@hartl-services/medusa-base 2.6.1 → 2.7.0

package/.medusa/server/src/customer-auth/application/prepare-code-account-password-reset.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareCodeAccountPasswordReset = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+const transaction_1 = require("../../shared/lib/transaction");
+const auth_methods_1 = require("../domain/auth-methods");
+const login_code_accounts_1 = require("../login-code-accounts");
+const remove_provider_identity_1 = require("../remove-provider-identity");
+/** `code_provider` of the verification that records "proven by a code login". */
+const VERIFICATION_CODE_PROVIDER = "email-otp";
+/**
+ * Records that the address was proven for the auth identity: a verified Medusa
+ * auth verification (`entity_type` "email"), the one check the linking rule,
+ * the clean-up after a code login and `customer_verification` all use. A
+ * leftover unverified row of an earlier password identity is verified instead
+ * of duplicated.
+ */
+const confirmAddress = async (auth, authIdentityId, entityId) => {
+    const now = new Date();
+    const [existing] = await auth.listAuthVerifications({ auth_identity_id: authIdentityId, entity_id: entityId, entity_type: "email" }, { select: ["id", "verified_at"], take: 1 });
+    if (existing?.id) {
+        if (!existing.verified_at) {
+            await auth.updateAuthVerifications({ id: existing.id, verified_at: now });
+        }
+        return;
+    }
+    try {
+        await auth.createAuthVerifications({
+            auth_identity_id: authIdentityId,
+            entity_id: entityId,
+            entity_type: "email",
+            code_provider: VERIFICATION_CODE_PROVIDER,
+            requested_at: now,
+            verified_at: now,
+        });
+    }
+    catch (error) {
+        if (!(0, transaction_1.isUniqueConstraintViolation)(error)) {
+            throw error;
+        }
+        // A parallel request wrote the row; it is the same fact.
+    }
+};
+/**
+ * Makes "Passwort vergessen" work for an account that so far only logged in
+ * with codes, and returns the identifier Medusa's reset route has to use
+ * (null: leave the request as it is). Medusa looks the provider identity up by
+ * the exact spelling and mails the address it was given, so:
+ *
+ * 1. Exactly one `emailpass` identity with a customer matches the address
+ *    (letter case ignored): its stored spelling is the identifier, so a
+ *    differently cased input still gets the mail.
+ * 2. Otherwise, if the address has a code login whose account carries a
+ *    customer of that address, the address was proven by a code: customer-less
+ *    `emailpass` identities of the address (left by a failed registration) are
+ *    deleted for good, and an `emailpass` identity with the normalized address
+ *    is added to the account, together with a verified auth verification of
+ *    the address so `customer_verification` never blocks it and the code login
+ *    never deletes it as unconfirmed. The identity has no password at all, and
+ *    `emailpass` fails closed for a missing password, so nobody can log in
+ *    with it before the reset sets one. The normalized address is the
+ *    identifier.
+ * 3. Anything else (unknown address, several accounts) changes nothing.
+ *
+ * A parallel request that creates the identity first wins the unique index on
+ * `(entity_id, provider)`; the identity is then read again.
+ */
+const prepareCodeAccountPasswordReset = async (container, identifier) => {
+    const parsed = customer_auth_1.RequestLoginCodeSchema.safeParse({ email: identifier });
+    if (!parsed.success) {
+        return null;
+    }
+    const normalized = (0, customer_auth_1.normalizeLoginEmail)(parsed.data.email);
+    const sql = container.resolve(utils_1.ContainerRegistrationKeys.PG_CONNECTION);
+    const auth = container.resolve(utils_1.Modules.AUTH);
+    const passwordIdentities = await (0, login_code_accounts_1.findPasswordIdentities)(sql, normalized);
+    const withCustomer = passwordIdentities.filter(({ customerId }) => customerId);
+    if (withCustomer.length === 1) {
+        return withCustomer[0].entityId;
+    }
+    if (withCustomer.length > 1) {
+        return null;
+    }
+    const authIdentityId = await (0, login_code_accounts_1.findCodeAccountAuthIdentityId)(sql, normalized);
+    if (!authIdentityId) {
+        return null;
+    }
+    for (const orphan of passwordIdentities) {
+        await (0, remove_provider_identity_1.removeProviderIdentity)(auth, orphan);
+    }
+    // The verification first: if the identity then fails to appear, a verified
+    // row of an address the code login proved is all that remains.
+    await confirmAddress(auth, authIdentityId, normalized);
+    try {
+        await auth.createProviderIdentities({
+            auth_identity_id: authIdentityId,
+            provider: auth_methods_1.EMAIL_PASSWORD_AUTH_PROVIDER,
+            entity_id: normalized,
+        });
+    }
+    catch (error) {
+        if (!(0, transaction_1.isUniqueConstraintViolation)(error)) {
+            throw error;
+        }
+    }
+    const created = (await (0, login_code_accounts_1.findPasswordIdentities)(sql, normalized)).find(({ entityId }) => entityId === normalized);
+    return created?.customerId ? normalized : null;
+};
