@payloadcms/figma 0.0.1-alpha.6 → 0.0.1-alpha.61

package/dist/oauth/endpoints/getLogoutEndpoint.js

@@ -1,9 +1,9 @@
 import jwt from 'jsonwebtoken';
 import { parseCookies } from 'payload';
+import { formatAdminURL } from 'payload/shared';
 import { clearCookie } from '../utilities/clearCookie.js';
 import { createCookieOptions } from '../utilities/createCookieOptions.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
-import { getAdminPath } from '../utilities/getAdminPath.js';
 export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, strategy })=>({
         handler: async (req)=>{
             const debugLogger = createDebugLogger(req.payload, pluginOptions.debug);
@@ -23,12 +23,15 @@ export const getLogoutEndpoint = ({ collection, endpointSlug, pluginOptions, str
             }
             try {
                 await strategy.ensureMeta();
-                const baseRedirectDestination = pluginOptions.redirectServerURL || config.serverURL;
-                let successfulLogoutRedirectDest = `${baseRedirectDestination}${getAdminPath(config)}`;
+                const redirectServerlURL = pluginOptions.redirectServerURL || config.serverURL;
+                let successfulLogoutRedirectDest = formatAdminURL({
+                    adminRoute: config.routes?.admin || '/admin',
+                    serverURL: redirectServerlURL
+                });
                 if (typeof req.query.redirect === 'string') {
                     successfulLogoutRedirectDest = req.query.redirect;
                 }
-                if (!baseRedirectDestination && !req.query.redirect) {
+                if (!redirectServerlURL && !req.query.redirect) {
                     debugLogger.error({
                         msg: 'No redirect URL provided',
                         path: req.pathname

package/dist/oauth/index.js

@@ -1,3 +1,4 @@
+import { fieldAffectsData } from 'payload/shared';
 import { defaultVerify } from './defaults.js';
 import { getLoginEndpoint } from './endpoints/getLoginEndpoint.js';
 import { getLogoutEndpoint } from './endpoints/getLogoutEndpoint.js';
@@ -84,23 +85,46 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 if (collectionOptions.usePayloadJWT) {
                     cookieName = `${config.cookiePrefix || 'payload'}-token`;
                 }
-                const usernameField = getUsernameField({
-                    collection: existingCollection,
-                    collectionOptions
-                });
                 // Check if email field exists, if not add it
                 const hasEmailField = existingCollection.fields.some((field)=>'name' in field && field.name === 'email');
-                const fields = [
-                    ...existingCollection.fields,
-                    ...typeof adminCollectionOptions.usernameField === 'string' ? [] : [
-                        usernameField
-                    ],
-                    ...!hasEmailField ? [
+                // Add email field to collection before getting username field
+                // This ensures getUsernameField can find the email field if it's configured as the username
+                const collectionWithEmail = hasEmailField ? existingCollection : {
+                    ...existingCollection,
+                    fields: [
+                        ...existingCollection.fields,
                         {
                             name: 'email',
-                            type: 'email'
+                            type: 'email',
+                            admin: {
+                                description: 'Managed by Figma',
+                                readOnly: true
+                            },
+                            unique: true
                         }
-                    ] : []
+                    ]
+                };
+                const usernameField = getUsernameField({
+                    collection: collectionWithEmail,
+                    collectionOptions
+                });
+                // Make username field readOnly (and add description for email fields)
+                const readOnlyUsernameField = {
+                    ...usernameField,
+                    admin: {
+                        ...usernameField.admin || {},
+                        ...usernameField.name === 'email' ? {
+                            description: 'Managed by Figma'
+                        } : {},
+                        readOnly: true
+                    }
+                };
+                const isUsernameFieldString = typeof adminCollectionOptions.usernameField === 'string';
+                const fields = [
+                    ...collectionWithEmail.fields.map((field)=>fieldAffectsData(field) && field.name === usernameField.name ? readOnlyUsernameField : field),
+                    ...isUsernameFieldString ? [] : [
+                        readOnlyUsernameField
+                    ]
                 ];
                 if (disabled) {
                     return {
@@ -110,7 +134,6 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 }
                 const strategy = new Strategy({
                     clientID: collectionOptions.clientID,
-                    clientSecret: collectionOptions.clientSecret,
                     collection: existingCollection,
                     collectionOptions,
                     cookieName,
@@ -142,6 +165,10 @@ export const oAuth2Plugin = (pluginOptions)=>(config)=>{
                 }
                 return {
                     ...existingCollection,
+                    access: {
+                        ...existingCollection.access || {},
+                        create: ()=>false
+                    },
                     auth: {
                         ...typeof existingCollection.auth === 'object' ? existingCollection.auth : {},
                         disableLocalStrategy,

