@thorprovider/adapters 5.0.10 → 5.0.12

package/src/providers/medusa/auth.ts

@@ -179,7 +179,13 @@ export class MedusaAuthProvider implements AuthProvider {
       // Note: For session-based auth, the SDK automatically handles cookies
       // when auth.login() is called with auth.type='session' in SDK config
 
-      // Step 3: Fetch customer data
+      // Step 3: Link the customer to the publishable-key sales channel
+      // (idempotent). The order-history route is channel-scoped, so login must
+      // ensure the customer's channel link before any history read; a route that
+      // is unavailable is surfaced as a typed error rather than silently skipped.
+      await this.linkCustomerChannel();
+
+      // Step 4: Fetch customer data
       const customer = await this.getCurrentCustomer();
 
       this.logger.info('Login successful', { customerId: customer?.id });
@@ -189,6 +195,8 @@ export class MedusaAuthProvider implements AuthProvider {
         customer: customer ?? undefined,
       };
     } catch (error: any) {
+      // A typed channel-account failure is truthful and must not be masked.
+      if (error instanceof ProviderAPIError) throw error;
       this.logger.error('Login failed', error);
       throw new ProviderAPIError(
         `Authentication failed: ${error.message}`,
@@ -202,24 +210,29 @@ export class MedusaAuthProvider implements AuthProvider {
     this.logger.debug('register', { email: data.email });
 
     try {
-      // Step 1: Register auth identity with Medusa
-      // v2.16.0: register no longer accepts returnVerification option.
-      // The SDK auto-stores the registration JWT token for subsequent requests.
-      await this.sdk.auth.register('customer', 'emailpass', {
+      // Step 1: Register auth identity with Medusa.
+      // v2.16.0: register no longer accepts returnVerification option. It
+      // returns the registration JWT token and writes it into the SDK's
+      // request-scoped token storage (the caller's mutable custom storage).
+      const registrationToken = await this.sdk.auth.register('customer', 'emailpass', {
         email: data.email,
         password: data.password,
       });
 
-      // Step 2: Create customer profile
-      // The registration token is automatically included in the header by the SDK.
-      const { customer } = await this.sdk.store.customer.create({
-        email: data.email,
-        first_name: data.first_name,
-        last_name: data.last_name,
-        phone: data.phone,
-      });
+      // Step 2: Persist the registration token explicitly through the
+      // request-scoped MUTABLE custom storage so the customer-linking call
+      // carries it. The storage's `setItem` genuinely mutates the per-request
+      // holder (it is not a no-op), so the linking call is authenticated.
+      if (this.authConfig.method === 'jwt' && typeof registrationToken === 'string') {
+        await this.storageManager.setToken(registrationToken);
+      }
+
+      // Step 3: Create + link the customer to the publishable-key sales channel
+      // through the channel-linking route. The native `POST /store/customers`
+      // is NOT used: it does not link a channel and would mis-scope history.
+      const linked = await this.createChannelLinkedCustomer(data);
 
-      // Step 3: Login to obtain the actual session/token
+      // Step 4: Login to obtain the actual session/token.
       // v2.16.0: verification status is now returned by login, not register.
       const loginResult = await this.sdk.auth.login('customer', 'emailpass', {
         email: data.email,
@@ -250,19 +263,31 @@ export class MedusaAuthProvider implements AuthProvider {
 
       const token = loginResult;
 
-      // Step 4: Store actual auth token based on auth method
+      // Step 5: Store actual auth token based on auth method
       if (this.authConfig.method === 'jwt') {
         await this.storageManager.setToken(token);
       }
       // Note: For session-based auth, the SDK automatically handles cookies
 
+      // Step 6: An auth identity alone is NOT a complete customer. Resolve the
+      // linked customer and require it to be the one just created/linked.
+      const customer = await this.getCurrentCustomer();
+      if (!customer || customer.id !== linked.id) {
+        throw new ProviderAPIError(
+          'Registration created an auth identity without a linked customer.',
+          'CUSTOMER_LINK_INCOMPLETE',
+        );
+      }
+
       this.logger.info('Registration successful', { customerId: customer.id });
 
