@medusajs/auth-google 2.22.0-snapshot-20261020204851 → 2.22.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/AGENTS.md +58 -0
  2. package/README.md +105 -9
  3. package/package.json +7 -3
package/AGENTS.md ADDED
@@ -0,0 +1,58 @@
1
+ # @medusajs/auth-google
2
+
3
+ Auth Module provider for "Sign in with Google" using the OAuth 2 authorization-code flow with ID-token verification.
4
+
5
+ ## Using this package
6
+
7
+ ```ts
8
+ module.exports = defineConfig({
9
+ modules: [
10
+ {
11
+ resolve: "@medusajs/medusa/auth",
12
+ options: {
13
+ providers: [
14
+ // overriding `providers` drops the default emailpass provider, so re-add it
15
+ {
16
+ resolve: "@medusajs/medusa/auth-emailpass",
17
+ id: "emailpass",
18
+ },
19
+ {
20
+ resolve: "@medusajs/medusa/auth-google",
21
+ id: "google",
22
+ options: {
23
+ clientId: process.env.GOOGLE_CLIENT_ID,
24
+ clientSecret: process.env.GOOGLE_CLIENT_SECRET,
25
+ callbackUrl: process.env.GOOGLE_CALLBACK_URL,
26
+ },
27
+ },
28
+ ],
29
+ },
30
+ },
31
+ ],
32
+ })
33
+ ```
34
+
35
+ - Options (`GoogleAuthProviderOptions`): `clientId`, `clientSecret`, `callbackUrl`, all required (`validateOptions` throws at boot).
36
+ - Flow: `POST /auth/{actor_type}/google` returns `{ location }`; Google redirects to `callbackUrl`, which calls `POST /auth/{actor_type}/google/callback` forwarding the `code` and `state` query params.
37
+ - Docs: https://docs.medusajs.com/resources/commerce-modules/auth/auth-providers/google.md
38
+ - Build a custom auth provider: https://docs.medusajs.com/resources/references/auth/provider.md
39
+
40
+ ## Architecture
41
+
42
+ - `src/services/google.ts`: `GoogleAuthService extends AbstractAuthModuleProvider`, `static identifier = "google"`.
43
+ - Implements `validateOptions`, `authenticate`, `validateCallback`; `register` throws `NOT_ALLOWED`.
44
+ - The `id_token` from the token endpoint is verified with `jsonwebtoken` against Google's JWKS (`jwks-rsa`, cached): `RS256`, `aud = clientId`, `iss` in `accounts.google.com` / `https://accounts.google.com`.
45
+ - Requested scopes are fixed: `email profile openid`.
46
+
47
+ ## Development
48
+
49
+ - `yarn build`, `yarn test`
50
+ - `yarn test:integration`: `integration-tests/__tests__/services.spec.ts` mocks Google token and JWKS endpoints with `msw`.
51
+
52
+ ## Gotchas
53
+
54
+ - `entity_id` is the `sub` claim, not the email. `user_metadata` (`name`, `email`, `picture`, `given_name`, `family_name`) is only written when the identity is first created; later logins don't refresh it.
55
+ - Login is rejected unless `email_verified` is true in the ID token.
56
+ - Tokens aren't stored (no `provider_metadata`), unlike `auth-github`.
57
+ - A body `callback_url` overrides `callbackUrl` per request with no allowlist; it must also be registered as a redirect URI in Google Cloud.
58
+ - For Google Workspace SSO with domain restrictions, `@medusajs/auth-oidc` (`allowed_email_domains`) is the better fit.
package/README.md CHANGED
@@ -1,11 +1,107 @@
1
- ## Testing
1
+ <p align="center">
2
+ <a href="https://www.medusajs.com">
3
+ <picture>
4
+ <source media="(prefers-color-scheme: dark)" srcset="https://user-images.githubusercontent.com/59018053/229103275-b5e482bb-4601-46e6-8142-244f531cebdb.svg">
5
+ <source media="(prefers-color-scheme: light)" srcset="https://user-images.githubusercontent.com/59018053/229103726-e5b529a3-9b3f-4970-8a1f-c6af37f087bf.svg">
6
+ <img alt="Medusa logo" src="https://user-images.githubusercontent.com/59018053/229103726-e5b529a3-9b3f-4970-8a1f-c6af37f087bf.svg">
7
+ </picture>
8
+ </a>
9
+ </p>
10
+ <h1 align="center">
11
+ @medusajs/auth-google
12
+ </h1>
2
13
 
3
- In order to manually test the flow, you can do the following:
14
+ <h4 align="center">
15
+ <a href="https://docs.medusajs.com">Documentation</a> |
16
+ <a href="https://www.medusajs.com">Website</a>
17
+ </h4>
4
18
 
5
- 1. Register an app in `https://console.cloud.google.com/apis/credentials/consent`
6
- 2. Generate clientId and clientSecret credentials in the console
7
- 3. Replace the values in the test with your credentials
8
- 4. Remove the `server.listen()` call
9
- 5. Run the tests, get the `location` value from the `authenticate` test, open the browser
10
- 6. Once redirected, copy the `code` param from the URL, and add it in one of the `callback` success tests
11
- 7. Once you run the tests, you should get back an access token, id token, and so on.
