@thorprovider/medusa-extended 1.11.7 → 1.11.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thorprovider/medusa-extended",
-  "version": "1.11.7",
+  "version": "1.11.8",
   "description": "Thor Commerce multi-tenant admin extensions for Medusa v2",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@thorprovider/adapters": "^5.0.8",
-    "@thorprovider/types": "^5.3.6"
+    "@thorprovider/types": "^5.3.8"
   },
   "devDependencies": {
     "msw": "^2.12.3",

package/src/index.ts

@@ -9,3 +9,6 @@ export type { MedusaAdminClientConfig } from './admin';
 export { DropshipperClient } from './dropshipper';
 export type { DropshipperClientConfig, ChatStreamEvent } from './dropshipper';
 
+export { RecoveryClient } from './recovery';
+export type { RecoveryClientConfig } from './recovery';
+

package/src/recovery.ts

@@ -0,0 +1,247 @@
+/**
+ * @fileoverview Recovery Client — Thor Commerce Extended
+ * @module @thorprovider/medusa-extended/recovery
+ *
+ * Public HTTP client for account-recovery flows (password reset + activation).
+ *
+ * Unlike `DropshipperClient`, this client does NOT require a JWT: it talks to
+ * public storefront endpoints so a user can recover access without being
+ * logged in. Backend URLs are owned here; the dashboard never builds them.
+ *
+ * Endpoints:
+ *   - `POST /auth/user/emailpass/reset-password`           (request reset, Medusa native)
+ *   - `GET  /store/dropshipper/auth/reset-password/verify`  (verify reset token, no consume)
+ *   - `POST /auth/user/emailpass/update`                    (confirm reset, consumes token)
+ *   - `GET  /store/dropshipper/applications/activate/verify`(verify activation token, no consume)
+ *   - `POST /store/dropshipper/applications/activate`       (confirm activation, consumes token)
+ *
+ * Confirm methods follow the two-phase contract: verify (no consume) first,
+ * then confirm (atomic consume). A re-verify after a failed confirm maps the
+ * TOCTOU state (used/expired/revoked) into `RecoveryConfirmResult.status`.
+ */
+
+import type { TokenVerifyResult, RecoveryConfirmResult } from '@thorprovider/types';
+import { createLogger, ProviderAPIError } from '@thorprovider/adapters';
+import { fetchBackendWithResilience } from './request-resilience';
+
+type FetchMethod = 'GET' | 'POST';
+
+/**
+ * Configuration required to instantiate the recovery client.
+ */
+export interface RecoveryClientConfig {
+  /** Medusa backend base URL */
+  baseUrl: string;
+  /** Enable debug logging */
+  debug?: boolean;
+}
+
+/**
+ * HTTP client for account-recovery endpoints (public, no auth required).
+ *
+ * All methods throw `ProviderAPIError` on non-2xx responses except the
+ * confirm methods, which normalize failures into `RecoveryConfirmResult`.
+ *
+ * @example
+ * ```typescript
+ * const client = new RecoveryClient({
+ *   baseUrl: process.env.MEDUSA_BACKEND_URL!,
+ * });
+ *
+ * await client.requestUserPasswordReset('juan@ejemplo.com');
+ * const result = await client.verifyUserPasswordResetToken(token);
+ * const confirm = await client.confirmUserPasswordReset(token, 'NuevaClave1');
+ * ```
+ */
+export class RecoveryClient {
+  private baseUrl: string;
+  private logger: ReturnType<typeof createLogger>;
+
+  constructor(config: RecoveryClientConfig) {
+    this.baseUrl = config.baseUrl.replace(/\/$/, '');
+    this.logger = createLogger('RecoveryClient', config.debug);
+  }
+
+  // -------------------------------------------------------------------------
+  // Private — HTTP helper
+  // -------------------------------------------------------------------------
+
+  private async request<T>(method: FetchMethod, path: string, body?: unknown): Promise<T> {
+    const url = `${this.baseUrl}${path}`;
+    this.logger.debug(`[recovery] ${method} ${path}`);
+
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+    };
+
+    const init: RequestInit = {
+      method,
+      headers,
+      ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+    };
+
+    let response: Response;
+    try {
+      response = await fetchBackendWithResilience(url, init);
+    } catch (networkError: any) {
+      throw new ProviderAPIError(
+        `[recovery] Network error on ${method} ${path}: ${networkError.message}`,
+        'NETWORK_ERROR',
+        networkError,
+      );
+    }
+
+    if (!response.ok) {
+      let message = `HTTP ${response.status}`;
+      try {
+        const json = await response.json();
+        message = json?.message ?? message;
+      } catch {
+        // ignore parse errors
+      }
+      throw new ProviderAPIError(
+        `[recovery] ${method} ${path} failed: ${message}`,
+        `RECOVERY_API_${response.status}`,
+        response.status,
+      );
+    }
+
+    return response.json() as Promise<T>;
+  }
+
+  // -------------------------------------------------------------------------
+  // Private — reset token helpers
+  // -------------------------------------------------------------------------
