@hartl-services/medusa-base 2.6.1 → 2.8.0

package/.medusa/server/src/customer-auth/login-code-accounts.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasCustomerAccountIdentity = exports.findCodeAccountAuthIdentityId = exports.findPasswordIdentities = exports.deleteUnconfirmedPasswordIdentities = exports.findEmailPasswordAccounts = exports.findOwnLoginIdentity = void 0;
+/** The address's own code-login identity (provider `email-otp`), or null. */
+const findOwnLoginIdentity = async (sql, entityId) => {
+    const result = await sql.raw(`SELECT pi.id AS provider_identity_id,
+            pi.auth_identity_id AS auth_identity_id,
+            NULLIF(ai.app_metadata->>'customer_id', '') AS customer_id
+     FROM provider_identity pi
+     JOIN auth_identity ai ON ai.id = pi.auth_identity_id AND ai.deleted_at IS NULL
+     WHERE pi.provider = 'email-otp'
+       AND pi.entity_id = ?
+       AND pi.deleted_at IS NULL`, [entityId]);
+    const row = result.rows[0];
+    return row
+        ? {
+            providerIdentityId: String(row.provider_identity_id),
+            authIdentityId: String(row.auth_identity_id),
+            customerId: typeof row.customer_id === "string" && row.customer_id
+                ? row.customer_id
+                : null,
+        }
+        : null;
+};
+exports.findOwnLoginIdentity = findOwnLoginIdentity;
+/**
+ * A verified Medusa auth verification of the provider identity `pi`'s very
+ * address (`entity_type` "email"): the one confirmation check of the linking
+ * rule and of the clean-up after a code login.
+ */
+const ADDRESS_CONFIRMED_SQL = `EXISTS (
+  SELECT 1 FROM auth_verification v
+  WHERE v.auth_identity_id = pi.auth_identity_id
+    AND v.entity_id = pi.entity_id
+    AND v.entity_type = 'email'
+    AND v.verified_at IS NOT NULL
+    AND v.deleted_at IS NULL
+)`;
+/**
+ * Customer accounts that registered with this address through `emailpass`.
+ * `emailpass` stores the address exactly as typed, so the match ignores
+ * letter case. Only identities whose auth identity carries a customer count
+ * (`app_metadata.customer_id`); `confirmed` is a verified Medusa auth
+ * verification of that very address. `customerEmailMatches` says the customer
+ * record itself (not deleted) has the same address, so a password identity
+ * pointing at a customer of another address is never linked.
+ */
+const findEmailPasswordAccounts = async (sql, normalizedEmail) => {
+    const result = await sql.raw(`SELECT pi.auth_identity_id AS auth_identity_id,
+            pi.entity_id AS entity_id,
+            ${ADDRESS_CONFIRMED_SQL} AS confirmed,
+            (c.id IS NOT NULL AND lower(c.email) = ?) AS customer_email_matches
+     FROM provider_identity pi
+     JOIN auth_identity ai ON ai.id = pi.auth_identity_id AND ai.deleted_at IS NULL
+     LEFT JOIN customer c
+       ON c.id = ai.app_metadata->>'customer_id' AND c.deleted_at IS NULL
+     WHERE pi.provider = 'emailpass'
+       AND lower(pi.entity_id) = ?
+       AND pi.entity_id ~ '^[\\x21-\\x7e]+$'
+       AND pi.deleted_at IS NULL
+       AND NULLIF(ai.app_metadata->>'customer_id', '') IS NOT NULL`, [normalizedEmail, normalizedEmail]);
+    return result.rows.map((row) => ({
+        authIdentityId: String(row.auth_identity_id),
+        entityId: String(row.entity_id),
+        confirmed: row.confirmed === true,
+        customerEmailMatches: row.customer_email_matches === true,
+    }));
+};
+exports.findEmailPasswordAccounts = findEmailPasswordAccounts;
+/**
+ * Deletes the `emailpass` identities of an auth identity whose address was
+ * never confirmed, for good (the unique index on `(entity_id, provider)` has no
+ * `deleted_at` filter, so a soft delete would block a new registration). A
+ * password somebody else may have planted for the address before the code
+ * login took over can then never be used. Returns how many were deleted.
+ */
+const deleteUnconfirmedPasswordIdentities = async (sql, authIdentityId) => {
+    const result = await sql.raw(`DELETE FROM provider_identity pi
+     WHERE pi.auth_identity_id = ?
+       AND pi.provider = 'emailpass'
+       AND NOT ${ADDRESS_CONFIRMED_SQL}
+     RETURNING pi.id`, [authIdentityId]);
+    return result.rows.length;
+};
+exports.deleteUnconfirmedPasswordIdentities = deleteUnconfirmedPasswordIdentities;
+/**
+ * Every `emailpass` identity of the address, letter case ignored (`emailpass`
+ * stores the address as typed), with or without a customer.
+ */
+const findPasswordIdentities = async (sql, normalizedEmail) => {
+    const result = await sql.raw(`SELECT pi.id AS provider_identity_id,
+            pi.auth_identity_id AS auth_identity_id,
+            pi.entity_id AS entity_id,
+            NULLIF(ai.app_metadata->>'customer_id', '') AS customer_id
+     FROM provider_identity pi
+     JOIN auth_identity ai ON ai.id = pi.auth_identity_id AND ai.deleted_at IS NULL
+     WHERE pi.provider = 'emailpass'
+       AND lower(pi.entity_id) = ?
+       AND pi.entity_id ~ '^[\\x21-\\x7e]+$'
+       AND pi.deleted_at IS NULL`, [normalizedEmail]);
+    return result.rows.map((row) => ({
+        providerIdentityId: String(row.provider_identity_id),
+        authIdentityId: String(row.auth_identity_id),
+        entityId: String(row.entity_id),
+        customerId: typeof row.customer_id === "string" && row.customer_id
+            ? row.customer_id
+            : null,
+    }));
+};
+exports.findPasswordIdentities = findPasswordIdentities;
+/**
+ * The auth identity of the address's code login (`email-otp`) when it carries a
+ * customer (not deleted) with that very address: the account the address was
+ * proven for. Null otherwise.
+ */
+const findCodeAccountAuthIdentityId = async (sql, normalizedEmail) => {
+    const result = await sql.raw(`SELECT pi.auth_identity_id AS auth_identity_id
+     FROM provider_identity pi
+     JOIN auth_identity ai ON ai.id = pi.auth_identity_id AND ai.deleted_at IS NULL
+     JOIN customer c
+       ON c.id = ai.app_metadata->>'customer_id' AND c.deleted_at IS NULL
+     WHERE pi.provider = 'email-otp'
+       AND pi.entity_id = ?
+       AND pi.deleted_at IS NULL
+       AND lower(c.email) = ?`, [normalizedEmail, normalizedEmail]);
+    const id = result.rows[0]?.auth_identity_id;
+    return typeof id === "string" && id ? id : null;
+};
+exports.findCodeAccountAuthIdentityId = findCodeAccountAuthIdentityId;
+/**
+ * Whether an identity of any provider for the address (letter case ignored)
+ * belongs to an auth identity that carries a customer.
+ */
+const hasCustomerAccountIdentity = async (sql, normalizedEmail) => {
+    const result = await sql.raw(`SELECT 1 AS found
+     FROM provider_identity pi
+     JOIN auth_identity ai ON ai.id = pi.auth_identity_id AND ai.deleted_at IS NULL
+     WHERE lower(pi.entity_id) = ?
