customer-registration 0.0.111 → 0.0.113

package/.medusa/server/src/api/middlewares/validate-customer-registration.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateCustomerRegistration = validateCustomerRegistration;
+const utils_1 = require("@medusajs/framework/utils");
+const config_1 = require("../../config");
+const VALID_IDENTIFIERS = ["email", "phone", "both"];
+const EMAIL_REGEX = /^\S+@\S+\.\S+$/;
+const PHONE_REGEX = /^\+?[0-9]{8,15}$/;
+/**
+ * Validates registration fields on `POST /store/customers` based on the
+ * plugin's `registration.identifier` config:
+ *
+ *  - "email" → email required, format checked
+ *  - "phone" → phone required, format checked
+ *  - "both"  → email and phone both required, both format-checked
+ *
+ * Format validation applies to any field that is present, regardless of
+ * whether it was required, so bad data is always rejected early.
+ */
+async function validateCustomerRegistration(req, res, next) {
+    // Defensive guard — the matcher in middlewares.ts already limits to POST,
+    // but protect against accidental broader mounting.
+    if (req.method !== "POST") {
+        return next();
+    }
+    const configModule = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+    const options = (0, config_1.resolveCustomerRegistrationOptions)(configModule);
+    const identifier = options.registration.identifier;
+    // Fail fast if the config value is somehow outside the known set
+    if (!VALID_IDENTIFIERS.includes(identifier)) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Invalid registration identifier configuration: "${identifier}". Must be one of: ${VALID_IDENTIFIERS.join(", ")}`);
+    }
+    const { email, phone } = (req.body ?? {});
+    const emailNormalized = email?.trim() || undefined;
+    const phoneNormalized = phone?.trim() || undefined;
+    // --- Presence checks (identifier-specific) ---
+    if (identifier === "email" && !emailNormalized) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Email is required for registration");
+    }
+    if (identifier === "phone" && !phoneNormalized) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Phone is required for registration");
+    }
+    if (identifier === "both") {
+        if (!emailNormalized) {
+            throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Email is required for registration");
+        }
+        if (!phoneNormalized) {
+            throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Phone is required for registration");
+        }
+    }
+    // --- Format checks (applied to any field that is present) ---
+    if (emailNormalized && !EMAIL_REGEX.test(emailNormalized)) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Invalid email format");
+    }
+    if (phoneNormalized && !PHONE_REGEX.test(phoneNormalized)) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Invalid phone number format. Must be 8–15 digits, optionally prefixed with +");
+    }
+    next();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGUtY3VzdG9tZXItcmVnaXN0cmF0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2FwaS9taWRkbGV3YXJlcy92YWxpZGF0ZS1jdXN0b21lci1yZWdpc3RyYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUEyQkEsb0VBaUZDO0FBdkdELHFEQUFrRjtBQUNsRix5Q0FHcUI7QUFFckIsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFVLENBQUE7QUFFN0QsTUFBTSxXQUFXLEdBQUcsZ0JBQWdCLENBQUE7QUFDcEMsTUFBTSxXQUFXLEdBQUcsa0JBQWtCLENBQUE7QUFFdEM7Ozs7Ozs7Ozs7R0FVRztBQUNJLEtBQUssVUFBVSw0QkFBNEIsQ0FDaEQsR0FBa0IsRUFDbEIsR0FBbUIsRUFDbkIsSUFBd0I7SUFFeEIsMEVBQTBFO0lBQzFFLG1EQUFtRDtJQUNuRCxJQUFJLEdBQUcsQ0FBQyxNQUFNLEtBQUssTUFBTSxFQUFFLENBQUM7UUFDMUIsT0FBTyxJQUFJLEVBQUUsQ0FBQTtJQUNmLENBQUM7SUFFRCxNQUFNLFlBQVksR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FDcEMsaUNBQXlCLENBQUMsYUFBYSxDQUN4QyxDQUFBO0lBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBQSwyQ0FBa0MsRUFBQyxZQUFZLENBQUMsQ0FBQTtJQUNoRSxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQTtJQUVsRCxpRUFBaUU7SUFDakUsSUFBSSxDQUFFLGlCQUF1QyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ25FLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLG1EQUFtRCxVQUFVLHNCQUFzQixpQkFBaUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FDbEgsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxFQUFFLENBR3ZDLENBQUE7SUFFRCxNQUFNLGVBQWUsR0FBRyxLQUFLLEVBQUUsSUFBSSxFQUFFLElBQUksU0FBUyxDQUFBO0lBQ2xELE1BQU0sZUFBZSxHQUFHLEtBQUssRUFBRSxJQUFJLEVBQUUsSUFBSSxTQUFTLENBQUE7SUFFbEQsZ0RBQWdEO0lBRWhELElBQUksVUFBVSxLQUFLLE9BQU8sSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQy9DLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLG9DQUFvQyxDQUNyQyxDQUFBO0lBQ0gsQ0FBQztJQUVELElBQUksVUFBVSxLQUFLLE9BQU8sSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQy9DLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLG9DQUFvQyxDQUNyQyxDQUFBO0lBQ0gsQ0FBQztJQUVELElBQUksVUFBVSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQzFCLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUNyQixNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5QixvQ0FBb0MsQ0FDckMsQ0FBQTtRQUNILENBQUM7UUFDRCxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDckIsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsb0NBQW9DLENBQ3JDLENBQUE7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVELCtEQUErRDtJQUUvRCxJQUFJLGVBQWUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztRQUMxRCxNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5QixzQkFBc0IsQ0FDdkIsQ0FBQTtJQUNILENBQUM7SUFFRCxJQUFJLGVBQWUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztRQUMxRCxNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5Qiw4RUFBOEUsQ0FDL0UsQ0FBQTtJQUNILENBQUM7SUFFRCxJQUFJLEVBQUUsQ0FBQTtBQUNSLENBQUMifQ==

package/.medusa/server/src/api/middlewares.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("@medusajs/framework/http");
+const guard_account_deletion_1 = require("./middlewares/guard-account-deletion");
+const validate_customer_registration_1 = require("./middlewares/validate-customer-registration");
+const ip_rate_limit_1 = require("./middlewares/ip-rate-limit");
+exports.default = (0, http_1.defineMiddlewares)({
+    routes: [
+        {
+            matcher: "/auth/customer/*",
+            middlewares: [guard_account_deletion_1.guardAccountDeletion],
+        },
+        {
+            matcher: "/store/*",
+            middlewares: [guard_account_deletion_1.guardAccountDeletion],
+        },
+        {
+            matcher: "/store/customers",
+            method: ["POST"],
+            middlewares: [validate_customer_registration_1.validateCustomerRegistration],
+        },
+        {
+            // Unauthenticated endpoint — rate-limit per IP to prevent OTP spam
+            matcher: "/store/customers/account-deletion/cancel-request",
+            method: ["POST"],
+            middlewares: [(0, ip_rate_limit_1.ipRateLimit)({ max: 5, windowMs: 60_000 })],
+        },
+    ],
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWlkZGxld2FyZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYXBpL21pZGRsZXdhcmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsbURBQTREO0FBQzVELGlGQUEyRTtBQUMzRSxpR0FBMkY7QUFDM0YsK0RBQXlEO0FBRXpELGtCQUFlLElBQUEsd0JBQWlCLEVBQUM7SUFDL0IsTUFBTSxFQUFFO1FBQ047WUFDRSxPQUFPLEVBQUUsa0JBQWtCO1lBQzNCLFdBQVcsRUFBRSxDQUFDLDZDQUFvQixDQUFDO1NBQ3BDO1FBQ0Q7WUFDRSxPQUFPLEVBQUUsVUFBVTtZQUNuQixXQUFXLEVBQUUsQ0FBQyw2Q0FBb0IsQ0FBQztTQUNwQztRQUNEO1lBQ0UsT0FBTyxFQUFFLGtCQUFrQjtZQUMzQixNQUFNLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDaEIsV0FBVyxFQUFFLENBQUMsNkRBQTRCLENBQUM7U0FDNUM7UUFDRDtZQUNFLG1FQUFtRTtZQUNuRSxPQUFPLEVBQUUsa0RBQWtEO1lBQzNELE1BQU0sRUFBRSxDQUFDLE1BQU0sQ0FBQztZQUNoQixXQUFXLEVBQUUsQ0FBQyxJQUFBLDJCQUFXLEVBQUMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1NBQ3pEO0tBQ0Y7Q0FDRixDQUFDLENBQUEifQ==

package/.medusa/server/src/api/store/customers/account-deletion/cancel-confirm/route.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const otp_verification_1 = require("../../../../../modules/otp-verification");
+const otp_verification_2 = require("../../../../../modules/otp-verification/models/otp-verification");
+const account_deletion_request_1 = require("../../../../../modules/account-deletion-request");
+const validators_1 = require("../validators");
+const POST = async (req, res) => {
+    const parsed = validators_1.ConfirmCancelSchema.safeParse(req.body ?? {});
+    if (!parsed.success) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, parsed.error.errors.map((e) => e.message).join("; ") || "Invalid input");
+    }
+    const { token, code } = parsed.data;
+    const otpService = req.scope.resolve(otp_verification_1.OTP_VERIFICATION_MODULE);
+    const config = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+    const jwtSecret = config?.projectConfig?.http
+        ?.jwtSecret || "supersecret";
+    const verifyResult = await otpService.verifyOtp({ token, code }, jwtSecret);
+    if (verifyResult.type !== otp_verification_2.OtpPurpose.ACCOUNT_DELETION_CANCEL) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Invalid verification type for cancel confirmation");