package/dist/oauth/strategy/index.d.ts

@@ -4,7 +4,6 @@ import * as jose from 'jose';
 import type { CollectionOptions, PluginOptions, VerifyFunction } from '../types.js';
 export interface Options {
     clientID: string;
-    clientSecret?: string;
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
     cookieName: string;
@@ -16,7 +15,6 @@ export interface Options {
 }
 export declare class Strategy {
     clientID: string;
-    clientSecret?: string;
     collection: CollectionConfig;
     collectionOptions: CollectionOptions;
     cookieName: string;

package/dist/oauth/strategy/index.js

@@ -1,14 +1,13 @@
 import * as jose from 'jose';
 import { APIError, parseCookies } from 'payload';
-import { validateProjectToken } from '../../auth/jwt-validator.js';
-import { getEnvironment } from '../../constants.js';
+import { JWTValidationError, validateProjectToken } from '../../auth/jwt-validator.js';
+import { getInfraEnvironment } from '../../constants.js';
 import { createDebugLogger } from '../utilities/createDebugLogger.js';
 import { getTokenExp } from '../utilities/getTokenExp.js';
 import { mergeHeaders } from '../utilities/mergeHeaders.js';
 import { refreshTokens } from '../utilities/refreshTokens.js';
 export class Strategy {
     clientID;
-    clientSecret;
     collection;
     collectionOptions;
     cookieName;
@@ -28,7 +27,6 @@ export class Strategy {
         this.verify = options.verify;
         this.cookieName = options.cookieName;
         this.clientID = options.clientID;
-        this.clientSecret = options.clientSecret;
         this.identityMetadataURL = options.identityMetadata;
         this.name = options.strategyName;
         this.collection = options.collection;
@@ -63,7 +61,11 @@ export class Strategy {
             }
         }
         if (!oauthToken) {
-            if (refreshToken && canSetHeaders) {
+            // Attempt refresh even when canSetHeaders=false (e.g., during RSC navigation).
+            // This allows authentication to succeed for the current request even when
+            // cookies cannot be updated. The cookie will be refreshed on the next
+            // full page load when canSetHeaders=true.
+            if (refreshToken) {
                 debugLogger.info({
                     msg: 'No access token found, but refresh token exists. Attempting to refresh...',
                     refreshToken
@@ -83,11 +85,20 @@ export class Strategy {
                         msg: 'Token refreshed. Verifying...',
                         verifyResult
                     });
-                    if (verifyResult.responseHeaders) {
-                        mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                    // Only return response headers (to set cookies) when canSetHeaders is true.
+                    // During RSC navigation, canSetHeaders=false because response streaming
+                    // has already started and cookies cannot be modified.
+                    if (canSetHeaders) {
+                        if (verifyResult.responseHeaders) {
+                            mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                        }
+                        return {
+                            responseHeaders: refreshed.headers,
+                            user: verifyResult.user
+                        };
                     }
+                    // Authenticate this request without updating cookies
                     return {
-                        responseHeaders: refreshed.headers,
                         user: verifyResult.user
                     };
                 } else {
@@ -97,11 +108,10 @@ export class Strategy {
                         refreshToken
                     });
                 }
-            } else {
-                return {
-                    user: null
-                };
             }
+            return {
+                user: null
+            };
         }
         let oauthTokenVerifyResult = null;
         // First, try to verify token
@@ -136,7 +146,10 @@ export class Strategy {
                 });
             }
         }
-        if (oauthTokenVerifyResult instanceof Error && oauthTokenVerifyResult.name === 'TokenExpiredError' && refreshToken && !this.collectionOptions.usePayloadJWT && canSetHeaders) {
+        // Handle expired access token with valid refresh token.
+        // Same pattern as above: refresh regardless of canSetHeaders to support RSC navigation,
+        // but only update cookies when canSetHeaders=true.
+        if (oauthTokenVerifyResult instanceof JWTValidationError && oauthTokenVerifyResult.code === 'EXPIRED' && refreshToken && !this.collectionOptions.usePayloadJWT) {
             const refreshed = await refreshTokens({
                 payload,
                 refreshToken,
@@ -157,11 +170,17 @@ export class Strategy {
                     msg: 'Token refreshed. Verifying...',
                     verifyResult
                 });
-                if (verifyResult.responseHeaders) {
-                    mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                if (canSetHeaders) {
+                    if (verifyResult.responseHeaders) {
+                        mergeHeaders(verifyResult.responseHeaders, refreshed.headers);
+                    }
+                    return {
+                        responseHeaders: refreshed.headers,
+                        user: verifyResult.user
+                    };
                 }
+                // Authenticate this request without updating cookies
                 return {
-                    responseHeaders: refreshed.headers,
                     user: verifyResult.user
                 };
             } else {
@@ -200,6 +219,10 @@ export class Strategy {
             for(let attempt = 1; attempt <= 5; attempt++){
                 try {
                     this.meta = await fetch(this.identityMetadataURL).then((res)=>res.json());
+                    if (this.meta) {
+                        // TODO: This is a hack to get the DefaultLoginButton to work with dynamic OAuth client registration
+                        this.meta.authorization_endpoint = this.meta?.authorization_endpoint + '/cms';
+                    }
                     this.debugLog(`fetchMeta - success on attempt ${attempt}`);
                     if (this.meta?.jwks_uri) {
                         this.jwks = await fetch(this.meta.jwks_uri).then((res)=>res.json());
@@ -259,7 +282,7 @@ export class Strategy {
     }
     async jwtVerify({ payload, token }) {
         try {
-            const verified = await validateProjectToken(token, getEnvironment());
+            const verified = await validateProjectToken(token, getInfraEnvironment());
             if (typeof verified !== 'string') {
                 return verified;
             }