+exports.prepareCodeAccountPasswordReset = prepareCodeAccountPasswordReset;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJlcGFyZS1jb2RlLWFjY291bnQtcGFzc3dvcmQtcmVzZXQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvY3VzdG9tZXItYXV0aC9hcHBsaWNhdGlvbi9wcmVwYXJlLWNvZGUtYWNjb3VudC1wYXNzd29yZC1yZXNldC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFDQSxxREFBOEU7QUFDOUUsMkdBR2dGO0FBRWhGLDhEQUEwRTtBQUMxRSx5REFBcUU7QUFDckUsZ0VBRytCO0FBRS9CLDBFQUFvRTtBQUVwRSxpRkFBaUY7QUFDakYsTUFBTSwwQkFBMEIsR0FBRyxXQUFXLENBQUE7QUF1QjlDOzs7Ozs7R0FNRztBQUNILE1BQU0sY0FBYyxHQUFHLEtBQUssRUFDMUIsSUFBNEIsRUFDNUIsY0FBc0IsRUFDdEIsUUFBZ0IsRUFDRCxFQUFFO0lBQ2pCLE1BQU0sR0FBRyxHQUFHLElBQUksSUFBSSxFQUFFLENBQUE7SUFDdEIsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLE1BQU0sSUFBSSxDQUFDLHFCQUFxQixDQUNqRCxFQUFFLGdCQUFnQixFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxPQUFPLEVBQUUsRUFDL0UsRUFBRSxNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsYUFBYSxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUMzQyxDQUFBO0lBQ0QsSUFBSSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUM7UUFDakIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUMxQixNQUFNLElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxFQUFFLEVBQUUsRUFBRSxRQUFRLENBQUMsRUFBRSxFQUFFLFdBQVcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFBO1FBQzNFLENBQUM7UUFDRCxPQUFNO0lBQ1IsQ0FBQztJQUNELElBQUksQ0FBQztRQUNILE1BQU0sSUFBSSxDQUFDLHVCQUF1QixDQUFDO1lBQ2pDLGdCQUFnQixFQUFFLGNBQWM7WUFDaEMsU0FBUyxFQUFFLFFBQVE7WUFDbkIsV0FBVyxFQUFFLE9BQU87WUFDcEIsYUFBYSxFQUFFLDBCQUEwQjtZQUN6QyxZQUFZLEVBQUUsR0FBRztZQUNqQixXQUFXLEVBQUUsR0FBRztTQUNqQixDQUFDLENBQUE7SUFDSixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUksQ0FBQyxJQUFBLHlDQUEyQixFQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDeEMsTUFBTSxLQUFLLENBQUE7UUFDYixDQUFDO1FBQ0QseURBQXlEO0lBQzNELENBQUM7QUFDSCxDQUFDLENBQUE7QUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0F1Qkc7QUFDSSxNQUFNLCtCQUErQixHQUFHLEtBQUssRUFDbEQsU0FBMEIsRUFDMUIsVUFBa0IsRUFDTSxFQUFFO0lBQzFCLE1BQU0sTUFBTSxHQUFHLHNDQUFzQixDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFBO0lBQ3RFLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDcEIsT0FBTyxJQUFJLENBQUE7SUFDYixDQUFDO0lBQ0QsTUFBTSxVQUFVLEdBQUcsSUFBQSxtQ0FBbUIsRUFBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ3pELE1BQU0sR0FBRyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQzNCLGlDQUF5QixDQUFDLGFBQWEsQ0FDeEMsQ0FBQTtJQUNELE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQXFCLGVBQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQTtJQUVoRSxNQUFNLGtCQUFrQixHQUFHLE1BQU0sSUFBQSw0Q0FBc0IsRUFBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLENBQUE7SUFDeEUsTUFBTSxZQUFZLEdBQUcsa0JBQWtCLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxVQUFVLEVBQUUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLENBQUE7SUFDOUUsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzlCLE9BQU8sWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQTtJQUNqQyxDQUFDO0lBQ0QsSUFBSSxZQUFZLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzVCLE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztJQUVELE1BQU0sY0FBYyxHQUFHLE1BQU0sSUFBQSxtREFBNkIsRUFBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLENBQUE7SUFDM0UsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQ3BCLE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztJQUNELEtBQUssTUFBTSxNQUFNLElBQUksa0JBQWtCLEVBQUUsQ0FBQztRQUN4QyxNQUFNLElBQUEsaURBQXNCLEVBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBQzVDLENBQUM7SUFFRCwyRUFBMkU7SUFDM0UsK0RBQStEO0lBQy9ELE1BQU0sY0FBYyxDQUNsQixJQUE4QixFQUM5QixjQUFjLEVBQ2QsVUFBVSxDQUNYLENBQUE7SUFDRCxJQUFJLENBQUM7UUFDSCxNQUFNLElBQUksQ0FBQyx3QkFBd0IsQ0FBQztZQUNsQyxnQkFBZ0IsRUFBRSxjQUFjO1lBQ2hDLFFBQVEsRUFBRSwyQ0FBNEI7WUFDdEMsU0FBUyxFQUFFLFVBQVU7U0FDdEIsQ0FBQyxDQUFBO0lBQ0osQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLENBQUMsSUFBQSx5Q0FBMkIsRUFBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sS0FBSyxDQUFBO1FBQ2IsQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLE9BQU8sR0FBRyxDQUFDLE1BQU0sSUFBQSw0Q0FBc0IsRUFBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQ2xFLENBQUMsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUMsUUFBUSxLQUFLLFVBQVUsQ0FDMUMsQ0FBQTtJQUNELE9BQU8sT0FBTyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7QUFDaEQsQ0FBQyxDQUFBO0FBckRZLFFBQUEsK0JBQStCLG1DQXFEM0MifQ==

package/.medusa/server/src/customer-auth/application/request-login-code.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestLoginCode = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+const deliver_login_code_1 = require("../../email/application/deliver-login-code");
+const enforcement_1 = require("../../public/enforcement");
+const transaction_1 = require("../../shared/lib/transaction");
+const account_linking_1 = require("../domain/account-linking");
+const login_code_1 = require("../domain/login-code");
+const login_code_accounts_1 = require("../login-code-accounts");
+const login_code_state_1 = require("../login-code-state");
+const plugin_features_1 = require("../plugin-features");
+const remove_provider_identity_1 = require("../remove-provider-identity");
+/**
+ * The key material of the code hashes: the shop's JWT secret, the same value
+ * the `email-otp` auth provider gets as its `hmacSecret` option (the shop
+ * preset sets both from `JWT_SECRET`). Both derive the HMAC key from it with
+ * `hashLoginCode`.
+ */
+const resolveJwtSecret = (container) => {
+    const secret = container.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE).projectConfig?.http?.jwtSecret;
+    if (typeof secret !== "string" || !secret.trim()) {
+        throw new Error("projectConfig.http.jwtSecret is not set");
+    }
+    return secret;
+};
+const logSafely = (container, level, message) => {
+    try {
+        container.resolve(utils_1.ContainerRegistrationKeys.LOGGER)[level](message);
+    }
+    catch {
+        // The caller runs detached: a broken logger must not become an
+        // unhandled rejection.
+    }
+};
+const errorClass = (error) => error instanceof Error ? error.name : "unknown error";
+/**
+ * The address's code-login identity, created when missing. A parallel first
+ * request loses the unique index (entity_id, provider) and reads the winner's
+ * row instead (create-or-get).
