{"record":{"id":"6db0af471ba53d23","repo":"payloadcms/payload","slug":"this-action-will-lock-you-out-of-this-preset","errorCode":null,"errorMessage":"This action will lock you out of this preset.","messagePattern":"This action will lock you out of this preset\\.","errorType":"http","errorClass":"APIError","httpStatus":403,"severity":"error","filePath":"packages/payload/src/query-presets/preventLockout.ts","lineNumber":75,"sourceCode":"        req,\n        user: req.user,\n      })\n\n      canRead = true\n\n      await req.payload.update({\n        id: tempPreset.id,\n        collection: queryPresetsCollectionSlug,\n        data: tempPreset,\n        overrideAccess: false,\n        req,\n        user: req.user,\n      })\n\n      canUpdate = true\n    } catch (_err) {\n      if (!canRead || !canUpdate) {\n        throw new APIError('This action will lock you out of this preset.', 403, {}, true)\n      }\n    } finally {\n      if (transaction) {\n        await killTransaction(req)\n      } else {\n        // delete the temp record\n        await req.payload.delete({\n          id: tempPreset.id,\n          collection: queryPresetsCollectionSlug,\n          req,\n        })\n      }\n    }\n  }\n\n  return true as unknown as true\n}\n","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/query-presets/preventLockout.ts#L57-L93","documentation":"Thrown by `preventLockout` with HTTP 403 when an attempted query-preset change would remove the user's own ability to read AND update the preset. The function simulates the change by writing a temp preset and trying to read/update it with `overrideAccess: false`; if both fail, it aborts to keep the user from locking themselves out. The thrown APIError has `isSensitive=true`.","triggerScenarios":"Editing a query preset's `access` control or ownership so that the current user would no longer satisfy `read` and `update` access — e.g. changing access to a role the user lacks, or reassigning to another user.","commonSituations":"An admin narrows preset access and accidentally excludes their own role; changing the preset's user/relationship field to someone else; misconfigured access function that returns false for the acting user.","solutions":["Keep at least one read OR update grant for yourself in the new access config — the lockout only triggers when BOTH fail.","Adjust the `access.update`/`access.read` functions so the current user still passes after the change.","Use an admin/superuser context (`overrideAccess`) only if lockout recovery is intentional, and document it."],"exampleFix":"// before\naccess: { update: () => false } // locks everyone out\n\n// after\naccess: {\n  update: ({ req: { user } }) => Boolean(user),\n  read: ({ req: { user } }) => Boolean(user),\n}","handlingStrategy":"validation","validationCode":"import { APIError } from 'payload'\n\nasync function canReadAndUpdateAfterChange(payload, presetId, req): Promise<boolean> {\n  // mimic preventLockout: confirm at least read OR update still holds\n  try {\n    await payload.findByID({ collection: 'query-presets', id: presetId, overrideAccess: false, req })\n    return true\n  } catch {\n    return false\n  }\n}\n\n// before applying the preset change, warn the user if it would lock them out","typeGuard":null,"tryCatchPattern":"try {\n  await payload.update({ collection: 'query-presets', id, data, req })\n} catch (err) {\n  if (err instanceof APIError && err.message.includes('lock you out')) {\n    // surface a friendly warning: 'keep at least read or update for yourself'\n  } else throw err\n}","preventionTips":["Always retain read OR update access for the acting user in preset access functions.","In the UI, disable 'save' if the access editor would remove all of the user's grants.\n        ","Write access-function tests asserting the acting role still passes after a change."],"tags":["query-presets","authorization","lockout","access-control"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}