+
+  /**
+   * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
+   *
+   * The JWT is unsigned-trust for this claim: the email is later sent to
+   * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
+   * token signature and payload before applying the change.
+   */
+  private decodeResetTokenEmail(token: string): string | null {
+    const parts = token.split('.');
+    if (parts.length !== 3) return null;
+    try {
+      const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+      return typeof payload.entity_id === 'string' && payload.entity_id.length > 0
+        ? payload.entity_id
+        : null;
+    } catch {
+      return null;
+    }
+  }
+
+  // -------------------------------------------------------------------------
+  // Password reset
+  // -------------------------------------------------------------------------
+
+  /**
+   * Solicita un email de reset de contraseña para el actor `user`
+   * (dropshippers). El backend responde de forma uniforme exista o no la
+   * cuenta (anti enumeración).
+   *
+   * `POST /auth/user/emailpass/reset-password`
+   */
+  async requestUserPasswordReset(email: string): Promise<void> {
+    await this.request('POST', '/auth/user/emailpass/reset-password', {
+      identifier: email,
+    });
+  }
+
+  /**
+   * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
+   * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
+   *
+   * `GET /store/dropshipper/auth/reset-password/verify`
+   */
+  async verifyUserPasswordResetToken(token: string): Promise<TokenVerifyResult> {
+    return this.request('GET', `/store/dropshipper/auth/reset-password/verify?token=${encodeURIComponent(token)}`);
+  }
+
+  /**
+   * Confirma el reset: re-verifica el token (sin consumir), luego consume el
+   * token vía `POST /auth/user/emailpass/update`. El email se deriva del
+   * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+   */
+  async confirmUserPasswordReset(token: string, password: string): Promise<RecoveryConfirmResult> {
+    const verify = await this.verifyUserPasswordResetToken(token);
+    if (verify.status !== 'valid') {
+      return { ok: false, status: verify.status };
+    }
+
+    const email = this.decodeResetTokenEmail(token);
+    if (!email) {
+      return { ok: false, status: 'invalid' };
+    }
+
+    try {
+      const headers: Record<string, string> = {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+      };
+      const response = await fetchBackendWithResilience(`${this.baseUrl}/auth/user/emailpass/update`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ email, password }),
+      });
+      if (!response.ok) {
+        throw new ProviderAPIError(
+          `[recovery] POST /auth/user/emailpass/update failed: HTTP ${response.status}`,
+          'RECOVERY_API_' + response.status,
+          response.status,
+        );
+      }
+      return { ok: true };
+    } catch (error) {
+      // TOCTOU: el token pudo consumirse/expirar entre verify y update.
+      this.logger.warn('[recovery] confirmUserPasswordReset failed, re-verifying', error);
+      try {
+        const recheck = await this.verifyUserPasswordResetToken(token);
+        return { ok: false, status: recheck.status };
+      } catch {
+        return { ok: false, status: 'invalid' };
+      }
+    }
+  }
+
+  // -------------------------------------------------------------------------
+  // Account activation
+  // -------------------------------------------------------------------------
+
+  /**
+   * Verifica un token de activación de cuenta dropshipper sin consumirlo.
+   *
+   * `GET /store/dropshipper/applications/activate/verify`
+   */
+  async verifyActivationToken(token: string): Promise<TokenVerifyResult> {
+    return this.request('GET', `/store/dropshipper/applications/activate/verify?token=${encodeURIComponent(token)}`);
+  }
+
+  /**
+   * Activa la cuenta: re-verifica el token (sin consumir), luego consume el
+   * token vía `POST /store/dropshipper/applications/activate` y establece la
+   * contraseña inicial. Al éxito, la UI redirige a /login sin auto-login.
+   */
+  async activateAccount(token: string, password: string): Promise<RecoveryConfirmResult> {
+    const verify = await this.verifyActivationToken(token);
+    if (verify.status !== 'valid') {
+      return { ok: false, status: verify.status };
+    }
+
+    try {
+      await this.request('POST', '/store/dropshipper/applications/activate', { token, password });
+      return { ok: true };
+    } catch (error) {
+      // TOCTOU: re-verificar para distinguir used/expired/revoked.
+      this.logger.warn('[recovery] activateAccount failed, re-verifying', error);
+      try {
+        const recheck = await this.verifyActivationToken(token);
+        return { ok: false, status: recheck.status };
+      } catch {
+        return { ok: false, status: 'invalid' };
+      }
+    }
+  }
+}