@hartl-services/medusa-base 2.1.0 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -9,6 +9,7 @@ const files_1 = require("@hartl-services/medusa-food-supplements-contracts/schem
|
|
|
9
9
|
const plugin_features_2 = require("../documents/plugin-features");
|
|
10
10
|
const plugin_features_3 = require("../email/plugin-features");
|
|
11
11
|
const customer_verification_request_throttle_1 = require("./customer-verification-request-throttle");
|
|
12
|
+
const password_policy_1 = require("./password-policy");
|
|
12
13
|
const public_1 = require("../public");
|
|
13
14
|
/**
|
|
14
15
|
* Feature-toggle gate for the Documents routes. Without `methods` Medusa
|
|
@@ -138,6 +139,20 @@ exports.default = (0, http_1.defineMiddlewares)({
|
|
|
138
139
|
customer_verification_request_throttle_1.throttleCustomerVerificationRequest,
|
|
139
140
|
],
|
|
140
141
|
},
|
|
142
|
+
// Password policy for customers and Admin users: registration (sign-up
|
|
143
|
+
// and Admin invite) and the password reset. Without `methods` the entry
|
|
144
|
+
// is an `app.use` prefix match that runs before Medusa's method-specific
|
|
145
|
+
// entries, so a rejected password never consumes the single-use reset
|
|
146
|
+
// token (Medusa's `validateToken` deletes it on the update route). Both
|
|
147
|
+
// paths only exist for POST.
|
|
148
|
+
{
|
|
149
|
+
matcher: "/auth/:actor_type/emailpass/register",
|
|
150
|
+
middlewares: [password_policy_1.enforcePasswordPolicy],
|
|
151
|
+
},
|
|
152
|
+
{
|
|
153
|
+
matcher: "/auth/:actor_type/emailpass/update",
|
|
154
|
+
middlewares: [password_policy_1.enforcePasswordPolicy],
|
|
155
|
+
},
|
|
141
156
|
// --- Dokumente ------------------------------------------------------
|
|
142
157
|
// Feature-toggle gates (see plugin-features.ts). They cover every
|
|
143
158
|
// Documents route and nothing else; subscribers and jobs check the
|
|
@@ -233,4 +248,4 @@ exports.default = (0, http_1.defineMiddlewares)({
|
|
|
233
248
|
},
|
|
234
249
|
],
|
|
235
250
|
});
|
|
236
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
251
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWlkZGxld2FyZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYXBpL21pZGRsZXdhcmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsbURBS2lDO0FBQ2pDLCtHQUtrRjtBQUNsRixtR0FHNEU7QUFDNUUsMkZBS3dFO0FBQ3hFLDJIQUFrSTtBQUNsSSwyRkFBdUg7QUFFdkgsa0VBR3FDO0FBQ3JDLDhEQUE4RDtBQUM5RCxxR0FBOEY7QUFDOUYsdURBQXlEO0FBQ3pELHNDQUFnRDtBQUVoRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLGFBQWEsR0FBRyxDQUFDLE9BQWUsRUFBRSxHQUFHLElBQTJCLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDMUUsT0FBTztJQUNQLFdBQVcsRUFBRSxDQUFDLElBQUEsNkJBQW9CLEVBQUMseUNBQXVCLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztDQUN0RSxDQUFDLENBQUE7QUFFRix5RUFBeUU7QUFDekUsbUVBQW1FO0FBQ25FLHVFQUF1RTtBQUN2RSwyRUFBMkU7QUFDM0UsMEVBQTBFO0FBQzFFLHVDQUF1QztBQUN2QyxrQkFBZSxJQUFBLHdCQUFpQixFQUFDO0lBQy9CLE1BQU0sRUFBRTtRQUNOO1lBQ0UsT0FBTyxFQUFFLHdCQUF3QjtZQUNqQyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFLENBQUMsSUFBQSwrQkFBd0IsRUFBQyw0Q0FBMEIsQ0FBQyxDQUFDO1NBQ3BFO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsNkNBQTZDO1lBQ3RELE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUUsQ0FBQyxJQUFBLCtCQUF3QixFQUFDLDRDQUEwQixDQUFDLENBQUM7U0FDcEU7UUFDRDtZQUNFLE9BQU8sRUFBRSx3REFBd0Q7WUFDakUsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRSxDQUFDLElBQUEsK0JBQXdCLEVBQUMsdUNBQXFCLENBQUMsQ0FBQztTQUMvRDtRQUNEO1lBQ0UsT0FBTyxFQUFFLDZEQUE2RDtZQUN0RSxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFO2dCQUNYLElBQUEsZ0NBQXlCLEVBQUMsaURBQStCLEVBQUU7b0JBQ3pELE1BQU0sRUFBRSxLQUFLO2lCQUNkLENBQUM7YUFDSDtTQUNGO1FBQ0QsdUVBQXVFO1FBQ3ZFLHlFQUF5RTtRQUN6RSxxRUFBcUU7UUFDckUsd0VBQXdFO1FBQ3hFLG1EQUFtRDtRQUNuRCxxRUFBcUU7UUFDckU7WUFDRSxPQUFPLEVBQUUsY0FBYztZQUN2QixXQUFXLEVBQUUsQ0FBQyxJQUFBLDZCQUFvQixFQUFDLHFDQUFtQixDQUFDLENBQUM7U0FDekQ7UUFDRDtZQUNFLE9BQU8sRUFBRSx1QkFBdUI7WUFDaEMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLGdDQUF5QixFQUFDLHlDQUFpQyxFQUFFO29CQUMzRCxNQUFNLEVBQUUsSUFBSTtpQkFDYixDQUFDO2FBQ0g7U0FDRjtRQUNEO1lBQ0UsT0FBTyxFQUFFLDJCQUEyQjtZQUNwQyxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQzNEO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsbUNBQW1DO1lBQzVDLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDM0MsSUFBQSwrQkFBd0IsRUFBQyxxQ0FBNkIsQ0FBQzthQUN4RDtTQUNGO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsNkJBQTZCO1lBQ3RDLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDM0MsSUFBQSxnQ0FBeUIsRUFBQyw4Q0FBc0MsRUFBRTtvQkFDaEUsTUFBTSxFQUFFLElBQUk7aUJBQ2IsQ0FBQzthQUNIO1NBQ0Y7UUFDRDtZQUNFLFVBQVUsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUU7WUFDaEMsT0FBTyxFQUFFLDZCQUE2QjtZQUN0QyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsK0JBQXdCLEVBQUMsMENBQWtDLENBQUM7YUFDN0Q7U0FDRjtRQUNEO1lBQ0UsT0FBTyxFQUFFLDBDQUEwQztZQUNuRCxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQzNEO1FBQ0QsK0RBQStEO1FBQy9ELHVFQUF1RTtRQUN2RSx3RUFBd0U7UUFDeEUsMkRBQTJEO1FBQzNEO1lBQ0UsT0FBTyxFQUFFLDhCQUE4QjtZQUN2QyxXQUFXLEVBQUU7Z0JBQ1gsSUFBQSw2QkFBb0IsRUFDbEIscUNBQW1CLEVBQ25CLGVBQWUsRUFDZix1QkFBdUIsQ0FDeEI7YUFDRjtTQUNGO1FBQ0Q7WUFDRSxPQUFPLEVBQUUscUNBQXFDO1lBQzlDLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUUsQ0FBQyxJQUFBLCtCQUF3QixFQUFDLHdEQUFnQyxDQUFDLENBQUM7U0FDMUU7UUFDRCxzRUFBc0U7UUFDdEUsb0VBQW9FO1FBQ3BFLHdFQUF3RTtRQUN4RSx3RUFBd0U7UUFDeEUsaURBQWlEO1FBQ2pEO1lBQ0UsT0FBTyxFQUFFLDRCQUE0QjtZQUNyQyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxpQkFBaUIsRUFBRSxJQUFJLEVBQUUsQ0FBQztnQkFDckUsNEVBQW1DO2FBQ3BDO1NBQ0Y7UUFDRCx1RUFBdUU7UUFDdkUsd0VBQXdFO1FBQ3hFLHlFQUF5RTtRQUN6RSxzRUFBc0U7UUFDdEUsd0VBQXdFO1FBQ3hFLDZCQUE2QjtRQUM3QjtZQUNFLE9BQU8sRUFBRSxzQ0FBc0M7WUFDL0MsV0FBVyxFQUFFLENBQUMsdUNBQXFCLENBQUM7U0FDckM7UUFDRDtZQUNFLE9BQU8sRUFBRSxvQ0FBb0M7WUFDN0MsV0FBVyxFQUFFLENBQUMsdUNBQXFCLENBQUM7U0FDckM7UUFDRCx1RUFBdUU7UUFDdkUsa0VBQWtFO1FBQ2xFLG1FQUFtRTtRQUNuRSxxRUFBcUU7UUFDckUsRUFBRTtRQUNGLGdCQUFnQjtRQUNoQixhQUFhLENBQUMsa0JBQWtCLENBQUM7UUFDakMsYUFBYSxDQUFDLDZCQUE2QixDQUFDO1FBQzVDLGFBQWEsQ0FBQyxpQ0FBaUMsQ0FBQztRQUNoRCx1QkFBdUI7UUFDdkIsYUFBYSxDQUFDLGtCQUFrQixFQUFFLFVBQVUsQ0FBQztRQUM3QyxhQUFhLENBQUMsNkJBQTZCLEVBQUUsVUFBVSxDQUFDO1FBQ3hELGFBQWE7UUFDYixhQUFhLENBQUMsaUNBQWlDLEVBQUUsZUFBZSxDQUFDO1FBQ2pFO1lBQ0UsT0FBTyxFQUFFLGtCQUFrQjtZQUMzQixPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLFVBQVUsRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQy9EO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsc0JBQXNCO1lBQy9CLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsVUFBVSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDL0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSwrQkFBK0I7WUFDeEMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRSxDQUFDLElBQUEsbUJBQVksRUFBQyxVQUFVLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztTQUMvRDtRQUNEO1lBQ0UsT0FBTyxFQUFFLDZCQUE2QjtZQUN0QyxPQUFPLEVBQUUsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDO1lBQ3hCLFdBQVcsRUFBRSxDQUFDLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztTQUMzRDtRQUNEO1lBQ0UsT0FBTyxFQUFFLG1EQUFtRDtZQUM1RCxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQzNEO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsd0NBQXdDO1lBQ2pELE