@thorprovider/adapters 5.0.11 → 5.0.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thorprovider/adapters",
-  "version": "5.0.11",
+  "version": "5.0.12",
   "description": "Framework-agnostic commerce adapters for Thor Commerce ecosystem - Multi-platform support with unified API",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -45,4 +45,4 @@
     "directory": "packages/adapters"
   },
   "license": "MIT"
-}
+}

package/src/providers/medusa/auth.test.ts

@@ -1,5 +1,13 @@
 /**
  * @fileoverview Tests for MedusaAuthProvider
+ *
+ * Covers the channel-linked registration/login workflow
+ * (change: storefront-live-auth-orders-acceptance, task 2.4):
+ * - the registration token is persisted in the request-scoped MUTABLE custom
+ *   storage before the customer-linking call, and that call carries it;
+ * - an auth identity without a linked customer is not treated as complete;
+ * - the channel-linking route being unavailable fails closed with a typed error;
+ * - login links the customer's channel idempotently.
  */
 
 import { describe, expect, it, vi } from 'vitest'
@@ -17,6 +25,9 @@ function makeSdkStub() {
       resetPassword: vi.fn(),
       updateProvider: vi.fn(),
     },
+    client: {
+      fetch: vi.fn(),
+    },
     store: {
       customer: {
         retrieve: vi.fn(),
@@ -31,20 +42,49 @@ function makeSdkStub() {
   } as unknown as Medusa
 }
 
-function makeStorageWithToken(token: string | null) {
+/** Access the stubbed SDK client fetch as a vitest mock. */
+function mockFetch(sdk: Medusa): ReturnType<typeof vi.fn> {
+  return sdk.client.fetch as unknown as ReturnType<typeof vi.fn>
+}
+
+/** A mutable request-scoped storage that records the order of its operations. */
+function makeRecordingStorage(
+  token: string | null,
+  events: string[] = [],
+): {
+  storage: {
+    getItem: (key: string) => Promise<string | null>
+    setItem: (key: string, value: string) => Promise<void>
+    removeItem: () => Promise<void>
+  }
+  peek: () => string | null
+} {
   let stored: string | null = token
   return {
-    getItem: () => Promise.resolve(stored),
-    setItem: (_key: string, value: string) => { stored = value; return Promise.resolve() },
-    removeItem: () => { stored = null; return Promise.resolve() },
+    storage: {
+      getItem: () => Promise.resolve(stored),
+      setItem: (_key: string, value: string) => {
+        stored = value
+        events.push(`set:${value}`)
+        return Promise.resolve()
+      },
+      removeItem: () => {
+        stored = null
+        events.push('remove')
+        return Promise.resolve()
+      },
+    },
+    peek: () => stored,
   }
 }
 
-function makeAuthConfig(token: string | null = 'jwt-bearer-token') {
+function makeAuthConfig(token: string | null = 'jwt-bearer-token', customStorage?: unknown) {
   return {
     method: 'jwt' as const,
     storage: 'memory' as const,
-    customStorage: makeStorageWithToken(token),
+    customStorage:
+      (customStorage as ReturnType<typeof makeRecordingStorage>['storage']) ??
+      makeRecordingStorage(token).storage,
   }
 }
 
@@ -56,7 +96,10 @@ describe('MedusaAuthProvider', () => {
   it('stores jwt token and returns customer on login', async () => {
     const sdk = makeSdkStub()
     sdk.auth.login = vi.fn().mockResolvedValue('jwt-bearer-token')
-    sdk.store.customer.retrieve = vi.fn().mockResolvedValue({ customer: { id: 'cus_1', email: 'test@example.com' } })
+    mockFetch(sdk).mockResolvedValue({ linked: true })
+    sdk.store.customer.retrieve = vi
+      .fn()
+      .mockResolvedValue({ customer: { id: 'cus_1', email: 'test@example.com' } })
 
     const provider = new MedusaAuthProvider(sdk, makeAuthConfig('jwt-bearer-token'), false)
 
@@ -70,13 +113,45 @@ describe('MedusaAuthProvider', () => {
     })
   })
 