+ */
+const ensureProviderIdentity = async (sql, entityId, create) => {
+    try {
+        await create();
+    }
+    catch (error) {
+        if (!(0, transaction_1.isUniqueConstraintViolation)(error)) {
+            throw error;
+        }
+    }
+    return await (0, login_code_accounts_1.findOwnLoginIdentity)(sql, entityId);
+};
+/**
+ * Issues a login code for `email` and mails it. Never rejects and never
+ * reveals anything to the caller's client (the route answers 202 first): a
+ * failure is logged with a fixed message and the error class only, as the
+ * message of a database error can carry the address.
+ *
+ * 1. Find the address's own code-login identity and the customer accounts
+ *    that registered it through `emailpass` (letter case ignored).
+ * 2. Decide where the code goes (`decideLoginCodeTarget`, the anti-takeover
+ *    rule): use or create the code identity, link it to the account, or send
+ *    nothing.
+ * 3. Store a new code with one conditional UPDATE that also enforces the
+ *    resend interval and the daily budget of codes per address; no row means
+ *    throttled or capped and no mail.
+ * 4. Mail the code (`auth.login_code`); it is never persisted or logged.
+ */
+const requestLoginCode = async (container, email) => {
+    try {
+        const entityId = (0, customer_auth_1.normalizeLoginEmail)(email);
+        const hmacSecret = resolveJwtSecret(container);
+        const auth = container.resolve(utils_1.Modules.AUTH);
+        const sql = container.resolve(utils_1.ContainerRegistrationKeys.PG_CONNECTION);
+        const [own, accounts, emailPasswordEnabled] = await Promise.all([
+            (0, login_code_accounts_1.findOwnLoginIdentity)(sql, entityId),
+            (0, login_code_accounts_1.findEmailPasswordAccounts)(sql, entityId),
+            (0, enforcement_1.isPluginFeatureEnabled)(container, plugin_features_1.customerAuthPluginFeatures, customer_auth_1.CUSTOMER_AUTH_FEATURES.emailPassword),
+        ]);
+        const decision = (0, account_linking_1.decideLoginCodeTarget)({
+            emailPasswordEnabled,
+            normalizedEmail: entityId,
+            own,
+            accounts,
+        });
+        if (decision.action === "ambiguous") {
+            logSafely(container, "warn", "Login code not sent: more than one customer account matches the address (they differ only in letter case).");
+            return { status: "ambiguous" };
+        }
+        if (decision.action === "blocked") {
+            logSafely(container, "info", "Login code not sent: the address belongs to an account that may not be linked (address not confirmed or different from the customer's).");
+            return { status: "blocked" };
+        }
+        let target = own;
+        if (decision.action === "link") {
+            if (own) {
+                // A customer-less code identity (and its auth identity if it is then empty).
+                await (0, remove_provider_identity_1.removeProviderIdentity)(auth, own);
+            }
+            target = await ensureProviderIdentity(sql, entityId, () => auth.createProviderIdentities({
+                auth_identity_id: decision.authIdentityId,
+                provider: customer_auth_1.EMAIL_OTP_AUTH_PROVIDER,
+                entity_id: entityId,
+            }));
+        }
+        else if (decision.action === "create") {
+            target = await ensureProviderIdentity(sql, entityId, () => auth.createAuthIdentities({
+                provider_identities: [
+                    { provider: customer_auth_1.EMAIL_OTP_AUTH_PROVIDER, entity_id: entityId },
+                ],
+            }));
+        }
+        if (!target) {
+            logSafely(container, "error", "Login code not sent: the code identity could not be created.");
+            return { status: "failed" };
+        }
+        const code = (0, login_code_1.generateLoginCode)();
+        const stored = await (0, login_code_state_1.storeLoginCode)(sql, target.providerIdentityId, (0, login_code_1.hashLoginCode)(hmacSecret, entityId, code));
+        if (stored === "capped") {
+            logSafely(container, "warn", "Login code not sent: an address used up its daily budget of codes.");
+            return { status: "capped" };
+        }
+        if (stored === "throttled") {
+            return { status: "throttled" };
+        }
+        const mail = await (0, deliver_login_code_1.sendLoginCodeMail)(container, {
+            code,
+            customerId: target.customerId,
+            expiresAt: new Date(Date.now() + customer_auth_1.LOGIN_CODE_TTL_MINUTES * 60_000),
+            to: entityId,
+        });
+        if (mail.status !== "sent") {
+            logSafely(container, "error", `Login code mail was not delivered (${mail.status}${mail.code ? `: ${mail.code}` : ""}).`);
+            return { status: "failed" };
+        }
+        return { status: "sent" };
+    }
+    catch (error) {
+        logSafely(container, "error", `A login code could not be requested (${errorClass(error)}).`);
+        return { status: "failed" };
+    }
+};