       return {
         token: this.authConfig.method === 'jwt' ? token : undefined,
-        customer: transformCustomer(customer, customer.email),
+        customer,
       };
     } catch (error: any) {
+      // A typed channel-account failure is truthful and must not be masked.
+      if (error instanceof ProviderAPIError) throw error;
       this.logger.error('Registration failed', error);
       throw new ProviderAPIError(
         `Registration failed: ${error.message}`,
@@ -271,6 +296,94 @@ export class MedusaAuthProvider implements AuthProvider {
       );
     }
   }
+
+  /**
+   * Create and channel-link a customer through `POST /store/thor/customers`.
+   *
+   * The request carries the registration token (read by the SDK from the
+   * request-scoped custom storage) and the publishable key; the backend links
+   * the customer to the publishable-key sales channel. A route that is
+   * unavailable fails closed with a typed error — there is no silent native
+   * fallback that would leave the customer unlinked.
+   */
+  private async createChannelLinkedCustomer(data: RegisterData): Promise<{ id: string }> {
+    const response = await this.fetchChannelAccountRoute<{ customer?: { id?: string } }>(
+      '/store/thor/customers',
+      {
+        method: 'POST',
+        body: {
+          email: data.email,
+          first_name: data.first_name,
+          last_name: data.last_name,
+          phone: data.phone,
+        },
+      },
+    );
+    const id = response?.customer?.id;
+    if (typeof id !== 'string' || id.length === 0) {
+      throw new ProviderAPIError(
+        'Channel-linked customer creation returned no customer id.',
+        'CUSTOMER_LINK_INCOMPLETE',
+      );
+    }
+    return { id };
+  }
+
+  /**
+   * Link the authenticated customer to the publishable-key sales channel
+   * through `POST /store/thor/customers/me/channels` (idempotent). Called after
+   * login so history is channel-scoped for the current storefront.
+   */
+  private async linkCustomerChannel(): Promise<void> {
+    const response = await this.fetchChannelAccountRoute<{
+      linked?: boolean;
+      reason?: string;
+    }>('/store/thor/customers/me/channels', { method: 'POST' });
+
+    // `linked:true` means the link was created now; `linked:false` is only valid
+    // when the link already existed. Any other shape is an incomplete link.
+    if (response?.linked === false && response?.reason !== 'already_linked') {
+      throw new ProviderAPIError(
+        'Customer channel link did not complete.',
+        'CUSTOMER_LINK_INCOMPLETE',
+      );
+    }
+  }
+
+  /**
+   * Call a Thor channel account route through the SDK client, which attaches
+   * the request-scoped customer/registration token and the publishable key. A
+   * missing client or an unavailable route (404/405/501) fails closed with a
+   * typed `CUSTOMER_LINK_UNAVAILABLE` error.
+   */
+  private async fetchChannelAccountRoute<T>(
+    path: string,
+    init: { method: 'GET' | 'POST'; body?: unknown; query?: Record<string, unknown> },
+  ): Promise<T> {
+    const client = (this.sdk as unknown as { client?: { fetch?: unknown } }).client;
+    if (!client || typeof client.fetch !== 'function') {
+      throw new ProviderAPIError(
+        `The channel account route ${path} is unavailable in this SDK.`,
+        'CUSTOMER_LINK_UNAVAILABLE',
+      );
+    }
+    try {
+      return await (
+        client.fetch as (p: string, i: typeof init) => Promise<T>
+      )(path, init);
+    } catch (error: any) {
+      const status = error?.status || error?.statusCode;
+      if (status === 404 || status === 405 || status === 501) {
+        throw new ProviderAPIError(
+          `The channel account route ${path} is unavailable (status ${status}).`,
+          'CUSTOMER_LINK_UNAVAILABLE',
+          status,
+        );
+      }
+      throw error;
+    }
+  }
+  
   
   async logout(): Promise<void> {
     this.logger.debug('logout');

