@reactionary/magento 0.12.4 → 0.12.7

package/capabilities/identity.capability.js

@@ -9,20 +9,21 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 import {
-  IdentityCapability,
   Reactionary,
   IdentityQuerySelfSchema,
   IdentitySchema,
   IdentityMutationRegisterSchema,
   IdentityMutationLoginSchema,
   IdentityMutationLogoutSchema,
+  error,
   success
 } from "@reactionary/core";
+import { OidcIdentityCapability } from "@reactionary/oidc";
 import createDebug from "debug";
 const debug = createDebug("reactionary:magento:identity");
-class MagentoIdentityCapability extends IdentityCapability {
+class MagentoIdentityCapability extends OidcIdentityCapability {
   constructor(config, cache, context, magentoApi) {
-    super(cache, context);
+    super(cache, context, config.externalIdentityProviders);
     this.magentoApi = magentoApi;
     this.config = config;
   }
@@ -92,6 +93,21 @@ class MagentoIdentityCapability extends IdentityCapability {
       password: payload.password
     });
   }
+  /**
+   * Stock Magento has no external login. Once the shared OpenID Connect client has verified the identity, this
+   * finds or creates the customer by verified email (the pattern in Adobe's social login guide) and issues a
+   * customer token. An existing account with the same email is signed in, which is only appropriate for identity
+   * providers the shop owner trusts: that is what the configured provider list is.
+   */
+  async exchangeExternalIdentity(input) {
+    const email = input.claims["email"];
+    if (typeof email !== "string" || email.length === 0) {
+      return error({ type: "InvalidInput", error: "The identity provider did not return an email address" });
+    }
+    await this.magentoApi.loginWithExternalIdentity({ email, ...namesFromClaims(input.claims) });
+    const me = await this.magentoApi.getMe();
+    return success({ type: "Registered", id: { userId: String(me.id) } });
+  }
 }
 __decorateClass([
   Reactionary({
@@ -117,6 +133,16 @@ __decorateClass([
     outputSchema: IdentitySchema
   })
 ], MagentoIdentityCapability.prototype, "register", 1);
+function namesFromClaims(claims) {
+  const text = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
+  const given = text(claims["given_name"]);
+  const family = text(claims["family_name"]);
+  if (given || family) {
+    return { firstName: given ?? "User", lastName: family ?? "Account" };
+  }
+  const [first, ...rest] = (text(claims["name"]) ?? "").split(" ").filter(Boolean);
+  return { firstName: first ?? "User", lastName: rest.join(" ") || "Account" };
+}
 export {
   MagentoIdentityCapability
 };