+exports.requestLoginCode = requestLoginCode;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVxdWVzdC1sb2dpbi1jb2RlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvYXBwbGljYXRpb24vcmVxdWVzdC1sb2dpbi1jb2RlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUtBLHFEQUdrQztBQUNsQywyR0FLZ0Y7QUFFaEYsbUZBQThFO0FBQzlFLDBEQUFpRTtBQUNqRSw4REFBMEU7QUFDMUUsK0RBR2tDO0FBQ2xDLHFEQUc2QjtBQUM3QixnRUFHK0I7QUFDL0IsMERBQXVFO0FBQ3ZFLHdEQUErRDtBQUMvRCwwRUFBb0U7QUFhcEU7Ozs7O0dBS0c7QUFDSCxNQUFNLGdCQUFnQixHQUFHLENBQUMsU0FBMEIsRUFBVSxFQUFFO0lBQzlELE1BQU0sTUFBTSxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBRTdCLGlDQUF5QixDQUFDLGFBQWEsQ0FBQyxDQUFDLGFBQWEsRUFBRSxJQUFJLEVBQUUsU0FBUyxDQUFBO0lBQzFFLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7UUFDakQsTUFBTSxJQUFJLEtBQUssQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFBO0lBQzVELENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQTtBQUNmLENBQUMsQ0FBQTtBQUVELE1BQU0sU0FBUyxHQUFHLENBQ2hCLFNBQTBCLEVBQzFCLEtBQWdDLEVBQ2hDLE9BQWUsRUFDVCxFQUFFO0lBQ1IsSUFBSSxDQUFDO1FBQ0gsU0FBUyxDQUFDLE9BQU8sQ0FBUyxpQ0FBeUIsQ0FBQyxNQUFNLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQTtJQUM3RSxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsK0RBQStEO1FBQy9ELHVCQUF1QjtJQUN6QixDQUFDO0FBQ0gsQ0FBQyxDQUFBO0FBRUQsTUFBTSxVQUFVLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRSxDQUM1QyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUE7QUFFdkQ7Ozs7R0FJRztBQUNILE1BQU0sc0JBQXNCLEdBQUcsS0FBSyxFQUNsQyxHQUFpQixFQUNqQixRQUFnQixFQUNoQixNQUE4QixFQUNJLEVBQUU7SUFDcEMsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEVBQUUsQ0FBQTtJQUNoQixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUksQ0FBQyxJQUFBLHlDQUEyQixFQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDeEMsTUFBTSxLQUFLLENBQUE7UUFDYixDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxJQUFBLDBDQUFvQixFQUFDLEdBQUcsRUFBRSxRQUFRLENBQUMsQ0FBQTtBQUNsRCxDQUFDLENBQUE7QUFFRDs7Ozs7Ozs7Ozs7Ozs7O0dBZUc7QUFDSSxNQUFNLGdCQUFnQixHQUFHLEtBQUssRUFDbkMsU0FBMEIsRUFDMUIsS0FBYSxFQUNvQixFQUFFO0lBQ25DLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLElBQUEsbUNBQW1CLEVBQUMsS0FBSyxDQUFDLENBQUE7UUFDM0MsTUFBTSxVQUFVLEdBQUcsZ0JBQWdCLENBQUMsU0FBUyxDQUFDLENBQUE7UUFDOUMsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBcUIsZUFBTyxDQUFDLElBQUksQ0FBQyxDQUFBO1FBQ2hFLE1BQU0sR0FBRyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQzNCLGlDQUF5QixDQUFDLGFBQWEsQ0FDeEMsQ0FBQTtRQUVELE1BQU0sQ0FBQyxHQUFHLEVBQUUsUUFBUSxFQUFFLG9CQUFvQixDQUFDLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDO1lBQzlELElBQUEsMENBQW9CLEVBQUMsR0FBRyxFQUFFLFFBQVEsQ0FBQztZQUNuQyxJQUFBLCtDQUF5QixFQUFDLEdBQUcsRUFBRSxRQUFRLENBQUM7WUFDeEMsSUFBQSxvQ0FBc0IsRUFDcEIsU0FBUyxFQUNULDRDQUEwQixFQUMxQixzQ0FBc0IsQ0FBQyxhQUFhLENBQ3JDO1NBQ0YsQ0FBQyxDQUFBO1FBQ0YsTUFBTSxRQUFRLEdBQUcsSUFBQSx1Q0FBcUIsRUFBQztZQUNyQyxvQkFBb0I7WUFDcEIsZUFBZSxFQUFFLFFBQVE7WUFDekIsR0FBRztZQUNILFFBQVE7U0FDVCxDQUFDLENBQUE7UUFFRixJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssV0FBVyxFQUFFLENBQUM7WUFDcEMsU0FBUyxDQUNQLFNBQVMsRUFDVCxNQUFNLEVBQ04sNEdBQTRHLENBQzdHLENBQUE7WUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxDQUFBO1FBQ2hDLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDbEMsU0FBUyxDQUNQLFNBQVMsRUFDVCxNQUFNLEVBQ04seUlBQXlJLENBQzFJLENBQUE7WUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFBO1FBQzlCLENBQUM7UUFFRCxJQUFJLE1BQU0sR0FBNEIsR0FBRyxDQUFBO1FBQ3pDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUMvQixJQUFJLEdBQUcsRUFBRSxDQUFDO2dCQUNSLDZFQUE2RTtnQkFDN0UsTUFBTSxJQUFBLGlEQUFzQixFQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQTtZQUN6QyxDQUFDO1lBQ0QsTUFBTSxHQUFHLE1BQU0sc0JBQXNCLENBQUMsR0FBRyxFQUFFLFFBQVEsRUFBRSxHQUFHLEVBQUUsQ0FDeEQsSUFBSSxDQUFDLHdCQUF3QixDQUFDO2dCQUM1QixnQkFBZ0IsRUFBRSxRQUFRLENBQUMsY0FBYztnQkFDekMsUUFBUSxFQUFFLHVDQUF1QjtnQkFDakMsU0FBUyxFQUFFLFFBQVE7YUFDcEIsQ0FBQyxDQUNILENBQUE7UUFDSCxDQUFDO2FBQU0sSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sR0FBRyxNQUFNLHNCQUFzQixDQUFDLEdBQUcsRUFBRSxRQUFRLEVBQUUsR0FBRyxFQUFFLENBQ3hELElBQUksQ0FBQyxvQkFBb0IsQ0FBQztnQkFDeEIsbUJBQW1CLEVBQUU7b0JBQ25CLEVBQUUsUUFBUSxFQUFFLHVDQUF1QixFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUU7aUJBQzNEO2FBQ0YsQ0FBQyxDQUNILENBQUE7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ1osU0FBUyxDQUNQLFNBQVMsRUFDVCxPQUFPLEVBQ1AsOERBQThELENBQy9ELENBQUE7WUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxDQUFBO1FBQzdCLENBQUM7UUFFRCxNQUFNLElBQUksR0FBRyxJQUFBLDhCQUFpQixHQUFFLENBQUE7UUFDaEMsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFBLGlDQUFjLEVBQ2pDLEdBQUcsRUFDSCxNQUFNLENBQUMsa0JBQWtCLEVBQ3pCLElBQUEsMEJBQWEsRUFBQyxVQUFVLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUMxQyxDQUFBO1FBQ0QsSUFBSSxNQUFNLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDeEIsU0FBUyxDQUNQLFNBQVMsRUFDVCxNQUFNLEVBQ04sb0VBQW9FLENBQ3JFLENBQUE7WUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxDQUFBO1FBQzdCLENBQUM7UUFDRCxJQUFJLE1BQU0sS0FBSyxXQUFXLEVBQUUsQ0FBQztZQUMzQixPQUFPLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxDQUFBO1FBQ2hDLENBQUM7UUFFRCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUEsc0NBQWlCLEVBQUMsU0FBUyxFQUFFO1lBQzlDLElBQUk7WUFDSixVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7WUFDN0IsU0FBUyxFQUFFLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxzQ0FBc0IsR0FBRyxNQUFNLENBQUM7WUFDakUsRUFBRSxFQUFFLFFBQVE7U0FDYixDQUFDLENBQUE7UUFDRixJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDM0IsU0FBUyxDQUNQLFNBQVMsRUFDVCxPQUFPLEVBQ1Asc0NBQXNDLElBQUksQ0FBQyxNQUFNLEdBQy9DLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEtBQUssSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUNqQyxJQUFJLENBQ0wsQ0FBQTtZQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLENBQUE7UUFDN0IsQ0FBQztRQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLENBQUE7SUFDM0IsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixTQUFTLENBQ1AsU0FBUyxFQUNULE9BQU8sRUFDUCx3Q0FBd0MsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQzlELENBQUE7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxDQUFBO0lBQzdCLENBQUM7QUFDSCxDQUFDLENBQUE7QUF2SFksUUFBQSxnQkFBZ0Isb0JBdUg1QiJ9

