payloadcms / payloadcms/payload
Authenticated me endpoint ignores the draft URL search parameter
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 44.8k
- Forks
- 4.2k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 53
Description
Describe the Bug
The authenticated REST me handler ignores a draft value supplied through req.searchParams when req.query.draft is absent.
packages/payload/src/auth/endpoints/me.ts currently initializes both search-parameter fallbacks from depth:
const depthFromSearchParams = searchParams.get('depth')
const draftFromSearchParams = searchParams.get('depth')
As a result, a request represented as ?draft=true reaches meOperation with draft: false. This affects adapters that populate the standard URLSearchParams representation without also copying draft into req.query.
The typo is present in v3.88.0, the current 3.x branch, and current main.
Link to the code that reproduces this issue
Reproduction Steps
-
Check out the linked reproduction branch and install dependencies with the repository's Node 24 / pnpm 11 toolchain.
-
Run:
pnpm exec vitest run --project unit packages/payload/src/auth/endpoints/me.spec.ts -
Observe that the test fails because
meOperationreceivesdraft: falseeven though the request hasnew URLSearchParams('draft=true').
Expected: the handler reads searchParams.get('draft') and passes draft: true.
Which area(s) are affected?
area: core
Environment Info
Payload: 3.88.0 (also reproduced on current 3.x and main)
Node.js: 24.15.0+
pnpm: 11.9.0
Framework: handler-level; reproducible without a database
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in packages/payload/src/auth/endpoints/me.ts and compare the depth and draft fallbacks, then inspect the reproduction in packages/payload/src/auth/endpoints/me.spec.ts. Run pnpm exec vitest run --project unit packages/payload/src/auth/endpoints/me.spec.ts; done means the test passes with draft=true reaching meOperation from URLSearchParams.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100