package/core/client.js

@@ -15,6 +15,11 @@ function ensureMagentoPasswordPolicy(password) {
   if (!/[^A-Za-z0-9]/.test(password)) suffix += "!";
   return `${password}${suffix}`;
 }
+function randomMagentoPassword() {
+  const bytes = new Uint8Array(24);
+  crypto.getRandomValues(bytes);
+  return ensureMagentoPasswordPolicy(btoa(String.fromCharCode(...bytes)));
+}
 class RequestContextTokenStore {
   constructor(context, keyPrefix = "__x") {
     this.context = context;
@@ -160,6 +165,34 @@ class Magento {
       await this.tokenStore.setItem("customerToken", normalized);
       return normalized;
     },
+    /**
+     * Establishes a customer session for a verified external identity, the way Adobe's social login guide does:
+     * find the customer by email, create it if there is none, then issue a customer token with the admin key.
+     * Needs the Storefront Compatibility Package (4.7.6+) for POST /V1/customers/{id}/token.
+     */
+    loginWithExternalIdentity: async (identity) => {
+      const params = new URLSearchParams();
+      params.set("searchCriteria[filterGroups][0][filters][0][field]", "email");
+      params.set("searchCriteria[filterGroups][0][filters][0][value]", identity.email);
+      params.set("searchCriteria[filterGroups][0][filters][0][condition_type]", "eq");
+      params.set("searchCriteria[pageSize]", "1");
+      const found = await this.adminRest.request(
+        "GET",
+        `/V1/customers/search?${params.toString()}`
+      );
+      let customerId = found.items?.[0]?.id;
+      if (customerId === void 0) {
+        const created = await this.adminRest.request("POST", "/V1/customers", {
+          customer: { email: identity.email, firstname: identity.firstName, lastname: identity.lastName },
+          password: randomMagentoPassword()
+        });
+        customerId = created.id;
+      }
+      const token = await this.adminRest.request("POST", `/V1/customers/${customerId}/token`);
+      const normalized = typeof token === "string" ? token.replace(/^"|"$/g, "") : String(token);
+      await this.tokenStore.setItem("customerToken", normalized);
+      return normalized;
+    },
     logout: async () => {
       await this.tokenStore.removeItem("customerToken");
     }
@@ -297,6 +330,16 @@ class Magento {
       }
     },
     cart: {
+      /**
+       * Moves a guest cart's items into the signed-in customer's cart (Adobe's recommended step after login).
+       * Must run with the customer token already stored.
+       */
+      mergeGuestCart: async (guestCartId) => {
+        await this.gql.request(
+          "mutation MergeGuestCart($source: String!) { mergeCarts(source_cart_id: $source) { id } }",
+          { source: guestCartId }
+        );
+      },
       create: async (customerToken) => {
         if (customerToken) {
           const res2 = await this.rest.request("POST", "/V1/carts/mine");
@@ -455,6 +498,25 @@ class MagentoClient {
     const client = await this.getClient();
     return client.auth.login(email, password);
   }
+  /**
+   * Signs in a verified external identity (see Magento.auth.loginWithExternalIdentity) and carries a guest cart over.
+   * The guest cart id is cleared either way: after login the cart endpoints use /carts/mine, and a stale id would
+   * make getSelf report a guest after the next logout.
+   */
+  async loginWithExternalIdentity(identity) {
+    const client = await this.getClient();
+    const guestCartId = await this.getActiveCartId();
+    const token = await client.auth.loginWithExternalIdentity(identity);
+    if (guestCartId) {
+      try {
+        await client.store.cart.mergeGuestCart(guestCartId);
+      } catch (err) {
+        debug("Could not merge the guest cart after external login:", err);
+      }
+      await this.clearActiveCartId();
+    }
+    return token;
+  }
   async logout() {
     const client = await this.getClient();
     return client.auth.logout();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reactionary/magento",
-  "version": "0.12.4",
+  "version": "0.12.7",
   "type": "module",
   "main": "./index.js",
   "types": "./src/index.d.ts",
@@ -9,9 +9,10 @@
     "url": "git+https://github.com/Solteq/reactionary.git"
   },
   "dependencies": {
-    "@reactionary/core": "0.12.4",
+    "@reactionary/core": "0.12.7",
     "zod": "4.1.9",
-    "debug": "^4.4.3"
+    "debug": "^4.4.3",
+    "@reactionary/oidc": "0.12.7"
   },
   "devDependencies": {
     "vitest": "^4.0.9"

package/schema/configuration.schema.js

@@ -1,4 +1,5 @@
 import * as z from "zod";
+import { ExternalIdentityProviderSchema } from "@reactionary/oidc";
 const MagentoConfigurationSchema = z.looseObject({
   adminApiKey: z.string().meta({ description: "The API key for Magento admin operations. Needed for the few tasks that require admin access." }),
   baseUrl: z.string().meta({ description: "The base URL for the Magento installation." }),
@@ -11,6 +12,7 @@ const MagentoConfigurationSchema = z.looseObject({
   reviewRatingCode: z.string().optional().meta({ description: 'The name of the Magento review rating (as listed by `productReviewRatingsMetadata`) that carries the overall star rating. Defaults to "Rating"; the first available rating is used as a fallback.' }),
   storeCode: z.string().default(""),
   checkoutAgreementIds: z.array(z.string()).optional().meta({ description: "Ids of the Magento terms and conditions (Magento_CheckoutAgreements) the shopper accepts when placing an order. Required by stores with \"Enable Terms and Conditions\" on, which otherwise reject order placement. Sent as the payment method's `extension_attributes.agreement_ids`. The storefront must collect the shopper's consent before finalizing checkout." }),
+  externalIdentityProviders: z.array(ExternalIdentityProviderSchema).optional().meta({ description: "OpenID Connect identity providers shoppers can sign in with. Stock Magento has no social login, so reactionary runs the OpenID Connect flow and then creates or finds the customer by verified email and issues a customer token (Adobe's documented pattern). The admin API key needs the Magento_Customer::retrieve_tokens permission and the Storefront Compatibility Package (4.7.6 or newer) must be installed." }),
   authStoreCode: z.string().default("default").meta({ description: "The store/website scope used for customer authentication and account operations (token, customers/me). Customers typically live on the default website, which may differ from the catalog storeCode." })
 });
 export {

