{"record":{"id":"f2dbdc77d4e5530f","repo":"payloadcms/payload","slug":"unauthorized-you-must-be-logged-in-to-make-this-r-f2dbdc","errorCode":null,"errorMessage":"Unauthorized, you must be logged in to make this request.","messagePattern":"Unauthorized, you must be logged in to make this request\\.","errorType":"exception","errorClass":"UnauthorizedError","httpStatus":401,"severity":"error","filePath":"packages/ui/src/forms/fieldSchemasToFormState/serverFunctions/renderFieldServerFn.ts","lineNumber":53,"sourceCode":"   *\n   * Examples:\n   *   \"collection.posts.richText\"\n   *   \"global.siteSettings.content\"\n   */\n  schemaPath: string\n}\nexport type RenderFieldServerFnReturnType = {} & FieldState['customComponents']\n\n/**\n * @experimental - may break in minor releases\n */\nexport const _internal_renderFieldHandler: ServerFunction<\n  RenderFieldServerFnArgs,\n  Promise<RenderFieldServerFnReturnType>\n  // eslint-disable-next-line @typescript-eslint/require-await\n> = async ({ field: fieldArg, initialValue, path, req, schemaPath }) => {\n  if (!req.user) {\n    throw new UnauthorizedError()\n  }\n\n  const [entityType, entitySlug, ...fieldPath] = schemaPath.split('.')\n\n  const schemaMap = getSchemaMap({\n    collectionSlug: entityType === 'collection' ? entitySlug : undefined,\n    config: req.payload.config,\n    globalSlug: entityType === 'global' ? entitySlug : undefined,\n    i18n: req.i18n,\n  })\n\n  // Provide client schema map as it would have been provided if the target editor field would have been rendered.\n  // For lexical, only then will it contain all the lexical-internal entries\n  const clientSchemaMap = getClientSchemaMap({\n    collectionSlug: entityType === 'collection' ? entitySlug : undefined,\n    config: getClientConfig({\n      config: req.payload.config,\n      i18n: req.i18n,","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/ui/src/forms/fieldSchemasToFormState/serverFunctions/renderFieldServerFn.ts#L35-L71","documentation":"Thrown as UnauthorizedError (HTTP 401) by the experimental _internal_renderField server function when req.user is falsy. This server function renders a single field's custom components on the server and requires an authenticated admin session.","triggerScenarios":"The renderField server function is invoked (e.g. to server-render a field's custom component) while req.user is null — no session, expired session, or the call did not propagate auth.","commonSituations":"Field renders triggered after session expiry; a custom editor invoking the renderField RPC without forwarding credentials; SSR of a field before auth middleware populates req.user.","solutions":["Ensure the admin session is active and the cookie reaches the renderField server function.","Gate client-side calls to renderField behind a user check so they aren't issued anonymously.","Wire auth middleware to populate req.user before the server function executes."],"exampleFix":"// before — calling renderField without ensuring auth\nconst result = await fetchServerFunction('renderField', { schemaPath, path })\n\n// after — verify auth before calling\nif (!user) redirect('/login')\nconst result = await fetchServerFunction('renderField', { schemaPath, path })","handlingStrategy":"validation","validationCode":"function isLoggedIn(user: unknown): user is { id: string } {\n  return Boolean(user)\n}\n\nif (!isLoggedIn(req.user)) {\n  throw new Error('Login required to render this field.')\n}","typeGuard":"import { UnauthorizedError } from 'payload'\n\nfunction isUnauthorized(err: unknown): err is UnauthorizedError {\n  return err instanceof UnauthorizedError\n}","tryCatchPattern":"try {\n  await fetchServerFunction('renderField', { field, schemaPath, path })\n} catch (err) {\n  if (isUnauthorized(err)) {\n    redirectToLogin()\n    return\n  }\n  throw err\n}","preventionTips":["Ensure the admin session is active before issuing renderField calls.","Forward credentials with the RPC so req.user is populated.","Gate client calls behind a user check to avoid anonymous RPCs."],"tags":["ui","server-function","auth","fields","render","experimental"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}