[Serious] Graphql api draft option not working for unpublished documents

[Stupidism]

Bug Report

I found our draft articles and unpublished articles are shown in prod env.

Steps to Reproduce

1. Open pages list in demo site and publish the first article
2. Publish the second article and then unpublish it directly

3. Open the graphql-playground:
   https://demo.payloadcms.com/api/graphql-playground

Input this query and execute:

# Write your query or mutation here
query getPages {
  Pages(draft: false) {
    docs {
      slug
      _status
      updatedAt
    }
  }
}

Other Details

[Stupidism]

Do I have to use this query to filter out _status: "draft"? If so, can I find any documentation about this?

# Write your query or mutation here
query getPages {
  Pages(draft: false, where:{_status: {equals: published}}) {
    docs {
      title
      slug
      _status
      updatedAt
    }
  }
}

[jmikrut]

Your understanding in your second comment is correct - the draft: true argument replaces any docs in your main collection with their newest drafts, which would be stored in the _versions collection.

We do have docs about this - take a look here:
https://payloadcms.com/docs/versions/drafts#controlling-who-can-see-collection-drafts

Basically, the draft argument alone does not restrict who can see drafts. If you need that, you need to do that with access control. The draft arg simply does what is stated above.

Does that make sense? I will convert this to a discussion as I don't believe there's anything actionable to be done here. What do you think?