+       AND pi.entity_id ~ '^[\\x21-\\x7e]+$'
+       AND pi.deleted_at IS NULL
+       AND NULLIF(ai.app_metadata->>'customer_id', '') IS NOT NULL
+     LIMIT 1`, [normalizedEmail]);
+    return result.rows.length > 0;
+};
+exports.hasCustomerAccountIdentity = hasCustomerAccountIdentity;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9naW4tY29kZS1hY2NvdW50cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9jdXN0b21lci1hdXRoL2xvZ2luLWNvZGUtYWNjb3VudHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBTUEsNkVBQTZFO0FBQ3RFLE1BQU0sb0JBQW9CLEdBQUcsS0FBSyxFQUN2QyxHQUFpQixFQUNqQixRQUFnQixFQUNrQixFQUFFO0lBQ3BDLE1BQU0sTUFBTSxHQUFHLE1BQU0sR0FBRyxDQUFDLEdBQUcsQ0FDMUI7Ozs7Ozs7aUNBTzZCLEVBQzdCLENBQUMsUUFBUSxDQUFDLENBQ1gsQ0FBQTtJQUNELE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDMUIsT0FBTyxHQUFHO1FBQ1IsQ0FBQyxDQUFDO1lBQ0Usa0JBQWtCLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxvQkFBb0IsQ0FBQztZQUNwRCxjQUFjLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQztZQUM1QyxVQUFVLEVBQ1IsT0FBTyxHQUFHLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxHQUFHLENBQUMsV0FBVztnQkFDcEQsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxXQUFXO2dCQUNqQixDQUFDLENBQUMsSUFBSTtTQUNYO1FBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQTtBQUNWLENBQUMsQ0FBQTtBQTFCWSxRQUFBLG9CQUFvQix3QkEwQmhDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0scUJBQXFCLEdBQUc7Ozs7Ozs7RUFPNUIsQ0FBQTtBQUVGOzs7Ozs7OztHQVFHO0FBQ0ksTUFBTSx5QkFBeUIsR0FBRyxLQUFLLEVBQzVDLEdBQWlCLEVBQ2pCLGVBQXVCLEVBQ2MsRUFBRTtJQUN2QyxNQUFNLE1BQU0sR0FBRyxNQUFNLEdBQUcsQ0FBQyxHQUFHLENBQzFCOztjQUVVLHFCQUFxQjs7Ozs7Ozs7OzttRUFVZ0MsRUFDL0QsQ0FBQyxlQUFlLEVBQUUsZUFBZSxDQUFDLENBQ25DLENBQUE7SUFDRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQy9CLGNBQWMsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDO1FBQzVDLFFBQVEsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQztRQUMvQixTQUFTLEVBQUUsR0FBRyxDQUFDLFNBQVMsS0FBSyxJQUFJO1FBQ2pDLG9CQUFvQixFQUFFLEdBQUcsQ0FBQyxzQkFBc0IsS0FBSyxJQUFJO0tBQzFELENBQUMsQ0FBQyxDQUFBO0FBQ0wsQ0FBQyxDQUFBO0FBMUJZLFFBQUEseUJBQXlCLDZCQTBCckM7QUFFRDs7Ozs7O0dBTUc7QUFDSSxNQUFNLG1DQUFtQyxHQUFHLEtBQUssRUFDdEQsR0FBaUIsRUFDakIsY0FBc0IsRUFDTCxFQUFFO0lBQ25CLE1BQU0sTUFBTSxHQUFHLE1BQU0sR0FBRyxDQUFDLEdBQUcsQ0FDMUI7OztpQkFHYSxxQkFBcUI7cUJBQ2pCLEVBQ2pCLENBQUMsY0FBYyxDQUFDLENBQ2pCLENBQUE7SUFDRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFBO0FBQzNCLENBQUMsQ0FBQTtBQWJZLFFBQUEsbUNBQW1DLHVDQWEvQztBQVlEOzs7R0FHRztBQUNJLE1BQU0sc0JBQXNCLEdBQUcsS0FBSyxFQUN6QyxHQUFpQixFQUNqQixlQUF1QixFQUNNLEVBQUU7SUFDL0IsTUFBTSxNQUFNLEdBQUcsTUFBTSxHQUFHLENBQUMsR0FBRyxDQUMxQjs7Ozs7Ozs7O2lDQVM2QixFQUM3QixDQUFDLGVBQWUsQ0FBQyxDQUNsQixDQUFBO0lBQ0QsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUMvQixrQkFBa0IsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLG9CQUFvQixDQUFDO1FBQ3BELGNBQWMsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDO1FBQzVDLFFBQVEsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQztRQUMvQixVQUFVLEVBQ1IsT0FBTyxHQUFHLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxHQUFHLENBQUMsV0FBVztZQUNwRCxDQUFDLENBQUMsR0FBRyxDQUFDLFdBQVc7WUFDakIsQ0FBQyxDQUFDLElBQUk7S0FDWCxDQUFDLENBQUMsQ0FBQTtBQUNMLENBQUMsQ0FBQTtBQTFCWSxRQUFBLHNCQUFzQiwwQkEwQmxDO0FBRUQ7Ozs7R0FJRztBQUNJLE1BQU0sNkJBQTZCLEdBQUcsS0FBSyxFQUNoRCxHQUFpQixFQUNqQixlQUF1QixFQUNDLEVBQUU7SUFDMUIsTUFBTSxNQUFNLEdBQUcsTUFBTSxHQUFHLENBQUMsR0FBRyxDQUMxQjs7Ozs7Ozs7OEJBUTBCLEVBQzFCLENBQUMsZUFBZSxFQUFFLGVBQWUsQ0FBQyxDQUNuQyxDQUFBO0lBQ0QsTUFBTSxFQUFFLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxnQkFBZ0IsQ0FBQTtJQUMzQyxPQUFPLE9BQU8sRUFBRSxLQUFLLFFBQVEsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBO0FBQ2pELENBQUMsQ0FBQTtBQWxCWSxRQUFBLDZCQUE2QixpQ0FrQnpDO0FBRUQ7OztHQUdHO0FBQ0ksTUFBTSwwQkFBMEIsR0FBRyxLQUFLLEVBQzdDLEdBQWlCLEVBQ2pCLGVBQXVCLEVBQ0wsRUFBRTtJQUNwQixNQUFNLE1BQU0sR0FBRyxNQUFNLEdBQUcsQ0FBQyxHQUFHLENBQzFCOzs7Ozs7O2FBT1MsRUFDVCxDQUFDLGVBQWUsQ0FBQyxDQUNsQixDQUFBO0lBQ0QsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUE7QUFDL0IsQ0FBQyxDQUFBO0FBaEJZLFFBQUEsMEJBQTBCLDhCQWdCdEMifQ==

package/.medusa/server/src/customer-auth/login-code-state.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.consumeLoginCode = exports.countLoginCodeAttempt = exports.storeLoginCode = exports.LOGIN_CODE_RESEND_SLACK_SECONDS = void 0;
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+/**
+ * The code state lives in `provider_identity.provider_metadata` of the
+ * `email-otp` provider identity: `login_code` is `{ hash, expires_at,
+ * attempts, sent_at }`, `login_code_budget` is `{ window_start, issued }`
+ * (codes issued in the current 24 hour window; issuing a new code does not
+ * reset it, a successful login does). Every transition below is one SQL
+ * statement whose WHERE clause carries the rule, so concurrent requests cannot
+ * both pass it. Time is the database's `now()`, never the application's clock.
+ */
+/**
+ * The storefront starts its resend countdown when it receives the 202, which
+ * is before `sent_at` is written; the spacing check tolerates that head start.
