@thorprovider/medusa-extended 1.13.2 → 1.13.3

package/dist/index.d.mts

@@ -867,12 +867,12 @@ declare class DropshipperClient {
  * logged in. Backend URLs are owned here; the dashboard never builds them.
  *
  * Endpoints:
- *   - `POST /auth/user/emailpass/reset-password`           (request reset, Medusa native)
- *   - `GET  /store/dropshipper/auth/reset-password/verify`  (verify reset token, no consume)
- *   - `POST /auth/user/emailpass/update`                    (confirm reset, consumes token)
- *   - `GET  /store/dropshipper/applications/activate/verify`(verify activation token, no consume)
- *   - `POST /store/dropshipper/applications/activate`       (confirm activation, consumes token)
- *   - `POST /public/dropshipper/applications`               (submit application, no auth)
+ *   - `POST /dropshipper/auth/emailpass/reset-password`         (request reset, dropshipper)
+ *   - `GET  /dropshipper/auth/emailpass/reset-password/verify`  (verify reset token, no consume)
+ *   - `POST /dropshipper/auth/emailpass/update`                 (confirm reset, consumes token)
+ *   - `GET  /store/dropshipper/applications/activate/verify`    (verify activation token, no consume)
+ *   - `POST /store/dropshipper/applications/activate`           (confirm activation, consumes token)
+ *   - `POST /public/dropshipper/applications`                   (submit application, no auth)
  *
  * Confirm methods follow the two-phase contract: verify (no consume) first,
  * then confirm (atomic consume). A re-verify after a failed confirm maps the
@@ -915,33 +915,26 @@ declare class RecoveryClient {
     private logger;
     constructor(config: RecoveryClientConfig);
     private request;
-    /**
-     * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
-     *
-     * The JWT is unsigned-trust for this claim: the email is later sent to
-     * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
-     * token signature and payload before applying the change.
-     */
-    private decodeResetTokenEmail;
     /**
      * Solicita un email de reset de contraseña para el actor `user`
      * (dropshippers). El backend responde de forma uniforme exista o no la
      * cuenta (anti enumeración).
      *
-     * `POST /auth/user/emailpass/reset-password`
+     * `POST /dropshipper/auth/emailpass/reset-password`
      */
     requestUserPasswordReset(email: string): Promise<void>;
     /**
      * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
      * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
      *
-     * `GET /store/dropshipper/auth/reset-password/verify`
+     * `GET /dropshipper/auth/emailpass/reset-password/verify`
      */
     verifyUserPasswordResetToken(token: string): Promise<TokenVerifyResult>;
     /**
      * Confirma el reset: re-verifica el token (sin consumir), luego consume el
-     * token vía `POST /auth/user/emailpass/update`. El email se deriva del
-     * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+     * token vía `POST /dropshipper/auth/emailpass/update`. El email se deriva del
+     * propio JWT en el backend; aquí solo se envía la nueva contraseña. Nunca
+     * devuelve auto-login: al éxito, la UI redirige a /login.
      */
     confirmUserPasswordReset(token: string, password: string): Promise<RecoveryConfirmResult>;
     /**

package/dist/index.d.ts

@@ -867,12 +867,12 @@ declare class DropshipperClient {
  * logged in. Backend URLs are owned here; the dashboard never builds them.
  *
  * Endpoints:
- *   - `POST /auth/user/emailpass/reset-password`           (request reset, Medusa native)
- *   - `GET  /store/dropshipper/auth/reset-password/verify`  (verify reset token, no consume)
- *   - `POST /auth/user/emailpass/update`                    (confirm reset, consumes token)
- *   - `GET  /store/dropshipper/applications/activate/verify`(verify activation token, no consume)
- *   - `POST /store/dropshipper/applications/activate`       (confirm activation, consumes token)
- *   - `POST /public/dropshipper/applications`               (submit application, no auth)
+ *   - `POST /dropshipper/auth/emailpass/reset-password`         (request reset, dropshipper)
+ *   - `GET  /dropshipper/auth/emailpass/reset-password/verify`  (verify reset token, no consume)
+ *   - `POST /dropshipper/auth/emailpass/update`                 (confirm reset, consumes token)
+ *   - `GET  /store/dropshipper/applications/activate/verify`    (verify activation token, no consume)
+ *   - `POST /store/dropshipper/applications/activate`           (confirm activation, consumes token)
+ *   - `POST /public/dropshipper/applications`                   (submit application, no auth)
  *
  * Confirm methods follow the two-phase contract: verify (no consume) first,
  * then confirm (atomic consume). A re-verify after a failed confirm maps the
@@ -915,33 +915,26 @@ declare class RecoveryClient {
     private logger;
     constructor(config: RecoveryClientConfig);
     private request;
-    /**
-     * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
-     *
-     * The JWT is unsigned-trust for this claim: the email is later sent to
-     * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
-     * token signature and payload before applying the change.
-     */
-    private decodeResetTokenEmail;
     /**
      * Solicita un email de reset de contraseña para el actor `user`
      * (dropshippers). El backend responde de forma uniforme exista o no la
      * cuenta (anti enumeración).
      *
-     * `POST /auth/user/emailpass/reset-password`
+     * `POST /dropshipper/auth/emailpass/reset-password`
      */
     requestUserPasswordReset(email: string): Promise<void>;
     /**
      * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
      * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
      *
-     * `GET /store/dropshipper/auth/reset-password/verify`
+     * `GET /dropshipper/auth/emailpass/reset-password/verify`
      */
     verifyUserPasswordResetToken(token: string): Promise<TokenVerifyResult>;
     /**
      * Confirma el reset: re-verifica el token (sin consumir), luego consume el
-     * token vía `POST /auth/user/emailpass/update`. El email se deriva del
-     * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+     * token vía `POST /dropshipper/auth/emailpass/update`. El email se deriva del
+     * propio JWT en el backend; aquí solo se envía la nueva contraseña. Nunca
+     * devuelve auto-login: al éxito, la UI redirige a /login.
      */
     confirmUserPasswordReset(token: string, password: string): Promise<RecoveryConfirmResult>;
     /**

