@thorprovider/medusa-extended 1.13.1 → 1.13.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thorprovider/medusa-extended",
-  "version": "1.13.1",
+  "version": "1.13.3",
   "description": "Thor Commerce multi-tenant admin extensions for Medusa v2",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@thorprovider/adapters": "^5.0.8",
-    "@thorprovider/types": "^5.5.1"
+    "@thorprovider/types": "^5.7.1"
   },
   "devDependencies": {
     "msw": "^2.12.3",

package/src/dropshipper.test.ts

@@ -1011,6 +1011,64 @@ describe('DropshipperClient.getAccount', () => {
   })
 })
 
+describe('DropshipperClient.getBusinessPolicy', () => {
+  it('GET /admin/thor/dropshipper/account/policies', async () => {
+    server.use(
+      http.get(`${BASE}/admin/thor/dropshipper/account/policies`, ({ request }) => {
+        requireBearerToken(request)
+        return HttpResponse.json({ business_policy: 'Devoluciones dentro de 30 días.' })
+      }),
+    )
+
+    const result = await client().getBusinessPolicy()
+    expect(result.business_policy).toBe('Devoluciones dentro de 30 días.')
+  })
+
+  it('returns an empty string when no policy is set', async () => {
+    server.use(
+      http.get(`${BASE}/admin/thor/dropshipper/account/policies`, ({ request }) => {
+        requireBearerToken(request)
+        return HttpResponse.json({ business_policy: '' })
+      }),
+    )
+
+    const result = await client().getBusinessPolicy()
+    expect(result.business_policy).toBe('')
+  })
+})
+
+describe('DropshipperClient.updateBusinessPolicy', () => {
+  it('PATCH /admin/thor/dropshipper/account/policies', async () => {
+    server.use(
+      http.patch(`${BASE}/admin/thor/dropshipper/account/policies`, async ({ request }) => {
+        requireBearerToken(request)
+        const body = await request.json() as any
+        expect(body.business_policy).toBe('Devoluciones dentro de 30 días.')
+        return HttpResponse.json({ business_policy: 'Devoluciones dentro de 30 días.' })
+      }),
+    )
+
+    const result = await client().updateBusinessPolicy({
+      business_policy: 'Devoluciones dentro de 30 días.',
+    })
+    expect(result.business_policy).toBe('Devoluciones dentro de 30 días.')
+  })
+
+  it('returns the trimmed value persisted by the server', async () => {
+    server.use(
+      http.patch(`${BASE}/admin/thor/dropshipper/account/policies`, async ({ request }) => {
+        requireBearerToken(request)
+        const body = await request.json() as any
+        expect(body.business_policy).toBe('  Política  ')
+        return HttpResponse.json({ business_policy: 'Política' })
+      }),
+    )
+
+    const result = await client().updateBusinessPolicy({ business_policy: '  Política  ' })
+    expect(result.business_policy).toBe('Política')
+  })
+})
+
 describe('DropshipperClient.getSettlements', () => {
   it('GET /admin/thor/dropshipper/settlements with defaults', async () => {
     server.use(

package/src/dropshipper.ts

@@ -171,6 +171,10 @@ import type {
   DropshipperNotificationPreference,
   UpdateNotificationPreferencesBody,
   GetNotificationPreferencesResponse,
+  // Dropshipper business policy
+  GetBusinessPolicyResponse,
+  UpdateBusinessPolicyBody,
+  UpdateBusinessPolicyResponse,
   // Inline return types
   DropshipperCategory,
   DropshipperPromotion,
@@ -1327,6 +1331,35 @@ export class DropshipperClient {
      );
    }
 