+ */
+exports.LOGIN_CODE_RESEND_SLACK_SECONDS = 5;
+/** Length of the issuance window (fixed, counted from its first code). */
+const LOGIN_CODE_BUDGET_WINDOW_HOURS = 24;
+/** The budget window of the row is still running (`window_start` < 24 h ago). */
+const BUDGET_WINDOW_ACTIVE_SQL = `COALESCE(
+  jsonb_typeof(provider_metadata->'login_code_budget') = 'object'
+  AND (provider_metadata->'login_code_budget'->>'window_start')::timestamptz
+        > now() - make_interval(hours => ${LOGIN_CODE_BUDGET_WINDOW_HOURS}),
+  false
+)`;
+/**
+ * Stores a new code unless one was sent within the resend interval or the
+ * address already got `LOGIN_CODE_MAX_PER_DAY` codes in the running 24 hour
+ * window. Both rules are checked and the code and the budget are written by
+ * one conditional UPDATE. An expired window starts a new one with this code.
+ */
+const storeLoginCode = async (sql, providerIdentityId, hash) => {
+    const result = await sql.raw(`UPDATE provider_identity
+     SET provider_metadata = jsonb_set(
+           jsonb_set(
+             COALESCE(provider_metadata, '{}'::jsonb),
+             '{login_code}',
+             jsonb_build_object(
+               'hash', ?::text,
+               'expires_at', to_jsonb(now() + make_interval(mins => ?)),
+               'attempts', 0,
+               'sent_at', to_jsonb(now())
+             )
+           ),
+           '{login_code_budget}',
+           jsonb_build_object(
+             'window_start', CASE
+               WHEN ${BUDGET_WINDOW_ACTIVE_SQL}
+               THEN provider_metadata->'login_code_budget'->'window_start'
+               ELSE to_jsonb(now())
+             END,
+             'issued', CASE
+               WHEN ${BUDGET_WINDOW_ACTIVE_SQL}
+               THEN to_jsonb((provider_metadata->'login_code_budget'->>'issued')::int + 1)
+               ELSE to_jsonb(1)
+             END
+           )
+         ),
+         updated_at = now()
+     WHERE id = ?
+       AND provider = 'email-otp'
+       AND deleted_at IS NULL
+       AND (
+         jsonb_typeof(provider_metadata->'login_code') IS DISTINCT FROM 'object'
+         OR (provider_metadata->'login_code'->>'sent_at')::timestamptz
+              < now() - make_interval(secs => ?)
+       )
+       AND (
+         NOT ${BUDGET_WINDOW_ACTIVE_SQL}
+         OR (provider_metadata->'login_code_budget'->>'issued')::int < ?
+       )
+     RETURNING id`, [
+        hash,
+        customer_auth_1.LOGIN_CODE_TTL_MINUTES,
+        providerIdentityId,
+        customer_auth_1.LOGIN_CODE_RESEND_INTERVAL_SECONDS - exports.LOGIN_CODE_RESEND_SLACK_SECONDS,
+        customer_auth_1.LOGIN_CODE_MAX_PER_DAY,
+    ]);
+    if (result.rows.length === 1) {
+        return "stored";
+    }
+    // Only to tell the reason apart for the caller's log; the decision above
+    // was already made atomically.
+    const capped = await sql.raw(`SELECT id FROM provider_identity
+     WHERE id = ?
+       AND provider = 'email-otp'
+       AND deleted_at IS NULL
+       AND ${BUDGET_WINDOW_ACTIVE_SQL}
+       AND (provider_metadata->'login_code_budget'->>'issued')::int >= ?`, [providerIdentityId, customer_auth_1.LOGIN_CODE_MAX_PER_DAY]);
+    return capped.rows.length === 1 ? "capped" : "throttled";
+};
+exports.storeLoginCode = storeLoginCode;
+/**
+ * Counts one attempt against the address' live code and returns the stored
+ * hash; null when there is no code, it is expired or its attempts are used
+ * up. The count happens before the comparison, so parallel guesses share the
+ * limit instead of each seeing the same remaining budget.
+ */
+const countLoginCodeAttempt = async (sql, entityId) => {
+    const result = await sql.raw(`UPDATE provider_identity
+     SET provider_metadata = jsonb_set(
+           provider_metadata,
+           '{login_code,attempts}',
+           to_jsonb((provider_metadata->'login_code'->>'attempts')::int + 1)
+         ),
+         updated_at = now()
+     WHERE provider = 'email-otp'
+       AND entity_id = ?
+       AND deleted_at IS NULL
+       AND jsonb_typeof(provider_metadata->'login_code') = 'object'
+       AND (provider_metadata->'login_code'->>'attempts')::int < ?
+       AND (provider_metadata->'login_code'->>'expires_at')::timestamptz > now()
+     RETURNING provider_metadata->'login_code'->>'hash' AS hash`, [entityId, customer_auth_1.LOGIN_CODE_MAX_ATTEMPTS]);
+    const hash = result.rows[0]?.hash;
+    return typeof hash === "string" && hash ? hash : null;
+};
+exports.countLoginCodeAttempt = countLoginCodeAttempt;
+/**
+ * Uses the code up: removes it (and the issuance budget, a successful login
+ * proves the address' owner holds the mailbox) if it is still the one with
+ * `hash` and not expired. Exactly one of several parallel correct logins gets
+ * true.
+ */
+const consumeLoginCode = async (sql, entityId, hash) => {
+    const result = await sql.raw(`UPDATE provider_identity
+     SET provider_metadata = provider_metadata - 'login_code' - 'login_code_budget',
+         updated_at = now()
+     WHERE provider = 'email-otp'
+       AND entity_id = ?
+       AND deleted_at IS NULL
+       AND provider_metadata->'login_code'->>'hash' = ?
+       AND (provider_metadata->'login_code'->>'expires_at')::timestamptz > now()
+     RETURNING id`, [entityId, hash]);
+    return result.rows.length === 1;
+};
+exports.consumeLoginCode = consumeLoginCode;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9naW4tY29kZS1zdGF0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9jdXN0b21lci1hdXRoL2xvZ2luLWNvZGUtc3RhdGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkdBS2dGO0FBVWhGOzs7Ozs7OztHQVFHO0FBRUg7OztHQUdHO0FBQ1UsUUFBQSwrQkFBK0IsR0FBRyxDQUFDLENBQUE7QUFFaEQsMEVBQTBFO0FBQzFFLE1BQU0sOEJBQThCLEdBQUcsRUFBRSxDQUFBO0FBRXpDLGlGQUFpRjtBQUNqRixNQUFNLHdCQUF3QixHQUFHOzs7MkNBR1UsOEJBQThCOztFQUV2RSxDQUFBO0FBVUY7Ozs7O0dBS0c7QUFDSSxNQUFNLGNBQWMsR0FBRyxLQUFLLEVBQ2pDLEdBQWlCLEVBQ2pCLGtCQUEwQixFQUMxQixJQUFZLEVBQ21CLEVBQUU7SUFDakMsTUFBTSxNQUFNLEdBQUcsTUFBTSxHQUFHLENBQUMsR0FBRyxDQUMxQjs7Ozs7Ozs7Ozs7Ozs7O3NCQWVrQix3QkFBd0I7Ozs7O3NCQUt4Qix3QkFBd0I7Ozs7Ozs7Ozs7Ozs7Ozs7ZUFnQi9CLHdCQUF3Qjs7O2tCQUdyQixFQUNkO1FBQ0UsSUFBSTtRQUNKLHNDQUFzQjtRQUN0QixrQkFBa0I7UUFDbEIsa0RBQWtDLEdBQUcsdUNBQStCO1FBQ3BFLHNDQUFzQjtLQUN2QixDQUNGLENBQUE7SUFDRCxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzdCLE9BQU8sUUFBUSxDQUFBO0lBQ2pCLENBQUM7SUFDRCx5RUFBeUU7SUFDekUsK0JBQStCO0lBQy9CLE1BQU0sTUFBTSxHQUFHLE1BQU0sR0FBRyxDQUFDLEdBQUcsQ0FDMUI7Ozs7YUFJUyx3QkFBd0I7eUVBQ29DLEVBQ3JFLENBQUMsa0JBQWtCLEVBQUUsc0NBQXNCLENBQUMsQ0FDN0MsQ0FBQTtJQUNELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQTtBQUMxRCxDQUFDLENBQUE7QUFyRVksUUFBQSxjQUFjLGtCQXFFMUI7QUFFRDs7Ozs7R0FLRztBQUNJLE1BQU0scUJBQXFCLEdBQUcsS0FBSyxFQUN4QyxHQUFpQixFQUNqQixRQUFnQixFQUNRLEVBQUU7SUFDMUIsTUFBTSxNQUFNLEdBQUcsTUFBTSxHQUFHLENBQUMsR0FBRyxDQUMxQjs7Ozs7Ozs7Ozs7OztnRUFhNEQsRUFDNUQsQ0FBQyxRQUFRLEVBQUUsdUNBQXVCLENBQUMsQ0FDcEMsQ0FBQTtJQUNELE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxDQUFBO0lBQ2pDLE9BQU8sT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7QUFDdkQsQ0FBQyxDQUFBO0FBdkJZLFFBQUEscUJBQXFCLHlCQXVCakM7QUFFRDs7Ozs7R0FLRztBQUNJLE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxFQUNuQyxHQUFpQixFQUNqQixRQUFnQixFQUNoQixJQUFZLEVBQ00sRUFBRTtJQUNwQixNQUFNLE1BQU0sR0FBRyxNQUFNLEdBQUcsQ0FBQyxHQUFHLENBQzFCOzs7Ozs7OztrQkFRYyxFQUNkLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUNqQixDQUFBO0lBQ0QsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUE7QUFDakMsQ0FBQyxDQUFBO0FBbEJZLFFBQUEsZ0JBQWdCLG9CQWtCNUIifQ==