package/.medusa/server/src/customer-auth/customer-auth-methods-snapshot.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setCustomerAuthMethodsForTests = exports.customerAuthMethods = exports.startCustomerAuthMethodsSnapshot = exports.stopCustomerAuthMethodsSnapshot = exports.refreshCustomerAuthMethodsSnapshot = void 0;
+const refreshing_snapshot_1 = require("../shared/lib/refreshing-snapshot");
+const auth_methods_1 = require("./domain/auth-methods");
+const plugin_features_1 = require("./plugin-features");
+/**
+ * In-memory copy of the login methods customers may use, for the one place
+ * that cannot await them: Medusa reads
+ * `projectConfig.http.authMethodsPerActor.customer` synchronously on every
+ * request to an `/auth/customer/<provider>` route. The shop preset puts
+ * `customerAuthMethods()` behind a getter there, so a switch in the Admin
+ * takes effect without a restart. Loading, the 30 s refresh and the failure
+ * behavior are those of `createRefreshingSnapshot`.
+ *
+ * Start and fallback value are the descriptor defaults (`["emailpass"]`),
+ * never an empty list: an empty allowlist blocks every customer login, so a
+ * failed read must not produce one.
+ */
+const snapshot = (0, refreshing_snapshot_1.createRefreshingSnapshot)({
+    key: "@hartl-services/medusa-base/customer-auth-methods-snapshot",
+    initial: Object.freeze((0, auth_methods_1.defaultCustomerAuthMethods)(plugin_features_1.customerAuthPluginFeatures)),
+    describe: (methods) => `Customer login methods could not be read, keeping [${methods.join(", ")}]`,
+});
+/** Reads the switches once; never rejects. Concurrent calls share one read. */
+const refreshCustomerAuthMethodsSnapshot = () => snapshot.refresh();
+exports.refreshCustomerAuthMethodsSnapshot = refreshCustomerAuthMethodsSnapshot;
+/** Stops the periodic refresh (application shutdown). The value stays. */
+const stopCustomerAuthMethodsSnapshot = () => snapshot.stop();
+exports.stopCustomerAuthMethodsSnapshot = stopCustomerAuthMethodsSnapshot;
+/**
+ * Registers the reader, loads the switches once and keeps them fresh every
+ * 30 s (application start). `read` returns the effective feature map of
+ * `customer_auth`; `warn` is the container logger.
+ */
+const startCustomerAuthMethodsSnapshot = (input) => snapshot.start({
+    read: async () => Object.freeze((0, auth_methods_1.deriveCustomerAuthMethods)(await input.read())),
+    warn: input.warn,
+});
+exports.startCustomerAuthMethodsSnapshot = startCustomerAuthMethodsSnapshot;
+/**
+ * The value of `authMethodsPerActor.customer`: the provider ids a customer
+ * may use. Synchronous; starts a background refresh when the copy is stale.
+ * A fresh array per call.
+ */
+const customerAuthMethods = () => [...snapshot.current()];
+exports.customerAuthMethods = customerAuthMethods;
+/**
+ * Test hook: sets the methods and counts as just refreshed, so they hold for
+ * 30 s without a reader; `null` forgets reader and value (back to the
+ * defaults).
+ */
+const setCustomerAuthMethodsForTests = (methods) => snapshot.setForTests(methods === null ? null : Object.freeze([...methods]));
+exports.setCustomerAuthMethodsForTests = setCustomerAuthMethodsForTests;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3VzdG9tZXItYXV0aC1tZXRob2RzLXNuYXBzaG90LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvY3VzdG9tZXItYXV0aC1tZXRob2RzLXNuYXBzaG90LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJFQUE0RTtBQUU1RSx3REFHOEI7QUFDOUIsdURBQThEO0FBRTlEOzs7Ozs7Ozs7Ozs7R0FZRztBQUNILE1BQU0sUUFBUSxHQUFHLElBQUEsOENBQXdCLEVBQW9CO0lBQzNELEdBQUcsRUFBRSw0REFBNEQ7SUFDakUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBQSx5Q0FBMEIsRUFBQyw0Q0FBMEIsQ0FBQyxDQUFDO0lBQzlFLFFBQVEsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQ3BCLHNEQUFzRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHO0NBQzlFLENBQUMsQ0FBQTtBQUVGLCtFQUErRTtBQUN4RSxNQUFNLGtDQUFrQyxHQUFHLEdBQWtCLEVBQUUsQ0FDcEUsUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFBO0FBRFAsUUFBQSxrQ0FBa0Msc0NBQzNCO0FBRXBCLDBFQUEwRTtBQUNuRSxNQUFNLCtCQUErQixHQUFHLEdBQVMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQTtBQUE3RCxRQUFBLCtCQUErQixtQ0FBOEI7QUFFMUU7Ozs7R0FJRztBQUNJLE1BQU0sZ0NBQWdDLEdBQUcsQ0FDOUMsS0FHRSxFQUNhLEVBQUUsQ0FDakIsUUFBUSxDQUFDLEtBQUssQ0FBQztJQUNiLElBQUksRUFBRSxLQUFLLElBQUksRUFBRSxDQUNmLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBQSx3Q0FBeUIsRUFBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzlELElBQUksRUFBRSxLQUFLLENBQUMsSUFBSTtDQUNqQixDQUFDLENBQUE7QUFWUyxRQUFBLGdDQUFnQyxvQ0FVekM7QUFFSjs7OztHQUlHO0FBQ0ksTUFBTSxtQkFBbUIsR0FBRyxHQUFhLEVBQUUsQ0FBQyxDQUFDLEdBQUcsUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUE7QUFBN0QsUUFBQSxtQkFBbUIsdUJBQTBDO0FBRTFFOzs7O0dBSUc7QUFDSSxNQUFNLDhCQUE4QixHQUFHLENBQzVDLE9BQWlDLEVBQzNCLEVBQUUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFBO0FBRnpFLFFBQUEsOEJBQThCLGtDQUUyQyJ9

package/.medusa/server/src/customer-auth/customer-password-policy.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCustomerPasswordPolicy = exports.toCustomerPasswordPolicy = void 0;
+const password_policy_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/password-policy");
+const settings_1 = require("../public/settings");
+const plugin_features_1 = require("./plugin-features");
+/**
+ * Pure part: turns the resolved `customer_auth` settings into the policy.