+  it('links the customer channel idempotently on login', async () => {
+    const sdk = makeSdkStub()
+    sdk.auth.login = vi.fn().mockResolvedValue('jwt-bearer-token')
+    mockFetch(sdk).mockResolvedValue({ linked: false, reason: 'already_linked' })
+    sdk.store.customer.retrieve = vi
+      .fn()
+      .mockResolvedValue({ customer: { id: 'cus_1', email: 'test@example.com' } })
+
+    const provider = new MedusaAuthProvider(sdk, makeAuthConfig('jwt-bearer-token'), false)
+    const result = await provider.login({ email: 'test@example.com', password: 'secret' })
+
+    expect(sdk.client.fetch).toHaveBeenCalledWith(
+      '/store/thor/customers/me/channels',
+      expect.objectContaining({ method: 'POST' }),
+    )
+    expect(result.customer?.id).toBe('cus_1')
+  })
+
+  it('fails closed with a typed error when the channel link route is unavailable on login', async () => {
+    const sdk = makeSdkStub()
+    sdk.auth.login = vi.fn().mockResolvedValue('jwt-bearer-token')
+    mockFetch(sdk).mockRejectedValue(Object.assign(new Error('not found'), { status: 404 }))
+
+    const provider = new MedusaAuthProvider(sdk, makeAuthConfig('jwt-bearer-token'), false)
+
+    await expect(
+      provider.login({ email: 'test@example.com', password: 'secret' }),
+    ).rejects.toMatchObject({ provider: 'CUSTOMER_LINK_UNAVAILABLE' })
+  })
+
   it('throws ProviderAPIError with login code on auth failure', async () => {
     const sdk = makeSdkStub()
     sdk.auth.login = vi.fn().mockRejectedValue(new Error('bad credentials'))
 
     const provider = new MedusaAuthProvider(sdk, makeAuthConfig(), false)
 
-    await expect(provider.login({ email: 'test@example.com', password: 'secret' })).rejects.toMatchObject({
+    await expect(
+      provider.login({ email: 'test@example.com', password: 'secret' }),
+    ).rejects.toMatchObject({
       name: 'ProviderAPIError',
       code: 'PROVIDER_API_ERROR',
       provider: 'LOGIN_FAILED',
@@ -86,7 +161,9 @@ describe('MedusaAuthProvider', () => {
 
   it('returns requiresAction when login requires verification (v2.16.0)', async () => {
     const sdk = makeSdkStub()
-    sdk.auth.login = vi.fn().mockResolvedValue({ verification_required: true, token: 'verify-token' })
+    sdk.auth.login = vi
+      .fn()
+      .mockResolvedValue({ verification_required: true, token: 'verify-token' })
 
     const provider = new MedusaAuthProvider(sdk, makeAuthConfig(), false)
     const result = await provider.login({ email: 'test@example.com', password: 'secret' })
@@ -95,19 +172,22 @@ describe('MedusaAuthProvider', () => {
     expect(result.token).toBe('verify-token')
   })
 
-  it('stores jwt token and returns customer on register (v2.16.0)', async () => {
+  it('persists the registration token before the channel-linking call and returns the linked customer', async () => {
     const sdk = makeSdkStub()
-    sdk.auth.register = vi.fn().mockResolvedValue(undefined)
-    sdk.auth.login = vi.fn().mockResolvedValue('jwt-bearer-token')
-    sdk.store.customer.create = vi.fn().mockResolvedValue({
-      customer: { id: 'cus_1', email: 'test@example.com', first_name: 'Test', last_name: 'User' },
-    })
-    sdk.store.customer.retrieve = vi.fn().mockResolvedValue({
-      customer: { id: 'cus_1', email: 'test@example.com', first_name: 'Test', last_name: 'User' },
+    const events: string[] = []
+    const { storage } = makeRecordingStorage(null, events)
+    sdk.auth.register = vi.fn().mockResolvedValue('registration-token')
+    sdk.auth.login = vi.fn().mockResolvedValue('session-token')
+    mockFetch(sdk).mockImplementation(async (path: string) => {
+      events.push(`fetch:${path}`)
+      if (path === '/store/thor/customers') return { customer: { id: 'cus_1' } }
+      throw new Error(`unexpected ${path}`)
     })
+    sdk.store.customer.retrieve = vi
+      .fn()
+      .mockResolvedValue({ customer: { id: 'cus_1', email: 'test@example.com' } })
 
