@hartl-services/medusa-base 2.6.1 → 2.8.0

package/.medusa/server/src/api/admin-first-login-password-policy.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enforceAdminPasswordOnFirstLogin = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const password_policy_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/password-policy");
+const password_policy_2 = require("./password-policy");
+/**
+ * An `emailpass` identity is shared by all actor types: somebody invited as an
+ * Admin could first register through `/auth/customer/emailpass/register`
+ * (customer minimum, possibly 8 characters), then log in at
+ * `/auth/user/emailpass` and accept the invite with that token, which binds
+ * the weak password to an Admin. So the first Admin login of an identity that
+ * has no Admin yet (`app_metadata.user_id` unset) must meet
+ * `ADMIN_PASSWORD_POLICY`; the login of an identity that already belongs to an
+ * Admin is never checked, so older passwords keep working. An unknown address
+ * or a body without strings goes on to Medusa, which rejects it itself.
+ * Runs for POST and GET (the core handler reads the body on both) and decides
+ * on the decoded, lowercased params, like `enforcePasswordPolicy`.
+ *
+ * Remaining limit: the other direction is not closed. A customer could
+ * register through the Admin path with 15 characters and no composition rules
+ * although the shop asks for more; that only weakens their own password.
+ */
+const enforceAdminPasswordOnFirstLogin = async (req, _res, next) => {
+    if ((0, password_policy_2.decodedRouteParam)(req, "actor_type") !== "user" ||
+        (0, password_policy_2.decodedRouteParam)(req, "auth_provider") !== "emailpass") {
+        next();
+        return;
+    }
+    const { email, password } = (req.body ?? {});
+    if (typeof email !== "string" || typeof password !== "string") {
+        next();
+        return;
+    }
+    const message = (0, password_policy_1.unmetPasswordRulesMessage)(password_policy_1.ADMIN_PASSWORD_POLICY, password);
+    if (!message) {
+        next();
+        return;
+    }
+    const auth = req.scope.resolve(utils_1.Modules.AUTH);
+    const [providerIdentity] = await auth.listProviderIdentities({ provider: "emailpass", entity_id: email }, { select: ["id", "auth_identity_id"], take: 1 });
+    if (!providerIdentity?.auth_identity_id) {
+        next();
+        return;
+    }
+    const authIdentity = await auth.retrieveAuthIdentity(providerIdentity.auth_identity_id, { select: ["id", "app_metadata"] });
+    const userId = authIdentity.app_metadata
+        ?.user_id;
+    if (typeof userId === "string" && userId) {
+        next();
+        return;
+    }
+    next(new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, message));
+};
+exports.enforceAdminPasswordOnFirstLogin = enforceAdminPasswordOnFirstLogin;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWRtaW4tZmlyc3QtbG9naW4tcGFzc3dvcmQtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2FwaS9hZG1pbi1maXJzdC1sb2dpbi1wYXNzd29yZC1wb2xpY3kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBTUEscURBQWdFO0FBQ2hFLCtHQUdrRjtBQUVsRix1REFBcUQ7QUFFckQ7Ozs7Ozs7Ozs7Ozs7Ozs7R0FnQkc7QUFDSSxNQUFNLGdDQUFnQyxHQUFHLEtBQUssRUFDbkQsR0FBa0IsRUFDbEIsSUFBb0IsRUFDcEIsSUFBd0IsRUFDVCxFQUFFO0lBQ2pCLElBQ0UsSUFBQSxtQ0FBaUIsRUFBQyxHQUFHLEVBQUUsWUFBWSxDQUFDLEtBQUssTUFBTTtRQUMvQyxJQUFBLG1DQUFpQixFQUFDLEdBQUcsRUFBRSxlQUFlLENBQUMsS0FBSyxXQUFXLEVBQ3ZELENBQUM7UUFDRCxJQUFJLEVBQUUsQ0FBQTtRQUNOLE9BQU07SUFDUixDQUFDO0lBQ0QsTUFBTSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLElBQUksRUFBRSxDQUcxQyxDQUFBO0lBQ0QsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDOUQsSUFBSSxFQUFFLENBQUE7UUFDTixPQUFNO0lBQ1IsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLElBQUEsMkNBQXlCLEVBQUMsdUNBQXFCLEVBQUUsUUFBUSxDQUFDLENBQUE7SUFDMUUsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2IsSUFBSSxFQUFFLENBQUE7UUFDTixPQUFNO0lBQ1IsQ0FBQztJQUVELE1BQU0sSUFBSSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFxQixlQUFPLENBQUMsSUFBSSxDQUFDLENBQUE7SUFDaEUsTUFBTSxDQUFDLGdCQUFnQixDQUFDLEdBQUcsTUFBTSxJQUFJLENBQUMsc0JBQXNCLENBQzFELEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLEVBQzNDLEVBQUUsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLGtCQUFrQixDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUNoRCxDQUFBO0lBQ0QsSUFBSSxDQUFDLGdCQUFnQixFQUFFLGdCQUFnQixFQUFFLENBQUM7UUFDeEMsSUFBSSxFQUFFLENBQUE7UUFDTixPQUFNO0lBQ1IsQ0FBQztJQUNELE1BQU0sWUFBWSxHQUFHLE1BQU0sSUFBSSxDQUFDLG9CQUFvQixDQUNsRCxnQkFBZ0IsQ0FBQyxnQkFBZ0IsRUFDakMsRUFBRSxNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsY0FBYyxDQUFDLEVBQUUsQ0FDbkMsQ0FBQTtJQUNELE1BQU0sTUFBTSxHQUFJLFlBQVksQ0FBQyxZQUE2QztRQUN4RSxFQUFFLE9BQU8sQ0FBQTtJQUNYLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ3pDLElBQUksRUFBRSxDQUFBO1FBQ04sT0FBTTtJQUNSLENBQUM7SUFDRCxJQUFJLENBQUMsSUFBSSxtQkFBVyxDQUFDLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFBO0FBQ2hFLENBQUMsQ0FBQTtBQS9DWSxRQUFBLGdDQUFnQyxvQ0ErQzVDIn0=

package/.medusa/server/src/api/answer-actor-type-casing-not-found.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.answerActorTypeCasingNotFound = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const KNOWN_ACTOR_TYPES = new Set(["customer", "user"]);
+/**
+ * Medusa's `authMethodsPerActor` is keyed by the exact actor type, but
+ * Express routes `/auth/Customer/...` to the same handlers with the actor type
+ * "Customer", which has no allowlist and so may use every provider (also
+ * `emailpass` while the shop switched it off for customers). A known actor
+ * type spelled in another letter case therefore answers 404 for every
+ * `/auth/:actor_type/:auth_provider[/...]` route. Any other value (`token`,
+ * `session`, `verification`, `mfa`, ...) passes untouched: only a value that
+ * differs from `customer` or `user` in letter case alone is refused. No
+ * `methods` on the matcher, so it runs before Medusa's own handlers.
+ */
+const answerActorTypeCasingNotFound = (req, _res, next) => {
+    const actorType = String(req.params?.actor_type ?? "");
+    if (KNOWN_ACTOR_TYPES.has(actorType.toLowerCase()) && !KNOWN_ACTOR_TYPES.has(actorType)) {
+        next(new utils_1.MedusaError(utils_1.MedusaError.Types.NOT_FOUND, "Not Found"));
+        return;
+    }
+    next();
+};
+exports.answerActorTypeCasingNotFound = answerActorTypeCasingNotFound;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYW5zd2VyLWFjdG9yLXR5cGUtY2FzaW5nLW5vdC1mb3VuZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9hcGkvYW5zd2VyLWFjdG9yLXR5cGUtY2FzaW5nLW5vdC1mb3VuZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFLQSxxREFBdUQ7QUFFdkQsTUFBTSxpQkFBaUIsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFBO0FBRXZEOzs7Ozs7Ozs7O0dBVUc7QUFDSSxNQUFNLDZCQUE2QixHQUFHLENBQzNDLEdBQWtCLEVBQ2xCLElBQW9CLEVBQ3BCLElBQXdCLEVBQ2xCLEVBQUU7SUFDUixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxVQUFVLElBQUksRUFBRSxDQUFDLENBQUE7SUFDdEQsSUFBSSxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLFdBQVcsRUFBRSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUN4RixJQUFJLENBQUMsSUFBSSxtQkFBVyxDQUFDLG1CQUFXLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFBO1FBQy9ELE9BQU07SUFDUixDQUFDO0lBQ0QsSUFBSSxFQUFFLENBQUE7QUFDUixDQUFDLENBQUE7QUFYWSxRQUFBLDZCQUE2QixpQ0FXekMifQ==

package/.medusa/server/src/api/answer-code-provider-route-not-found.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.answerCodeProviderRouteNotFound = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+const UNSUPPORTED_ACTIONS = new Set([
+    "register",
+    "update",
+    "reset-password",
+    "callback",
+]);
+/**
+ * The `email-otp` auth provider only logs in: Medusa's other
+ * `/auth/:actor_type/:auth_provider/*` routes (register, update,
+ * reset-password, callback) would only call provider methods it does not
+ * implement, and `reset-password` would even create a reset token row for a
+ * code identity before failing. Registered without `methods` on
+ * `/auth/:actor_type/:auth_provider/:action`, so it runs before the core
+ * handlers for every method. It compares the decoded params, because Express
+ * matches literal path segments against the raw path: a literal
+ * `/email-otp/` matcher would miss `/email%2Dotp/`, which the core route
+ * still decodes to `email-otp`.
