autoLogin without prefillOnly breaks Preview

[danielkoller]

Link to reproduction

No response

Payload Version

3.0.0-beta.87

Node Version

22.5.1

Next.js Version

15.0.0-canary.104

Describe the Bug

I've encountered an issue when using the autoLogin feature (without prefillOnly) in the Payload config. When autoLogin is enabled, the live preview in the Payload admin panel no longer works.

The preview just displays a message saying "You are not allowed to preview this page" and the live preview window remains blank, even though I'm logged into the admin panel.

This may be intended behavior, but it's something that caught me off guard while I was showcasing Payload to my colleagues. Adding a note about this limitation in the Payload documentation would be really helpful, so users are aware of this potential gotcha when using autoLogin.

Huge fan of Payload, btw.

Reproduction Steps

1. Enable the autoLogin option in the Payload config:

  admin: {
    user: 'users',
    autoLogin:
      process.env.PAYLOAD_PUBLIC_ENABLE_AUTOLOGIN === 'true'
        ? {
            email: '[email protected]',
            password: 'test',
          }
        : false,
  },
  collections: [
    /** */
  ],
})

2. Log in to the Payload admin panel. You should be automatically logged in due to the autoLogin setting.

3. Try to use the live preview functionality in the Payload admin panel.

Expected Behavior

The live preview should work as expected, allowing me to see the content as it would appear on the frontend.

Actual Behavior

When the autoLogin option is enabled, the live preview stops working. The preview window displays the message "You are not allowed to preview this page" and remains blank, even though I'm logged into the admin panel.

Adapters and Plugins

No response

[paulpopus]

Hey @danielkoller I believe the issue here is that Live Preview endpoint checks for a token in your cookies but if you use autoLogin it bypasses that for the admin panel completely so chances are you don't have any cookie or an invalid token set.

Have a look at this code here: https://github.com/payloadcms/payload/blob/beta/templates/website/src/app/next/preview/route.ts#L31

Live preview endpoint hits this Next route that sets draft mode to true if the user is valid. You can extend this part here to first check if the environment isn't production and then if the config on payload has autoLogin configured and then just allow access; if none of these are true then it can continue checking the token of the user and verifying it.

This shouldn't be an issue in production since you shouldn't be running autoLogin in production.

Let me know if that makes sense!