-    const provider = new MedusaAuthProvider(sdk, makeAuthConfig('jwt-bearer-token'), false)
-
+    const provider = new MedusaAuthProvider(sdk, makeAuthConfig(null, storage), false)
     const result = await provider.register({
       email: 'test@example.com',
       password: 'secret',
@@ -119,12 +199,55 @@ describe('MedusaAuthProvider', () => {
       email: 'test@example.com',
       password: 'secret',
     })
-    expect(sdk.auth.login).toHaveBeenCalledWith('customer', 'emailpass', {
-      email: 'test@example.com',
-      password: 'secret',
-    })
-    expect(result.token).toBe('jwt-bearer-token')
-    expect(result.customer?.email).toBe('test@example.com')
+    // The registration token was written to the request-scoped mutable storage
+    // BEFORE the linking call carried it.
+    expect(events.indexOf('set:registration-token')).toBeGreaterThanOrEqual(0)
+    expect(events.indexOf('set:registration-token')).toBeLessThan(
+      events.indexOf('fetch:/store/thor/customers'),
+    )
+    // The linking call goes through the channel-linking route, not native create.
+    expect(sdk.client.fetch).toHaveBeenCalledWith(
+      '/store/thor/customers',
+      expect.objectContaining({ method: 'POST' }),
+    )
+    expect(sdk.store.customer.create).not.toHaveBeenCalled()
+    expect(result.token).toBe('session-token')
+    expect(result.customer?.id).toBe('cus_1')
+  })
+
+  it('does not treat an auth identity without a linked customer as complete', async () => {
+    const sdk = makeSdkStub()
+    sdk.auth.register = vi.fn().mockResolvedValue('registration-token')
+    // The linking route returns no customer id -> incomplete.
+    mockFetch(sdk).mockResolvedValue({ customer: {} })
+
+    const provider = new MedusaAuthProvider(sdk, makeAuthConfig(null), false)
+
+    await expect(
+      provider.register({
+        email: 'test@example.com',
+        password: 'secret',
+        first_name: 'Test',
+        last_name: 'User',
+      }),
+    ).rejects.toMatchObject({ provider: 'CUSTOMER_LINK_INCOMPLETE' })
+  })
+
+  it('fails closed with a typed unavailable error when the linking route is missing', async () => {
+    const sdk = makeSdkStub()
+    sdk.auth.register = vi.fn().mockResolvedValue('registration-token')
+    mockFetch(sdk).mockRejectedValue(Object.assign(new Error('not found'), { status: 404 }))
+
+    const provider = new MedusaAuthProvider(sdk, makeAuthConfig(null), false)
+
+    await expect(
+      provider.register({
+        email: 'test@example.com',
+        password: 'secret',
+        first_name: 'Test',
+        last_name: 'User',
+      }),
+    ).rejects.toMatchObject({ provider: 'CUSTOMER_LINK_UNAVAILABLE' })
   })
 
   it('requires email when resetting password', async () => {

package/src/providers/medusa/auth.ts

@@ -179,7 +179,13 @@ export class MedusaAuthProvider implements AuthProvider {
       // Note: For session-based auth, the SDK automatically handles cookies
       // when auth.login() is called with auth.type='session' in SDK config
 
-      // Step 3: Fetch customer data
+      // Step 3: Link the customer to the publishable-key sales channel
+      // (idempotent). The order-history route is channel-scoped, so login must
+      // ensure the customer's channel link before any history read; a route that
+      // is unavailable is surfaced as a typed error rather than silently skipped.
+      await this.linkCustomerChannel();
+
+      // Step 4: Fetch customer data
       const customer = await this.getCurrentCustomer();
 