19
+ <p align="center">
20
+ Building blocks for digital commerce
21
+ </p>
22
+ <p align="center">
23
+ <a href="https://github.com/medusajs/medusa/blob/develop/LICENSE">
24
+ <img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="Medusa is released under the MIT license." />
25
+ </a>
26
+ <a href="https://github.com/medusajs/medusa/blob/develop/CONTRIBUTING.md">
27
+ <img src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat" alt="PRs welcome!" />
28
+ </a>
29
+ <a href="https://discord.gg/xpCwq3Kfn8">
30
+ <img src="https://img.shields.io/badge/chat-on%20discord-7289DA.svg" alt="Discord Chat" />
31
+ </a>
32
+ <a href="https://twitter.com/intent/follow?screen_name=medusajs">
33
+ <img src="https://img.shields.io/twitter/follow/medusajs.svg?label=Follow%20@medusajs" alt="Follow @medusajs" />
34
+ </a>
35
+ </p>
36
+
37
+ Google Auth Module Provider for Medusa: lets users and customers log in with their Google account through OAuth 2. Use it to add "Log in with Google" for customers, admin users, or custom actor types. It ships with `@medusajs/medusa` and is registered through the `@medusajs/medusa/auth-google` path.
38
+
39
+ ## At a glance
40
+
41
+ | | |
42
+ | --- | --- |
43
+ | Package | `@medusajs/auth-google` |
44
+ | Type | Module Provider (Auth Module) |
45
+ | Provider ID | `google` |
46
+ | Registered by default | No |
47
+ | Import from | `@medusajs/medusa/auth-google` |
48
+
49
+ ## Installation
50
+
51
+ No installation needed. The provider is a dependency of `@medusajs/medusa`.
52
+
53
+ ## Usage
54
+
55
+ Register the provider in the Auth Module's `providers` array in `medusa-config.ts`. Passing `providers` replaces the default list, so keep `emailpass` if you still need email/password login:
56
+
57
+ ```ts
58
+ import { defineConfig } from "@medusajs/framework/utils"
59
+
60
+ module.exports = defineConfig({
61
+ // ...
62
+ modules: [
63
+ {
64
+ resolve: "@medusajs/medusa/auth",
65
+ options: {
66
+ providers: [
67
+ {
68
+ resolve: "@medusajs/medusa/auth-emailpass",
69
+ id: "emailpass",
70
+ },
71
+ {
72
+ resolve: "@medusajs/medusa/auth-google",
73
+ id: "google",
74
+ options: {
75
+ clientId: process.env.GOOGLE_CLIENT_ID,
76
+ clientSecret: process.env.GOOGLE_CLIENT_SECRET,
77
+ callbackUrl: process.env.GOOGLE_CALLBACK_URL,
78
+ },
79
+ },
80
+ ],
81
+ },
82
+ },
83
+ ],
84
+ })
85
+ ```
86
+
87
+ The provider's `id` is the one used in authentication routes, such as `/auth/customer/google`.
88
+
89
+ ## Configuration
90
+
91
+ | Option | Type | Description | Default |
92
+ | --- | --- | --- | --- |
93
+ | `clientId` | `string` | Required. The OAuth client ID of your Google app. | - |
94
+ | `clientSecret` | `string` | Required. The OAuth client secret of your Google app. | - |
95
+ | `callbackUrl` | `string` | Required. The URL Google redirects to after authentication. Can be overridden per request with a `callback_url` body parameter. | - |
96
+
97
+ | Environment variable | Description |
98
+ | --- | --- |
99
+ | `GOOGLE_CLIENT_ID` | Value for `clientId`, as used in the example above. |
100
+ | `GOOGLE_CLIENT_SECRET` | Value for `clientSecret`, as used in the example above. |
101
+ | `GOOGLE_CALLBACK_URL` | Value for `callbackUrl`, as used in the example above. |
102
+
103
+ ## Resources
104
+
105
+ - [Google Auth Module Provider](https://docs.medusajs.com/resources/commerce-modules/auth/auth-providers/google)
106
+ - [Auth Providers](https://docs.medusajs.com/resources/commerce-modules/auth/auth-providers)
107
+ - [Auth Module](https://docs.medusajs.com/resources/commerce-modules/auth)
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@medusajs/auth-google",
3
- "version": "2.22.0-snapshot-20261020204851",
3
+ "version": "2.22.0",
4
4
  "description": "Google OAuth authentication provider for Medusa",
5
5
  "main": "dist/index.js",
6
6
  "repository": {
@@ -13,10 +13,14 @@
13
13
  },
14
14
  "files": [
15
15
  "dist",
16
+ "AGENTS.md",
16
17
  "!dist/**/__tests__",
17
18
  "!dist/**/__mocks__",
18
19
  "!dist/**/__fixtures__"
19
20
  ],
21
+ "llms": "https://docs.medusajs.com/llms.txt",
22
+ "llmsFull": "https://docs.medusajs.com/llms-full.txt",
23
+ "mcpServer": "https://docs.medusajs.com/mcp",
20
24
  "engines": {
21
25
  "node": ">=22.22.0"
22
26
  },
@@ -29,14 +33,14 @@
29
33
  "watch": "yarn run -T tsc --watch"
30
34
  },
31
35
  "devDependencies": {
32
- "@medusajs/framework": "2.22.0-snapshot-20261020204851"
36
+ "@medusajs/framework": "2.22.0"
33
37
  },
34
38
  "dependencies": {
35
39
  "jsonwebtoken": "^9.0.2",
36
40
  "jwks-rsa": "^3.1.0"
37
41
  },
38
42
  "peerDependencies": {
39
- "@medusajs/framework": "2.22.0-snapshot-20261020204851"
43
+ "@medusajs/framework": "2.22.0"
40
44
  },
41
45
  "keywords": [
42
46
  "medusa-provider",