+ * A missing or mistyped value (or a length outside the allowed range) falls
+ * back to the default for that rule, so a broken value never blocks a
+ * registration with an unusable rule.
+ */
+const toCustomerPasswordPolicy = (values) => {
+    const { min, max } = password_policy_1.CUSTOMER_PASSWORD_MIN_LENGTH_RANGE;
+    const length = values.password_min_length;
+    const flag = (key, fallback) => typeof values[key] === "boolean" ? values[key] : fallback;
+    return {
+        min_length: typeof length === "number" &&
+            Number.isInteger(length) &&
+            length >= min &&
+            length <= max
+            ? length
+            : password_policy_1.DEFAULT_CUSTOMER_PASSWORD_POLICY.min_length,
+        require_mixed_case: flag("password_require_mixed_case", password_policy_1.DEFAULT_CUSTOMER_PASSWORD_POLICY.require_mixed_case),
+        require_digit: flag("password_require_digit", password_policy_1.DEFAULT_CUSTOMER_PASSWORD_POLICY.require_digit),
+        require_symbol: flag("password_require_symbol", password_policy_1.DEFAULT_CUSTOMER_PASSWORD_POLICY.require_symbol),
+    };
+};
+exports.toCustomerPasswordPolicy = toCustomerPasswordPolicy;
+/**
+ * The password rules customers currently have to meet: stored in the Admin >
+ * declared default, per rule. Read failures propagate; the callers decide
+ * what to do (the middleware falls back to the default policy).
+ */
+const resolveCustomerPasswordPolicy = async (container) => {
+    const { values } = await (0, settings_1.getPluginSettings)(container, plugin_features_1.customerAuthPluginFeatures);
+    return (0, exports.toCustomerPasswordPolicy)(values);
+};
+exports.resolveCustomerPasswordPolicy = resolveCustomerPasswordPolicy;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3VzdG9tZXItcGFzc3dvcmQtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvY3VzdG9tZXItcGFzc3dvcmQtcG9saWN5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLCtHQUlrRjtBQUVsRixpREFBc0Q7QUFDdEQsdURBQThEO0FBRTlEOzs7OztHQUtHO0FBQ0ksTUFBTSx3QkFBd0IsR0FBRyxDQUN0QyxNQUF5QyxFQUNqQixFQUFFO0lBQzFCLE1BQU0sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsb0RBQWtDLENBQUE7SUFDdkQsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLG1CQUFtQixDQUFBO0lBQ3pDLE1BQU0sSUFBSSxHQUFHLENBQUMsR0FBVyxFQUFFLFFBQWlCLEVBQVcsRUFBRSxDQUN2RCxPQUFPLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFFLE1BQU0sQ0FBQyxHQUFHLENBQWEsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFBO0lBRXhFLE9BQU87UUFDTCxVQUFVLEVBQ1IsT0FBTyxNQUFNLEtBQUssUUFBUTtZQUMxQixNQUFNLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQztZQUN4QixNQUFNLElBQUksR0FBRztZQUNiLE1BQU0sSUFBSSxHQUFHO1lBQ1gsQ0FBQyxDQUFDLE1BQU07WUFDUixDQUFDLENBQUMsa0RBQWdDLENBQUMsVUFBVTtRQUNqRCxrQkFBa0IsRUFBRSxJQUFJLENBQ3RCLDZCQUE2QixFQUM3QixrREFBZ0MsQ0FBQyxrQkFBa0IsQ0FDcEQ7UUFDRCxhQUFhLEVBQUUsSUFBSSxDQUNqQix3QkFBd0IsRUFDeEIsa0RBQWdDLENBQUMsYUFBYSxDQUMvQztRQUNELGNBQWMsRUFBRSxJQUFJLENBQ2xCLHlCQUF5QixFQUN6QixrREFBZ0MsQ0FBQyxjQUFjLENBQ2hEO0tBQ0YsQ0FBQTtBQUNILENBQUMsQ0FBQTtBQTdCWSxRQUFBLHdCQUF3Qiw0QkE2QnBDO0FBRUQ7Ozs7R0FJRztBQUNJLE1BQU0sNkJBQTZCLEdBQUcsS0FBSyxFQUNoRCxTQUEwQixFQUNPLEVBQUU7SUFDbkMsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sSUFBQSw0QkFBaUIsRUFDeEMsU0FBUyxFQUNULDRDQUEwQixDQUMzQixDQUFBO0lBQ0QsT0FBTyxJQUFBLGdDQUF3QixFQUFDLE1BQU0sQ0FBQyxDQUFBO0FBQ3pDLENBQUMsQ0FBQTtBQVJZLFFBQUEsNkJBQTZCLGlDQVF6QyJ9

package/.medusa/server/src/customer-auth/domain/account-linking.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decideLoginCodeTarget = void 0;
+/**
+ * Where a login code for an address goes. The rule that prevents account
+ * takeover: an existing `emailpass` account is linked only when password
+ * login is off in this shop, or when that address was confirmed through
+ * Medusa's auth verification, and only when its customer record has that very
+ * address. Otherwise anyone could register an account with somebody else's
+ * address and password, and the owner of the address would land in that
+ * account the first time they ask for a code. A customer record is never
+ * matched by `customer.email` alone, and guest customers are never touched.