       this.logger.info('Login successful', { customerId: customer?.id });
@@ -189,6 +195,8 @@ export class MedusaAuthProvider implements AuthProvider {
         customer: customer ?? undefined,
       };
     } catch (error: any) {
+      // A typed channel-account failure is truthful and must not be masked.
+      if (error instanceof ProviderAPIError) throw error;
       this.logger.error('Login failed', error);
       throw new ProviderAPIError(
         `Authentication failed: ${error.message}`,
@@ -202,24 +210,29 @@ export class MedusaAuthProvider implements AuthProvider {
     this.logger.debug('register', { email: data.email });
 
     try {
-      // Step 1: Register auth identity with Medusa
-      // v2.16.0: register no longer accepts returnVerification option.
-      // The SDK auto-stores the registration JWT token for subsequent requests.
-      await this.sdk.auth.register('customer', 'emailpass', {
+      // Step 1: Register auth identity with Medusa.
+      // v2.16.0: register no longer accepts returnVerification option. It
+      // returns the registration JWT token and writes it into the SDK's
+      // request-scoped token storage (the caller's mutable custom storage).
+      const registrationToken = await this.sdk.auth.register('customer', 'emailpass', {
         email: data.email,
         password: data.password,
       });
 
-      // Step 2: Create customer profile
-      // The registration token is automatically included in the header by the SDK.
-      const { customer } = await this.sdk.store.customer.create({
-        email: data.email,
-        first_name: data.first_name,
-        last_name: data.last_name,
-        phone: data.phone,
-      });
+      // Step 2: Persist the registration token explicitly through the
+      // request-scoped MUTABLE custom storage so the customer-linking call
+      // carries it. The storage's `setItem` genuinely mutates the per-request
+      // holder (it is not a no-op), so the linking call is authenticated.
+      if (this.authConfig.method === 'jwt' && typeof registrationToken === 'string') {
+        await this.storageManager.setToken(registrationToken);
+      }
+
+      // Step 3: Create + link the customer to the publishable-key sales channel
+      // through the channel-linking route. The native `POST /store/customers`
+      // is NOT used: it does not link a channel and would mis-scope history.
+      const linked = await this.createChannelLinkedCustomer(data);
 
-      // Step 3: Login to obtain the actual session/token
+      // Step 4: Login to obtain the actual session/token.
       // v2.16.0: verification status is now returned by login, not register.
       const loginResult = await this.sdk.auth.login('customer', 'emailpass', {
         email: data.email,
@@ -250,19 +263,31 @@ export class MedusaAuthProvider implements AuthProvider {
 
       const token = loginResult;
 
-      // Step 4: Store actual auth token based on auth method
+      // Step 5: Store actual auth token based on auth method
       if (this.authConfig.method === 'jwt') {
         await this.storageManager.setToken(token);
       }
       // Note: For session-based auth, the SDK automatically handles cookies
 
+      // Step 6: An auth identity alone is NOT a complete customer. Resolve the
+      // linked customer and require it to be the one just created/linked.
+      const customer = await this.getCurrentCustomer();
+      if (!customer || customer.id !== linked.id) {
+        throw new ProviderAPIError(
+          'Registration created an auth identity without a linked customer.',
+          'CUSTOMER_LINK_INCOMPLETE',
+        );
+      }
+
       this.logger.info('Registration successful', { customerId: customer.id });
 
