payloadcms / payloadcms/payload

Authenticated me endpoint ignores the draft URL search parameter

Open Beginner friendly
#18,072 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area: core Bug
Dominant language
TypeScript
Stars
44.8k
Forks
4.2k
Avg merge
2d 21h
Merged PRs (30d)
53

Description

Describe the Bug

The authenticated REST me handler ignores a draft value supplied through req.searchParams when req.query.draft is absent.

packages/payload/src/auth/endpoints/me.ts currently initializes both search-parameter fallbacks from depth:

const depthFromSearchParams = searchParams.get('depth')
const draftFromSearchParams = searchParams.get('depth')

As a result, a request represented as ?draft=true reaches meOperation with draft: false. This affects adapters that populate the standard URLSearchParams representation without also copying draft into req.query.

The typo is present in v3.88.0, the current 3.x branch, and current main.

Link to the code that reproduces this issue

https://github.com/jashkarangiya/payload/blob/reproduction/me-draft-search-param/packages/payload/src/auth/endpoints/me.spec.ts

Reproduction Steps
  1. Check out the linked reproduction branch and install dependencies with the repository's Node 24 / pnpm 11 toolchain.

  2. Run:

    pnpm exec vitest run --project unit packages/payload/src/auth/endpoints/me.spec.ts
    
  3. Observe that the test fails because meOperation receives draft: false even though the request has new URLSearchParams('draft=true').

Expected: the handler reads searchParams.get('draft') and passes draft: true.

Which area(s) are affected?

area: core

Environment Info
Payload: 3.88.0 (also reproduced on current 3.x and main)
Node.js: 24.15.0+
pnpm: 11.9.0
Framework: handler-level; reproducible without a database

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in packages/payload/src/auth/endpoints/me.ts and compare the depth and draft fallbacks, then inspect the reproduction in packages/payload/src/auth/endpoints/me.spec.ts. Run pnpm exec vitest run --project unit packages/payload/src/auth/endpoints/me.spec.ts; done means the test passes with draft=true reaching meOperation from URLSearchParams.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.