+ */
+const answerCodeProviderRouteNotFound = (req, _res, next) => {
+    const provider = String(req.params.auth_provider ?? "").toLowerCase();
+    const action = String(req.params.action ?? "").toLowerCase();
+    if (provider === customer_auth_1.EMAIL_OTP_AUTH_PROVIDER && UNSUPPORTED_ACTIONS.has(action)) {
+        next(new utils_1.MedusaError(utils_1.MedusaError.Types.NOT_FOUND, "Not Found"));
+        return;
+    }
+    next();
+};
+exports.answerCodeProviderRouteNotFound = answerCodeProviderRouteNotFound;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYW5zd2VyLWNvZGUtcHJvdmlkZXItcm91dGUtbm90LWZvdW5kLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2FwaS9hbnN3ZXItY29kZS1wcm92aWRlci1yb3V0ZS1ub3QtZm91bmQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBS0EscURBQXVEO0FBQ3ZELDJHQUFpSDtBQUVqSCxNQUFNLG1CQUFtQixHQUFHLElBQUksR0FBRyxDQUFDO0lBQ2xDLFVBQVU7SUFDVixRQUFRO0lBQ1IsZ0JBQWdCO0lBQ2hCLFVBQVU7Q0FDWCxDQUFDLENBQUE7QUFFRjs7Ozs7Ozs7Ozs7R0FXRztBQUNJLE1BQU0sK0JBQStCLEdBQUcsQ0FDN0MsR0FBa0IsRUFDbEIsSUFBb0IsRUFDcEIsSUFBd0IsRUFDbEIsRUFBRTtJQUNSLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLGFBQWEsSUFBSSxFQUFFLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQTtJQUNyRSxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUE7SUFDNUQsSUFBSSxRQUFRLEtBQUssdUNBQXVCLElBQUksbUJBQW1CLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUUsSUFBSSxDQUFDLElBQUksbUJBQVcsQ0FBQyxtQkFBVyxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQTtRQUMvRCxPQUFNO0lBQ1IsQ0FBQztJQUNELElBQUksRUFBRSxDQUFBO0FBQ1IsQ0FBQyxDQUFBO0FBWlksUUFBQSwrQkFBK0IsbUNBWTNDIn0=

package/.medusa/server/src/api/code-account-password-routes.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rejectRegistrationForExistingCustomerAccount = exports.prepareCodeAccountPasswordResetRoute = exports.EXISTING_CUSTOMER_ACCOUNT_MESSAGE = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+const prepare_code_account_password_reset_1 = require("../customer-auth/application/prepare-code-account-password-reset");
+const auth_methods_1 = require("../customer-auth/domain/auth-methods");
+const login_code_accounts_1 = require("../customer-auth/login-code-accounts");
+const plugin_features_1 = require("../customer-auth/plugin-features");
+const enforcement_1 = require("../public/enforcement");
+const password_policy_1 = require("./password-policy");
+exports.EXISTING_CUSTOMER_ACCOUNT_MESSAGE = "Zu dieser E-Mail-Adresse gibt es bereits ein Kundenkonto. Melde dich an oder setze über „Passwort vergessen?“ ein Passwort.";
+/** Whether the request is `<method> /auth/customer/emailpass/<action>` (decoded, any letter case). */
+const isCustomerPasswordRoute = (req, method, action) => req.method === method &&
+    (0, password_policy_1.decodedRouteParam)(req, "actor_type") === "customer" &&
+    (0, password_policy_1.decodedRouteParam)(req, "auth_provider") === auth_methods_1.EMAIL_PASSWORD_AUTH_PROVIDER &&
+    (0, password_policy_1.decodedRouteParam)(req, "action") === action;
+const isEmailPasswordEnabled = (container) => (0, enforcement_1.isPluginFeatureEnabled)(container, plugin_features_1.customerAuthPluginFeatures, customer_auth_1.CUSTOMER_AUTH_FEATURES.emailPassword);
+/** Class only: the message of an error can carry the address. */
+const warnFailSafe = (container, what, error) => {
+    try {
+        container
+            .resolve(utils_1.ContainerRegistrationKeys.LOGGER)
+            .warn(`${what} (${error instanceof Error ? error.name : "unknown error"}); the request goes on unchanged.`);
+    }
+    catch {
+        // A broken logger must not turn into a failed request.
+    }
+};
+/**
+ * `POST /auth/customer/emailpass/reset-password` for an account that so far
+ * only used codes (see `prepareCodeAccountPasswordReset`): gives it the
+ * password identity Medusa's reset flow needs and rewrites the identifier to
+ * the spelling Medusa has to look up. Only while `email_password` is on. Fail
+ * safe: whatever goes wrong here, the request continues unchanged (Medusa
+ * answers 201 for unknown identifiers anyway). No `methods` on the matcher
+ * (`/auth/:actor_type/:auth_provider/:action`), so it runs before the core
+ * validators and decides on the decoded, lowercased params.
+ */
+const prepareCodeAccountPasswordResetRoute = async (req, _res, next) => {
+    const body = req.body;
+    if (!isCustomerPasswordRoute(req, "POST", "reset-password") ||
+        typeof body?.identifier !== "string") {
+        next();
+        return;
+    }
+    try {
+        if (await isEmailPasswordEnabled(req.scope)) {
+            const identifier = await (0, prepare_code_account_password_reset_1.prepareCodeAccountPasswordReset)(req.scope, body.identifier);
+            if (identifier) {
+                body.identifier = identifier;
+            }
+        }
+    }
+    catch (error) {
+        warnFailSafe(req.scope, "The password reset of a code account could not be prepared", error);
+    }
+    next();
+};
+exports.prepareCodeAccountPasswordResetRoute = prepareCodeAccountPasswordResetRoute;
+/**
+ * `POST /auth/customer/emailpass/register` for an address that already has a
+ * customer account (a password account, or one that only used codes): 400 with
+ * a pointer to "Passwort vergessen". A new password identity beside a code
+ * account would only be a customer-less orphan Medusa cannot use (its own
+ * answer for an existing password account is the same refusal, so the
+ * existence of an account is not new information). Only while `email_password`
+ * is on; fail safe like the reset preparation.
+ */
+const rejectRegistrationForExistingCustomerAccount = async (req, _res, next) => {
+    const email = req.body?.email;
+    if (!isCustomerPasswordRoute(req, "POST", "register") || typeof email !== "string") {
+        next();
+        return;
+    }
+    let exists = false;
+    try {
+        exists =
+            (await isEmailPasswordEnabled(req.scope)) &&
+                (await (0, login_code_accounts_1.hasCustomerAccountIdentity)(req.scope.resolve(utils_1.ContainerRegistrationKeys.PG_CONNECTION), (0, customer_auth_1.normalizeLoginEmail)(email)));
+    }
+    catch (error) {
+        warnFailSafe(req.scope, "The registration could not be checked for an existing account", error);
+    }
+    if (exists) {
+        next(new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, exports.EXISTING_CUSTOMER_ACCOUNT_MESSAGE));
+        return;
+    }
+    next();
+};
+exports.rejectRegistrationForExistingCustomerAccount = rejectRegistrationForExistingCustomerAccount;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29kZS1hY2NvdW50LXBhc3N3b3JkLXJvdXRlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9hcGkvY29kZS1hY2NvdW50LXBhc3N3b3JkLXJvdXRlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFNQSxxREFBa0Y7QUFDbEYsMkdBR2dGO0FBRWhGLDBIQUFrSDtBQUNsSCx1RUFBbUY7QUFDbkYsOEVBQWlGO0FBRWpGLHNFQUE2RTtBQUM3RSx1REFBOEQ7QUFDOUQsdURBQXFEO0FBRXhDLFFBQUEsaUNBQWlDLEdBQzVDLDZIQUE2SCxDQUFBO0FBRS9ILHNHQUFzRztBQUN0RyxNQUFNLHVCQUF1QixHQUFHLENBQzlCLEdBQWtCLEVBQ2xCLE1BQWMsRUFDZCxNQUFjLEVBQ0wsRUFBRSxDQUNYLEdBQUcsQ0FBQyxNQUFNLEtBQUssTUFBTTtJQUNyQixJQUFBLG1DQUFpQixFQUFDLEdBQUcsRUFBRSxZQUFZLENBQUMsS0FBSyxVQUFVO0lBQ25ELElBQUEsbUNBQWlCLEVBQUMsR0FBRyxFQUFFLGVBQWUsQ0FBQyxLQUFLLDJDQUE0QjtJQUN4RSxJQUFBLG1DQUFpQixFQUFDLEdBQUcsRUFBRSxRQUFRLENBQUMsS0FBSyxNQUFNLENBQUE7QUFFN0MsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFNBQTBCLEVBQW9CLEVBQUUsQ0FDOUUsSUFBQSxvQ0FBc0IsRUFDcEIsU0FBUyxFQUNULDRDQUEwQixFQUMxQixzQ0FBc0IsQ0FBQyxhQUFhLENBQ3JDLENBQUE7QUFFSCxpRUFBaUU7QUFDakUsTUFBTSxZQUFZLEdBQUcsQ0FBQyxTQUEwQixFQUFFLElBQVksRUFBRSxLQUFjLEVBQUUsRUFBRTtJQUNoRixJQUFJLENBQUM7UUFDSCxTQUFTO2FBQ04sT0FBTyxDQUFTLGlDQUF5QixDQUFDLE1BQU0sQ0FBQzthQUNqRCxJQUFJLENBQ0gsR0FBRyxJQUFJLEtBQUssS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsZUFBZSxtQ0FBbUMsQ0FDckcsQ0FBQTtJQUNMLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCx1REFBdUQ7SUFDekQsQ0FBQztBQUNILENBQUMsQ0FBQTtBQUVEOzs7Ozs7Ozs7R0FTRztBQUNJLE1BQU0sb0NBQW9DLEdBQUcsS0FBSyxFQUN2RCxHQUFrQixFQUNsQixJQUFvQixFQUNwQixJQUF3QixFQUNULEVBQUU7SUFDakIsTUFBTSxJQUFJLEdBQUcsR0FBRyxDQUFDLElBQTRDLENBQUE7SUFDN0QsSUFDRSxDQUFDLHVCQUF1QixDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsZ0JBQWdCLENBQUM7UUFDdkQsT0FBTyxJQUFJLEVBQUUsVUFBVSxLQUFLLFFBQVEsRUFDcEMsQ0FBQztRQUNELElBQUksRUFBRSxDQUFBO1FBQ04sT0FBTTtJQUNSLