@thorprovider/medusa-extended 1.13.2 → 1.13.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thorprovider/medusa-extended",
-  "version": "1.13.2",
+  "version": "1.13.4",
   "description": "Thor Commerce multi-tenant admin extensions for Medusa v2",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/dropshipper.test.ts

@@ -262,6 +262,18 @@ describe('DropshipperClient.getOrder', () => {
             totals: { subtotal: 5000, shipping_total: 0, discount_total: 0, total: 5000, cost_total: 2000, profit: 3000, margin_percent: 60 },
             payment_collected_by: 'dropshipper',
             settlement_status: 'unsettled',
+            financial_summary: {
+              paid_total: 0,
+              refunded_total: 0,
+              pending_difference: 5000,
+              current_order_total: 5000,
+              original_order_total: 5000,
+              transaction_total: 0,
+              accounting_total: 5000,
+              credit_line_total: 0,
+              effective: { paid_total: 0, pending_difference: 5000 },
+            },
+            credit_lines: [],
             timeline: [],
           },
         })
@@ -271,6 +283,8 @@ describe('DropshipperClient.getOrder', () => {
     const result = await client().getOrder('ord_1')
     expect(result.order.id).toBe('ord_1')
     expect(result.order.totals.profit).toBe(3000)
+    expect(result.order.financial_summary.credit_line_total).toBe(0)
+    expect(result.order.credit_lines).toEqual([])
   })
 })
 

package/src/recovery.ts

@@ -9,12 +9,12 @@
  * logged in. Backend URLs are owned here; the dashboard never builds them.
  *
  * Endpoints:
- *   - `POST /auth/user/emailpass/reset-password`           (request reset, Medusa native)
- *   - `GET  /store/dropshipper/auth/reset-password/verify`  (verify reset token, no consume)
- *   - `POST /auth/user/emailpass/update`                    (confirm reset, consumes token)
- *   - `GET  /store/dropshipper/applications/activate/verify`(verify activation token, no consume)
- *   - `POST /store/dropshipper/applications/activate`       (confirm activation, consumes token)
- *   - `POST /public/dropshipper/applications`               (submit application, no auth)
+ *   - `POST /dropshipper/auth/emailpass/reset-password`         (request reset, dropshipper)
+ *   - `GET  /dropshipper/auth/emailpass/reset-password/verify`  (verify reset token, no consume)
+ *   - `POST /dropshipper/auth/emailpass/update`                 (confirm reset, consumes token)
+ *   - `GET  /store/dropshipper/applications/activate/verify`    (verify activation token, no consume)
+ *   - `POST /store/dropshipper/applications/activate`           (confirm activation, consumes token)
+ *   - `POST /public/dropshipper/applications`                   (submit application, no auth)
  *
  * Confirm methods follow the two-phase contract: verify (no consume) first,
  * then confirm (atomic consume). A re-verify after a failed confirm maps the
@@ -127,31 +127,20 @@ export class RecoveryClient {
       );
     }
 
-    return response.json() as Promise<T>;
-  }
-
-  // -------------------------------------------------------------------------
-  // Private — reset token helpers
-  // -------------------------------------------------------------------------
-
-  /**
-   * Decodes the `entity_id` (email) claim from a Medusa reset-password JWT.
-   *
-   * The JWT is unsigned-trust for this claim: the email is later sent to
-   * `POST /auth/user/emailpass/update`, where Medusa itself re-validates the
-   * token signature and payload before applying the change.
-   */
-  private decodeResetTokenEmail(token: string): string | null {
-    const parts = token.split('.');
-    if (parts.length !== 3) return null;
-    try {
-      const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
-      return typeof payload.entity_id === 'string' && payload.entity_id.length > 0
-        ? payload.entity_id
-        : null;
-    } catch {
-      return null;
+    // 2xx success with a JSON body: parse and return it.
+    if ((response.headers.get('content-type') ?? '').includes('application/json')) {
+      try {
+        return (await response.json()) as T;
+      } catch {
+        // A 2xx that claims JSON but fails to parse should not crash the
+        // caller as a raw SyntaxError; the stub lets the caller handle it.
+        return {} as T;
+      }
     }
+
+    // 2xx success without a JSON body (204 No Content, or plain-text bodies
+    // like `201 Created` from native endpoints). No value to return.
+    return {} as T;
   }
 
   // -------------------------------------------------------------------------
@@ -163,11 +152,11 @@ export class RecoveryClient {
    * (dropshippers). El backend responde de forma uniforme exista o no la
    * cuenta (anti enumeración).
    *
-   * `POST /auth/user/emailpass/reset-password`
+   * `POST /dropshipper/auth/emailpass/reset-password`
    */
   async requestUserPasswordReset(email: string): Promise<void> {
-    await this.request('POST', '/auth/user/emailpass/reset-password', {
-      identifier: email,
+    await this.request('POST', '/dropshipper/auth/emailpass/reset-password', {
+      email,
     });
   }
 
@@ -175,16 +164,17 @@ export class RecoveryClient {
    * Verifica un token de reset de contraseña sin consumirlo. Devuelve el
    * email enmascarado (p. ej. `j***@ejemplo.com`) solo cuando `status === 'valid'`.
    *
-   * `GET /store/dropshipper/auth/reset-password/verify`
+   * `GET /dropshipper/auth/emailpass/reset-password/verify`
    */
   async verifyUserPasswordResetToken(token: string): Promise<TokenVerifyResult> {
-    return this.request('GET', `/store/dropshipper/auth/reset-password/verify?token=${encodeURIComponent(token)}`);
+    return this.request('GET', `/dropshipper/auth/emailpass/reset-password/verify?token=${encodeURIComponent(token)}`);
   }
 
   /**
    * Confirma el reset: re-verifica el token (sin consumir), luego consume el
-   * token vía `POST /auth/user/emailpass/update`. El email se deriva del
-   * propio JWT. Nunca devuelve auto-login: al éxito, la UI redirige a /login.
+   * token vía `POST /dropshipper/auth/emailpass/update`. El email se deriva del
+   * propio JWT en el backend; aquí solo se envía la nueva contraseña. Nunca
+   * devuelve auto-login: al éxito, la UI redirige a /login.
    */
   async confirmUserPasswordReset(token: string, password: string): Promise<RecoveryConfirmResult> {
     const verify = await this.verifyUserPasswordResetToken(token);
@@ -192,24 +182,19 @@ export class RecoveryClient {
       return { ok: false, status: verify.status };
     }
 
-    const email = this.decodeResetTokenEmail(token);
-    if (!email) {
-      return { ok: false, status: 'invalid' };
-    }
-
     try {
       const headers: Record<string, string> = {
         Authorization: `Bearer ${token}`,
         'Content-Type': 'application/json',
       };
-      const response = await fetchBackendWithResilience(`${this.baseUrl}/auth/user/emailpass/update`, {
+      const response = await fetchBackendWithResilience(`${this.baseUrl}/dropshipper/auth/emailpass/update`, {
         method: 'POST',
         headers,
-        body: JSON.stringify({ email, password }),
+        body: JSON.stringify({ password }),
       });
       if (!response.ok) {
         throw new ProviderAPIError(
-          `[recovery] POST /auth/user/emailpass/update failed: HTTP ${response.status}`,
+          `[recovery] POST /dropshipper/auth/emailpass/update failed: HTTP ${response.status}`,
           'RECOVERY_API_' + response.status,
           response.status,
         );