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDM0MsSUFBQSwrQkFBd0IsRUFBQyxrREFBc0MsQ0FBQzthQUNqRTtTQUNGO1FBQ0Q7WUFDRSxPQUFPLEVBQUUscURBQXFEO1lBQzlELE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDM0MsSUFBQSwrQkFBd0IsRUFBQyxrREFBc0MsQ0FBQzthQUNqRTtTQUNGO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsaUNBQWlDO1lBQzFDLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDM0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSwwREFBMEQ7WUFDbkUsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRSxDQUFDLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztTQUMzRDtRQUNEO1lBQ0UsT0FBTyxFQUFFLHVEQUF1RDtZQUNoRSxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsK0JBQXdCLEVBQUMsZ0RBQW9DLENBQUM7YUFDL0Q7U0FDRjtRQUNELHVFQUF1RTtRQUN2RTtZQUNFLE9BQU8sRUFBRSx1QkFBdUI7WUFDaEMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLGdDQUF5QixFQUFDLDZDQUFxQyxFQUFFO29CQUMvRCxNQUFNLEVBQUUsS0FBSztpQkFDZCxDQUFDO2FBQ0g7U0FDRjtRQUNEO1lBQ0UsVUFBVSxFQUFFLEtBQUs7WUFDakIsT0FBTyxFQUFFLHNCQUFzQjtZQUMvQixPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFO2dCQUNYLElBQUEsZ0NBQXlCLEVBQUMsNkNBQXFDLEVBQUU7b0JBQy9ELE1BQU0sRUFBRSxLQUFLO2lCQUNkLENBQUM7YUFDSDtTQUNGO0tBQ0Y7Q0FDRixDQUFDLENBQUEifQ==
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.enforcePasswordPolicy = void 0;
|
|
4
|
+
const utils_1 = require("@medusajs/framework/utils");
|
|
5
|
+
const password_policy_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/password-policy");
|
|
6
|
+
/**
|
|
7
|
+
* Runs before Medusa's `emailpass` register and password-update routes (every
|
|
8
|
+
* actor type, so customers and Admin users) and rejects a password shorter
|
|
9
|
+
* than `PASSWORD_MIN_LENGTH` with 400 `invalid_data`. A body without a string
|
|
10
|
+
* password goes on to Medusa unchanged, which answers it itself (register) or
|
|
11
|
+
* changes nothing (update). Login is never checked, so older, shorter
|
|
12
|
+
* passwords keep working.
|
|
13
|
+
*/
|
|
14
|
+
const enforcePasswordPolicy = (req, _res, next) => {
|
|
15
|
+
const password = req.body?.password;
|
|
16
|
+
if (typeof password === "string" && !(0, password_policy_1.isPasswordLongEnough)(password)) {
|
|
17
|
+
next(new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Das Passwort muss mindestens ${password_policy_1.PASSWORD_MIN_LENGTH} Zeichen lang sein.`));
|
|
18
|
+
return;
|
|
19
|
+
}
|
|
20
|
+
next();
|
|
21
|
+
};
|
|
22
|
+
exports.enforcePasswordPolicy = enforcePasswordPolicy;
|
|
23
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGFzc3dvcmQtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2FwaS9wYXNzd29yZC1wb2xpY3kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBS0EscURBQXVEO0FBQ3ZELCtHQUdrRjtBQUVsRjs7Ozs7OztHQU9HO0FBQ0ksTUFBTSxxQkFBcUIsR0FBRyxDQUNuQyxHQUFrQixFQUNsQixJQUFvQixFQUNwQixJQUF3QixFQUNsQixFQUFFO0lBQ1IsTUFBTSxRQUFRLEdBQUksR0FBRyxDQUFDLElBQTJDLEVBQUUsUUFBUSxDQUFBO0lBQzNFLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsSUFBQSxzQ0FBb0IsRUFBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ3BFLElBQUksQ0FDRixJQUFJLG1CQUFXLENBQ2IsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5QixnQ0FBZ0MscUNBQW1CLHFCQUFxQixDQUN6RSxDQUNGLENBQUE7UUFDRCxPQUFNO0lBQ1IsQ0FBQztJQUNELElBQUksRUFBRSxDQUFBO0FBQ1IsQ0FBQyxDQUFBO0FBaEJZLFFBQUEscUJBQXFCLHlCQWdCakMifQ==
|
package/README.md
CHANGED
|
@@ -39,6 +39,8 @@ packing lists) and S3 file storage, and the turnkey `medusa-config.ts` preset
|
|
|
39
39
|
- Redirects `GET /` to the admin dashboard and repairs dangling
|
|
40
40
|
`cart_promotion` links (see "Root redirect" and "Cart-promotion link
|
|
41
41
|
repair").