package/src/providers/medusa/available-filters.test.ts

@@ -0,0 +1,280 @@
+/**
+ * Adapter facet truthfulness — E2 `storefront-catalog-search-filters` task 2.3.
+ *
+ * `getAvailableFilters` must never fabricate a numeric range or a per-option
+ * facet count. Medusa's Store `/store/products` returns matching products and a
+ * total count, not filterable values or their ranges, so no price range is read
+ * here and the control is omitted rather than defaulted to `0..10000`. A custom
+ * attribute range/count is emitted only when the backend actually supplies the
+ * finite metadata; a missing bound or count is omitted, never replaced by a
+ * `0`/`100` default or a synthesized `0`.
+ *
+ * The HTTP boundary is intercepted with msw against a controlled fixture, so
+ * the exact emitted filter shapes are asserted.
+ */
+import { describe, expect, it } from 'vitest'
+import { http, HttpResponse } from 'msw'
+import { server } from '../stelorder/client.test-helpers'
+import { MedusaProvider } from './index'
+
+const BASE = 'https://medusa.example.com'
+const PUB_KEY = 'pk_test_abc123'
+const CURRENCY = 'usd'
+
+const CATEGORIES = [
+  {
+    id: 'pcat_x',
+    name: 'Category X',
+    handle: 'x',
+    description: null,
+    parent_category_id: null,
+    product_count: 3,
+    metadata: null,
+  },
+]
+
+const COLLECTIONS = [
+  { id: 'pcol_c1', handle: 'c1', title: 'Collection One', metadata: null },
+]
+
+/** A `multi-select` attribute whose values carry real backend counts. */
+const MULTI_WITH_COUNTS = {
+  attribute_id: 'attr_ram',
+  attribute: {
+    name: 'RAM',
+    handle: 'ram',
+    type: 'multi-select',
+    is_filterable: true,
+    is_active: true,
+    ranking: 40,
+    values: [
+      { id: 'val_8', value: '8GB', count: 15 },
+      { id: 'val_16', value: '16GB', count: 23 },
+    ],
+  },
+}
+
+/** A `multi-select` attribute whose values carry no counts. */
+const MULTI_WITHOUT_COUNTS = {
+  attribute_id: 'attr_ram',
+  attribute: {
+    ...MULTI_WITH_COUNTS.attribute,
+    values: [
+      { id: 'val_8', value: '8GB' },
+      { id: 'val_16', value: '16GB' },
+    ],
+  },
+}
+
+/** A `number` attribute with a real backend range. */
+const RANGE_WITH_BOUNDS = {
+  attribute_id: 'attr_price',
+  attribute: {
+    name: 'Price',
+    handle: 'price-attr',
+    type: 'number',
+    is_filterable: true,
+    is_active: true,
+    ranking: 30,
+    metadata: { min: 5, max: 250 },
+  },
+}
+
+/** A `number` attribute with metadata but no real bounds. */
+const RANGE_WITHOUT_BOUNDS = {
+  attribute_id: 'attr_price',
+  attribute: {
+    ...RANGE_WITH_BOUNDS.attribute,
+    metadata: {},
+  },
+}
+
+function makeProvider() {
+  return new MedusaProvider({
+    baseUrl: BASE,
+    publishableKey: PUB_KEY,
+    currencyCode: CURRENCY,
+    debug: false,
+  })
+}
+
+interface Fixture {
+  /** Every `/store/custom-attributes/category/:id` request URL. */
+  customAttributeUrls: string[]
+}
+
+function installFixture(
+  attributes: Array<Record<string, unknown>> = [],
+): Fixture {
+  const fixture: Fixture = { customAttributeUrls: [] }
+  server.use(
+    // Thor plugin endpoints are absent; the static capability fallback applies
+    // (advancedSearch/customAttributes true) and channel scoping stays unscoped.
+    http.get(`${BASE}/store/thor/capabilities`, () =>
+      HttpResponse.json({}, { status: 404 }),
+    ),
+    http.get(`${BASE}/store/thor/categories`, () =>
+      HttpResponse.json({}, { status: 404 }),
+    ),
+    http.get(`${BASE}/store/thor/collections`, () =>
+      HttpResponse.json({}, { status: 404 }),
+    ),
+    // The optional advanced endpoint is absent: the facet-support probe must
+    // treat this as "not demonstrated" rather than reading a capability flag.
+    http.get(`${BASE}/store/search`, () =>
+      HttpResponse.json(
+        { error: 'Failed to search products', message: 'search unavailable' },
+        { status: 500 },
+      ),
+    ),
+    http.get(`${BASE}/store/product-categories`, () =>
+      HttpResponse.json({
+        product_categories: CATEGORIES,
+        count: CATEGORIES.length,
+        offset: 0,
+        limit: 50,
+      }),
+    ),
+    http.get(`${BASE}/store/collections`, () =>
+      HttpResponse.json({
+        collections: COLLECTIONS,
+        count: COLLECTIONS.length,
+        offset: 0,
+        limit: 100,
+      }),
+    ),
+    http.get(
+      `${BASE}/store/custom-attributes/category/:categoryId`,
+      ({ request }) => {
+        fixture.customAttributeUrls.push(request.url)
+        return HttpResponse.json({ attributes })
+      },
+    ),
+  )