+ *
+ * - An `email-otp` identity that already belongs to a customer is used as is.
+ * - Otherwise accounts are the candidates. First those that must not be
+ *   linked are dropped (unconfirmed while password login is on, customer
+ *   address differs); a candidate that cannot be linked never makes the
+ *   address ambiguous next to a linkable one. None left (but some existed)
+ *   -> send nothing: an unconfirmed password account somebody else
+ *   registered for the address then blocks the code login while password
+ *   login is on, until the owner resets that password and confirms the
+ *   address (or the shop switches password login off). Of the rest, confirmed
+ *   ones are preferred, then the one whose stored address equals the
+ *   requested spelling exactly; if more than one is still left -> send
+ *   nothing. No account at all -> use the customer-less own identity or
+ *   create one.
+ */
+const decideLoginCodeTarget = (input) => {
+    const { emailPasswordEnabled, normalizedEmail, own, accounts } = input;
+    if (own?.customerId) {
+        return { action: "use_own" };
+    }
+    if (!accounts.length) {
+        return own ? { action: "use_own" } : { action: "create" };
+    }
+    let remaining = accounts.filter((account) => account.customerEmailMatches && (!emailPasswordEnabled || account.confirmed));
+    if (!remaining.length) {
+        return { action: "blocked" };
+    }
+    if (remaining.length > 1) {
+        const confirmed = remaining.filter((account) => account.confirmed);
+        remaining = confirmed.length ? confirmed : remaining;
+    }
+    if (remaining.length > 1) {
+        const exact = remaining.filter((account) => account.entityId === normalizedEmail);
+        remaining = exact.length ? exact : remaining;
+    }
+    return remaining.length === 1
+        ? { action: "link", authIdentityId: remaining[0].authIdentityId }
+        : { action: "ambiguous" };
+};
+exports.decideLoginCodeTarget = decideLoginCodeTarget;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjb3VudC1saW5raW5nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvZG9tYWluL2FjY291bnQtbGlua2luZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFxQ0E7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBdUJHO0FBQ0ksTUFBTSxxQkFBcUIsR0FBRyxDQUNuQyxLQU1FLEVBQ3VCLEVBQUU7SUFDM0IsTUFBTSxFQUFFLG9CQUFvQixFQUFFLGVBQWUsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLEdBQUcsS0FBSyxDQUFBO0lBQ3RFLElBQUksR0FBRyxFQUFFLFVBQVUsRUFBRSxDQUFDO1FBQ3BCLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLENBQUE7SUFDOUIsQ0FBQztJQUNELElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDckIsT0FBTyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsQ0FBQTtJQUMzRCxDQUFDO0lBRUQsSUFBSSxTQUFTLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FDN0IsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUNWLE9BQU8sQ0FBQyxvQkFBb0IsSUFBSSxDQUFDLENBQUMsb0JBQW9CLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUMvRSxDQUFBO0lBQ0QsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN0QixPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFBO0lBQzlCLENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDekIsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFBO1FBQ2xFLFNBQVMsR0FBRyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQTtJQUN0RCxDQUFDO0lBQ0QsSUFBSSxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sS0FBSyxHQUFHLFNBQVMsQ0FBQyxNQUFNLENBQzVCLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxLQUFLLGVBQWUsQ0FDbEQsQ0FBQTtRQUNELFNBQVMsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQTtJQUM5QyxDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUM7UUFDM0IsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxjQUFjLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLGNBQWMsRUFBRTtRQUNqRSxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLENBQUE7QUFDN0IsQ0FBQyxDQUFBO0FBckNZLFFBQUEscUJBQXFCLHlCQXFDakMifQ==

package/.medusa/server/src/customer-auth/domain/auth-methods.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultCustomerAuthMethods = exports.deriveCustomerAuthMethods = exports.EMAIL_PASSWORD_AUTH_PROVIDER = void 0;
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+/** Medusa's built-in e-mail + password provider. */
+exports.EMAIL_PASSWORD_AUTH_PROVIDER = "emailpass";
+/**
+ * The auth providers a customer may use for the given effective switches:
+ * `emailpass` while `email_password` is on, `email-otp` while `email_otp` is
+ * on. Empty only when both are off, which blocks every customer login (Medusa
+ * treats an empty allowlist as "nothing allowed"). A fresh array per call.
+ */
+const deriveCustomerAuthMethods = (features) => [
+    ...(features[customer_auth_1.CUSTOMER_AUTH_FEATURES.emailPassword] === true
+        ? [exports.EMAIL_PASSWORD_AUTH_PROVIDER]
+        : []),
+    ...(features[customer_auth_1.CUSTOMER_AUTH_FEATURES.emailOtp] === true
+        ? [customer_auth_1.EMAIL_OTP_AUTH_PROVIDER]
+        : []),
+];
+exports.deriveCustomerAuthMethods = deriveCustomerAuthMethods;
+/**
+ * The methods of a shop whose switches were never stored: the defaults of
+ * the descriptor. This is the start value and the fallback of the snapshot,
+ * so an unreadable database never locks every customer out.