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxJQUFJLE1BQU0sc0JBQXNCLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxVQUFVLEdBQUcsTUFBTSxJQUFBLHFFQUErQixFQUN0RCxHQUFHLENBQUMsS0FBSyxFQUNULElBQUksQ0FBQyxVQUFVLENBQ2hCLENBQUE7WUFDRCxJQUFJLFVBQVUsRUFBRSxDQUFDO2dCQUNmLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFBO1lBQzlCLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixZQUFZLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSw0REFBNEQsRUFBRSxLQUFLLENBQUMsQ0FBQTtJQUM5RixDQUFDO0lBQ0QsSUFBSSxFQUFFLENBQUE7QUFDUixDQUFDLENBQUE7QUEzQlksUUFBQSxvQ0FBb0Msd0NBMkJoRDtBQUVEOzs7Ozs7OztHQVFHO0FBQ0ksTUFBTSw0Q0FBNEMsR0FBRyxLQUFLLEVBQy9ELEdBQWtCLEVBQ2xCLElBQW9CLEVBQ3BCLElBQXdCLEVBQ1QsRUFBRTtJQUNqQixNQUFNLEtBQUssR0FBSSxHQUFHLENBQUMsSUFBd0MsRUFBRSxLQUFLLENBQUE7SUFDbEUsSUFBSSxDQUFDLHVCQUF1QixDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsVUFBVSxDQUFDLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDbkYsSUFBSSxFQUFFLENBQUE7UUFDTixPQUFNO0lBQ1IsQ0FBQztJQUNELElBQUksTUFBTSxHQUFHLEtBQUssQ0FBQTtJQUNsQixJQUFJLENBQUM7UUFDSCxNQUFNO1lBQ0osQ0FBQyxNQUFNLHNCQUFzQixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDekMsQ0FBQyxNQUFNLElBQUEsZ0RBQTBCLEVBQy9CLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFlLGlDQUF5QixDQUFDLGFBQWEsQ0FBQyxFQUN4RSxJQUFBLG1DQUFtQixFQUFDLEtBQUssQ0FBQyxDQUMzQixDQUFDLENBQUE7SUFDTixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLFlBQVksQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLCtEQUErRCxFQUFFLEtBQUssQ0FBQyxDQUFBO0lBQ2pHLENBQUM7SUFDRCxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ1gsSUFBSSxDQUNGLElBQUksbUJBQVcsQ0FDYixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLHlDQUFpQyxDQUNsQyxDQUNGLENBQUE7UUFDRCxPQUFNO0lBQ1IsQ0FBQztJQUNELElBQUksRUFBRSxDQUFBO0FBQ1IsQ0FBQyxDQUFBO0FBL0JZLFFBQUEsNENBQTRDLGdEQStCeEQifQ==

package/.medusa/server/src/api/middlewares.js

@@ -4,18 +4,26 @@ const http_1 = require("@medusajs/framework/http");
 const plugin_features_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/plugin-features");
 const documents_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/documents");
 const email_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/email");
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
 const customer_verification_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-verification");
 const files_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/files");
-const plugin_features_2 = require("../documents/plugin-features");
-const plugin_features_3 = require("../email/plugin-features");
+const plugin_features_2 = require("../customer-auth/plugin-features");
+const plugin_features_3 = require("../documents/plugin-features");
+const plugin_features_4 = require("../email/plugin-features");
 const customer_verification_request_throttle_1 = require("./customer-verification-request-throttle");
+const answer_code_provider_route_not_found_1 = require("./answer-code-provider-route-not-found");
+const answer_actor_type_casing_not_found_1 = require("./answer-actor-type-casing-not-found");
+const admin_first_login_password_policy_1 = require("./admin-first-login-password-policy");
+const code_account_password_routes_1 = require("./code-account-password-routes");
 const password_policy_1 = require("./password-policy");
+const require_login_code_customer_email_1 = require("./require-login-code-customer-email");
 const public_1 = require("../public");
 /**
  * Feature-toggle gate for the Documents routes (see `pluginFeatureGate`): a
  * disabled feature answers 404 for the route and everything below it.
  */
-const documentsGate = (0, public_1.pluginFeatureGate)(plugin_features_2.documentsPluginFeatures);
+const documentsGate = (0, public_1.pluginFeatureGate)(plugin_features_3.documentsPluginFeatures);
+const customerAuthGate = (0, public_1.pluginFeatureGate)(plugin_features_2.customerAuthPluginFeatures);
 // Authentication: Medusa authenticates every /admin route (actor "user";
 // bearer, session or secret API key) before plugin middlewares run
 // (framework 2.19.0 http/router.js), so no second `authenticate` here.
@@ -57,7 +65,7 @@ exports.default = (0, http_1.defineMiddlewares)({
         // confirmation switch below, which belongs to `order_mails`.
         {
             matcher: "/admin/email",
-            middlewares: [(0, public_1.requirePluginFeature)(plugin_features_3.emailPluginFeatures)],
+            middlewares: [(0, public_1.requirePluginFeature)(plugin_features_4.emailPluginFeatures)],
         },
         {
             matcher: "/admin/email/messages",
@@ -174,7 +182,7 @@ exports.default = (0, http_1.defineMiddlewares)({
         // see workflows/hooks/draft-order-confirmation-default.ts).
         {
             matcher: "/admin/draft-orders/:id/order-confirmation",
-            middlewares: [(0, public_1.requirePluginFeature)(plugin_features_3.emailPluginFeatures, "order_mails")],
+            middlewares: [(0, public_1.requirePluginFeature)(plugin_features_4.emailPluginFeatures, "order_mails")],
         },
         {
             matcher: "/admin/draft-orders/:id/order-confirmation",
@@ -190,7 +198,7 @@ exports.default = (0, http_1.defineMiddlewares)({
         {
             matcher: "/store/customer-verification",
             middlewares: [
-                (0, public_1.requirePluginFeature)(plugin_features_3.emailPluginFeatures, "account_mails", "customer_verification"),
+                (0, public_1.requirePluginFeature)(plugin_features_4.emailPluginFeatures, "account_mails", "customer_verification"),
             ],
         },
         {
@@ -211,19 +219,76 @@ exports.default = (0, http_1.defineMiddlewares)({
                 customer_verification_request_throttle_1.throttleCustomerVerificationRequest,
             ],
         },
-        // Password policy for customers and Admin users: registration (sign-up
-        // and Admin invite) and the password reset. Without `methods` the entry
-        // is an `app.use` prefix match that runs before Medusa's method-specific
-        // entries, so a rejected password never consumes the single-use reset
-        // token (Medusa's `validateToken` deletes it on the update route). Both
-        // paths only exist for POST.
+        // --- Kunden-Login ---------------------------------------------------
+        // The code request answers 404 while `email_otp` is off. The gate has no
+        // `methods`, so it runs before the method-specific entry below. Public
+        // by design (the customer has no token yet); the 60 s limit per address
+        // and the uniform 202 answer live in the use case.
+        customerAuthGate("/store/customer-auth/login-code", customer_auth_1.CUSTOMER_AUTH_FEATURES.emailOtp),
         {
-            matcher: "/auth/:actor_type/emailpass/register",
-            middlewares: [password_policy_1.enforcePasswordPolicy],
+            matcher: "/store/customer-auth/login-code",
+            methods: ["POST"],
+            middlewares: [(0, http_1.validateAndTransformBody)(customer_auth_1.RequestLoginCodeSchema)],
+        },
+        // The password rules customers have to meet (shown by the storefront at
+        // registration and reset); 404 while `email_password` is off. Public.
+        customerAuthGate("/store/customer-auth/password-policy", customer_auth_1.CUSTOMER_AUTH_FEATURES.emailPassword),
+        // A code-login token may only create the customer of the address it was
+        // issued for (see the middleware). Medusa's own entry for this matcher
+        // runs first (core routes load before plugin routes); authentication is
+        // repeated so the check never depends on that order.
+        {
+            matcher: "/store/customers",
+            methods: ["POST"],
+            middlewares: [
+                (0, http_1.authenticate)("customer", ["session", "bearer"], {
+                    allowUnregistered: true,
+                }),
+                require_login_code_customer_email_1.requireLoginCodeCustomerEmail,
+            ],
+        },
+        // A known actor type in another letter case (`/auth/Customer/...`) would
+        // reach Medusa's handlers without the allowlist of `customer`: 404. No
+        // `methods` (prefix match), decided on the decoded param; `token`,
+        // `session`, `verification` and `mfa` are none of the two and pass.
