@smta/payload

Documentation · GitHub

The Payload CMS adapter for SMTA (SaaS Multi-Tenant Architecture). Provides the SQL auth implementation for Payload deployments and a TypeScript middleware to inject the current user's ID into the PostgreSQL session before each request.

What's in this package

SQL (deployed via @smta/cli):

| File | Purpose | |------|---------| | auth_payload_impl.sql | Implements core.get_current_user_id() using the app.current_user_id PostgreSQL session variable |

TypeScript middleware:

• injectUserContext(db, userId) — sets app.current_user_id for the current transaction
• clearUserContext(db) — clears the session variable

Deploy the SQL

npx @smta/cli --adapter payload

Apply the generated script to your Payload project's PostgreSQL database. See the Payload Quick Start for full instructions.

Install the TypeScript middleware

npm install @smta/payload

Usage

Call injectUserContext inside a Payload beforeOperation hook so SMTA's RLS policies can identify the current user on every query:

import { injectUserContext } from '@smta/payload'

// In your Payload collection's hooks
const MyCollection: CollectionConfig = {
  slug: 'my-collection',
  hooks: {
    beforeOperation: [
      async ({ req }) => {
        if (req.user?.id) {
          await injectUserContext(req.payload.db.drizzle, req.user.id)
        }
      },
    ],
  },
}

injectUserContext uses SET LOCAL so the session variable is scoped to the current transaction — it is automatically cleared when the transaction ends.

For more on how SMTA's RLS policies use this value, see the Adapter Pattern docs.

Part of the SMTA package family

| Package | Purpose | |---------|---------| | @smta/core | Adapter-agnostic SQL schema | | @smta/supabase | Supabase adapter SQL | | @smta/payload | This package — Payload CMS adapter SQL + middleware | | @smta/billing | BillingProvider interface (Stripe, Lemon Squeezy) | | @smta/schemas | Zod v4 schemas for all public.* RPC contracts | | @smta/cli | Deployment CLI |

License

MIT