Creating a new user without a password

[jmurth1234]

It feels a little odd to me that a user requires a password to be set before creating them.

Especially when emails are successfully configured, a password may not need to be set as the user can have a password reset email sent to them instead. Or maybe you want to create a user that can only be accessed via api key based authentication

What are the thoughts on this change?

[paper-krane]

Would also love to see this feature. Would love an option that could be passed in the auth config of a collection that would make passwords necessary or not. I believe it would expand a lot of opportunities user onboarding.

[the-digital-anarchist]

I guess it would also be possible to change the user collection our self right?
Or is this piece of code under the hood and not adjustable?
I've tried it, but can't find how to do it.

Edit: found the docs on customizing the user: https://payloadcms.com/docs/admin/overview#the-admin-user-collection
But not how to create a user without password yet.

[the-digital-anarchist]

Did any one have any luck with this?
Please share if you found a way

[thgh]

Setting a random password works well.

Using payload.login though is a bad idea as you won't know the password (and shouldn't store it plaintext).

The solution I ended up with (not yet in the linked repo) is along these lines:

          // Sanitize the user object
          // let user = userDoc.toJSON({ virtuals: true }) // Not sure what this does
          const user = JSON.parse(JSON.stringify(req.user))

          // Decide which user fields to include in the JWT
          const collectionConfig = payload.collections[collectionSlug].config
          const fieldsToSign = collectionConfig.fields.reduce(
            (signedFields, field: Field) => {
              const result = {
                ...signedFields,
              }

              if (!fieldAffectsData(field) && fieldHasSubFields(field)) {
                field.fields.forEach((subField) => {
                  if (fieldAffectsData(subField) && subField.saveToJWT) {
                    result[subField.name] = user[subField.name]
                  }
                })
              }

              if (fieldAffectsData(field) && field.saveToJWT) {
                result[field.name] = user[field.name]
              }

              return result
            },
            {
              email: user.email,
              id: user.id,
              collection: collectionConfig.slug,
            }
          )

          // Sign the JWT
          const token = jwt.sign(fieldsToSign, payload.secret, {
            expiresIn: collectionConfig.auth.tokenExpiration,
          })

          // Set cookie
          res.cookie(`${payload.config.cookiePrefix}-token`, token, {
            path: '/',
            httpOnly: true,
            expires: getCookieExpiration(collectionConfig.auth.tokenExpiration),
            secure: collectionConfig.auth.cookies.secure,
            sameSite: collectionConfig.auth.cookies.sameSite,
            domain: collectionConfig.auth.cookies.domain || undefined,
          })

          // Redirect to admin dashboard
          res.redirect('/admin')