+  return fixture
+}
+
+describe('MedusaProvider.getAvailableFilters — facet truthfulness', () => {
+  it('emits no price range when the backend supplies no price metadata (never 0..10000)', async () => {
+    installFixture()
+    const filters = await makeProvider().getAvailableFilters({
+      useAdvancedSearch: true,
+    })
+
+    // The call succeeded against the real backend: basic filters are present.
+    expect(filters.map((f) => f.id)).toContain('categories')
+    // No hardcoded price filter and no synthetic range anywhere.
+    expect(filters.find((f) => f.id === 'price')).toBeUndefined()
+    expect(
+      filters.some((f) => f.type === 'range' && f.min === 0 && f.max === 10000),
+    ).toBe(false)
+  })
+
+  it('does not offer the stock toggle when the optional endpoint is absent (a capability boolean is not proof)', async () => {
+    installFixture()
+    const filters = await makeProvider().getAvailableFilters({
+      useAdvancedSearch: true,
+    })
+    // `advancedSearch: true` is advertised by the backend, but the real
+    // `/store/search` endpoint returns 500, so `inStock` is held and no toggle
+    // is offered (E2 task 2.4).
+    expect(filters.find((f) => f.id === 'isAvailable')).toBeUndefined()
+  })
+
+  it('offers the stock toggle only when the optional endpoint demonstrates inStock', async () => {
+    installFixture()
+    server.use(
+      http.get(`${BASE}/store/search`, () =>
+        HttpResponse.json({ hits: [], applied_filters: { isAvailable: true } }),
+      ),
+    )
+    const filters = await makeProvider().getAvailableFilters({
+      useAdvancedSearch: true,
+    })
+    expect(filters.find((f) => f.id === 'isAvailable')).toMatchObject({
+      type: 'boolean',
+    })
+  })
+
+  it('returns basic category/collection options with no synthesized counts', async () => {
+    installFixture()
+    const filters = await makeProvider().getAvailableFilters({})
+
+    const categories = filters.find((f) => f.id === 'categories')
+    expect(categories?.options).toEqual([
+      { value: 'x', label: 'Category X', id: 'pcat_x' },
+    ])
+    expect(categories?.options?.[0]).not.toHaveProperty('count')
+
+    const collections = filters.find((f) => f.id === 'collections')
+    expect(collections?.options?.[0]).not.toHaveProperty('count')
+  })
+
+  it('omits attribute counts when the backend supplies none', async () => {
+    installFixture([MULTI_WITHOUT_COUNTS])
+    const filters = await makeProvider().getAvailableFilters({
+      categoryId: 'pcat_x',
+      includeBasicFilters: false,
+      includeFacetCounts: true,
+    })
+
+    const ram = filters.find((f) => f.id === 'ram')
+    expect(ram?.options).toHaveLength(2)
+    expect(ram?.options?.[0]).not.toHaveProperty('count')
+  })
+
+  it('emits attribute counts only from real backend-supplied numbers', async () => {
+    installFixture([MULTI_WITH_COUNTS])
+    const filters = await makeProvider().getAvailableFilters({
+      categoryId: 'pcat_x',
+      includeBasicFilters: false,
+      includeFacetCounts: true,
+    })
+
+    const ram = filters.find((f) => f.id === 'ram')
+    expect(ram?.options).toEqual([
+      { value: '8gb', label: '8GB', id: 'val_8', count: 15 },
+      { value: '16gb', label: '16GB', id: 'val_16', count: 23 },
+    ])
+  })
+
+  it('omits attribute counts when the caller did not request them', async () => {
+    installFixture([MULTI_WITH_COUNTS])
+    const filters = await makeProvider().getAvailableFilters({
+      categoryId: 'pcat_x',
+      includeBasicFilters: false,
+      includeFacetCounts: false,
+    })
+
+    const ram = filters.find((f) => f.id === 'ram')
+    expect(ram?.options?.[0]).not.toHaveProperty('count')
+  })
+
+  it('emits an attribute range only from real backend bounds', async () => {
+    installFixture([RANGE_WITH_BOUNDS])
+    const filters = await makeProvider().getAvailableFilters({
+      categoryId: 'pcat_x',
+      includeBasicFilters: false,
+    })
+
+    expect(filters.find((f) => f.id === 'price-attr')).toMatchObject({
+      type: 'range',
+      min: 5,
+      max: 250,
+    })
+  })
+
+  it('does not fabricate a 0/100 range when metadata bounds are missing', async () => {
+    installFixture([RANGE_WITHOUT_BOUNDS])
+    const filters = await makeProvider().getAvailableFilters({
+      categoryId: 'pcat_x',
+      includeBasicFilters: false,
+    })
+
+    // No fabricated range control at all.
+    expect(filters.find((f) => f.id === 'price-attr')).toBeUndefined()
+    expect(
+      filters.some((f) => f.type === 'range' && f.min === 0 && f.max === 100),
+    ).toBe(false)
+  })
+})