init commit for iPAL-kit plugin

src/globals/SiteIntegrations/index.ts

@@ -0,0 +1,54 @@
+import type { Field, GlobalConfig } from 'payload'
+
+import { isAdmin } from '../../modules/access/index.js'
+import { analyticsFields } from './fields/analytics.js'
+import { smtpFields } from './fields/smtp.js'
+import { storageFields } from './fields/storage.js'
+import { turnstileFields } from './fields/turnstile.js'
+
+type BuildSiteIntegrationsArgs = {
+  /** Extra fields injected by the client project */
+  additionalFields?: Field[]
+}
+
+/**
+ * Builds the SiteIntegrations global.
+ *
+ * Holds third-party service credentials. Access is enforced at the global
+ * level — the whole global requires an authenticated user — so secrets stay
+ * out of anonymous API responses while remaining editable in the admin panel
+ * and readable via the server-side Local API. (Field-level read:false was
+ * avoided because it also hides fields from the admin UI, making them
+ * impossible to enter.)
+ *
+ * Unnamed tabs keep data flat (siteIntegrations.ga4MeasurementId).
+ */
+export function buildSiteIntegrations({
+  additionalFields,
+}: BuildSiteIntegrationsArgs = {}): GlobalConfig {
+  return {
+    slug: 'site-integrations',
+    access: {
+      // Admin-only — secrets live here. Anonymous and non-admin users get
+      // nothing through the API; admins read/edit in the panel and via Local API.
+      read: ({ req: { user } }) => isAdmin(user),
+      update: ({ req: { user } }) => isAdmin(user),
+    },
+    admin: {
+      group: 'Settings',
+    },
+    fields: [
+      {
+        type: 'tabs',
+        tabs: [
+          { fields: analyticsFields, label: 'Analytics' },
+          { fields: turnstileFields, label: 'Turnstile' },
+          { fields: smtpFields, label: 'SMTP' },
+          { fields: storageFields, label: 'Storage' },
+          ...(additionalFields?.length ? [{ fields: additionalFields, label: 'Custom' }] : []),
+        ],
+      },
+    ],
+    label: 'Site Integrations',
+  }
+}