@open-mercato/core 0.4.8-develop-28cee031d6 → 0.4.8-develop-15259be22b

package/src/modules/customer_accounts/lib/customerAuthServer.ts

@@ -0,0 +1,54 @@
+/**
+ * Server-side customer auth helpers for Next.js server components.
+ *
+ * Uses the `cookies()` API from `next/headers` to read the customer auth token
+ * from cookies — analogous to `getAuthFromCookies()` for staff auth.
+ */
+
+import { cookies } from 'next/headers'
+import { verifyJwt } from '@open-mercato/shared/lib/auth/jwt'
+import type { CustomerAuthContext } from './customerAuth'
+
+export type { CustomerAuthContext }
+
+/**
+ * Read and verify customer auth from cookies in server components.
+ *
+ * Returns the customer auth context if a valid customer JWT is found,
+ * or null if not authenticated.
+ *
+ * @example
+ * ```tsx
+ * // In a server component or catch-all route
+ * import { getCustomerAuthFromCookies } from '@open-mercato/core/modules/customer_accounts/lib/customerAuthServer'
+ *
+ * const customerAuth = await getCustomerAuthFromCookies()
+ * if (!customerAuth) redirect('/login')
+ * ```
+ */
+export async function getCustomerAuthFromCookies(): Promise<CustomerAuthContext | null> {
+  const cookieStore = await cookies()
+  const token = cookieStore.get('customer_auth_token')?.value
+  if (!token) return null
+
+  try {
+    const payload = verifyJwt(token) as Record<string, unknown> | null
+    if (!payload) return null
+    if (payload.type !== 'customer') return null
+
+    return {
+      sub: String(payload.sub),
+      type: 'customer',
+      tenantId: String(payload.tenantId),
+      orgId: String(payload.orgId),
+      email: String(payload.email || ''),
+      displayName: String(payload.displayName || ''),
+      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,
+      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,
+      resolvedFeatures: Array.isArray(payload.resolvedFeatures) ? payload.resolvedFeatures as string[] : [],
+    }
+  } catch {
+    // Invalid or expired JWT — treat as unauthenticated
+    return null
+  }
+}

package/src/modules/customer_accounts/lib/rateLimiter.ts

@@ -0,0 +1,36 @@
+import { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'
+import { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'
+
+export const customerLoginRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_LOGIN', {
+  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'customer-login',
+})
+
+export const customerLoginIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_LOGIN_IP', {
+  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'customer-login-ip',
+})
+
+export const customerSignupRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_SIGNUP', {
+  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-signup',
+})
+
+export const customerSignupIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_SIGNUP_IP', {
+  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-signup-ip',
+})
+
+export const customerPasswordResetRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_PASSWORD_RESET', {
+  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-password-reset',
+})
+
+export const customerPasswordResetIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_PASSWORD_RESET_IP', {
+  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-password-reset-ip',
+})
+
+export const customerMagicLinkRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_MAGIC_LINK', {
+  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link',
+})
+
+export const customerMagicLinkIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_MAGIC_LINK_IP', {
+  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link-ip',
+})
+
+export { checkAuthRateLimit, resetAuthRateLimit }

package/src/modules/customer_accounts/lib/tokenGenerator.ts

@@ -0,0 +1,9 @@
+import crypto from 'node:crypto'
+
+export function generateSecureToken(): string {
+  return crypto.randomBytes(32).toString('base64url')
+}
+
+export function hashToken(token: string): string {
+  return crypto.createHash('sha256').update(token).digest('hex')
+}