+        {
+            matcher: "/auth/:actor_type/:auth_provider",
+            middlewares: [answer_actor_type_casing_not_found_1.answerActorTypeCasingNotFound],
+        },
+        // The `/auth/:actor_type/:auth_provider/:action` entry below has no
+        // `methods`, so it is an `app.use` prefix match that runs before Medusa's
+        // own handlers and validators (`validateToken` deletes the single-use
+        // reset token on the update route, so a rejected password has to be
+        // refused before it). Every middleware in it decides on the decoded,
+        // lowercased params itself: Express matches literal path segments against
+        // the raw path, so a literal `/emailpass/register` or `/email-otp/`
+        // matcher would miss `/email%70ass/register` or `/email%2Dotp/`, which the
+        // core route still decodes.
+        // - The code login provider has no register, update, reset-password or
+        //   callback: those routes answer 404 for every actor type and method.
+        // - Registering a password for an address that already has a customer
+        //   account is refused (see the middleware).
+        // - A password reset for an account that only used codes gets the
+        //   password identity Medusa's reset flow needs.
+        // - Password policy (customers: `customer_auth` settings, Admin users:
+        //   fixed 15 characters) for the registration (sign-up and Admin invite)
+        //   and the password update of the reset.
+        {
+            matcher: "/auth/:actor_type/:auth_provider/:action",
+            middlewares: [
+                answer_code_provider_route_not_found_1.answerCodeProviderRouteNotFound,
+                code_account_password_routes_1.rejectRegistrationForExistingCustomerAccount,
+                code_account_password_routes_1.prepareCodeAccountPasswordResetRoute,
+                password_policy_1.enforcePasswordPolicy,
+            ],
         },
+        // First Admin login of an identity that has no Admin yet: the password
+        // must meet the Admin rules (see the middleware). Login is exact-path
+        // (`POST` and `GET`), the check runs before the core handler.
         {
-            matcher: "/auth/:actor_type/emailpass/update",
-            middlewares: [password_policy_1.enforcePasswordPolicy],
+            matcher: "/auth/:actor_type/:auth_provider",
+            methods: ["POST", "GET"],
+            middlewares: [admin_first_login_password_policy_1.enforceAdminPasswordOnFirstLogin],
         },
         // --- Dokumente ------------------------------------------------------
         // Feature-toggle gates (see plugin-features.ts). They cover every
@@ -320,4 +385,4 @@ exports.default = (0, http_1.defineMiddlewares)({
         },
     ],
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWlkZGxld2FyZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYXBpL21pZGRsZXdhcmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsbURBS2lDO0FBQ2pDLCtHQUtrRjtBQUNsRixtR0FHNEU7QUFDNUUsMkZBWXdFO0FBQ3hFLDJIQUFrSTtBQUNsSSwyRkFBdUg7QUFFdkgsa0VBQXNFO0FBQ3RFLDhEQUE4RDtBQUM5RCxxR0FBOEY7QUFDOUYsdURBQXlEO0FBQ3pELHNDQUFtRTtBQUVuRTs7O0dBR0c7QUFDSCxNQUFNLGFBQWEsR0FBRyxJQUFBLDBCQUFpQixFQUFDLHlDQUF1QixDQUFDLENBQUE7QUFFaEUseUVBQXlFO0FBQ3pFLG1FQUFtRTtBQUNuRSx1RUFBdUU7QUFDdkUsMkVBQTJFO0FBQzNFLDBFQUEwRTtBQUMxRSx1Q0FBdUM7QUFDdkMsa0JBQWUsSUFBQSx3QkFBaUIsRUFBQztJQUMvQixNQUFNLEVBQUU7UUFDTjtZQUNFLE9BQU8sRUFBRSx3QkFBd0I7WUFDakMsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRSxDQUFDLElBQUEsK0JBQXdCLEVBQUMsNENBQTBCLENBQUMsQ0FBQztTQUNwRTtRQUNEO1lBQ0UsT0FBTyxFQUFFLDZDQUE2QztZQUN0RCxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFLENBQUMsSUFBQSwrQkFBd0IsRUFBQyw0Q0FBMEIsQ0FBQyxDQUFDO1NBQ3BFO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsd0RBQXdEO1lBQ2pFLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUUsQ0FBQyxJQUFBLCtCQUF3QixFQUFDLHVDQUFxQixDQUFDLENBQUM7U0FDL0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSw2REFBNkQ7WUFDdEUsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLGdDQUF5QixFQUFDLGlEQUErQixFQUFFO29CQUN6RCxNQUFNLEVBQUUsS0FBSztpQkFDZCxDQUFDO2FBQ0g7U0FDRjtRQUNELHVFQUF1RTtRQUN2RSx5RUFBeUU7UUFDekUscUVBQXFFO1FBQ3JFLHdFQUF3RTtRQUN4RSxtREFBbUQ7UUFDbkQsa0VBQWtFO1FBQ2xFLDZEQUE2RDtRQUM3RDtZQUNFLE9BQU8sRUFBRSxjQUFjO1lBQ3ZCLFdBQVcsRUFBRSxDQUFDLElBQUEsNkJBQW9CLEVBQUMscUNBQW1CLENBQUMsQ0FBQztTQUN6RDtRQUNEO1lBQ0UsT0FBTyxFQUFFLHVCQUF1QjtZQUNoQyxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsZ0NBQXlCLEVBQUMseUNBQWlDLEVBQUU7b0JBQzNELE1BQU0sRUFBRSxJQUFJO2lCQUNiLENBQUM7YUFDSDtTQUNGO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsMkJBQTJCO1lBQ3BDLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDM0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSxtQ0FBbUM7WUFDNUMsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLCtCQUF3QixFQUFDLHFDQUE2QixDQUFDO2FBQ3hEO1NBQ0Y7UUFDRDtZQUNFLE9BQU8sRUFBRSwwQkFBMEI7WUFDbkMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRSxDQUFDLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztTQUMzRDtRQUNEO1lBQ0UsT0FBTyxFQUFFLDBCQUEwQjtZQUNuQyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsK0JBQXdCLEVBQUMsZ0RBQXdDLENBQUM7YUFDbkU7U0FDRjtRQUNEO1lBQ0UsT0FBTyxFQUFFLDhCQUE4QjtZQUN2QyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsK0JBQXdCLEVBQUMsZ0RBQXdDLENBQUM7YUFDbkU7U0FDRjtRQUNEO1lBQ0UsT0FBTyxFQUFFLHlDQUF5QztZQUNsRCxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsK0JBQXdCLEVBQUMsNkNBQXFDLENBQUM7YUFDaEU7U0FDRjtRQUNEO1lBQ0UsVUFBVSxFQUFFLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRTtZQUNoQyxPQUFPLEVBQUUsdUNBQXVDO1lBQ2hELE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDM0MsSUFBQSwrQkFBd0IsRUFBQywrQ0FBdUMsQ0FBQzthQUNsRTtTQUNGO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsNERBQTREO1lBQ3JFLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDM0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSx3QkFBd0I7WUFDakMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRSxDQUFDLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztTQUMzRDtRQUNEO1lBQ0UsT0FBTyxFQUFFLDhCQUE4QjtZQUN2QyxPQUFPLEVBQUUsQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDO1lBQzFCLFdBQVcsRUFBRSxDQUFDLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztTQUMzRDtRQUNEO1lBQ0UsVUFBVSxFQUFFLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRTtZQUNoQyxPQUFPLEVBQUUsOEJBQThCO1lBQ3ZDLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDM0MsSUFBQSwrQkFBd0IsRUFBQyxvQ0FBNEIsQ0FBQzthQUN2RDtTQUNGO1FBQ0Q7WUFDRSxVQUFVLEVBQUUsRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFO1lBQ2hDLE9BQU8sRUFBRSxzQ0FBc0M7WUFDL0MsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLCtCQUF3QixFQUFDLHVDQUErQixDQUFDO2FBQzFEO1NBQ0Y7UUFDRDtZQUNFLFVBQVUsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUU7WUFDaEMsT0FBTyxFQUFFLHdDQUF3QztZQUNqRCxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsK0JBQXdCLEVBQUMsd0NBQWdDLENBQUM7YUFDM0Q7U0FDRjtRQUNEO1lBQ0UsT0FBTyxFQUFFLDJDQUEyQztZQUNwRCxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsZ0NBQXlCLEVBQ3ZCLG9EQUE0QyxFQUM1QyxFQUFFLENBQ0g7YUFDRjtTQUNGO1FBQ0QsdUVBQXVFO1FBQ3ZFLDREQUE0RDtRQUM1RDtZQUNFLE9BQU8sRUFBRSw0Q0FBNEM7WUFDckQsV0FBVyxFQUFFLENBQUMsSUFBQSw2QkFBb0IsRUFBQyxxQ0FBbUIsRUFBRSxhQUFhLENBQUMsQ0FBQztTQUN4RTtRQUNEO1lBQ0UsT0FBTyxFQUFFLDRDQUE0QztZQUNyRCxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsK0JBQXdCLEVBQUMsK0NBQXVDLENBQUM7YUFDbEU7U0FDRjtRQUNELCtEQUErRDtRQUMvRCx1RUFBdUU7UUFDdkUsd0VBQXdFO1FBQ3hFLDJEQUEyRDtRQUMzRDtZQUNFLE9BQU8sRUFBRSw4QkFBOEI7WUFDdkMsV0FBVyxFQUFFO2dCQUNYLElBQUEsNkJBQW9CLEVBQ2xCLHFDQUFtQixFQUNuQixlQUFlLEVBQ2YsdUJBQXVCLENBQ3hCO2FBQ0Y7U0FDRjtRQUNEO1lBQ0UsT0FBTyxFQUFFLHFDQUFxQztZQUM5QyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFLENBQUMsSUFBQSwrQkFBd0IsRUFBQyx3REFBZ0MsQ0FBQyxDQUFDO1NBQzFFO1FBQ0Qsc0VBQXNFO1FBQ3RFLG9FQUFvRTtRQUNwRSx3RUFBd0U7UUFDeEUsd0VBQXdFO1FBQ3hFLGlEQUFpRDtRQUNqRDtZQUNFLE9BQU8sRUFBRSw0QkFBNEI7WUFDckMsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxFQUFFLEVBQUUsaUJBQWlCLEVBQUUsSUFBSSxFQUFFLENBQUM7Z0JBQ3JFLDRFQUFtQzthQUNwQztTQUNGO1FBQ0QsdUVBQXVFO1FBQ3ZFLHdFQUF3RTtRQUN4RSx5RUFBeUU7UUFDekUsc0VBQXNFO1FBQ3RFLHdFQUF3RTtRQUN4RSw2QkFBNkI7UUFDN0I7WUFDRSxPQUFPLEVBQUUsc0NBQXNDO1lBQy9DLFdBQVcsRUFBRSxDQUFDLHVDQUFxQixDQUFDO1NBQ3JDO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsb0NBQW9DO1lBQzdDLFdBQVcsRUFBRSxDQUFDLHVDQUFxQixDQUFDO1NBQ3JDO1FBQ0QsdUVBQXVFO1FBQ3ZFLGtFQUFrRTtRQUNsRSxtRUFBbUU7UUFDbkUscUVBQXFFO1FBQ3JFLEVBQUU7UUFDRixnQkFBZ0I7UUFDaEIsYUFBYSxDQUFDLGtCQUFrQixDQUFDO1FBQ2pDLGFBQWEsQ0FBQyw2QkFBNkIsQ0FBQztRQUM1QyxhQUFhLENBQUMsaUNBQWlDLENBQUM7UUFDaEQsdUJBQXVCO1FBQ3ZCLGFBQWEsQ0FBQyxrQkFBa0IsRUFBRSxVQUFVLENBQUM7UUFDN0MsYUFBYSxDQUFDLDZCQUE2QixFQUFFLFVBQVUsQ0FBQztRQUN4RCxhQUFhO1FBQ2IsYUFBYSxDQUFDLGlDQUFpQyxFQUFFLGVBQWUsQ0FBQztRQUNqRTtZQUNFLE9BQU8sRUFBRSxrQkFBa0I7WUFDM0IsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRSxDQUFDLElBQUEsbUJBQVksRUFBQyxVQUFVLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztTQUMvRDtRQUNEO1lBQ0UsT0FBTyxFQUFFLHNCQUFzQjtZQUMvQixPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLFVBQVUsRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQy9EO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsK0JBQStCO1lBQ3hDLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsVUFBVSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDL0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSw2QkFBNkI7WUFDdEMsT0FBTyxFQUFFLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQztZQUN4QixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDM0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSxtREFBbUQ7WUFDNUQsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRSxDQUFDLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztTQUMzRDtRQUNEO1lBQ0UsT0FBTyxFQUFFLHdDQUF3QztZQUNqRCxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsK0JBQXdCLEVBQUMsa0RBQXNDLENBQUM7YUFDakU7U0FDRjtRQUNEO1lBQ0UsT0FBTyxFQUFFLHFEQUFxRDtZQUM5RCxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsK0JBQXdCLEVBQUMsa0RBQXNDLENBQUM7YUFDakU7U0FDRjtRQUNEO1lBQ0UsT0FBTyxFQUFFLGlDQUFpQztZQUMxQyxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQzNEO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsMERBQTBEO1lBQ25FLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDM0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSx1REFBdUQ7WUFDaEUsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLCtCQUF3QixFQUFDLGdEQUFvQyxDQUFDO2FBQy9EO1NBQ0Y7UUFDRCx1RUFBdUU7UUFDdkU7WUFDRSxPQUFPLEVBQUUsdUJBQXVCO1lBQ2hDLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxnQ0FBeUIsRUFBQyw2Q0FBcUMsRUFBRTtvQkFDL0QsTUFBTSxFQUFFLEtBQUs7aUJBQ2QsQ0FBQzthQUNIO1NBQ0Y7UUFDRDtZQUNFLFVBQVUsRUFBRSxLQUFLO1lBQ2pCLE9BQU8sRUFBRSxzQkFBc0I7WUFDL0IsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLGdDQUF5QixFQUFDLDZDQUFxQyxFQUFFO29CQUMvRCxNQUFNLEVBQUUsS0FBSztpQkFDZCxDQUFDO2FBQ0g7U0FDRjtLQUNGO0NBQ0YsQ0FBQyxDQUFBIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWlkZGxld2FyZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYXBpL21pZGRsZXdhcmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsbURBS2lDO0FBQ2pDLCtHQUtrRjtBQUNsRixtR0FHNEU7QUFDNUUsMkZBWXdFO0FBQ3hFLDJHQUdnRjtBQUNoRiwySEFBa0k7QUFDbEksMkZBQXVIO0FBRXZILHNFQUE2RTtBQUM3RSxrRUFBc0U7QUFDdEUsOERBQThEO0FBQzlELHFHQUE4RjtBQUM5RixpR0FBd0Y7QUFDeEYsNkZBQW9GO0FBQ3BGLDJGQUFzRjtBQUN0RixpRkFHdUM7QUFDdkMsdURBQXlEO0FBQ3pELDJGQUFtRjtBQUNuRixzQ0FBbUU7QUFFbkU7OztHQUdHO0FBQ0gsTUFBTSxhQUFhLEdBQUcsSUFBQSwwQkFBaUIsRUFBQyx5Q0FBdUIsQ0FBQyxDQUFBO0FBQ2hFLE1BQU0sZ0JBQWdCLEdBQUcsSUFBQSwwQkFBaUIsRUFBQyw0Q0FBMEIsQ0FBQyxDQUFBO0FBRXRFLHlFQUF5RTtBQUN6RSxtRUFBbUU7QUFDbkUsdUVBQXVFO0FBQ3ZFLDJFQUEyRTtBQUMzRSwwRUFBMEU7QUFDMUUsdUNBQXVDO0FBQ3ZDLGtCQUFlLElBQUEsd0JBQWlCLEVBQUM7SUFDL0IsTUFBTSxFQUFFO1FBQ047WUFDRSxPQUFPLEVBQUUsd0JBQXdCO1lBQ2pDLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUUsQ0FBQyxJQUFBLCtCQUF3QixFQUFDLDRDQUEwQixDQUFDLENBQUM7U0FDcEU7UUFDRDtZQUNFLE9BQU8sRUFBRSw2Q0FBNkM7WUFDdEQsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRSxDQUFDLElBQUEsK0JBQXdCLEVBQUMsNENBQTBCLENBQUMsQ0FBQztTQUNwRTtRQUNEO1lBQ0UsT0FBTyxFQUFFLHdEQUF3RDtZQUNqRSxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFLENBQUMsSUFBQSwrQkFBd0IsRUFBQyx1Q0FBcUIsQ0FBQyxDQUFDO1NBQy9EO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsNkRBQTZEO1lBQ3RFLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxnQ0FBeUIsRUFBQyxpREFBK0IsRUFBRTtvQkFDekQsTUFBTSxFQUFFLEtBQUs7aUJBQ2QsQ0FBQzthQUNIO1NBQ0Y7UUFDRCx1RUFBdUU7UUFDdkUseUVBQXlFO1FBQ3pFLHFFQUFxRTtRQUNyRSx3RUFBd0U7UUFDeEUsbURBQW1EO1FBQ25ELGtFQUFrRTtRQUNsRSw2REFBNkQ7UUFDN0Q7WUFDRSxPQUFPLEVBQUUsY0FBYztZQUN2QixXQUFXLEVBQUUsQ0FBQyxJQUFBLDZCQUFvQixFQUFDLHFDQUFtQixDQUFDLENBQUM7U0FDekQ7UUFDRDtZQUNFLE9BQU8sRUFBRSx1QkFBdUI7WUFDaEMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLGdDQUF5QixFQUFDLHlDQUFpQyxFQUFFO29CQUMzRCxNQUFNLEVBQUUsSUFBSTtpQkFDYixDQUFDO2FBQ0g7U0FDRjtRQUNEO1lBQ0UsT0FBTyxFQUFFLDJCQUEyQjtZQUNwQyxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQzNEO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsbUNBQW1DO1lBQzVDLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDM0MsSUFBQSwrQkFBd0IsRUFBQyxxQ0FBNkIsQ0FBQzthQUN4RDtTQUNGO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsMEJBQTBCO1lBQ25DLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDM0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSwwQkFBMEI7WUFDbkMsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLCtCQUF3QixFQUFDLGdEQUF3QyxDQUFDO2FBQ25FO1NBQ0Y7UUFDRDtZQUNFLE9BQU8sRUFBRSw4QkFBOEI7WUFDdkMsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLCtCQUF3QixFQUFDLGdEQUF3QyxDQUFDO2FBQ25FO1NBQ0Y7UUFDRDtZQUNFLE9BQU8sRUFBRSx5Q0FBeUM7WUFDbEQsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLCtCQUF3QixFQUFDLDZDQUFxQyxDQUFDO2FBQ2hFO1NBQ0Y7UUFDRDtZQUNFLFVBQVUsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUU7WUFDaEMsT0FBTyxFQUFFLHVDQUF1QztZQUNoRCxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsK0JBQXdCLEVBQUMsK0NBQXVDLENBQUM7YUFDbEU7U0FDRjtRQUNEO1lBQ0UsT0FBTyxFQUFFLDREQUE0RDtZQUNyRSxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQzNEO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsd0JBQXdCO1lBQ2pDLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDM0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSw4QkFBOEI7WUFDdkMsT0FBTyxFQUFFLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQztZQUMxQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDM0Q7UUFDRDtZQUNFLFVBQVUsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUU7WUFDaEMsT0FBTyxFQUFFLDhCQUE4QjtZQUN2QyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFO2dCQUNYLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQzNDLElBQUEsK0JBQXdCLEVBQUMsb0NBQTRCLENBQUM7YUFDdkQ7U0FDRjtRQUNEO1lBQ0UsVUFBVSxFQUFFLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRTtZQUNoQyxPQUFPLEVBQUUsc0NBQXNDO1lBQy9DLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDM0MsSUFBQSwrQkFBd0IsRUFBQyx1Q0FBK0IsQ0FBQzthQUMxRDtTQUNGO1FBQ0Q7WUFDRSxVQUFVLEVBQUUsRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFO1lBQ2hDLE9BQU8sRUFBRSx3Q0FBd0M7WUFDakQsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLCtCQUF3QixFQUFDLHdDQUFnQyxDQUFDO2FBQzNEO1NBQ0Y7UUFDRDtZQUNFLE9BQU8sRUFBRSwyQ0FBMkM7WUFDcEQsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLGdDQUF5QixFQUN2QixvREFBNEMsRUFDNUMsRUFBRSxDQUNIO2FBQ0Y7U0FDRjtRQUNELHVFQUF1RTtRQUN2RSw0REFBNEQ7UUFDNUQ7WUFDRSxPQUFPLEVBQUUsNENBQTRDO1lBQ3JELFdBQVcsRUFBRSxDQUFDLElBQUEsNkJBQW9CLEVBQUMscUNBQW1CLEVBQUUsYUFBYSxDQUFDLENBQUM7U0FDeEU7UUFDRDtZQUNFLE9BQU8sRUFBRSw0Q0FBNEM7WUFDckQsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLCtCQUF3QixFQUFDLCtDQUF1QyxDQUFDO2FBQ2xFO1NBQ0Y7UUFDRCwrREFBK0Q7UUFDL0QsdUVBQXVFO1FBQ3ZFLHdFQUF3RTtRQUN4RSwyREFBMkQ7UUFDM0Q7WUFDRSxPQUFPLEVBQUUsOEJBQThCO1lBQ3ZDLFdBQVcsRUFBRTtnQkFDWCxJQUFBLDZCQUFvQixFQUNsQixxQ0FBbUIsRUFDbkIsZUFBZSxFQUNmLHVCQUF1QixDQUN4QjthQUNGO1NBQ0Y7UUFDRDtZQUNFLE9BQU8sRUFBRSxxQ0FBcUM7WUFDOUMsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRSxDQUFDLElBQUEsK0JBQXdCLEVBQUMsd0RBQWdDLENBQUMsQ0FBQztTQUMxRTtRQUNELHNFQUFzRTtRQUN0RSxvRUFBb0U7UUFDcEUsd0VBQXdFO1FBQ3hFLHdFQUF3RTtRQUN4RSxpREFBaUQ7UUFDakQ7WUFDRSxPQUFPLEVBQUUsNEJBQTRCO1lBQ3JDLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxtQkFBWSxFQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsRUFBRSxFQUFFLGlCQUFpQixFQUFFLElBQUksRUFBRSxDQUFDO2dCQUNyRSw0RUFBbUM7YUFDcEM7U0FDRjtRQUNELHVFQUF1RTtRQUN2RSx5RUFBeUU7UUFDekUsdUVBQXVFO1FBQ3ZFLHdFQUF3RTtRQUN4RSxtREFBbUQ7UUFDbkQsZ0JBQWdCLENBQUMsaUNBQWlDLEVBQUUsc0NBQXNCLENBQUMsUUFBUSxDQUFDO1FBQ3BGO1lBQ0UsT0FBTyxFQUFFLGlDQUFpQztZQUMxQyxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDakIsV0FBVyxFQUFFLENBQUMsSUFBQSwrQkFBd0IsRUFBQyxzQ0FBc0IsQ0FBQyxDQUFDO1NBQ2hFO1FBQ0Qsd0VBQXdFO1FBQ3hFLHNFQUFzRTtRQUN0RSxnQkFBZ0IsQ0FDZCxzQ0FBc0MsRUFDdEMsc0NBQXNCLENBQUMsYUFBYSxDQUNyQztRQUNELHdFQUF3RTtRQUN4RSx1RUFBdUU7UUFDdkUsd0VBQXdFO1FBQ3hFLHFEQUFxRDtRQUNyRDtZQUNFLE9BQU8sRUFBRSxrQkFBa0I7WUFDM0IsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsVUFBVSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxFQUFFO29CQUM5QyxpQkFBaUIsRUFBRSxJQUFJO2lCQUN4QixDQUFDO2dCQUNGLGlFQUE2QjthQUM5QjtTQUNGO1FBQ0QseUVBQXlFO1FBQ3pFLHVFQUF1RTtRQUN2RSxtRUFBbUU7UUFDbkUsb0VBQW9FO1FBQ3BFO1lBQ0UsT0FBTyxFQUFFLGtDQUFrQztZQUMzQyxXQUFXLEVBQUUsQ0FBQyxrRUFBNkIsQ0FBQztTQUM3QztRQUNELG9FQUFvRTtRQUNwRSwwRUFBMEU7UUFDMUUsc0VBQXNFO1FBQ3RFLG9FQUFvRTtRQUNwRSxxRUFBcUU7UUFDckUsMEVBQTBFO1FBQzFFLG9FQUFvRTtRQUNwRSwyRUFBMkU7UUFDM0UsNEJBQTRCO1FBQzVCLHVFQUF1RTtRQUN2RSx1RUFBdUU7UUFDdkUsc0VBQXNFO1FBQ3RFLDZDQUE2QztRQUM3QyxrRUFBa0U7UUFDbEUsaURBQWlEO1FBQ2pELHVFQUF1RTtRQUN2RSx5RUFBeUU7UUFDekUsMENBQTBDO1FBQzFDO1lBQ0UsT0FBTyxFQUFFLDBDQUEwQztZQUNuRCxXQUFXLEVBQUU7Z0JBQ1gsc0VBQStCO2dCQUMvQiwyRUFBNEM7Z0JBQzVDLG1FQUFvQztnQkFDcEMsdUNBQXFCO2FBQ3RCO1NBQ0Y7UUFDRCx1RUFBdUU7UUFDdkUsc0VBQXNFO1FBQ3RFLDhEQUE4RDtRQUM5RDtZQUNFLE9BQU8sRUFBRSxrQ0FBa0M7WUFDM0MsT0FBTyxFQUFFLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQztZQUN4QixXQUFXLEVBQUUsQ0FBQyxvRUFBZ0MsQ0FBQztTQUNoRDtRQUNELHVFQUF1RTtRQUN2RSxrRUFBa0U7UUFDbEUsbUVBQW1FO1FBQ25FLHFFQUFxRTtRQUNyRSxFQUFFO1FBQ0YsZ0JBQWdCO1FBQ2hCLGFBQWEsQ0FBQyxrQkFBa0IsQ0FBQztRQUNqQyxhQUFhLENBQUMsNkJBQTZCLENBQUM7UUFDNUMsYUFBYSxDQUFDLGlDQUFpQyxDQUFDO1FBQ2hELHVCQUF1QjtRQUN2QixhQUFhLENBQUMsa0JBQWtCLEVBQUUsVUFBVSxDQUFDO1FBQzdDLGFBQWEsQ0FBQyw2QkFBNkIsRUFBRSxVQUFVLENBQUM7UUFDeEQsYUFBYTtRQUNiLGFBQWEsQ0FBQyxpQ0FBaUMsRUFBRSxlQUFlLENBQUM7UUFDakU7WUFDRSxPQUFPLEVBQUUsa0JBQWtCO1lBQzNCLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsVUFBVSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDL0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSxzQkFBc0I7WUFDL0IsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRSxDQUFDLElBQUEsbUJBQVksRUFBQyxVQUFVLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztTQUMvRDtRQUNEO1lBQ0UsT0FBTyxFQUFFLCtCQUErQjtZQUN4QyxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLFVBQVUsRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQy9EO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsNkJBQTZCO1lBQ3RDLE9BQU8sRUFBRSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUM7WUFDeEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQzNEO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsbURBQW1EO1lBQzVELE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7U0FDM0Q7UUFDRDtZQUNFLE9BQU8sRUFBRSx3Q0FBd0M7WUFDakQsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLCtCQUF3QixFQUFDLGtEQUFzQyxDQUFDO2FBQ2pFO1NBQ0Y7UUFDRDtZQUNFLE9BQU8sRUFBRSxxREFBcUQ7WUFDOUQsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFdBQVcsRUFBRTtnQkFDWCxJQUFBLG1CQUFZLEVBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUMzQyxJQUFBLCtCQUF3QixFQUFDLGtEQUFzQyxDQUFDO2FBQ2pFO1NBQ0Y7UUFDRDtZQUNFLE9BQU8sRUFBRSxpQ0FBaUM7WUFDMUMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDO1lBQ2hCLFdBQVcsRUFBRSxDQUFDLElBQUEsbUJBQVksRUFBQyxNQUFNLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztTQUMzRDtRQUNEO1lBQ0UsT0FBTyxFQUFFLDBEQUEwRDtZQUNuRSxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1NBQzNEO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsdURBQXVEO1lBQ2hFLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNqQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxtQkFBWSxFQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDM0MsSUFBQSwrQkFBd0IsRUFBQyxnREFBb0MsQ0FBQzthQUMvRDtTQUNGO1FBQ0QsdUVBQXVFO1FBQ3ZFO1lBQ0UsT0FBTyxFQUFFLHVCQUF1QjtZQUNoQyxPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDaEIsV0FBVyxFQUFFO2dCQUNYLElBQUEsZ0NBQXlCLEVBQUMsNkNBQXFDLEVBQUU7b0JBQy9ELE1BQU0sRUFBRSxLQUFLO2lCQUNkLENBQUM7YUFDSDtTQUNGO1FBQ0Q7WUFDRSxVQUFVLEVBQUUsS0FBSztZQUNqQixPQUFPLEVBQUUsc0JBQXNCO1lBQy9CLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNoQixXQUFXLEVBQUU7Z0JBQ1gsSUFBQSxnQ0FBeUIsRUFBQyw2Q0FBcUMsRUFBRTtvQkFDL0QsTUFBTSxFQUFFLEtBQUs7aUJBQ2QsQ0FBQzthQUNIO1NBQ0Y7S0FDRjtDQUNGLENBQUMsQ0FBQSJ9

package/.medusa/server/src/api/password-policy.js

@@ -1,23 +1,68 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.enforcePasswordPolicy = void 0;
+exports.enforcePasswordPolicy = exports.passwordPolicyFor = exports.decodedRouteParam = void 0;
 const utils_1 = require("@medusajs/framework/utils");
 const password_policy_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/password-policy");
+const customer_password_policy_1 = require("../customer-auth/customer-password-policy");
+/** Medusa's password provider; its routes are the ones the policy guards. */
+const EMAIL_PASSWORD_PROVIDER = "emailpass";
+const POLICY_ACTIONS = new Set(["register", "update"]);
+/** A route param as Express decoded it, lowercased (Express matches case-insensitively). */
+const decodedRouteParam = (req, name) => String(req.params?.[name] ?? "").toLowerCase();
+exports.decodedRouteParam = decodedRouteParam;
+/**