package/.medusa/server/src/customer-auth/plugin-features.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.customerAuthPluginFeatures = void 0;
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+const descriptor_1 = require("../public/descriptor");
+const PASSWORD_RULES = "Passwort-Regeln";
+exports.customerAuthPluginFeatures = (0, descriptor_1.definePluginFeatures)({
+    plugin_key: customer_auth_1.CUSTOMER_AUTH_PLUGIN_KEY,
+    label: "Kunden-Login",
+    description: "Wie sich Kunden anmelden. Mindestens eine Methode bleibt eingeschaltet; Admin-Benutzer melden sich immer mit E-Mail und Passwort an.",
+    summary: "Anmeldemethoden und Passwort-Regeln für Kunden.",
+    icon: "ShieldCheck",
+    switchable: false,
+    features_heading: "Anmeldemethoden",
+    features_note: "Wirkt nach ca. 1 Minute.",
+    all_off_warning: "Keine Methode eingeschaltet: Kunden können sich nicht mehr anmelden.",
+    require_enabled_feature: true,
+    features: [
+        {
+            key: customer_auth_1.CUSTOMER_AUTH_FEATURES.emailPassword,
+            label: "E-Mail + Passwort",
+            description: "Anmeldung, Registrierung und Passwort zurücksetzen.",
+            default_enabled: true,
+        },
+        {
+            key: customer_auth_1.CUSTOMER_AUTH_FEATURES.emailOtp,
+            label: "Anmeldecode per E-Mail",
+            description: "Anmeldung mit einem 6-stelligen Code per E-Mail; für neue Adressen entsteht ein Konto.",
+            default_enabled: false,
+        },
+    ],
+    setting_groups: [
+        {
+            name: PASSWORD_RULES,
+            description: "Für Kunden mit „E-Mail + Passwort“. Admin-Benutzer: mindestens 15 Zeichen.",
+            requires_feature: customer_auth_1.CUSTOMER_AUTH_FEATURES.emailPassword,
+        },
+    ],
+    settings: [
+        {
+            key: "password_min_length",
+            label: "Mindestlänge",
+            description: "Gilt bei Registrierung und Passwort-Zurücksetzen; bestehende Passwörter bleiben gültig.",
+            hint: "8 bis 128 Zeichen. Empfohlen: 15 (NIST SP 800-63B).",
+            group: PASSWORD_RULES,
+            width: "half",
+            type: "number",
+            min: 8,
+            max: 128,
+            integer: true,
+            default: 15,
+        },
+        {
+            key: "password_require_mixed_case",
+            label: "Groß- und Kleinbuchstaben verlangen",
+            description: "Mindestens ein Groß- und ein Kleinbuchstabe.",
+            hint: "NIST rät von Zeichenregeln ab, Länge schützt besser.",
+            group: PASSWORD_RULES,
+            type: "boolean",
+            default: false,
+        },
+        {
+            key: "password_require_digit",
+            label: "Ziffer verlangen",
+            description: "Mindestens eine Ziffer.",
+            group: PASSWORD_RULES,
+            type: "boolean",
+            default: false,
+        },
+        {
+            key: "password_require_symbol",
+            label: "Sonderzeichen verlangen",
+            description: "Mindestens ein Sonderzeichen.",
+            group: PASSWORD_RULES,
+            type: "boolean",
+            default: false,
+        },
+    ],
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLWZlYXR1cmVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvcGx1Z2luLWZlYXR1cmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJHQUdnRjtBQUVoRixxREFBMkQ7QUFFM0QsTUFBTSxjQUFjLEdBQUcsaUJBQWlCLENBQUE7QUFFM0IsUUFBQSwwQkFBMEIsR0FBRyxJQUFBLGlDQUFvQixFQUFDO0lBQzdELFVBQVUsRUFBRSx3Q0FBd0I7SUFDcEMsS0FBSyxFQUFFLGNBQWM7SUFDckIsV0FBVyxFQUNULHNJQUFzSTtJQUN4SSxPQUFPLEVBQUUsaURBQWlEO0lBQzFELElBQUksRUFBRSxhQUFhO0lBQ25CLFVBQVUsRUFBRSxLQUFLO0lBQ2pCLGdCQUFnQixFQUFFLGlCQUFpQjtJQUNuQyxhQUFhLEVBQUUsMEJBQTBCO0lBQ3pDLGVBQWUsRUFDYixzRUFBc0U7SUFDeEUsdUJBQXVCLEVBQUUsSUFBSTtJQUM3QixRQUFRLEVBQUU7UUFDUjtZQUNFLEdBQUcsRUFBRSxzQ0FBc0IsQ0FBQyxhQUFhO1lBQ3pDLEtBQUssRUFBRSxtQkFBbUI7WUFDMUIsV0FBVyxFQUNULHFEQUFxRDtZQUN2RCxlQUFlLEVBQUUsSUFBSTtTQUN0QjtRQUNEO1lBQ0UsR0FBRyxFQUFFLHNDQUFzQixDQUFDLFFBQVE7WUFDcEMsS0FBSyxFQUFFLHdCQUF3QjtZQUMvQixXQUFXLEVBQ1Qsd0ZBQXdGO1lBQzFGLGVBQWUsRUFBRSxLQUFLO1NBQ3ZCO0tBQ0Y7SUFDRCxjQUFjLEVBQUU7UUFDZDtZQUNFLElBQUksRUFBRSxjQUFjO1lBQ3BCLFdBQVcsRUFDVCw0RUFBNEU7WUFDOUUsZ0JBQWdCLEVBQUUsc0NBQXNCLENBQUMsYUFBYTtTQUN2RDtLQUNGO0lBQ0QsUUFBUSxFQUFFO1FBQ1I7WUFDRSxHQUFHLEVBQUUscUJBQXFCO1lBQzFCLEtBQUssRUFBRSxjQUFjO1lBQ3JCLFdBQVcsRUFDVCx5RkFBeUY7WUFDM0YsSUFBSSxFQUFFLHFEQUFxRDtZQUMzRCxLQUFLLEVBQUUsY0FBYztZQUNyQixLQUFLLEVBQUUsTUFBTTtZQUNiLElBQUksRUFBRSxRQUFRO1lBQ2QsR0FBRyxFQUFFLENBQUM7WUFDTixHQUFHLEVBQUUsR0FBRztZQUNSLE9BQU8sRUFBRSxJQUFJO1lBQ2IsT0FBTyxFQUFFLEVBQUU7U0FDWjtRQUNEO1lBQ0UsR0FBRyxFQUFFLDZCQUE2QjtZQUNsQyxLQUFLLEVBQUUscUNBQXFDO1lBQzVDLFdBQVcsRUFBRSw4Q0FBOEM7WUFDM0QsSUFBSSxFQUFFLHNEQUFzRDtZQUM1RCxLQUFLLEVBQUUsY0FBYztZQUNyQixJQUFJLEVBQUUsU0FBUztZQUNmLE9BQU8sRUFBRSxLQUFLO1NBQ2Y7UUFDRDtZQUNFLEdBQUcsRUFBRSx3QkFBd0I7WUFDN0IsS0FBSyxFQUFFLGtCQUFrQjtZQUN6QixXQUFXLEVBQUUseUJBQXlCO1lBQ3RDLEtBQUssRUFBRSxjQUFjO1lBQ3JCLElBQUksRUFBRSxTQUFTO1lBQ2YsT0FBTyxFQUFFLEtBQUs7U0FDZjtRQUNEO1lBQ0UsR0FBRyxFQUFFLHlCQUF5QjtZQUM5QixLQUFLLEVBQUUseUJBQXlCO1lBQ2hDLFdBQVcsRUFBRSwrQkFBK0I7WUFDNUMsS0FBSyxFQUFFLGNBQWM7WUFDckIsSUFBSSxFQUFFLFNBQVM7WUFDZixPQUFPLEVBQUUsS0FBSztTQUNmO0tBQ0Y7Q0FDRixDQUFDLENBQUEifQ==

package/.medusa/server/src/customer-auth/remove-provider-identity.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeProviderIdentity = void 0;
+/**
+ * Deletes a provider identity for good and, when no provider identity is left
+ * on its auth identity, the auth identity too. The unique index on
+ * `(entity_id, provider)` has no `deleted_at` filter, so a soft delete would
+ * block the address for a new registration.
