Enable users to use their existing WordPress password in Payload

[andershermansen]

Found a plugin for payload 2 (https://github.com/thgh/payload-plugin-wordpress-password). Implemented it as a simple hook instead for payload 3.

It assumes your auth collection is users and that you have a field wordPressPasswordHash which stores the password hash imported from WordPress. It will do the conversion once, and delete the hash when password is correct and converted.

You also need to install the wp-passhash package to do the password check against the old hash.

import type { CollectionBeforeOperationHook } from 'payload';
import createPasswordHasher from 'wp-passhash';

export const beforeLoginHook: CollectionBeforeOperationHook = async ({ args, req, operation }) => {
    if (operation !== 'login') {
        return args;
    }

    const { email: unsanitizedEmail, password } = args.data;
    const email = typeof unsanitizedEmail === 'string' ? unsanitizedEmail.toLowerCase().trim() : null;
    if (!email || !password) {
        return args;
    }

    const user = await req.payload.db.findOne<any>({
        collection: 'users',
        req,
        where: {
            email: { equals: email },
            wordPressPasswordHash: { exists: true },
        },
    });
    if (!user) {
        return args;
    }

    const wordPressPasswordHash = user.wordPressPasswordHash;
    if (wordPressPasswordHash && createPasswordHasher().check(password, wordPressPasswordHash)) {
        await req.payload.update({
            collection: 'users',
            id: user.id,
            data: {
                password,
                wordPressPasswordHash: null,
            },
        });
        console.log('converted password of user', user.email);
    }

    return args;
};

Use it like this in your users collection:

export const Users: CollectionConfig = {
    ...
    hooks: {
        beforeOperation: [beforeLoginHook],
    },
    ...
}

[andershermansen]

Thanks for the plugin which showed me the way @thgh