custom strategies in paylaod

[Khaled-Ch]

Hey there.
This is my first project with payload and I am kinda blocked and seeking help

I have two user collections Users & AppUsers
I am using custom strategies for my AppUsers the flow is like the following
I am generating magicLink where I invite app-user to signup in my system
when the link is clicked my frontend will call
POST http://localhost:3000/api/app-users/login

curl --location --request POST 'http://localhost:3000/api/app-users/login' \
--header 'x-auth-method: invite' \
--header 'x-email: [email protected]' \
--header 'x-invite-token: some-token' \
--header 'x-business-unit: some-id' \
--data ''

my app-users collection is

import type { CollectionConfig } from 'payload'
import { inviteStrategy } from '../auth/invite'
import { AppUserStatus, Slugs } from '../utils'

export const AppUsers: CollectionConfig = {
  slug: 'app-users',
  admin: {
    useAsTitle: 'email',
  },
  auth: {
    disableLocalStrategy: true,
    strategies: [inviteStrategy],
  },
  access: {
    read: () => true,
    create: () => true,
    update: () => true,
    delete: () => false,
  },
  fields: [
    { name: 'email', type: 'email', required: true, unique: true },
    { name: 'phone', type: 'text' },

    { name: 'firstName', type: 'text', required: true },
    { name: 'lastName', type: 'text', required: true },
    { name: 'companyName', type: 'text', required: true },
    {
      name: 'createdAt',
      type: 'date',
      admin: { readOnly: true },
    },
  ],
}

My inviteStrategy is

import type { AuthStrategy } from 'payload'
import { Slugs } from '../utils'

export const inviteStrategy: AuthStrategy = {
  name: 'invite-link',
  authenticate: async ({ payload, headers }) => {
    if (headers.get('x-auth-method') !== 'invite') return { user: null }

    const email = headers.get('x-email') ?? ''
    const token = headers.get('x-invite-token') ?? ''
    const businessUnit = headers.get('x-business-unit') ?? ''

    if (!email || !token || !businessUnit) return { user: null }

    const { docs: existing } = await payload
      .find({
        collection: 'app-users',
        where: { email: { equals: email } },
        limit: 1,
      })
      .catch((e: Error) => {
        console.error('failed to fetch app-users during the invite stategy', e)
        throw e
      })

    const appUser =
      existing[0] ??
      (await payload
        .create({
          collection: 'app-users',
          data: {
            email,
            firstName: 'first-name',
            lastName: 'last-name',
            companyName: 'company-name',
          },
        })
        .catch((e: Error) => {
          console.error('failed to create app-user during the invite stategy', e)
          throw e
        }))

    console.log('>>>> appUser', appUser)

    return {
      user: {
        collection: 'app-users',
        _strategy: 'invite-link',
        ...appUser,
      },
    }
  },
}

I can confirm the the user is created in the DB but I am getting 403 status code when I am calling the login endpoint

{
    "errors": [
        {
            "message": "You are not allowed to perform this action."
        }
    ]
}

what could be wrong?? any help?

[Khaled-Ch]

@denolfe appreciate your help!

[Khaled-Ch]

@jmikrut appreciate you help 🙏