+ */
+const defaultCustomerAuthMethods = (descriptor) => (0, exports.deriveCustomerAuthMethods)(Object.fromEntries(descriptor.features.map((feature) => [
+    feature.key,
+    feature.default_enabled,
+])));
+exports.defaultCustomerAuthMethods = defaultCustomerAuthMethods;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC1tZXRob2RzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvZG9tYWluL2F1dGgtbWV0aG9kcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyR0FHZ0Y7QUFJaEYsb0RBQW9EO0FBQ3ZDLFFBQUEsNEJBQTRCLEdBQUcsV0FBVyxDQUFBO0FBRXZEOzs7OztHQUtHO0FBQ0ksTUFBTSx5QkFBeUIsR0FBRyxDQUN2QyxRQUF1RCxFQUM3QyxFQUFFLENBQUM7SUFDYixHQUFHLENBQUMsUUFBUSxDQUFDLHNDQUFzQixDQUFDLGFBQWEsQ0FBQyxLQUFLLElBQUk7UUFDekQsQ0FBQyxDQUFDLENBQUMsb0NBQTRCLENBQUM7UUFDaEMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNQLEdBQUcsQ0FBQyxRQUFRLENBQUMsc0NBQXNCLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSTtRQUNwRCxDQUFDLENBQUMsQ0FBQyx1Q0FBdUIsQ0FBQztRQUMzQixDQUFDLENBQUMsRUFBRSxDQUFDO0NBQ1IsQ0FBQTtBQVRZLFFBQUEseUJBQXlCLDZCQVNyQztBQUVEOzs7O0dBSUc7QUFDSSxNQUFNLDBCQUEwQixHQUFHLENBQ3hDLFVBQW1DLEVBQ3pCLEVBQUUsQ0FDWixJQUFBLGlDQUF5QixFQUN2QixNQUFNLENBQUMsV0FBVyxDQUNoQixVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7SUFDbkMsT0FBTyxDQUFDLEdBQUc7SUFDWCxPQUFPLENBQUMsZUFBZTtDQUN4QixDQUFDLENBQ0gsQ0FDRixDQUFBO0FBVlUsUUFBQSwwQkFBMEIsOEJBVXBDIn0=

package/.medusa/server/src/customer-auth/domain/login-code.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loginCodeHashesEqual = exports.hashLoginCode = exports.deriveLoginCodeKey = exports.generateLoginCode = exports.LOGIN_CODE_REJECTED_MESSAGE = void 0;
+const node_crypto_1 = require("node:crypto");
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+/** One message for a wrong, expired, used-up or unknown code: never says which. */
+exports.LOGIN_CODE_REJECTED_MESSAGE = "Der Code ist falsch oder abgelaufen. Fordere bei Bedarf einen neuen Code an.";
+/** HKDF `info` label of the login code key. */
+const LOGIN_CODE_KEY_INFO = "email-otp-login-code";
+/** A uniformly random code of exactly `LOGIN_CODE_LENGTH` digits, leading zeros kept. */
+const generateLoginCode = () => String((0, node_crypto_1.randomInt)(0, 10 ** customer_auth_1.LOGIN_CODE_LENGTH)).padStart(customer_auth_1.LOGIN_CODE_LENGTH, "0");
+exports.generateLoginCode = generateLoginCode;
+/**
+ * The HMAC key of the login code hashes, derived from the shop's JWT secret
+ * (HKDF-SHA256, fixed purpose label) so the secret itself never keys the
+ * hashes and a code hash is of no use anywhere else. Both sides, the request
+ * use case and the `email-otp` provider, call this one function with the same
+ * secret (`projectConfig.http.jwtSecret`).
+ */
+const deriveLoginCodeKey = (secret) => Buffer.from((0, node_crypto_1.hkdfSync)("sha256", secret, "", LOGIN_CODE_KEY_INFO, 32));
+exports.deriveLoginCodeKey = deriveLoginCodeKey;
+/**
+ * What is stored instead of the code: hex HMAC-SHA256 over the address and
+ * the code, so a copy of the row neither reveals the code (the space is only
+ * a million values, a plain hash would be brute-forced at once) nor works for
+ * another address. `secret` is the raw JWT secret; the key is derived here.
+ */
+const hashLoginCode = (secret, entityId, code) => (0, node_crypto_1.createHmac)("sha256", (0, exports.deriveLoginCodeKey)(secret))
+    .update(`email-otp:v1:${entityId}:${code}`)
+    .digest("hex");
+exports.hashLoginCode = hashLoginCode;
+/** Constant-time comparison of two hex digests; false for other lengths. */
+const loginCodeHashesEqual = (left, right) => {
+    const a = Buffer.from(left, "utf8");
+    const b = Buffer.from(right, "utf8");
+    return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b);
+};
+exports.loginCodeHashesEqual = loginCodeHashesEqual;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9naW4tY29kZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9jdXN0b21lci1hdXRoL2RvbWFpbi9sb2dpbi1jb2RlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDZDQUE4RTtBQUU5RSwyR0FBMkc7QUFFM0csbUZBQW1GO0FBQ3RFLFFBQUEsMkJBQTJCLEdBQ3RDLDhFQUE4RSxDQUFBO0FBRWhGLCtDQUErQztBQUMvQyxNQUFNLG1CQUFtQixHQUFHLHNCQUFzQixDQUFBO0FBRWxELHlGQUF5RjtBQUNsRixNQUFNLGlCQUFpQixHQUFHLEdBQVcsRUFBRSxDQUM1QyxNQUFNLENBQUMsSUFBQSx1QkFBUyxFQUFDLENBQUMsRUFBRSxFQUFFLElBQUksaUNBQWlCLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxpQ0FBaUIsRUFBRSxHQUFHLENBQUMsQ0FBQTtBQURuRSxRQUFBLGlCQUFpQixxQkFDa0Q7QUFFaEY7Ozs7OztHQU1HO0FBQ0ksTUFBTSxrQkFBa0IsR0FBRyxDQUFDLE1BQWMsRUFBVSxFQUFFLENBQzNELE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBQSxzQkFBUSxFQUFDLFFBQVEsRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLG1CQUFtQixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUE7QUFEekQsUUFBQSxrQkFBa0Isc0JBQ3VDO0FBRXRFOzs7OztHQUtHO0FBQ0ksTUFBTSxhQUFhLEdBQUcsQ0FDM0IsTUFBYyxFQUNkLFFBQWdCLEVBQ2hCLElBQVksRUFDSixFQUFFLENBQ1YsSUFBQSx3QkFBVSxFQUFDLFFBQVEsRUFBRSxJQUFBLDBCQUFrQixFQUFDLE1BQU0sQ0FBQyxDQUFDO0tBQzdDLE1BQU0sQ0FBQyxnQkFBZ0IsUUFBUSxJQUFJLElBQUksRUFBRSxDQUFDO0tBQzFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQTtBQVBMLFFBQUEsYUFBYSxpQkFPUjtBQUVsQiw0RUFBNEU7QUFDckUsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLElBQVksRUFBRSxLQUFhLEVBQVcsRUFBRTtJQUMzRSxNQUFNLENBQUMsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQTtJQUNuQyxNQUFNLENBQUMsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQTtJQUNwQyxPQUFPLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLE1BQU0sSUFBSSxJQUFBLDZCQUFlLEVBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFBO0FBQ3ZELENBQUMsQ0FBQTtBQUpZLFFBQUEsb0JBQW9CLHdCQUloQyJ9