+    }
+    const accountDeletionService = req.scope.resolve(account_deletion_request_1.ACCOUNT_DELETION_REQUEST_MODULE);
+    const request = await accountDeletionService.cancelRequest(verifyResult.customer_id);
+    return res.status(200).json({
+        cancelled: true,
+        request: {
+            id: request.id,
+            customer_id: request.customer_id,
+            status: request.status,
+            cancelled_at: request.cancelled_at,
+        },
+    });
+};
+exports.POST = POST;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVycy9hY2NvdW50LWRlbGV0aW9uL2NhbmNlbC1jb25maXJtL3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLHFEQUdrQztBQUNsQyw4RUFBaUY7QUFFakYsc0dBQTRGO0FBQzVGLDhGQUFpRztBQUVqRyw4Q0FBbUQ7QUFFNUMsTUFBTSxJQUFJLEdBQUcsS0FBSyxFQUFFLEdBQWtCLEVBQUUsR0FBbUIsRUFBRSxFQUFFO0lBQ3BFLE1BQU0sTUFBTSxHQUFHLGdDQUFtQixDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFBO0lBQzVELElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDcEIsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLGVBQWUsQ0FDeEUsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUE7SUFFbkMsTUFBTSxVQUFVLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQ2xDLDBDQUF1QixDQUN4QixDQUFBO0lBQ0QsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsYUFBYSxDQUFDLENBQUE7SUFDekUsTUFBTSxTQUFTLEdBQ1osTUFBTSxFQUFFLGFBQW1ELEVBQUUsSUFBSTtRQUNoRSxFQUFFLFNBQVMsSUFBSSxhQUFhLENBQUE7SUFFaEMsTUFBTSxZQUFZLEdBQUcsTUFBTSxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxFQUFFLFNBQVMsQ0FBQyxDQUFBO0lBRTNFLElBQUksWUFBWSxDQUFDLElBQUksS0FBSyw2QkFBVSxDQUFDLHVCQUF1QixFQUFFLENBQUM7UUFDN0QsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsbURBQW1ELENBQ3BELENBQUE7SUFDSCxDQUFDO0lBRUQsTUFBTSxzQkFBc0IsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FDOUMsMERBQStCLENBQ2hDLENBQUE7SUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLHNCQUFzQixDQUFDLGFBQWEsQ0FDeEQsWUFBWSxDQUFDLFdBQVcsQ0FDekIsQ0FBQTtJQUVELE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDMUIsU0FBUyxFQUFFLElBQUk7UUFDZixPQUFPLEVBQUU7WUFDUCxFQUFFLEVBQUUsT0FBTyxDQUFDLEVBQUU7WUFDZCxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVc7WUFDaEMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNO1lBQ3RCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtTQUNuQztLQUNGLENBQUMsQ0FBQTtBQUNKLENBQUMsQ0FBQTtBQTdDWSxRQUFBLElBQUksUUE2Q2hCIn0=

package/.medusa/server/src/api/store/customers/account-deletion/cancel-request/route.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const account_deletion_request_1 = require("../../../../../modules/account-deletion-request");
+const otp_verification_1 = require("../../../../../modules/otp-verification/models/otp-verification");
+const send_otp_workflow_1 = __importDefault(require("../../../../../workflows/send-otp-workflow"));
+const validators_1 = require("../validators");
+const POST = async (req, res) => {
+    const parsed = validators_1.CancelRequestSchema.safeParse(req.body ?? {});
+    if (!parsed.success) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, parsed.error.errors.map((e) => e.message).join("; ") || "Invalid input");
+    }
+    const { email, phone } = parsed.data;
+    const knex = req.scope.resolve(utils_1.ContainerRegistrationKeys.PG_CONNECTION);
+    if (!knex) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.UNEXPECTED_STATE, "Database connection not available");
+    }
+    let customerId;
+    if (email) {
+        const result = await knex.raw(`SELECT id FROM customer WHERE email = ? LIMIT 1`, [email.toLowerCase().trim()]);
+        const row = result.rows?.[0] ?? result[0]?.[0];
+        customerId = row?.id;
+    }
+    else if (phone) {
+        const result = await knex.raw(`SELECT id FROM customer WHERE phone = ? LIMIT 1`, [phone.trim()]);
+        const row = result.rows?.[0] ?? result[0]?.[0];
+        customerId = row?.id;
+    }
+    if (!customerId) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.NOT_FOUND, email
+            ? "Customer not found with this email"
+            : "Customer not found with this phone number");
+    }
+    const accountDeletionService = req.scope.resolve(account_deletion_request_1.ACCOUNT_DELETION_REQUEST_MODULE);
+    const active = await accountDeletionService.getActiveByCustomerId(customerId);
+    if (!active) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.NOT_FOUND, "No active deletion request found for this customer");
+    }
+    const { result: workflowResult } = await (0, send_otp_workflow_1.default)(req.scope).run({
+        input: {
