data: { prefix: filePrefix },
+        draft: true,
+        file: await getFileByPath(path.resolve(dirname, './test-image.png')),
+      })
+
+      expect(draft.filename).not.toBe(published.filename)
+
+      // The prefix query param (as cloud-storage adapters generate) forces the
+      // access check's constrained lookup — the base-row miss this fix repairs
+      // by falling back to the latest draft version.
+      const draftFileResponse = await restClient.GET(
+        `/${draftReuploadMediaSlug}/file/${draft.filename}`,
+        { query: { prefix: filePrefix } },
+      )
+
+      expect(draftFileResponse.status).toBe(200)
+      expect(draftFileResponse.headers.get('content-type')).toContain('image/png')
+    })
+
+    it('should still deny access to a filename that matches no document', async () => {
+      const doc = await payload.create({
+        collection: draftReuploadMediaSlug as CollectionSlug,
+        data: { prefix: filePrefix },
+        draft: true,
+        file: await getFileByPath(path.resolve(dirname, './image.png')),
+      })
+      createdIDs.push(doc.id)
+
+      const response = await restClient.GET(`/${draftReuploadMediaSlug}/file/does-not-exist.png`, {
+        query: { prefix: filePrefix },
+      })
+
+      expect(response.status).toBe(403)
+    })
+  })
+
   describe('REST API', () => {
     describe('create', () => {
       it('creates from form data given a png', async () => {