|
|
42
|
+
- Requires passwords of at least 15 characters for customers and Admin users
|
|
43
|
+
(see "Password policy").
|
|
42
44
|
- Exports the shop's `medusa-config.ts` helpers from
|
|
43
45
|
`@hartl-services/medusa-base/config` and Sentry's `register()` from
|
|
44
46
|
`@hartl-services/medusa-base/instrumentation` (see "Config helpers" and
|
|
@@ -695,6 +697,30 @@ reverse-proxy rule. The redirect is temporary on purpose: browsers cache a
|
|
|
695
697
|
should `/` ever get real content. A shop that needs its own `/` defines
|
|
696
698
|
`src/api/route.ts` itself.
|
|
697
699
|
|
|
700
|
+
## Password policy
|
|
701
|
+
|
|
702
|
+
Medusa's `emailpass` provider accepts any non-empty password. The base runs a
|
|
703
|
+
middleware on `POST /auth/:actor_type/emailpass/register` (customer sign-up,
|
|
704
|
+
Admin invite) and `POST /auth/:actor_type/emailpass/update` (password reset)
|
|
705
|
+
and answers a password shorter than 15 characters with
|
|
706
|
+
`400 { type: "invalid_data", message: "Das Passwort muss mindestens 15 Zeichen lang sein." }`.
|
|
707
|
+
It applies to every actor type, so customers and Admin users alike. The check
|
|
708
|
+
runs before Medusa's reset-token check, so a rejected password leaves the
|
|
709
|
+
single-use reset link valid for a second attempt.
|
|
710
|
+
|
|
711
|
+
The rule follows NIST SP 800-63B Rev. 4 for a password that is the only
|
|
712
|
+
factor: at least 15 characters, counted as Unicode code points, and no
|
|
713
|
+
composition rules (digits and special characters are allowed, never required).
|
|
714
|
+
The value and the check come from the Contracts package
|
|
715
|
+
(`schemas/password-policy`: `PASSWORD_MIN_LENGTH`, `isPasswordLongEnough`), so
|
|
716
|
+
a storefront validates its forms with the same rule.
|
|
717
|
+
|
|
718
|
+
Login is not checked, so existing shorter passwords keep working until their
|
|
719
|
+
next reset. Accounts created without HTTP (`medusa user`, seed scripts calling
|
|
720
|
+
the Auth module) are not checked either.
|
|
721
|
+
|
|
722
|
+
Nothing to configure.
|
|
723
|
+
|
|
698
724
|
## Cart-promotion link repair
|
|
699
725
|
|
|
700
726
|
Medusa's `deletePromotionsWorkflow` only soft-deletes a promotion and leaves
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hartl-services/medusa-base",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.2.0",
|
|
4
4
|
"description": "Base plugin for Hartl Services Medusa shops: per-plugin feature toggles with a generic Admin settings page, a Store endpoint for storefronts, enforcement helpers, the complete-cart hook composition, the root redirect, cart-promotion link repair, the built-in E-Mail, Documents and S3 file storage modules, config helpers with the turnkey food-shop preset, and the Sentry logger wrapper and instrumentation.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"files": [
|
|
@@ -88,7 +88,7 @@
|
|
|
88
88
|
"mime-types": "3.0.1",
|
|
89
89
|
"nodemailer": "6.10.1",
|
|
90
90
|
"ulid": "^2.4.0",
|
|
91
|
-
"@hartl-services/medusa-food-supplements-contracts": "^0.
|
|
91
|
+
"@hartl-services/medusa-food-supplements-contracts": "^0.20.0"
|
|
92
92
|
},
|
|
93
93
|
"devDependencies": {
|
|
94
94
|
"@medusajs/admin-sdk": "2.19.0",
|