+            customer_id: customerId,
+            type: otp_verification_1.OtpPurpose.ACCOUNT_DELETION_CANCEL,
+        },
+    });
+    return res.status(200).json({
+        token: workflowResult.token,
+        expires_at: workflowResult.expires_at,
+    });
+};
+exports.POST = POST;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVycy9hY2NvdW50LWRlbGV0aW9uL2NhbmNlbC1yZXF1ZXN0L3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUNBLHFEQUdrQztBQUNsQyw4RkFBaUc7QUFFakcsc0dBQTRGO0FBQzVGLG1HQUF3RTtBQUN4RSw4Q0FBbUQ7QUFFNUMsTUFBTSxJQUFJLEdBQUcsS0FBSyxFQUFFLEdBQWtCLEVBQUUsR0FBbUIsRUFBRSxFQUFFO0lBQ3BFLE1BQU0sTUFBTSxHQUFHLGdDQUFtQixDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFBO0lBQzVELElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDcEIsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLGVBQWUsQ0FDeEUsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUE7SUFFcEMsTUFBTSxJQUFJLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsYUFBYSxDQUFDLENBQUE7SUFDdkUsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1YsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLGdCQUFnQixFQUNsQyxtQ0FBbUMsQ0FDcEMsQ0FBQTtJQUNILENBQUM7SUFFRCxJQUFJLFVBQThCLENBQUE7SUFFbEMsSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUNWLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLEdBQUcsQ0FDM0IsaURBQWlELEVBQ2pELENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxDQUFDLElBQUksRUFBRSxDQUFDLENBQzdCLENBQUE7UUFDRCxNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUE7UUFDOUMsVUFBVSxHQUFHLEdBQUcsRUFBRSxFQUFFLENBQUE7SUFDdEIsQ0FBQztTQUFNLElBQUksS0FBSyxFQUFFLENBQUM7UUFDakIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsR0FBRyxDQUMzQixpREFBaUQsRUFDakQsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FDZixDQUFBO1FBQ0QsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFBO1FBQzlDLFVBQVUsR0FBRyxHQUFHLEVBQUUsRUFBRSxDQUFBO0lBQ3RCLENBQUM7SUFFRCxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDaEIsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFDM0IsS0FBSztZQUNILENBQUMsQ0FBQyxvQ0FBb0M7WUFDdEMsQ0FBQyxDQUFDLDJDQUEyQyxDQUNoRCxDQUFBO0lBQ0gsQ0FBQztJQUVELE1BQU0sc0JBQXNCLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQzlDLDBEQUErQixDQUNoQyxDQUFBO0lBRUQsTUFBTSxNQUFNLEdBQUcsTUFBTSxzQkFBc0IsQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsQ0FBQTtJQUM3RSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUMzQixvREFBb0QsQ0FDckQsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxHQUFHLE1BQU0sSUFBQSwyQkFBZSxFQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLENBQUM7UUFDdEUsS0FBSyxFQUFFO1lBQ0wsV0FBVyxFQUFFLFVBQVU7WUFDdkIsSUFBSSxFQUFFLDZCQUFVLENBQUMsdUJBQXVCO1NBQ3pDO0tBQ0YsQ0FBQyxDQUFBO0lBRUYsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUMxQixLQUFLLEVBQUUsY0FBYyxDQUFDLEtBQUs7UUFDM0IsVUFBVSxFQUFFLGNBQWMsQ0FBQyxVQUFVO0tBQ3RDLENBQUMsQ0FBQTtBQUNKLENBQUMsQ0FBQTtBQXJFWSxRQUFBLElBQUksUUFxRWhCIn0=

package/.medusa/server/src/api/store/customers/account-deletion/confirm/route.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const otp_verification_1 = require("../../../../../modules/otp-verification");
+const otp_verification_2 = require("../../../../../modules/otp-verification/models/otp-verification");
+const account_deletion_request_1 = require("../../../../../modules/account-deletion-request");
+const config_1 = require("../../../../../config");
+const validators_1 = require("../validators");
+const DEFAULT_SCHEDULED_DAYS = 7;
+const POST = async (req, res) => {
+    const parsed = validators_1.ConfirmDeletionSchema.safeParse(req.body ?? {});
+    if (!parsed.success) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, parsed.error.errors.map((e) => e.message).join("; ") || "Invalid input");
+    }
+    const { token, code } = parsed.data;
+    const otpService = req.scope.resolve(otp_verification_1.OTP_VERIFICATION_MODULE);
+    const config = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+    const jwtSecret = config?.projectConfig?.http
+        ?.jwtSecret || "supersecret";
+    const verifyResult = await otpService.verifyOtp({ token, code }, jwtSecret);
+    if (verifyResult.type !== otp_verification_2.OtpPurpose.ACCOUNT_DELETION_REQUEST) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Invalid verification type for account deletion confirmation");
+    }
+    const configModule = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+    const pluginOptions = (0, config_1.resolveCustomerRegistrationOptions)(configModule);
+    const scheduledDays = pluginOptions?.account_deletion_request?.scheduled_days ??