+ * Policy of the actor: the settings-based rules for customers, the fixed
+ * Admin rules for every other actor type. A failed settings read falls back
+ * to the default policy (and is logged) instead of blocking registrations.
+ */
+const passwordPolicyFor = async (req) => {
+    if ((0, exports.decodedRouteParam)(req, "actor_type") !== "customer") {
+        return password_policy_1.ADMIN_PASSWORD_POLICY;
+    }
+    try {
+        return await (0, customer_password_policy_1.resolveCustomerPasswordPolicy)(req.scope);
+    }
+    catch (error) {
+        req.scope
+            .resolve(utils_1.ContainerRegistrationKeys.LOGGER)
+            .warn(`Customer password policy could not be read, using the default: ${error instanceof Error ? error.message : String(error)}`);
+        return password_policy_1.DEFAULT_CUSTOMER_PASSWORD_POLICY;
+    }
+};
+exports.passwordPolicyFor = passwordPolicyFor;
 /**
  * Runs before Medusa's `emailpass` register and password-update routes (every
- * actor type, so customers and Admin users) and rejects a password shorter
- * than `PASSWORD_MIN_LENGTH` with 400 `invalid_data`. A body without a string
- * password goes on to Medusa unchanged, which answers it itself (register) or
- * changes nothing (update). Login is never checked, so older, shorter
- * passwords keep working.
+ * actor type) and rejects a password that breaks the actor's rules with 400
+ * `invalid_data` and one message naming the unmet rules. Customers follow the
+ * `customer_auth` settings; every other actor (Admin users) the fixed
+ * `ADMIN_PASSWORD_POLICY`. A body without a string password goes on to Medusa
+ * unchanged, which answers it itself (register) or changes nothing (update).
+ * Login is never checked, so older passwords keep working.
+ *
+ * Registered without `methods` on `/auth/:actor_type/:auth_provider/:action`
+ * and deciding on the decoded, lowercased params: Express matches literal path
+ * segments against the raw path, so literal `/emailpass/register` matchers
+ * would miss `/email%70ass/register`, which Medusa's core route still decodes
+ * to `emailpass` (and `Customer` is an actor type of its own to Express, but
+ * not to this policy).
  */
-const enforcePasswordPolicy = (req, _res, next) => {
+const enforcePasswordPolicy = async (req, _res, next) => {
+    if ((0, exports.decodedRouteParam)(req, "auth_provider") !== EMAIL_PASSWORD_PROVIDER ||
+        !POLICY_ACTIONS.has((0, exports.decodedRouteParam)(req, "action"))) {
+        next();
+        return;
+    }
     const password = req.body?.password;
-    if (typeof password === "string" && !(0, password_policy_1.isPasswordLongEnough)(password)) {
-        next(new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Das Passwort muss mindestens ${password_policy_1.PASSWORD_MIN_LENGTH} Zeichen lang sein.`));
+    if (typeof password !== "string") {
+        next();
+        return;
+    }
+    const message = (0, password_policy_1.unmetPasswordRulesMessage)(await (0, exports.passwordPolicyFor)(req), password);
+    if (message) {
+        next(new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, message));
         return;
     }
     next();
 };
 exports.enforcePasswordPolicy = enforcePasswordPolicy;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGFzc3dvcmQtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2FwaS9wYXNzd29yZC1wb2xpY3kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBS0EscURBQXVEO0FBQ3ZELCtHQUdrRjtBQUVsRjs7Ozs7OztHQU9HO0FBQ0ksTUFBTSxxQkFBcUIsR0FBRyxDQUNuQyxHQUFrQixFQUNsQixJQUFvQixFQUNwQixJQUF3QixFQUNsQixFQUFFO0lBQ1IsTUFBTSxRQUFRLEdBQUksR0FBRyxDQUFDLElBQTJDLEVBQUUsUUFBUSxDQUFBO0lBQzNFLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsSUFBQSxzQ0FBb0IsRUFBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ3BFLElBQUksQ0FDRixJQUFJLG1CQUFXLENBQ2IsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5QixnQ0FBZ0MscUNBQW1CLHFCQUFxQixDQUN6RSxDQUNGLENBQUE7UUFDRCxPQUFNO0lBQ1IsQ0FBQztJQUNELElBQUksRUFBRSxDQUFBO0FBQ1IsQ0FBQyxDQUFBO0FBaEJZLFFBQUEscUJBQXFCLHlCQWdCakMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGFzc3dvcmQtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2FwaS9wYXNzd29yZC1wb2xpY3kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBS0EscURBQWtGO0FBQ2xGLCtHQUtrRjtBQUVsRix3RkFBeUY7QUFFekYsNkVBQTZFO0FBQzdFLE1BQU0sdUJBQXVCLEdBQUcsV0FBVyxDQUFBO0FBQzNDLE1BQU0sY0FBYyxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUE7QUFFdEQsNEZBQTRGO0FBQ3JGLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxHQUFrQixFQUFFLElBQVksRUFBVSxFQUFFLENBQzVFLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUE7QUFEbkMsUUFBQSxpQkFBaUIscUJBQ2tCO0FBRWhEOzs7O0dBSUc7QUFDSSxNQUFNLGlCQUFpQixHQUFHLEtBQUssRUFDcEMsR0FBa0IsRUFDZSxFQUFFO0lBQ25DLElBQUksSUFBQSx5QkFBaUIsRUFBQyxHQUFHLEVBQUUsWUFBWSxDQUFDLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDeEQsT0FBTyx1Q0FBcUIsQ0FBQTtJQUM5QixDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsT0FBTyxNQUFNLElBQUEsd0RBQTZCLEVBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ3ZELENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsR0FBRyxDQUFDLEtBQUs7YUFDTixPQUFPLENBQ04saUNBQXlCLENBQUMsTUFBTSxDQUNqQzthQUNBLElBQUksQ0FDSCxrRUFDRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUN2RCxFQUFFLENBQ0gsQ0FBQTtRQUNILE9BQU8sa0RBQWdDLENBQUE7SUFDekMsQ0FBQztBQUNILENBQUMsQ0FBQTtBQXBCWSxRQUFBLGlCQUFpQixxQkFvQjdCO0FBRUQ7Ozs7Ozs7Ozs7Ozs7OztHQWVHO0FBQ0ksTUFBTSxxQkFBcUIsR0FBRyxLQUFLLEVBQ3hDLEdBQWtCLEVBQ2xCLElBQW9CLEVBQ3BCLElBQXdCLEVBQ1QsRUFBRTtJQUNqQixJQUNFLElBQUEseUJBQWlCLEVBQUMsR0FBRyxFQUFFLGVBQWUsQ0FBQyxLQUFLLHVCQUF1QjtRQUNuRSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsSUFBQSx5QkFBaUIsRUFBQyxHQUFHLEVBQUUsUUFBUSxDQUFDLENBQUMsRUFDckQsQ0FBQztRQUNELElBQUksRUFBRSxDQUFBO1FBQ04sT0FBTTtJQUNSLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBSSxHQUFHLENBQUMsSUFBMkMsRUFBRSxRQUFRLENBQUE7SUFDM0UsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNqQyxJQUFJLEVBQUUsQ0FBQTtRQUNOLE9BQU07SUFDUixDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsSUFBQSwyQ0FBeUIsRUFDdkMsTUFBTSxJQUFBLHlCQUFpQixFQUFDLEdBQUcsQ0FBQyxFQUM1QixRQUFRLENBQ1QsQ0FBQTtJQUNELElBQUksT0FBTyxFQUFFLENBQUM7UUFDWixJQUFJLENBQUMsSUFBSSxtQkFBVyxDQUFDLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFBO1FBQzlELE9BQU07SUFDUixDQUFDO0lBQ0QsSUFBSSxFQUFFLENBQUE7QUFDUixDQUFDLENBQUE7QUEzQlksUUFBQSxxQkFBcUIseUJBMkJqQyJ9

package/.medusa/server/src/api/require-login-code-customer-email.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireLoginCodeCustomerEmail = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+const MISMATCH_MESSAGE = "Die E-Mail-Adresse des Kontos muss der Adresse entsprechen, für die der Anmeldecode angefordert wurde.";
+/**
+ * `POST /store/customers` with a code-login token: the customer's e-mail
+ * address must be the address the code was sent to. Medusa takes the address
+ * from the request body unchecked, so without this a token obtained for
+ * `attacker@example.com` could create a customer for `victim@example.com`,
+ * which the victim's later code login would then be linked to. Other tokens
+ * (password login) are not affected. The address is read from the validated
+ * body when the core validator already ran, else from the raw body.
