columns are shown in WhereBuilder and ColumnSelector despite admin.hidden, admin.condition, access or disableListColumn/disableListFilter in some cases

[tylkomat]

Describe the Bug

When enabling upload on a collection all the upload related columns have admin.hidden: true, but still show up under ColumnSelector and WhereBuilder.


In WhereBuilder there are even two additional empty entries (after height).

I added an additional field noAccess which has all field access set to false, but the field still shows up in ColumnSelector and WhereBuilder.
The same happens with the noCondition field, which has admin.condition: () => false.
For condition I'm not sure if it should hide the column from ColumnSelector and WhereBuilder, but if read access is false, I would expect the column to be hidden.

The only way to hide columns from ColumnSelector and WhereBuilder are admin.disableListColumn and admin.disableListFilter. For ColumnSelector it works when placing admin.disableListColumn on for example sizes field, but for WhereBuilder the properties have to be placed on the exact field i.e. sizes.fields.mimeType. It is not enough to put admin.disableListFilter and the parent sizes field, which I would expect to be working.

I believe it was working differently in an earlier version. If this is all working as expected, I propose to callback functions on admin.disableListFilter and admin.disableListColumn, such that these settings can be set based on user roles for example.

Link to the code that reproduces this issue

https://github.com/tylkomat/payload/tree/bug-list-filter-columns

Reproduction Steps

Visit Media collection and click on Columns or Filters

Which area(s) are affected? (Select all that apply)

area: core, area: ui

Environment Info

payload: 3.12.0
NextJS: 5.1.3
NodeJS: v20.12.2

[jacobsfletch]

@tylkomat I've got a fix for the blank options within the condition dropdown queued up here: #10246.

As for the other issues your facing, let me provide some clarity here. The admin.hidden property does not actually omit the field from the list view. This simply renders a hidden input within the document view. To hide those fields from the column selector and the filter conditions within the list view, you need to specify admin.disableListFilter and admin.disableListColumn. This is admittedly confusing, and in the future we're going to explore consolidating these properties into a single property, i.e. disabled: true | { field: true, filter: true, column: true } where disabled: true completely omits this field from all UI. This will be a breaking change, though, and so will have to wait until the next major version.

When it comes to admin.condition, this also has no effect on the column selector, and this is by design. This property is used as the condition to show or hide the field input itself within the form of the document view only.

But in addition to my fix above, I think there's likely a couple more things we can do here in the meantime to help. First, I agree that fields which lack read permission for the user should not appear at all in the column selector and the filters, as they cannot see any of that data anyway. I can explore this change in a separate PR. I also agree that if a group field has admin.disableListColumn defined, its subfields should respect that property as well.

[github-actions]

This issue has been automatically locked.
Please open a new issue if this issue persists with any additional detail.