package/src/capabilities/identity.capability.d.ts

@@ -1,7 +1,8 @@
-import { type Identity, type IdentityMutationLogin, type IdentityMutationLogout, type IdentityMutationRegister, type IdentityQuerySelf, type RequestContext, type Cache, IdentityCapability, type AnonymousIdentity, type Result } from '@reactionary/core';
+import { type Identity, type IdentityConflictError, type IdentityMutationLogin, type IdentityMutationLogout, type IdentityMutationRegister, type IdentityQuerySelf, type RequestContext, type Cache, type AnonymousIdentity, type Result } from '@reactionary/core';
+import { OidcIdentityCapability, type ExchangeExternalIdentityInput } from '@reactionary/oidc';
 import type { MagentoClient } from '../core/client.js';
 import type { MagentoConfiguration } from '../schema/configuration.schema.js';
-export declare class MagentoIdentityCapability extends IdentityCapability {
+export declare class MagentoIdentityCapability extends OidcIdentityCapability {
     magentoApi: MagentoClient;
     protected config: MagentoConfiguration;
     constructor(config: MagentoConfiguration, cache: Cache, context: RequestContext, magentoApi: MagentoClient);
@@ -10,4 +11,11 @@ export declare class MagentoIdentityCapability extends IdentityCapability {
     login(payload: IdentityMutationLogin): Promise<Result<Identity>>;
     logout(_payload: IdentityMutationLogout): Promise<Result<Identity>>;
     register(payload: IdentityMutationRegister): Promise<Result<Identity>>;
+    /**
+     * Stock Magento has no external login. Once the shared OpenID Connect client has verified the identity, this
+     * finds or creates the customer by verified email (the pattern in Adobe's social login guide) and issues a
+     * customer token. An existing account with the same email is signed in, which is only appropriate for identity
+     * providers the shop owner trusts: that is what the configured provider list is.
+     */
+    protected exchangeExternalIdentity(input: ExchangeExternalIdentityInput): Promise<Result<Identity, IdentityConflictError>>;
 }

package/src/core/client.d.ts

@@ -55,6 +55,16 @@ export declare class Magento {
     private get gql();
     auth: {
         login: (email: string, password: string) => Promise<string>;
+        /**
+         * Establishes a customer session for a verified external identity, the way Adobe's social login guide does:
+         * find the customer by email, create it if there is none, then issue a customer token with the admin key.
+         * Needs the Storefront Compatibility Package (4.7.6+) for POST /V1/customers/{id}/token.
+         */
+        loginWithExternalIdentity: (identity: {
+            email: string;
+            firstName: string;
+            lastName: string;
+        }) => Promise<string>;
         logout: () => Promise<void>;
     };
     store: {
@@ -95,6 +105,11 @@ export declare class Magento {
             placeOrder: (cartId: string | null, payload: MagentoPlaceOrderPayload, customerToken?: string | null) => Promise<number>;
         };
         cart: {
+            /**
+             * Moves a guest cart's items into the signed-in customer's cart (Adobe's recommended step after login).
+             * Must run with the customer token already stored.
+             */
+            mergeGuestCart: (guestCartId: string) => Promise<void>;
             create: (customerToken?: string | null) => Promise<string>;
             get: (cartId?: string | null, customerToken?: string | null) => Promise<any>;
             getTotals: (cartId?: string | null, customerToken?: string | null) => Promise<any>;
@@ -128,6 +143,16 @@ export declare class MagentoClient {
     constructor(config: MagentoConfiguration, context: RequestContext);
     getClient(): Promise<Magento>;
     login(email: string, password: string): Promise<string>;
+    /**
+     * Signs in a verified external identity (see Magento.auth.loginWithExternalIdentity) and carries a guest cart over.
+     * The guest cart id is cleared either way: after login the cart endpoints use /carts/mine, and a stale id would
+     * make getSelf report a guest after the next logout.
+     */
+    loginWithExternalIdentity(identity: {
+        email: string;
+        firstName: string;
+        lastName: string;
+    }): Promise<string>;
     logout(): Promise<void>;
     getMe(): Promise<any>;
     getCustomerToken(): Promise<string | null>;

package/src/schema/configuration.schema.d.ts

@@ -14,6 +14,20 @@ export declare const MagentoConfigurationSchema: z.ZodObject<{
     reviewRatingCode: z.ZodOptional<z.ZodString>;
     storeCode: z.ZodDefault<z.ZodString>;
     checkoutAgreementIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    externalIdentityProviders: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        displayName: z.ZodString;
+        brand: z.ZodOptional<z.ZodString>;
+        issuer: z.ZodURL;
+        clientId: z.ZodString;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        authorizationEndpoint: z.ZodOptional<z.ZodURL>;
+        tokenEndpoint: z.ZodOptional<z.ZodURL>;
+        jwksUri: z.ZodOptional<z.ZodURL>;
+    }, z.core.$loose>>>;
     authStoreCode: z.ZodDefault<z.ZodString>;
 }, z.core.$loose>;
 export type MagentoConfiguration = z.infer<typeof MagentoConfigurationSchema>;