Secure admin login flow

src/app/(payload)/admin/[[...segments]]/page.tsx

@@ -1,14 +1,32 @@
 import configPromise from '@payload-config'
 import { RootPage, generatePageMetadata } from '@payloadcms/next/views'
+import { headers as getHeaders } from 'next/headers'
+import { redirect } from 'next/navigation'
+import { executeAuthStrategies, getPayload } from 'payload'
 // @ts-expect-error generated by Payload admin import map generator
 import { importMap } from '../importMap.js'
 import { AdminHome } from '../_components/admin-home'
+import { AdminLoginForm } from '../_components/admin-login-form'
 
 type AdminPageProps = {
   params: Promise<{ segments?: string[] }>
   searchParams: Promise<{ [key: string]: string | string[] | undefined }>
 }
 
+async function getAdminUser() {
+  const [config, headers] = await Promise.all([configPromise, getHeaders()])
+  const payload = await getPayload({
+    config,
+    importMap,
+  })
+  const { user } = await executeAuthStrategies({
+    headers,
+    payload,
+  })
+
+  return user
+}
+
 export async function generateMetadata({ params, searchParams }: AdminPageProps) {
   return generatePageMetadata({
     config: configPromise,
@@ -27,7 +45,15 @@ export default async function PayloadAdminPage({ params, searchParams }: AdminPa
   const { segments } = await normalizedParams
   const resolvedSearchParams = await searchParams
 
+  if (segments.length === 1 && segments[0] === 'login') {
+    if (await getAdminUser()) redirect('/admin')
+
+    return <AdminLoginForm />
+  }
+
   if (segments.length === 0) {
+    if (!(await getAdminUser())) redirect('/admin/login?redirect=/admin')
+
     return <AdminHome cacheCleared={resolvedSearchParams.cache === 'cleared'} />
   }