package/dist/oauth/types.d.ts

@@ -30,7 +30,7 @@ export interface CollectionOptions {
      * Set to false to only accept the JWT from cookies
      */
     disableJWTFromHeader?: boolean;
-    disableLocalStrategy?: boolean | IncomingAuthType['disableLocalStrategy'];
+    disableLocalStrategy?: false | IncomingAuthType['disableLocalStrategy'];
     /**
      * The logout button will either redirect to the IDP logout screen or
      * automatically log the user out of the IDP depending on provider.
@@ -112,11 +112,6 @@ export interface PluginOptions {
      * @default 'payload-oauth-token'
      */
     cookieName?: string;
-    /**
-     * Debug mode will log additional information to the console.
-     *
-     * NOTE: This will log sensitive information to the console.
-     */
     /**
      * Accepts incoming request and allows for modification of cookie options
      */
@@ -125,6 +120,11 @@ export interface PluginOptions {
         cookieOptions: CookieOptions;
         headers: Headers;
     }) => CookieOptions;
+    /**
+     * Debug mode will log additional information to the console.
+     *
+     * NOTE: This will log sensitive information to the console.
+     */
     debug?: boolean;
     /**
      * Disables the plugin functionality while leaving in types, fields and component modifications.

package/dist/oauth/utilities/isDuplicateKeyError.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Check if an error is a duplicate key/unique constraint violation from Content API.
+ *
+ * Content API returns HTTP 409 with "conflict" or "already exists" in the message.
+ */
+export declare function isDuplicateKeyError(error: unknown): boolean;
+//# sourceMappingURL=isDuplicateKeyError.d.ts.map

package/dist/oauth/utilities/isDuplicateKeyError.js

@@ -0,0 +1,14 @@
+/**
+ * Check if an error is a duplicate key/unique constraint violation from Content API.
+ *
+ * Content API returns HTTP 409 with "conflict" or "already exists" in the message.
+ */ export function isDuplicateKeyError(error) {
+    if (!error || typeof error !== 'object') {
+        return false;
+    }
+    const err = error;
+    const message = typeof err.message === 'string' ? err.message : '';
+    return message.includes('409') || message.toLowerCase().includes('conflict') || message.toLowerCase().includes('already exists');
+}
+
+//# sourceMappingURL=isDuplicateKeyError.js.map