+   /**
+    * Get the authenticated dropshipper's business policy text.
+    * Returns an empty string when no policy is set.
+    *
+    * `GET /admin/thor/dropshipper/account/policies`
+    */
+   async getBusinessPolicy(): Promise<GetBusinessPolicyResponse> {
+     return this.request<GetBusinessPolicyResponse>(
+       'GET',
+       '/admin/thor/dropshipper/account/policies',
+     );
+   }
+
+   /**
+    * Update the authenticated dropshipper's business policy text.
+    * The value is trimmed server-side before being persisted.
+    *
+    * `PATCH /admin/thor/dropshipper/account/policies`
+    */
+   async updateBusinessPolicy(
+     body: UpdateBusinessPolicyBody,
+   ): Promise<UpdateBusinessPolicyResponse> {
+     return this.request<UpdateBusinessPolicyResponse>(
+       'PATCH',
+       '/admin/thor/dropshipper/account/policies',
+       body,
+     );
+   }
+
    /**
     * Orders where Y owes money to X (Y collected payment, needs to pay costs).
     *
@@ -2033,7 +2066,7 @@ export class DropshipperClient {
 }
 
 // Re-export types used by callers so they don't need to import from @thorprovider/types directly.
-export type { DropshipperCategory, DropshipperPromotion, NotificationData, PriceUpdatedNotificationData, ProductAssignedNotificationData, StockChangeNotificationData, ManualAdminNotificationData, RawNotification, GetNotificationsOptions, GetNotificationsResponse, DropshipperNotificationEventType, DropshipperNotificationPreference, UpdateNotificationPreferencesBody, GetNotificationPreferencesResponse, ChatRequest, ChatResponse, ChatMessage, ChatIntent, ChatSource, ChatSourceVariant } from '@thorprovider/types';
+export type { DropshipperCategory, DropshipperPromotion, NotificationData, PriceUpdatedNotificationData, ProductAssignedNotificationData, StockChangeNotificationData, ManualAdminNotificationData, RawNotification, GetNotificationsOptions, GetNotificationsResponse, DropshipperNotificationEventType, DropshipperNotificationPreference, UpdateNotificationPreferencesBody, GetNotificationPreferencesResponse, GetBusinessPolicyResponse, UpdateBusinessPolicyBody, UpdateBusinessPolicyResponse, ChatRequest, ChatResponse, ChatMessage, ChatIntent, ChatSource, ChatSourceVariant } from '@thorprovider/types';
 
 // ---------------------------------------------------------------------------
 // AI Assistant — streaming helpers

package/src/recovery.ts

@@ -9,12 +9,12 @@
  * logged in. Backend URLs are owned here; the dashboard never builds them.
  *
  * Endpoints:
- *   - `POST /auth/user/emailpass/reset-password`           (request reset, Medusa native)
- *   - `GET  /store/dropshipper/auth/reset-password/verify`  (verify reset token, no consume)
- *   - `POST /auth/user/emailpass/update`                    (confirm reset, consumes token)
- *   - `GET  /store/dropshipper/applications/activate/verify`(verify activation token, no consume)
- *   - `POST /store/dropshipper/applications/activate`       (confirm activation, consumes token)
- *   - `POST /public/dropshipper/applications`               (submit application, no auth)
+ *   - `POST /dropshipper/auth/emailpass/reset-password`         (request reset, dropshipper)
+ *   - `GET  /dropshipper/auth/emailpass/reset-password/verify`  (verify reset token, no consume)
+ *   - `POST /dropshipper/auth/emailpass/update`                 (confirm reset, consumes token)
+ *   - `GET  /store/dropshipper/applications/activate/verify`    (verify activation token, no consume)
+ *   - `POST /store/dropshipper/applications/activate`           (confirm activation, consumes token)
+ *   - `POST /public/dropshipper/applications`                   (submit application, no auth)
  *
  * Confirm methods follow the two-phase contract: verify (no consume) first,
  * then confirm (atomic consume). A re-verify after a failed confirm maps the
@@ -127,31 +127,20 @@ export class RecoveryClient {
       );
     }
 