+ */
+const requireLoginCodeCustomerEmail = async (req, _res, next) => {
+    const authContext = req.auth_context;
+    if (authContext?.auth_provider !== customer_auth_1.EMAIL_OTP_AUTH_PROVIDER) {
+        return next();
+    }
+    const body = req.validatedBody ?? req.body;
+    const email = typeof body === "object" && body !== null
+        ? body.email
+        : undefined;
+    const auth = req.scope.resolve(utils_1.Modules.AUTH);
+    const [providerIdentity] = authContext.auth_identity_id
+        ? await auth.listProviderIdentities({
+            auth_identity_id: authContext.auth_identity_id,
+            provider: customer_auth_1.EMAIL_OTP_AUTH_PROVIDER,
+        }, { select: ["id", "entity_id"], take: 1 })
+        : [];
+    if (typeof email !== "string" ||
+        !providerIdentity ||
+        (0, customer_auth_1.normalizeLoginEmail)(email) !== providerIdentity.entity_id) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, MISMATCH_MESSAGE);
+    }
+    next();
+};
+exports.requireLoginCodeCustomerEmail = requireLoginCodeCustomerEmail;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVxdWlyZS1sb2dpbi1jb2RlLWN1c3RvbWVyLWVtYWlsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2FwaS9yZXF1aXJlLWxvZ2luLWNvZGUtY3VzdG9tZXItZW1haWwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBTUEscURBQWdFO0FBQ2hFLDJHQUdnRjtBQUVoRixNQUFNLGdCQUFnQixHQUNwQix3R0FBd0csQ0FBQTtBQUUxRzs7Ozs7Ozs7R0FRRztBQUNJLE1BQU0sNkJBQTZCLEdBQUcsS0FBSyxFQUNoRCxHQUErQixFQUMvQixJQUFvQixFQUNwQixJQUF3QixFQUNULEVBQUU7SUFDakIsTUFBTSxXQUFXLEdBQUcsR0FBRyxDQUFDLFlBQVksQ0FBQTtJQUNwQyxJQUFJLFdBQVcsRUFBRSxhQUFhLEtBQUssdUNBQXVCLEVBQUUsQ0FBQztRQUMzRCxPQUFPLElBQUksRUFBRSxDQUFBO0lBQ2YsQ0FBQztJQUVELE1BQU0sSUFBSSxHQUFJLEdBQW1DLENBQUMsYUFBYSxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUE7SUFDM0UsTUFBTSxLQUFLLEdBQ1QsT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksS0FBSyxJQUFJO1FBQ3ZDLENBQUMsQ0FBRSxJQUE0QixDQUFDLEtBQUs7UUFDckMsQ0FBQyxDQUFDLFNBQVMsQ0FBQTtJQUNmLE1BQU0sSUFBSSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFxQixlQUFPLENBQUMsSUFBSSxDQUFDLENBQUE7SUFDaEUsTUFBTSxDQUFDLGdCQUFnQixDQUFDLEdBQUcsV0FBVyxDQUFDLGdCQUFnQjtRQUNyRCxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsc0JBQXNCLENBQy9CO1lBQ0UsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDLGdCQUFnQjtZQUM5QyxRQUFRLEVBQUUsdUNBQXVCO1NBQ2xDLEVBQ0QsRUFBRSxNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsV0FBVyxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUN6QztRQUNILENBQUMsQ0FBQyxFQUFFLENBQUE7SUFFTixJQUNFLE9BQU8sS0FBSyxLQUFLLFFBQVE7UUFDekIsQ0FBQyxnQkFBZ0I7UUFDakIsSUFBQSxtQ0FBbUIsRUFBQyxLQUFLLENBQUMsS0FBSyxnQkFBZ0IsQ0FBQyxTQUFTLEVBQ3pELENBQUM7UUFDRCxNQUFNLElBQUksbUJBQVcsQ0FBQyxtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQTtJQUN6RSxDQUFDO0lBQ0QsSUFBSSxFQUFFLENBQUE7QUFDUixDQUFDLENBQUE7QUFsQ1ksUUFBQSw2QkFBNkIsaUNBa0N6QyJ9

package/.medusa/server/src/api/store/customer-auth/login-code/route.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const request_login_code_1 = require("../../../../customer-auth/application/request-login-code");
+/**
+ * Always 202 `{ accepted: true }`, whether or not a code was sent (new,
+ * existing, ambiguous or too recently asked address). The answer goes out
+ * before any lookup, so every address takes equally long; the work runs
+ * detached and logs its own failures (it never rejects). 404 while the
+ * `email_otp` feature is off (gate in `api/middlewares.ts`).
+ */
+const POST = async (req, res) => {
+    res.status(202).json({ accepted: true });
+    void (0, request_login_code_1.requestLoginCode)(req.scope, req.validatedBody.email);
+};
+exports.POST = POST;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVyLWF1dGgvbG9naW4tY29kZS9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFNQSxpR0FBMkY7QUFFM0Y7Ozs7OztHQU1HO0FBQ0ksTUFBTSxJQUFJLEdBQUcsS0FBSyxFQUN2QixHQUFvQyxFQUNwQyxHQUE2QyxFQUM3QyxFQUFFO0lBQ0YsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQTtJQUN4QyxLQUFLLElBQUEscUNBQWdCLEVBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFBO0FBQzNELENBQUMsQ0FBQTtBQU5ZLFFBQUEsSUFBSSxRQU1oQiJ9

package/.medusa/server/src/api/store/customer-auth/password-policy/route.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = void 0;
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+const customer_password_policy_1 = require("../../../../customer-auth/customer-password-policy");
+const wire_response_1 = require("../../../../shared/lib/wire-response");
+/**
+ * The password rules customers have to meet at registration and password
+ * reset, so the storefront can show them. Public (publishable key only).
+ * 404 while the `email_password` feature is off (gate in
+ * `api/middlewares.ts`).
+ */
+const GET = async (req, res) => {
+    res.json((0, wire_response_1.toWireResponse)(customer_auth_1.PasswordPolicyResponseSchema, {
+        password_policy: await (0, customer_password_policy_1.resolveCustomerPasswordPolicy)(req.scope),
+    }));
+};
+exports.GET = GET;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVyLWF1dGgvcGFzc3dvcmQtcG9saWN5L3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLDJHQUFzSDtBQUd0SCxpR0FBa0c7QUFDbEcsd0VBQXFFO0FBRXJFOzs7OztHQUtHO0FBQ0ksTUFBTSxHQUFHLEdBQUcsS0FBSyxFQUN0QixHQUFrQixFQUNsQixHQUEyQyxFQUMzQyxFQUFFO0lBQ0YsR0FBRyxDQUFDLElBQUksQ0FDTixJQUFBLDhCQUFjLEVBQUMsNENBQTRCLEVBQUU7UUFDM0MsZUFBZSxFQUFFLE1BQU0sSUFBQSx3REFBNkIsRUFBQyxHQUFHLENBQUMsS0FBSyxDQUFDO0tBQ2hFLENBQUMsQ0FDSCxDQUFBO0FBQ0gsQ0FBQyxDQUFBO0FBVFksUUFBQSxHQUFHLE9BU2YifQ==