$ show UPDOT/payload-auth-plugin
This repository is a Payload CMS authentication plugin (payload-auth-plugin) that provides OAuth2, OIDC, password, and passkey authentication strategies. It is designed to be used with Payload CMS v3+ and integrates deeply with Payload's admin panel and frontend via custom API endpoints, collection field injection, and a client-side library. The plugin supports multiple providers (Google, GitHub, Apple, etc.) via a clean provider factory pattern and manages its own session cookies, credential hashing (PBKDF2), and account linking. The architecture is a plugin that hooks into Payload's lifecycle, extending the CMS with authentication endpoints and database collections. The example application (examples/with-website/) demonstrates a full Payload CMS + Next.js website with admin and public authentication flows. Despite being pre-1.0, the codebase exhibits solid engineering patterns: strategy pattern for endpoint registration, collection helper functions that merge user-defined configs, and a reusable AuthClient class for browser-side authentication. However, it lacks automated tests, has several FIXME comments in passkey and password protocols, and is tightly coupled to Payload's internal DB and cookie mechanisms, which introduces technical drift risk as Payload evolves. The plugin is actively maintained with frequent releases and a changelog documenting 50+ versions.
The LLM identified 4 files worth highlighting for reuse:
Provides the AuthClient class, a typed client-side abstraction for all authentication operations (OAuth, password, passkey, session, signout). It encapsulates HTTP calls, error handling, and redirects, making it reusable across any frontend that consumes the plugin's endpoints. The pattern is a clean API wrapper that can be extracted and adapted for other authentication backends.
Exemplifies the provider factory pattern used across ~20 OAuth/OIDC providers. Each provider exports a function returning a standardized configuration object (id, client_id, authorization_url, token_url, etc.). This pattern enables easy addition of new providers and is reusable independently of the plugin as a template for OAuth provider configurations.
Exports withUsersCollection and withAccountCollection, which inject required fields (hashed password, salt, verification tokens, passkey data, sessions) into user-defined Payload collection configs. These helpers use a merge-then-override pattern, allowing users to customize fields while ensuring plugin compatibility. The pattern is specific to Payload but demonstrates a clean approach to extending CMS collections.
Implements stateless session management using HTTP-only, signed cookies (JWT-like). Provides functions for creating, verifying, and invalidating session cookies. The pattern is generic and could be reused in any Node.js HTTP application for session handling, with Payload-specific cookie utilities separated.