-    return response.json() as Promise<T>;
-  }
-
-  // -------------------------------------------------------------------------
-  // Private — reset token helpers
-  // -------------------------------------------------------------------------
-
-  /**
-   * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
-   *
-   * The JWT is unsigned-trust for this claim: the email is later sent to
-   * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
-   * token signature and payload before applying the change.
-   */
-  private decodeResetTokenEmail(token: string): string | null {
-    const parts = token.split('.');
-    if (parts.length !== 3) return null;
-    try {
-      const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
-      return typeof payload.entity_id === 'string' && payload.entity_id.length > 0
-        ? payload.entity_id
-        : null;
-    } catch {
-      return null;
+    // 2xx success with a JSON body: parse and return it.
+    if ((response.headers.get('content-type') ?? '').includes('application/json')) {
+      try {
+        return (await response.json()) as T;
+      } catch {
+        // A 2xx that claims JSON but fails to parse should not crash the
+        // caller as a raw SyntaxError; the stub lets the caller handle it.
+        return {} as T;
+      }
     }
+
+    // 2xx success without a JSON body (204 No Content, or plain-text bodies
+    // like `201 Created` from native endpoints). No value to return.
+    return {} as T;
   }
 
   // -------------------------------------------------------------------------
@@ -163,11 +152,11 @@ export class RecoveryClient {
    * (dropshippers). El backend responde de forma uniforme exista o no la
    * cuenta (anti enumeración).
    *
-   * `POST /auth/user/emailpass/reset-password`
+   * `POST /dropshipper/auth/emailpass/reset-password`
    */
   async requestUserPasswordReset(email: string): Promise<void> {
-    await this.request('POST', '/auth/user/emailpass/reset-password', {
-      identifier: email,
+    await this.request('POST', '/dropshipper/auth/emailpass/reset-password', {
+      email,
     });
   }
 
@@ -175,16 +164,17 @@ export class RecoveryClient {
    * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
    * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
    *
-   * `GET /store/dropshipper/auth/reset-password/verify`
+   * `GET /dropshipper/auth/emailpass/reset-password/verify`
    */
   async verifyUserPasswordResetToken(token: string): Promise<TokenVerifyResult> {
-    return this.request('GET', `/store/dropshipper/auth/reset-password/verify?token=${encodeURIComponent(token)}`);
+    return this.request('GET', `/dropshipper/auth/emailpass/reset-password/verify?token=${encodeURIComponent(token)}`);
   }
 
   /**
    * Confirma el reset: re-verifica el token (sin consumir), luego consume el
-   * token vía `POST /auth/user/emailpass/update`. El email se deriva del
-   * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+   * token vía `POST /dropshipper/auth/emailpass/update`. El email se deriva del
+   * propio JWT en el backend; aquí solo se envía la nueva contraseña. Nunca
+   * devuelve auto-login: al éxito, la UI redirige a /login.
    */
   async confirmUserPasswordReset(token: string, password: string): Promise<RecoveryConfirmResult> {
     const verify = await this.verifyUserPasswordResetToken(token);
@@ -192,24 +182,19 @@ export class RecoveryClient {
       return { ok: false, status: verify.status };
     }
 
-    const email = this.decodeResetTokenEmail(token);
-    if (!email) {
-      return { ok: false, status: 'invalid' };
-    }
-
     try {
       const headers: Record<string, string> = {
         Authorization: `Bearer ${token}`,
         'Content-Type': 'application/json',
       };
-      const response = await fetchBackendWithResilience(`${this.baseUrl}/auth/user/emailpass/update`, {
+      const response = await fetchBackendWithResilience(`${this.baseUrl}/dropshipper/auth/emailpass/update`, {
         method: 'POST',
         headers,
-        body: JSON.stringify({ email, password }),
+        body: JSON.stringify({ password }),
       });
       if (!response.ok) {
         throw new ProviderAPIError(
-          `[recovery] POST /auth/user/emailpass/update failed: HTTP ${response.status}`,
+          `[recovery] POST /dropshipper/auth/emailpass/update failed: HTTP ${response.status}`,
           'RECOVERY_API_' + response.status,
           response.status,
         );
@@ -314,6 +299,13 @@ export class RecoveryClient {
             retryAfterSeconds: details.retry_after_seconds,
           };
         }
+        if (error.status === 400 && details?.type === 'challenge_failed') {
+          return {
+            ok: false,
+            reason: 'challenge_failed',
+            ...(typeof details.message === 'string' ? { message: details.message } : {}),
+          };
+        }
         if (error.status === 400) {
           return {
             ok: false,