+ */
+const removeProviderIdentity = async (auth, identity) => {
+    await auth.deleteProviderIdentities([identity.providerIdentityId]);
+    const remaining = await auth.listProviderIdentities({ auth_identity_id: identity.authIdentityId }, { select: ["id"], take: 1 });
+    if (!remaining.length) {
+        await auth.deleteAuthIdentities([identity.authIdentityId]);
+    }
+};
+exports.removeProviderIdentity = removeProviderIdentity;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3ZlLXByb3ZpZGVyLWlkZW50aXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvcmVtb3ZlLXByb3ZpZGVyLWlkZW50aXR5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUVBOzs7OztHQUtHO0FBQ0ksTUFBTSxzQkFBc0IsR0FBRyxLQUFLLEVBQ3pDLElBQXdCLEVBQ3hCLFFBQTBFLEVBQzNELEVBQUU7SUFDakIsTUFBTSxJQUFJLENBQUMsd0JBQXdCLENBQUMsQ0FBQyxRQUFRLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFBO0lBQ2xFLE1BQU0sU0FBUyxHQUFHLE1BQU0sSUFBSSxDQUFDLHNCQUFzQixDQUNqRCxFQUFFLGdCQUFnQixFQUFFLFFBQVEsQ0FBQyxjQUFjLEVBQUUsRUFDN0MsRUFBRSxNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxFQUFFLENBQzVCLENBQUE7SUFDRCxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3RCLE1BQU0sSUFBSSxDQUFDLG9CQUFvQixDQUFDLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUE7SUFDNUQsQ0FBQztBQUNILENBQUMsQ0FBQTtBQVpZLFFBQUEsc0JBQXNCLDBCQVlsQyJ9

package/.medusa/server/src/customer-auth/start-customer-auth-methods.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stopCustomerAuthMethods = exports.startCustomerAuthMethods = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const module_access_1 = require("../public/module-access");
+const customer_auth_methods_snapshot_1 = require("./customer-auth-methods-snapshot");
+const plugin_features_1 = require("./plugin-features");
+/**
+ * Hands the snapshot behind `authMethodsPerActor` its reader (the effective
+ * `customer_auth` switches) and loads it once. Called when the application
+ * has started, with the application container: the config getter that needs
+ * the switches has no container of its own.
+ */
+const startCustomerAuthMethods = (container) => (0, customer_auth_methods_snapshot_1.startCustomerAuthMethodsSnapshot)({
+    read: async () => (await (0, module_access_1.resolveBaseModule)(container).retrieveEffectiveFeatures(plugin_features_1.customerAuthPluginFeatures)).features,
+    warn: (message) => container.resolve(utils_1.ContainerRegistrationKeys.LOGGER).warn(message),
+});
+exports.startCustomerAuthMethods = startCustomerAuthMethods;
+exports.stopCustomerAuthMethods = customer_auth_methods_snapshot_1.stopCustomerAuthMethodsSnapshot;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RhcnQtY3VzdG9tZXItYXV0aC1tZXRob2RzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvc3RhcnQtY3VzdG9tZXItYXV0aC1tZXRob2RzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLHFEQUFxRTtBQUVyRSwyREFBMkQ7QUFFM0QscUZBR3lDO0FBQ3pDLHVEQUE4RDtBQVE5RDs7Ozs7R0FLRztBQUNJLE1BQU0sd0JBQXdCLEdBQUcsQ0FDdEMsU0FBMEIsRUFDWCxFQUFFLENBQ2pCLElBQUEsaUVBQWdDLEVBQUM7SUFDL0IsSUFBSSxFQUFFLEtBQUssSUFBSSxFQUFFLENBQ2YsQ0FDRSxNQUFNLElBQUEsaUNBQWlCLEVBQ3JCLFNBQVMsQ0FDVixDQUFDLHlCQUF5QixDQUFDLDRDQUEwQixDQUFDLENBQ3hELENBQUMsUUFBUTtJQUNaLElBQUksRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQ2hCLFNBQVMsQ0FBQyxPQUFPLENBQVMsaUNBQXlCLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztDQUM1RSxDQUFDLENBQUE7QUFaUyxRQUFBLHdCQUF3Qiw0QkFZakM7QUFFUyxRQUFBLHVCQUF1QixHQUFHLGdFQUErQixDQUFBIn0=

package/.medusa/server/src/documents/plugin-features.js

@@ -6,6 +6,10 @@ exports.documentsPluginFeatures = (0, public_1.definePluginFeatures)({
     plugin_key: "documents",
     label: "Dokumente",
     description: "Rechnungen, Stornos und Packlisten zu Bestellungen. Ausgeschaltet sind alle Dokument-Routen in Admin und Storefront nicht erreichbar und es werden keine neuen Dokumente erstellt; bereits ausgestellte Dokumente bleiben gespeichert. Checkout, Fulfillment und Versand laufen unverändert weiter.",
+    summary: "Rechnungen, Stornos und Packlisten zu Bestellungen.",
+    icon: "DocumentText",
+    disable_hint: "Aus: Dokument-Routen sind nicht erreichbar, es entstehen keine neuen Dokumente. Bestehende bleiben gespeichert.",
+    disable_confirm: "Alle Dokument-Routen in Admin und Storefront sind dann nicht erreichbar, und es werden keine neuen Dokumente erstellt. Bereits ausgestellte Dokumente bleiben gespeichert. Checkout, Fulfillment und Versand laufen unverändert weiter.",
     features: [
         {
             key: "invoices",
@@ -16,7 +20,7 @@ exports.documentsPluginFeatures = (0, public_1.definePluginFeatures)({
         {
             key: "packing_lists",
             label: "Packlisten",
-            description: "Packlisten je Fulfillment inklusive Chargenrevisionen und Abruf im Admin.",