package/dist/oauth/utilities/refreshTokens.js

@@ -1,7 +1,7 @@
 import { generateCookie } from 'payload';
 import { getProjectToken } from '../../api/figma-api.js';
 import { validateProjectToken } from '../../auth/jwt-validator.js';
-import { getEnvironment } from '../../constants.js';
+import { getInfraEnvironment } from '../../constants.js';
 import { createCookieOptions } from './createCookieOptions.js';
 import { createDebugLogger } from './createDebugLogger.js';
 import { getCookieExpiration } from './getCookieExpiration.js';
@@ -16,7 +16,10 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
     // so we will refresh both tokens
     try {
         // Get another project token
-        const { expiresAt, token } = await getProjectToken(refreshToken, 'someproject');
+        const { expiresAt, token } = await getProjectToken({
+            type: 'oauth',
+            token: refreshToken
+        }, payload.config.custom.figma.contentSystemId);
         debugLogger.info({
             expiresAt,
             msg: 'Received new tokens from Figma API',
@@ -48,7 +51,7 @@ export const refreshTokens = async ({ payload, refreshToken, strategy })=>{
                 value: token
             });
             headers.append('Set-Cookie', tokenCookie);
-            const decodedOauthToken = await validateProjectToken(token, getEnvironment());
+            const decodedOauthToken = await validateProjectToken(token, getInfraEnvironment());
             return {
                 decodedOauthToken,
                 headers,

package/dist/plugin/build-config.d.ts

@@ -6,38 +6,41 @@ import type { Config, SanitizedConfig } from 'payload';
  * - `db`: Omitted (auto-injected by Figma platform)
  * - `secret`: Omitted (auto-injected by Figma platform)
  * - `editor`: Optional (defaults to lexicalEditor() if not provided)
+ * - `contentSystemId`: Optional (resolved automatically from env vars or bootstrap cache)
  *
  * @example
- * // Minimal config
+ * // Minimal config (contentSystemId resolved automatically)
  * const config: FigmaConfig = {
+ *   figma: {},
  *   collections: [...]
  * }
  *
  * @example
  * // With custom editor
  * const config: FigmaConfig = {
+ *   figma: {},
  *   collections: [...],
  *   editor: lexicalEditor({ features: [...] })
  * }
+ *
+ * @example
+ * // Disable Content System (use custom db)
+ * const config: FigmaConfig = {
+ *   figma: {
+ *     useContentSystem: false
+ *   },
+ *   db: mongooseAdapter({ url: process.env.DATABASE_URI }),
+ *   collections: [...]
+ * }
  */
 export type FigmaConfig = {
     editor?: Config['editor'];
 } & {
     figma: {
-        region: string;
-        tenantId: string;
+        contentSystemId?: string;
+        storage?: boolean;
         useContentSystem?: boolean;
     };
-} & Omit<Config, 'editor' | 'secret' | 'db'> & Partial<Pick<Config, 'db'>>;
-/**
- * Figma platform wrapper for Payload's buildConfig.
- * Automatically injects:
- * - Figma database adapter
- * - Secret (platform-provided)
- * - Default lexicalEditor (if no custom editor specified)
- *
- * @param config - Payload configuration (db and secret omitted, editor optional)
- * @returns Promise<SanitizedConfig> - Built Payload configuration
- */
-export declare function buildConfig(config: FigmaConfig): Promise<SanitizedConfig>;
+} & Omit<Config, 'db' | 'editor' | 'secret'> & Partial<Pick<Config, 'db'>>;
+export declare function buildFigmaConfig(config: FigmaConfig): Promise<SanitizedConfig>;
 //# sourceMappingURL=build-config.d.ts.map