       return {
         token: this.authConfig.method === 'jwt' ? token : undefined,
-        customer: transformCustomer(customer, customer.email),
+        customer,
       };
     } catch (error: any) {
+      // A typed channel-account failure is truthful and must not be masked.
+      if (error instanceof ProviderAPIError) throw error;
       this.logger.error('Registration failed', error);
       throw new ProviderAPIError(
         `Registration failed: ${error.message}`,
@@ -271,6 +296,94 @@ export class MedusaAuthProvider implements AuthProvider {
       );
     }
   }
+
+  /**
+   * Create and channel-link a customer through `POST /store/thor/customers`.
+   *
+   * The request carries the registration token (read by the SDK from the
+   * request-scoped custom storage) and the publishable key; the backend links
+   * the customer to the publishable-key sales channel. A route that is
+   * unavailable fails closed with a typed error — there is no silent native
+   * fallback that would leave the customer unlinked.
+   */
+  private async createChannelLinkedCustomer(data: RegisterData): Promise<{ id: string }> {
+    const response = await this.fetchChannelAccountRoute<{ customer?: { id?: string } }>(
+      '/store/thor/customers',
+      {
+        method: 'POST',
+        body: {
+          email: data.email,
+          first_name: data.first_name,
+          last_name: data.last_name,
+          phone: data.phone,
+        },
+      },
+    );
+    const id = response?.customer?.id;
+    if (typeof id !== 'string' || id.length === 0) {
+      throw new ProviderAPIError(
+        'Channel-linked customer creation returned no customer id.',
+        'CUSTOMER_LINK_INCOMPLETE',
+      );
+    }
+    return { id };
+  }
+
+  /**
+   * Link the authenticated customer to the publishable-key sales channel
+   * through `POST /store/thor/customers/me/channels` (idempotent). Called after
+   * login so history is channel-scoped for the current storefront.
+   */
+  private async linkCustomerChannel(): Promise<void> {
+    const response = await this.fetchChannelAccountRoute<{
+      linked?: boolean;
+      reason?: string;
+    }>('/store/thor/customers/me/channels', { method: 'POST' });
+
+    // `linked:true` means the link was created now; `linked:false` is only valid
+    // when the link already existed. Any other shape is an incomplete link.
+    if (response?.linked === false && response?.reason !== 'already_linked') {
+      throw new ProviderAPIError(
+        'Customer channel link did not complete.',
+        'CUSTOMER_LINK_INCOMPLETE',
+      );
+    }
+  }
+
+  /**
+   * Call a Thor channel account route through the SDK client, which attaches
+   * the request-scoped customer/registration token and the publishable key. A
+   * missing client or an unavailable route (404/405/501) fails closed with a
+   * typed `CUSTOMER_LINK_UNAVAILABLE` error.
+   */
+  private async fetchChannelAccountRoute<T>(
+    path: string,
+    init: { method: 'GET' | 'POST'; body?: unknown; query?: Record<string, unknown> },
+  ): Promise<T> {
+    const client = (this.sdk as unknown as { client?: { fetch?: unknown } }).client;
+    if (!client || typeof client.fetch !== 'function') {
+      throw new ProviderAPIError(
+        `The channel account route ${path} is unavailable in this SDK.`,
+        'CUSTOMER_LINK_UNAVAILABLE',
+      );
+    }
+    try {
+      return await (
+        client.fetch as (p: string, i: typeof init) => Promise<T>
+      )(path, init);
+    } catch (error: any) {
+      const status = error?.status || error?.statusCode;
+      if (status === 404 || status === 405 || status === 501) {
+        throw new ProviderAPIError(
+          `The channel account route ${path} is unavailable (status ${status}).`,
+          'CUSTOMER_LINK_UNAVAILABLE',
+          status,
+        );
+      }
+      throw error;
+    }
+  }
+  
   
   async logout(): Promise<void> {
     this.logger.debug('logout');