+            description: "Eine Packliste je Fulfillment, inklusive Chargenrevisionen und Abruf im Admin.",
             default_enabled: true,
         },
     ],
@@ -25,8 +29,10 @@ exports.documentsPluginFeatures = (0, public_1.definePluginFeatures)({
             key: "payment_terms",
             label: "Zahlungskonditionen",
             description: "Erscheint auf Rechnungen unter den Summen, z. B. „Der Betrag wurde bei der Bestellung per Kreditkarte bezahlt.“ Leer lassen, wenn nichts stehen soll. Gilt für neu erstellte und neu erzeugte Rechnungen.",
+            hint: "Erscheint auf Rechnungen unter den Summen.",
+            placeholder: "z. B. Der Betrag wurde bei der Bestellung per Kreditkarte bezahlt.",
             type: "string",
         },
     ],
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLWZlYXR1cmVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2RvY3VtZW50cy9wbHVnaW4tZmVhdHVyZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsc0NBQWdEO0FBRW5DLFFBQUEsdUJBQXVCLEdBQUcsSUFBQSw2QkFBb0IsRUFBQztJQUMxRCxVQUFVLEVBQUUsV0FBVztJQUN2QixLQUFLLEVBQUUsV0FBVztJQUNsQixXQUFXLEVBQ1QscVNBQXFTO0lBQ3ZTLFFBQVEsRUFBRTtRQUNSO1lBQ0UsR0FBRyxFQUFFLFVBQVU7WUFDZixLQUFLLEVBQUUsc0JBQXNCO1lBQzdCLFdBQVcsRUFDVCxzYkFBc2I7WUFDeGIsZUFBZSxFQUFFLElBQUk7U0FDdEI7UUFDRDtZQUNFLEdBQUcsRUFBRSxlQUFlO1lBQ3BCLEtBQUssRUFBRSxZQUFZO1lBQ25CLFdBQVcsRUFDVCwyRUFBMkU7WUFDN0UsZUFBZSxFQUFFLElBQUk7U0FDdEI7S0FDRjtJQUNELFFBQVEsRUFBRTtRQUNSO1lBQ0UsR0FBRyxFQUFFLGVBQWU7WUFDcEIsS0FBSyxFQUFFLHFCQUFxQjtZQUM1QixXQUFXLEVBQ1QsMk1BQTJNO1lBQzdNLElBQUksRUFBRSxRQUFRO1NBQ2Y7S0FDRjtDQUNGLENBQUMsQ0FBQSJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLWZlYXR1cmVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2RvY3VtZW50cy9wbHVnaW4tZmVhdHVyZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsc0NBQWdEO0FBRW5DLFFBQUEsdUJBQXVCLEdBQUcsSUFBQSw2QkFBb0IsRUFBQztJQUMxRCxVQUFVLEVBQUUsV0FBVztJQUN2QixLQUFLLEVBQUUsV0FBVztJQUNsQixXQUFXLEVBQ1QscVNBQXFTO0lBQ3ZTLE9BQU8sRUFBRSxxREFBcUQ7SUFDOUQsSUFBSSxFQUFFLGNBQWM7SUFDcEIsWUFBWSxFQUNWLGlIQUFpSDtJQUNuSCxlQUFlLEVBQ2IseU9BQXlPO0lBQzNPLFFBQVEsRUFBRTtRQUNSO1lBQ0UsR0FBRyxFQUFFLFVBQVU7WUFDZixLQUFLLEVBQUUsc0JBQXNCO1lBQzdCLFdBQVcsRUFDVCxzYkFBc2I7WUFDeGIsZUFBZSxFQUFFLElBQUk7U0FDdEI7UUFDRDtZQUNFLEdBQUcsRUFBRSxlQUFlO1lBQ3BCLEtBQUssRUFBRSxZQUFZO1lBQ25CLFdBQVcsRUFDVCxnRkFBZ0Y7WUFDbEYsZUFBZSxFQUFFLElBQUk7U0FDdEI7S0FDRjtJQUNELFFBQVEsRUFBRTtRQUNSO1lBQ0UsR0FBRyxFQUFFLGVBQWU7WUFDcEIsS0FBSyxFQUFFLHFCQUFxQjtZQUM1QixXQUFXLEVBQ1QsMk1BQTJNO1lBQzdNLElBQUksRUFBRSw0Q0FBNEM7WUFDbEQsV0FBVyxFQUFFLG9FQUFvRTtZQUNqRixJQUFJLEVBQUUsUUFBUTtTQUNmO0tBQ0Y7Q0FDRixDQUFDLENBQUEifQ==

package/.medusa/server/src/email/application/deliver-ephemeral-auth-mail.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deliverEphemeralAuthMail = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const failure_classification_1 = require("../domain/failure-classification");
+const load_email_shop_details_1 = require("../rendering/load-email-shop-details");
+const load_template_1 = require("../templates/load-template");
+const dispatch_email_message_1 = require("../../workflows/email/dispatch-email-message");
+const asNotificationRecord = (value) => {
+    if (!value || typeof value !== "object") {
+        return null;
+    }
+    const record = value;
+    if (typeof record.id !== "string" ||
+        !record.id.trim() ||
+        (record.status !== "failure" &&
+            record.status !== "pending" &&
+            record.status !== "success")) {
+        return null;
+    }
+    return { id: record.id, status: record.status };
+};
+const failClaim = async (email, claim, code, now, notificationId = null) => {
+    const completed = await email.markAttemptFailed({
+        attempt_id: claim.attempt.id,
+        attempt_token: claim.attempt_token,
+        failure_code: code,
+        finished_at: now,
+        notification_id: notificationId,
+    });
+    return {
+        kind: "done",
+        result: {
+            attempt_id: claim.attempt.id,
+            code,
+            message_id: completed.message.id,
+            status: "failed",
+        },
+    };
+};
+/**
+ * One delivery attempt of a claimed message whose content carries a secret
+ * that lives only in the caller's `render` closure (password reset link,
+ * account confirmation link, login code): renders it, renews the lease, hands
+ * the content to the notification module and records the outcome on the
+ * attempt. The message stores no template data of the secret, the notification
+ * record keeps only ids, and nothing here is logged.
+ *
+ * Customer mails only (`resource_type` "customer").
+ */
+const deliverEphemeralAuthMail = async ({ claim, container, email, expiresAt, getNow, kind, maxAttempts, render, retryDelayMs, triggerType, }) => {
+    // A stored template never fails the mail: it falls back to the default.