package/dist/plugin/build-config.js

@@ -1,26 +1,205 @@
+import { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage';
+import { initClientUploads } from '@payloadcms/plugin-cloud-storage/utilities';
 import { lexicalEditor } from '@payloadcms/richtext-lexical';
 import { buildConfig as payloadBuildConfig } from 'payload';
+import { getBootstrapInfo } from '../api/control-plane.js';
+import { getValidCredential } from '../auth/oauth-flow.js';
+import { getTokenStore } from '../auth/token-store.js';
+import { getEnvConfig } from '../constants.js';
+import { contentAPIAdapter } from '../db-content-api/index.js';
+import { scheduleExtractPlugin } from '../deploy/schedule-extract-plugin.js';
+import { health } from '../endpoints/health.js';
+import { schema } from '../endpoints/schema.js';
 import { oAuth2Plugin } from '../oauth/index.js';
-import { figmaContentSystem } from './adapter.js';
+import { createStorageClient } from '../storage-content-api/client.js';
+import { getGenerateSignedURLHandler } from '../storage-content-api/client-uploads/generateSignedURL.js';
+import { contentApiStorageAdapter } from '../storage-content-api/index.js';
+import { cacheAllEnvironments } from '../utils/cache-bootstrap.js';
+import * as log from '../utils/log.js';
 /**
- * Figma platform wrapper for Payload's buildConfig.
- * Automatically injects:
- * - Figma database adapter
- * - Secret (platform-provided)
- * - Default lexicalEditor (if no custom editor specified)
- *
- * @param config - Payload configuration (db and secret omitted, editor optional)
- * @returns Promise<SanitizedConfig> - Built Payload configuration
- */ export async function buildConfig(config) {
+ * Fields added to users collection for Figma profile info
+ */ const figmaUserFields = [
+    {
+        name: 'figmaHandle',
+        type: 'text',
+        admin: {
+            readOnly: true
+        },
+        label: 'Name'
+    },
+    {
+        name: 'figmaImageUrl',
+        type: 'text',
+        admin: {
+            components: {
+                Cell: '@payloadcms/figma/client#FigmaAvatarCell'
+            },
+            disableBulkEdit: true,
+            hidden: true,
+            readOnly: true
+        },
+        label: 'Profile Picture'
+    }
+];
+function missingOAuthCredential(name) {
+    log.warning(`${name} could not be resolved. OAuth login will not work until this is configured. ` + 'Run `npx @payloadcms/figma init` to set up your project.');
+    return '';
+}
+/**
+ * Fetch bootstrap data from the API and cache all environments locally.
+ * Returns the requested environment's data, or null if resolution fails.
+ */ async function resolveAndCacheBootstrap(store, projectId, environmentName) {
+    try {
+        const credential = await getValidCredential(store);
+        if (!credential) {
+            return null;
+        }
+        const bootstrapInfo = await getBootstrapInfo(credential, projectId);
+        cacheAllEnvironments(store, projectId, bootstrapInfo);
+        return store.getBootstrapData(projectId, environmentName);
+    } catch (error) {
+        log.warning(`Failed to resolve bootstrap data: ${error instanceof Error ? error.message : 'Unknown error'}. ` + 'Try running `npx @payloadcms/figma login` to refresh authentication.');
+        return null;
+    }
+}
+export async function buildFigmaConfig(config) {
+    const envConfig = getEnvConfig();
+    // Resolve contentSystemId: config first, env var, then local store fallback (dev)
+    let { contentSystemId } = config.figma;
+    contentSystemId ??= process.env.FIGMA_CONTENT_API_CONTENT_SYSTEM_ID;
+    let bootstrapData = null;
+    // Local dev: resolve from project ID + bootstrap cache
+    if (!contentSystemId) {
+        const projectId = process.env.FIGMA_PROJECT_ID;
+        const environmentName = process.env.FIGMA_ENVIRONMENT_NAME;
+        if (projectId && environmentName) {
+            const store = getTokenStore();
+            bootstrapData = store.getBootstrapData(projectId, environmentName);
+            // Runtime fallback: fetch from API if not cached (e.g. environment switch without re-init)
+            if (!bootstrapData) {
+                bootstrapData = await resolveAndCacheBootstrap(store, projectId, environmentName);
+            }
+            if (bootstrapData) {
+                contentSystemId = bootstrapData.contentSystemId;
+            }
+        }
+    }
+    if (!contentSystemId) {
+        throw new Error('Content System ID could not be resolved. ' + 'Run `npx @payloadcms/figma init` to set up your project.');
+    }
+    const url = process.env.FIGMA_CONTENT_API_URL || envConfig.contentApiUrl;
+    const isProduction = process.env.NODE_ENV === 'production';
+    // Determine database adapter based on environment
+    let db;
+    if (config.figma.useContentSystem === false) {
+        db = config.db;
+    } else if (process.env.FIGMA_CONTENT_API_ACCESS_KEY) {
+        db = contentAPIAdapter({
+            auth: {
+                apiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY,
+                mode: 'apiKey'
+            },
+            contentSystemId,
+            url
+        });
+    } else if (process.env.FIGMA_DEV_JWT === 'true') {
+        db = contentAPIAdapter({