package/src/providers/medusa/customer-orders.test.ts

@@ -0,0 +1,142 @@
+/**
+ * @fileoverview Channel-scoped customer orders tests (MedusaProvider).
+ *
+ * Covers the account channel-API selection
+ * (change: storefront-live-auth-orders-acceptance, tasks 2.1–2.2, 2.5):
+ * - the paginated call goes to `GET /store/thor/orders` (customer + publishable
+ *   key sales channel) carrying the request's token, and no client-side
+ *   `filterByChannel` runs;
+ * - `getOrders` keeps its legacy `Order[]` return via the same channel route;
+ * - a foreign-channel order (a multi-channel key silently scoped to a first id)
+ *   fails closed with a typed error (AC-AUTH-4.5).
+ */
+
+import { describe, expect, it } from 'vitest'
+import { http, HttpResponse } from 'msw'
+import { server } from '../stelorder/client.test-helpers'
+import { MedusaProvider } from './index'
+
+const BASE = 'https://medusa.example.com'
+const PUB_KEY = 'pk_test_channel'
+const STORE_CHANNEL = 'sc_store'
+const TOKEN = 'request-scoped-customer-token'
+
+/** A minimal Medusa order the transform understands. */
+function medusaOrder(id: string, salesChannelId: string, displayId: number) {
+  return {
+    id,
+    display_id: displayId,
+    status: 'pending',
+    created_at: '2026-01-01T00:00:00.000Z',
+    updated_at: '2026-01-01T00:00:00.000Z',
+    email: 'buyer@example.com',
+    currency_code: 'usd',
+    total: 1000,
+    subtotal: 1000,
+    sales_channel_id: salesChannelId,
+    items: [],
+  }
+}
+
+/** A request-scoped custom storage holding exactly the request token. */
+function makeProvider() {
+  return new MedusaProvider({
+    baseUrl: BASE,
+    publishableKey: PUB_KEY,
+    currencyCode: 'usd',
+    debug: false,
+    auth: {
+      method: 'jwt',
+      storage: 'memory',
+      customStorage: {
+        getItem: () => TOKEN,
+        setItem: () => {},
+        removeItem: () => {},
+      },
+    },
+  })
+}
+
+describe('MedusaProvider — channel-scoped customer orders', () => {
+  it('calls GET /store/thor/orders with the request token and paginated window', async () => {
+    const captured: { url: string; auth: string | null }[] = []
+    server.use(
+      http.get(`${BASE}/store/thor/orders`, ({ request }) => {
+        captured.push({
+          url: request.url,
+          auth: request.headers.get('authorization'),
+        })
+        return HttpResponse.json({
+          orders: [medusaOrder('order_1', STORE_CHANNEL, 1)],
+          count: 12,
+          limit: 5,
+          offset: 5,
+        })
+      }),
+    )
+
+    const provider = makeProvider()
+    const page = await provider.customerOrdersPage({
+      page: 2,
+      pageSize: 5,
+      salesChannelId: STORE_CHANNEL,
+    })
+
+    expect(captured).toHaveLength(1)
+    const params = new URL(captured[0].url).searchParams
+    expect(new URL(captured[0].url).pathname).toBe('/store/thor/orders')
+    expect(params.get('limit')).toBe('5')
+    expect(params.get('offset')).toBe('5')
+    // The SDK attaches the request-scoped token as a bearer header.
+    expect(captured[0].auth).toBe(`Bearer ${TOKEN}`)
+    // The backend's real count is passed through, not a page length.
+    expect(page.count).toBe(12)
+    expect(page.limit).toBe(5)
+    expect(page.offset).toBe(5)
+    expect(page.orders).toHaveLength(1)
+  })
+
+  it('keeps the legacy getOrders surface array-returning through the channel route', async () => {
+    let calledPath = ''
+    server.use(
+      http.get(`${BASE}/store/thor/orders`, ({ request }) => {
+        calledPath = new URL(request.url).pathname
+        return HttpResponse.json({
+          orders: [
+            medusaOrder('order_1', STORE_CHANNEL, 1),
+            medusaOrder('order_2', STORE_CHANNEL, 2),
+          ],
+          count: 2,
+          limit: 100,
+          offset: 0,
+        })
+      }),
+    )
+
+    const provider = makeProvider()
+    const orders = await provider.getOrders({ salesChannelId: STORE_CHANNEL })
+
+    expect(calledPath).toBe('/store/thor/orders')
+    expect(Array.isArray(orders)).toBe(true)
+    expect(orders).toHaveLength(2)
+    expect(orders.map((o) => o.id)).toEqual(['order_1', 'order_2'])
+  })
+
+  it('fails closed when the backend returns a foreign-channel order', async () => {
+    server.use(
+      http.get(`${BASE}/store/thor/orders`, () =>
+        HttpResponse.json({
+          orders: [medusaOrder('order_foreign', 'sc_other', 9)],
+          count: 1,
+          limit: 10,
+          offset: 0,
+        }),
+      ),
+    )
+
+    const provider = makeProvider()
+    await expect(
+      provider.customerOrdersPage({ page: 1, pageSize: 10, salesChannelId: STORE_CHANNEL }),
+    ).rejects.toMatchObject({ name: 'ProviderAPIError' })
+  })
+})