+    const [shop, template] = await Promise.all([
+        (0, load_email_shop_details_1.loadEmailShopDetails)(container),
+        (0, load_template_1.loadEmailTemplate)(container, email, kind),
+    ]);
+    let rendered;
+    try {
+        rendered = render({
+            configuration: email.getDispatchConfiguration(),
+            shop,
+            template,
+        });
+    }
+    catch {
+        return await failClaim(email, claim, "render_failed", getNow());
+    }
+    const beforeNotification = getNow();
+    if (expiresAt.getTime() <= beforeNotification.getTime()) {
+        return await failClaim(email, claim, "payload_expired", beforeNotification);
+    }
+    try {
+        await email.renewAttemptLease({
+            attempt_id: claim.attempt.id,
+            attempt_token: claim.attempt_token,
+            now: beforeNotification,
+        });
+    }
+    catch {
+        return { kind: "retry" };
+    }
+    const notifications = container.resolve(utils_1.Modules.NOTIFICATION);
+    const safeData = {
+        attempt_id: claim.attempt.id,
+        kind: claim.message.kind,
+        message_id: claim.message.id,
+    };
+    let creationError;
+    let created = null;
+    try {
+        created = asNotificationRecord(await notifications.createNotifications({
+            channel: "email",
+            content: {
+                html: rendered.html,
+                subject: rendered.subject,
+                text: rendered.text,
+            },
+            data: safeData,
+            idempotency_key: (0, failure_classification_1.emailAttemptNotificationKey)(claim.attempt.id),
+            ...(claim.previous_notification_id
+                ? { original_notification_id: claim.previous_notification_id }
+                : {}),
+            provider_data: safeData,
+            ...(claim.message.resource_id
+                ? { resource_id: claim.message.resource_id }
+                : {}),
+            resource_type: "customer",
+            template: claim.message.kind,
+            to: claim.message.recipient,
+            trigger_type: triggerType,
+        }));
+    }
+    catch (error) {
+        creationError = error;
+    }
+    let persisted = null;
+    let lookupFailed = false;
+    if (!created || creationError) {
+        try {
+            persisted = await (0, dispatch_email_message_1.findAttemptNotification)(container, claim.attempt.id);
+        }
+        catch {
+            lookupFailed = true;
+        }
+    }
+    const notification = created ?? persisted;
+    const finishedAt = getNow();
+    if (notification?.status === "success") {
+        const completed = await email.markAttemptSent({
+            attempt_id: claim.attempt.id,
+            attempt_token: claim.attempt_token,
+            finished_at: finishedAt,
+            notification_id: notification.id,
+        });
+        return {
+            kind: "done",
+            result: {
+                attempt_id: claim.attempt.id,
+                message_id: completed.message.id,
+                status: "sent",
+            },
+        };
+    }
+    const failure = creationError && notification?.status === "failure" && !lookupFailed
+        ? (0, failure_classification_1.classifyNotificationFailure)(creationError)
+        : { code: "outcome_unknown", outcome: "unknown" };
+    if (failure.outcome === "retryable") {
+        const nextAttemptAt = new Date(finishedAt.getTime() + retryDelayMs);
+        if (claim.attempt.attempt_number < maxAttempts &&
+            nextAttemptAt.getTime() < expiresAt.getTime()) {
+            await email.markAttemptRetryable({
+                attempt_id: claim.attempt.id,
+                attempt_token: claim.attempt_token,
+                failure_code: failure.code,
+                finished_at: finishedAt,
+                next_attempt_at: nextAttemptAt,
+                notification_id: notification?.id ?? null,
+            });
+            return { kind: "retry" };
+        }
+        return await failClaim(email, claim, expiresAt.getTime() <= nextAttemptAt.getTime()
+            ? "payload_expired"
+            : "retry_exhausted", finishedAt, notification?.id ?? null);
+    }
+    if (failure.outcome === "failed") {
+        return await failClaim(email, claim, failure.code, finishedAt, notification?.id ?? null);
+    }
+    const completed = await email.markAttemptUnknown({
+        attempt_id: claim.attempt.id,
+        attempt_token: claim.attempt_token,
+        failure_code: failure.code,
+        finished_at: finishedAt,
+        notification_id: notification?.id ?? null,
+    });
+    return {
+        kind: "done",
+        result: {
+            attempt_id: claim.attempt.id,
+            code: failure.code,
+            message_id: completed.message.id,
+            status: "unknown",
+        },
+    };
+};
+exports.deliverEphemeralAuthMail = deliverEphemeralAuthMail;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVsaXZlci1lcGhlbWVyYWwtYXV0aC1tYWlsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2VtYWlsL2FwcGxpY2F0aW9uL2RlbGl2ZXItZXBoZW1lcmFsLWF1dGgtbWFpbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFJQSxxREFBb0Q7QUFFcEQsNkVBRzBDO0FBRzFDLGtGQUE0RTtBQUU1RSw4REFBK0Q7QUFPL0QseUZBQXVGO0FBK0N2RixNQUFNLG9CQUFvQixHQUFHLENBQUMsS0FBYyxFQUE2QixFQUFFO0lBQ3pFLElBQUksQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDeEMsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsS0FBZ0MsQ0FBQztJQUNoRCxJQUNFLE9BQU8sTUFBTSxDQUFDLEVBQUUsS0FBSyxRQUFRO1FBQzdCLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUU7UUFDakIsQ0FBQyxNQUFNLENBQUMsTUFBTSxLQUFLLFNBQVM7WUFDMUIsTUFBTSxDQUFDLE1BQU0sS0FBSyxTQUFTO1lBQzNCLE1BQU0sQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLEVBQzlCLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFDRCxPQUFPLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUNsRCxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxLQUFLLEVBQ3JCLEtBQXlCLEVBQ3pCLEtBQXdCLEVBQ3hCLElBQVksRUFDWixHQUFTLEVBQ1QsaUJBQWdDLElBQUksRUFDRCxFQUFFO0lBQ3JDLE1BQU0sU0FBUyxHQUFHLE1BQU0sS0FBSyxDQUFDLGlCQUFpQixDQUFDO1FBQzlDLFVBQVUsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUU7UUFDNUIsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUFhO1FBQ2xDLFlBQVksRUFBRSxJQUFJO1FBQ2xCLFdBQVcsRUFBRSxHQUFHO1FBQ2hCLGVBQWUsRUFBRSxjQUFjO0tBQ2hDLENBQUMsQ0FBQztJQUNILE9BQU87UUFDTCxJQUFJLEVBQUUsTUFBTTtRQUNaLE1BQU0sRUFBRTtZQUNOLFVBQVUsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUU7WUFDNUIsSUFBSTtZQUNKLFVBQVUsRUFBRSxTQUFTLENBQUMsT0FBTyxDQUFDLEVBQUU7WUFDaEMsTUFBTSxFQUFFLFFBQVE7U0FDakI7S0FDRixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7OztHQVNHO0FBQ0ksTUFBTSx3QkFBd0IsR0FBRyxLQUFLLEVBQUUsRUFDN0MsS0FBSyxFQUNMLFNBQVMsRUFDVCxLQUFLLEVBQ0wsU0FBUyxFQUNULE1BQU0sRUFDTixJQUFJLEVBQ0osV0FBVyxFQUNYLE1BQU0sRUFDTixZQUFZLEVBQ1osV0FBVyxHQUNjLEVBQXFDLEVBQUU7SUFDaEUsd0VBQXdFO0lBQ3hFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDO1FBQ3pDLElBQUEsOENBQW9CLEVBQUMsU0FBUyxDQUFDO1FBQy9CLElBQUEsaUNBQWlCLEVBQUMsU0FBUyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUM7S0FDMUMsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxRQUF1QixDQUFDO0lBQzVCLElBQUksQ0FBQztRQUNILFFBQVEsR0FBRyxNQUFNLENBQUM7WUFDaEIsYUFBYSxFQUFFLEtBQUssQ0FBQyx3QkFBd0IsRUFBRTtZQUMvQyxJQUFJO1lBQ0osUUFBUTtTQUNULENBQUMsQ0FBQztJQUNMLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLE1BQU0sU0FBUyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsZUFBZSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUVELE1BQU0sa0JBQWtCLEdBQUcsTUFBTSxFQUFFLENBQUM7SUFDcEMsSUFBSSxTQUFTLENBQUMsT0FBTyxFQUFFLElBQUksa0JBQWtCLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUN4RCxPQUFPLE1BQU0sU0FBUyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsaUJBQWlCLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxLQUFLLENBQUMsaUJBQWlCLENBQUM7WUFDNUIsVUFBVSxFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRTtZQUM1QixhQUFhLEVBQUUsS0FBSyxDQUFDLGFBQWE7WUFDbEMsR0FBRyxFQUFFLGtCQUFrQjtTQUN4QixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQztJQUMzQixDQUFDO0lBRUQsTUFBTSxhQUFhLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FDckMsZUFBTyxDQUFDLFlBQVksQ0FDckIsQ0FBQztJQUNGLE1BQU0sUUFBUSxHQUFHO1FBQ2YsVUFBVSxFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRTtRQUM1QixJQUFJLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJO1FBQ3hCLFVBQVUsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUU7S0FDN0IsQ0FBQztJQUNGLElBQUksYUFBc0IsQ0FBQztJQUMzQixJQUFJLE9BQU8sR0FBOEIsSUFBSSxDQUFDO0lBQzlDLElBQUksQ0FBQztRQUNILE9BQU8sR0FBRyxvQkFBb0IsQ0FDNUIsTUFBTSxhQUFhLENBQUMsbUJBQW1CLENBQUM7WUFDdEMsT0FBTyxFQUFFLE9BQU87WUFDaEIsT0FBTyxFQUFFO2dCQUNQLElBQUksRUFBRSxRQUFRLENBQUMsSUFBSTtnQkFDbkIsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO2dCQUN6QixJQUFJLEVBQUUsUUFBUSxDQUFDLElBQUk7YUFDcEI7WUFDRCxJQUFJLEVBQUUsUUFBUTtZQUNkLGVBQWUsRUFBRSxJQUFBLG9EQUEyQixFQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzlELEdBQUcsQ0FBQyxLQUFLLENBQUMsd0JBQXdCO2dCQUNoQyxDQUFDLENBQUMsRUFBRSx3QkFBd0IsRUFBRSxLQUFLLENBQUMsd0JBQXdCLEVBQUU7Z0JBQzlELENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDUCxhQUFhLEVBQUUsUUFBUTtZQUN2QixHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXO2dCQUMzQixDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUU7Z0JBQzVDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDUCxhQUFhLEVBQUUsVUFBVTtZQUN6QixRQUFRLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJO1lBQzVCLEVBQUUsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVU7WUFDNUIsWUFBWSxFQUFFLFdBQVc7U0FDMUIsQ0FBQyxDQUNILENBQUM7SUFDSixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLGFBQWEsR0FBRyxLQUFLLENBQUM7SUFDeEIsQ0FBQztJQUVELElBQUksU0FBUyxHQUE4QixJQUFJLENBQUM7SUFDaEQsSUFBSSxZQUFZLEdBQUcsS0FBSyxDQUFDO0lBQ3pCLElBQUksQ0FBQyxPQUFPLElBQUksYUFBYSxFQUFFLENBQUM7UUFDOUIsSUFBSSxDQUFDO1lBQ0gsU0FBUyxHQUFHLE1BQU0sSUFBQSxnREFBdUIsRUFBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsWUFBWSxHQUFHLElBQUksQ0FBQztRQUN0QixDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sWUFBWSxHQUFHLE9BQU8sSUFBSSxTQUFTLENBQUM7SUFDMUMsTUFBTSxVQUFVLEdBQUcsTUFBTSxFQUFFLENBQUM7SUFDNUIsSUFBSSxZQUFZLEVBQUUsTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sU0FBUyxHQUFHLE1BQU0sS0FBSyxDQUFDLGVBQWUsQ0FBQztZQUM1QyxVQUFVLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1lBQzVCLGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBYTtZQUNsQyxXQUFXLEVBQUUsVUFBVTtZQUN2QixlQUFlLEVBQUUsWUFBWSxDQUFDLEVBQUU7U0FDakMsQ0FBQyxDQUFDO1FBQ0gsT0FBTztZQUNMLElBQUksRUFBRSxNQUFNO1lBQ1osTUFBTSxFQUFFO2dCQUNOLFVBQVUsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUU7Z0JBQzVCLFVBQVUsRUFBRSxTQUFTLENBQUMsT0FBTyxDQUFDLEVBQUU7Z0JBQ2hDLE1BQU0sRUFBRSxNQUFNO2FBQ2Y7U0FDRixDQUFDO0lBQ0osQ0FBQztJQUVELE1BQU0sT0FBTyxHQUNYLGFBQWEsSUFBSSxZQUFZLEVBQUUsTUFBTSxLQUFLLFNBQVMsSUFBSSxDQUFDLFlBQVk7UUFDbEUsQ0FBQyxDQUFDLElBQUEsb0RBQTJCLEVBQUMsYUFBYSxDQUFDO1FBQzVDLENBQUMsQ0FBRSxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFZLENBQUM7SUFDakUsSUFBSSxPQUFPLENBQUMsT0FBTyxLQUFLLFdBQVcsRUFBRSxDQUFDO1FBQ3BDLE1BQU0sYUFBYSxHQUFHLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsR0FBRyxZQUFZLENBQUMsQ0FBQztRQUNwRSxJQUNFLEtBQUssQ0FBQyxPQUFPLENBQUMsY0FBYyxHQUFHLFdBQVc7WUFDMUMsYUFBYSxDQUFDLE9BQU8sRUFBRSxHQUFHLFNBQVMsQ0FBQyxPQUFPLEVBQUUsRUFDN0MsQ0FBQztZQUNELE1BQU0sS0FBSyxDQUFDLG9CQUFvQixDQUFDO2dCQUMvQixVQUFVLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFO2dCQUM1QixhQUFhLEVBQUUsS0FBSyxDQUFDLGFBQWE7Z0JBQ2xDLFlBQVksRUFBRSxPQUFPLENBQUMsSUFBSTtnQkFDMUIsV0FBVyxFQUFFLFVBQVU7Z0JBQ3ZCLGVBQWUsRUFBRSxhQUFhO2dCQUM5QixlQUFlLEVBQUUsWUFBWSxFQUFFLEVBQUUsSUFBSSxJQUFJO2FBQzFDLENBQUMsQ0FBQztZQUNILE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUM7UUFDM0IsQ0FBQztRQUNELE9BQU8sTUFBTSxTQUFTLENBQ3BCLEtBQUssRUFDTCxLQUFLLEVBQ0wsU0FBUyxDQUFDLE9BQU8sRUFBRSxJQUFJLGFBQWEsQ0FBQyxPQUFPLEVBQUU7WUFDNUMsQ0FBQyxDQUFDLGlCQUFpQjtZQUNuQixDQUFDLENBQUMsaUJBQWlCLEVBQ3JCLFVBQVUsRUFDVixZQUFZLEVBQUUsRUFBRSxJQUFJLElBQUksQ0FDekIsQ0FBQztJQUNKLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDakMsT0FBTyxNQUFNLFNBQVMsQ0FDcEIsS0FBSyxFQUNMLEtBQUssRUFDTCxPQUFPLENBQUMsSUFBSSxFQUNaLFVBQVUsRUFDVixZQUFZLEVBQUUsRUFBRSxJQUFJLElBQUksQ0FDekIsQ0FBQztJQUNKLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxNQUFNLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQztRQUMvQyxVQUFVLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1FBQzVCLGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBYTtRQUNsQyxZQUFZLEVBQUUsT0FBTyxDQUFDLElBQUk7UUFDMUIsV0FBVyxFQUFFLFVBQVU7UUFDdkIsZUFBZSxFQUFFLFlBQVksRUFBRSxFQUFFLElBQUksSUFBSTtLQUMxQyxDQUFDLENBQUM7SUFDSCxPQUFPO1FBQ0wsSUFBSSxFQUFFLE1BQU07UUFDWixNQUFNLEVBQUU7WUFDTixVQUFVLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1lBQzVCLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtZQUNsQixVQUFVLEVBQUUsU0FBUyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1lBQ2hDLE1BQU0sRUFBRSxTQUFTO1NBQ2xCO0tBQ0YsQ0FBQztBQUNKLENBQUMsQ0FBQztBQW5LVyxRQUFBLHdCQUF3Qiw0QkFtS25DIn0=