+            auth: {
+                mode: 'devJwt'
+            },
+            contentSystemId,
+            url
+        });
+    } else {
+        db = contentAPIAdapter({
+            auth: {
+                mode: 'tokenStore',
+                tokenStore: getTokenStore()
+            },
+            contentSystemId,
+            url
+        });
+    }
+    // Build storage plugin if there are upload collections and storage is not disabled
+    const uploadCollections = (config.collections || []).filter((c)=>c.upload);
+    let storagePlugin;
+    if (uploadCollections.length > 0 && config.figma.storage !== false) {
+        const storageConfig = process.env.FIGMA_CONTENT_API_ACCESS_KEY ? {
+            baseUrl: url,
+            contentApiKey: process.env.FIGMA_CONTENT_API_ACCESS_KEY
+        } : process.env.FIGMA_DEV_JWT === 'true' ? {
+            auth: {
+                mode: 'devJwt'
+            },
+            baseUrl: url,
+            contentSystemId
+        } : {
+            auth: {
+                mode: 'tokenStore',
+                tokenStore: getTokenStore()
+            },
+            baseUrl: url,
+            contentSystemId
+        };
+        const adapter = contentApiStorageAdapter(storageConfig);
+        const storageClient = createStorageClient(storageConfig);
+        const collectionsMap = uploadCollections.reduce((acc, c)=>{
+            acc[c.slug] = {
+                adapter,
+                disableLocalStorage: true
+            };
+            return acc;
+        }, {});
+        initClientUploads({
+            clientHandler: '@payloadcms/figma/client#ContentApiClientUploadHandler',
+            collections: collectionsMap,
+            config: config,
+            enabled: true,
+            serverHandler: getGenerateSignedURLHandler({
+                client: storageClient
+            }),
+            serverHandlerPath: '/content-api-storage-signed-url'
+        });
+        storagePlugin = cloudStoragePlugin({
+            collections: collectionsMap
+        });
+    }
     // Build complete config with Figma platform defaults
     const configWithFigmaDefaults = {
         ...config,
-        db: config.figma.useContentSystem ? figmaContentSystem() : config.db,
+        admin: {
+            // Auto-refresh tokens before expiry to prevent unexpected logouts.
+            autoRefresh: true,
+            avatar: {
+                Component: '@payloadcms/figma/client#FigmaAvatar'
+            },
+            ...config.admin
+        },
+        custom: {
+            figma: {
+                ...config.figma,
+                contentSystemId
+            }
+        },
+        db,
         editor: config.editor ?? lexicalEditor(),
+        endpoints: [
+            ...config.endpoints ?? [],
+            health,
+            schema
+        ],
+        ...isProduction && !config.logger ? {
+            logger: {
+                options: {}
+            }
+        } : {},
         secret: 'MY_SECRET',
         // Add oauth to plugins if not already present
         plugins: [
             ...config.plugins ?? [],
+            ...storagePlugin ? [
+                storagePlugin
+            ] : [],
             oAuth2Plugin({
                 collections: [
                     {
@@ -30,9 +209,9 @@ import { figmaContentSystem } from './adapter.js';
                             response_mode: 'query',
                             response_type: 'code'
                         },
-                        clientID: process.env.FIGMA_OAUTH_CLIENT_ID,
-                        clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET,
-                        identityMetadata: 'https://staging.figma.com/.well-known/openid-configuration',
+                        clientID: process.env.FIGMA_OAUTH_CLIENT_ID ?? bootstrapData?.oauthClientId ?? missingOAuthCredential('FIGMA_OAUTH_CLIENT_ID'),
+                        clientSecret: process.env.FIGMA_OAUTH_CLIENT_SECRET ?? bootstrapData?.oauthClientSecret,
+                        identityMetadata: envConfig.identityMetadata,
                         scope: [
                             'current_user:read'
                         ],
@@ -40,12 +219,28 @@ import { figmaContentSystem } from './adapter.js';
                         usernameField: 'email'
                     }
                 ],
-                debug: true,
-                disabled: false,
-                redirectServerURL: 'http://localhost:3000'
-            })
+                debug: !!process.env.DEBUG,
+                disabled: false
+            }),
+            scheduleExtractPlugin()
         ]
     };
+    // Inject figma fields into users collection
+    const collections = configWithFigmaDefaults.collections?.map((col)=>{
+        if (col.slug === 'users') {
+            return {
+                ...col,
+                fields: [
+                    ...col.fields || [],
+                    ...figmaUserFields
+                ]
+            };
+        }
+        return col;
+    });
+    if (collections) {
+        configWithFigmaDefaults.collections = collections;
+    }
     // Delegate to Payload's buildConfig
     return await payloadBuildConfig(configWithFigmaDefaults);
 }