package/dist/index.js

@@ -1997,27 +1997,14 @@ var RecoveryClient = class {
         details
       );
     }
-    return response.json();
-  }
-  // -------------------------------------------------------------------------
-  // Private — reset token helpers
-  // -------------------------------------------------------------------------
-  /**
-   * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
-   *
-   * The JWT is unsigned-trust for this claim: the email is later sent to
-   * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
-   * token signature and payload before applying the change.
-   */
-  decodeResetTokenEmail(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    try {
-      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-      return typeof payload.entity_id === "string" && payload.entity_id.length > 0 ? payload.entity_id : null;
-    } catch {
-      return null;
+    if ((response.headers.get("content-type") ?? "").includes("application/json")) {
+      try {
+        return await response.json();
+      } catch {
+        return {};
+      }
     }
+    return {};
   }
   // -------------------------------------------------------------------------
   // Password reset
@@ -2027,49 +2014,46 @@ var RecoveryClient = class {
    * (dropshippers). El backend responde de forma uniforme exista o no la
    * cuenta (anti enumeración).
    *
-   * `POST /auth/user/emailpass/reset-password`
+   * `POST /dropshipper/auth/emailpass/reset-password`
    */
   async requestUserPasswordReset(email) {
-    await this.request("POST", "/auth/user/emailpass/reset-password", {
-      identifier: email
+    await this.request("POST", "/dropshipper/auth/emailpass/reset-password", {
+      email
     });
   }
   /**
    * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
    * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
    *
-   * `GET /store/dropshipper/auth/reset-password/verify`
+   * `GET /dropshipper/auth/emailpass/reset-password/verify`
    */
   async verifyUserPasswordResetToken(token) {
-    return this.request("GET", `/store/dropshipper/auth/reset-password/verify?token=${encodeURIComponent(token)}`);
+    return this.request("GET", `/dropshipper/auth/emailpass/reset-password/verify?token=${encodeURIComponent(token)}`);
   }
   /**
    * Confirma el reset: re-verifica el token (sin consumir), luego consume el
-   * token vía `POST /auth/user/emailpass/update`. El email se deriva del
-   * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+   * token vía `POST /dropshipper/auth/emailpass/update`. El email se deriva del
+   * propio JWT en el backend; aquí solo se envía la nueva contraseña. Nunca
+   * devuelve auto-login: al éxito, la UI redirige a /login.
    */
   async confirmUserPasswordReset(token, password) {
     const verify = await this.verifyUserPasswordResetToken(token);
     if (verify.status !== "valid") {
       return { ok: false, status: verify.status };
     }
-    const email = this.decodeResetTokenEmail(token);
-    if (!email) {
-      return { ok: false, status: "invalid" };
-    }
     try {
       const headers = {
         Authorization: `Bearer ${token}`,
         "Content-Type": "application/json"
       };
-      const response = await fetchBackendWithResilience(`${this.baseUrl}/auth/user/emailpass/update`, {
+      const response = await fetchBackendWithResilience(`${this.baseUrl}/dropshipper/auth/emailpass/update`, {
         method: "POST",
         headers,
-        body: JSON.stringify({ email, password })
+        body: JSON.stringify({ password })
       });
       if (!response.ok) {
         throw new import_adapters4.ProviderAPIError(
-          `[recovery] POST /auth/user/emailpass/update failed: HTTP ${response.status}`,
+          `[recovery] POST /dropshipper/auth/emailpass/update failed: HTTP ${response.status}`,
           "RECOVERY_API_" + response.status,
           response.status
         );