@thorprovider/medusa-extended 1.13.1 → 1.13.3

package/dist/index.mjs

@@ -1227,6 +1227,31 @@ var DropshipperClient = class {
       "/admin/thor/dropshipper/account"
     );
   }
+  /**
+   * Get the authenticated dropshipper's business policy text.
+   * Returns an empty string when no policy is set.
+   *
+   * `GET /admin/thor/dropshipper/account/policies`
+   */
+  async getBusinessPolicy() {
+    return this.request(
+      "GET",
+      "/admin/thor/dropshipper/account/policies"
+    );
+  }
+  /**
+   * Update the authenticated dropshipper's business policy text.
+   * The value is trimmed server-side before being persisted.
+   *
+   * `PATCH /admin/thor/dropshipper/account/policies`
+   */
+  async updateBusinessPolicy(body) {
+    return this.request(
+      "PATCH",
+      "/admin/thor/dropshipper/account/policies",
+      body
+    );
+  }
   /**
    * Orders where Y owes money to X (Y collected payment, needs to pay costs).
    *
@@ -1944,27 +1969,14 @@ var RecoveryClient = class {
         details
       );
     }
-    return response.json();
-  }
-  // -------------------------------------------------------------------------
-  // Private — reset token helpers
-  // -------------------------------------------------------------------------
-  /**
-   * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
-   *
-   * The JWT is unsigned-trust for this claim: the email is later sent to
-   * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
-   * token signature and payload before applying the change.
-   */
-  decodeResetTokenEmail(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    try {
-      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-      return typeof payload.entity_id === "string" && payload.entity_id.length > 0 ? payload.entity_id : null;
-    } catch {
-      return null;
+    if ((response.headers.get("content-type") ?? "").includes("application/json")) {
+      try {
+        return await response.json();
+      } catch {
+        return {};
+      }
     }
+    return {};
   }
   // -------------------------------------------------------------------------
   // Password reset
@@ -1974,49 +1986,46 @@ var RecoveryClient = class {
    * (dropshippers). El backend responde de forma uniforme exista o no la
    * cuenta (anti enumeración).
    *
-   * `POST /auth/user/emailpass/reset-password`
+   * `POST /dropshipper/auth/emailpass/reset-password`
    */
   async requestUserPasswordReset(email) {
-    await this.request("POST", "/auth/user/emailpass/reset-password", {
-      identifier: email
+    await this.request("POST", "/dropshipper/auth/emailpass/reset-password", {
+      email
     });
   }
   /**
    * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
    * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
    *
-   * `GET /store/dropshipper/auth/reset-password/verify`
+   * `GET /dropshipper/auth/emailpass/reset-password/verify`
    */
   async verifyUserPasswordResetToken(token) {
-    return this.request("GET", `/store/dropshipper/auth/reset-password/verify?token=${encodeURIComponent(token)}`);
+    return this.request("GET", `/dropshipper/auth/emailpass/reset-password/verify?token=${encodeURIComponent(token)}`);
   }
   /**
    * Confirma el reset: re-verifica el token (sin consumir), luego consume el
-   * token vía `POST /auth/user/emailpass/update`. El email se deriva del
-   * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+   * token vía `POST /dropshipper/auth/emailpass/update`. El email se deriva del
+   * propio JWT en el backend; aquí solo se envía la nueva contraseña. Nunca
+   * devuelve auto-login: al éxito, la UI redirige a /login.
    */
   async confirmUserPasswordReset(token, password) {
     const verify = await this.verifyUserPasswordResetToken(token);
     if (verify.status !== "valid") {
       return { ok: false, status: verify.status };
     }
-    const email = this.decodeResetTokenEmail(token);
-    if (!email) {
-      return { ok: false, status: "invalid" };
-    }
     try {
       const headers = {
         Authorization: `Bearer ${token}`,
         "Content-Type": "application/json"
       };
-      const response = await fetchBackendWithResilience(`${this.baseUrl}/auth/user/emailpass/update`, {
+      const response = await fetchBackendWithResilience(`${this.baseUrl}/dropshipper/auth/emailpass/update`, {
         method: "POST",
         headers,
-        body: JSON.stringify({ email, password })
+        body: JSON.stringify({ password })
       });
       if (!response.ok) {
         throw new ProviderAPIError4(
-          `[recovery] POST /auth/user/emailpass/update failed: HTTP ${response.status}`,
+          `[recovery] POST /dropshipper/auth/emailpass/update failed: HTTP ${response.status}`,
           "RECOVERY_API_" + response.status,
           response.status
         );
@@ -2113,6 +2122,13 @@ var RecoveryClient = class {
             retryAfterSeconds: details.retry_after_seconds
           };
         }
+        if (error.status === 400 && details?.type === "challenge_failed") {
+          return {
+            ok: false,
+            reason: "challenge_failed",
+            ...typeof details.message === "string" ? { message: details.message } : {}
+          };
+        }
         if (error.status === 400) {
           return {
             ok: false,