+        DEFAULT_SCHEDULED_DAYS;
+    const deletion_scheduled_at = new Date(Date.now() + scheduledDays * 24 * 60 * 60 * 1000);
+    const accountDeletionService = req.scope.resolve(account_deletion_request_1.ACCOUNT_DELETION_REQUEST_MODULE);
+    const request = await accountDeletionService.createConfirmed(verifyResult.customer_id, deletion_scheduled_at);
+    return res.status(200).json({
+        request: {
+            id: request.id,
+            customer_id: request.customer_id,
+            reason: request.reason,
+            deletion_scheduled_at: request.deletion_scheduled_at,
+            status: request.status,
+        },
+    });
+};
+exports.POST = POST;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVycy9hY2NvdW50LWRlbGV0aW9uL2NvbmZpcm0vcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQ0EscURBR2tDO0FBQ2xDLDhFQUFpRjtBQUVqRixzR0FBNEY7QUFDNUYsOEZBQWlHO0FBRWpHLGtEQUEwRTtBQUUxRSw4Q0FBcUQ7QUFFckQsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLENBQUE7QUFFekIsTUFBTSxJQUFJLEdBQUcsS0FBSyxFQUFFLEdBQWtCLEVBQUUsR0FBbUIsRUFBRSxFQUFFO0lBQ3BFLE1BQU0sTUFBTSxHQUFHLGtDQUFxQixDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFBO0lBQzlELElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDcEIsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLGVBQWUsQ0FDeEUsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUE7SUFFbkMsTUFBTSxVQUFVLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQ2xDLDBDQUF1QixDQUN4QixDQUFBO0lBQ0QsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsYUFBYSxDQUFDLENBQUE7SUFDekUsTUFBTSxTQUFTLEdBQ1osTUFBTSxFQUFFLGFBQW1ELEVBQUUsSUFBSTtRQUNoRSxFQUFFLFNBQVMsSUFBSSxhQUFhLENBQUE7SUFFaEMsTUFBTSxZQUFZLEdBQUcsTUFBTSxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxFQUFFLFNBQVMsQ0FBQyxDQUFBO0lBRTNFLElBQUksWUFBWSxDQUFDLElBQUksS0FBSyw2QkFBVSxDQUFDLHdCQUF3QixFQUFFLENBQUM7UUFDOUQsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsNkRBQTZELENBQzlELENBQUE7SUFDSCxDQUFDO0lBRUQsTUFBTSxZQUFZLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQ3BDLGlDQUF5QixDQUFDLGFBQWEsQ0FDbkIsQ0FBQTtJQUN0QixNQUFNLGFBQWEsR0FBRyxJQUFBLDJDQUFrQyxFQUFDLFlBQVksQ0FBQyxDQUFBO0lBQ3RFLE1BQU0sYUFBYSxHQUNqQixhQUFhLEVBQUUsd0JBQXdCLEVBQUUsY0FBYztRQUN2RCxzQkFBc0IsQ0FBQTtJQUN4QixNQUFNLHFCQUFxQixHQUFHLElBQUksSUFBSSxDQUNwQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsYUFBYSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FDakQsQ0FBQTtJQUVELE1BQU0sc0JBQXNCLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQzlDLDBEQUErQixDQUNoQyxDQUFBO0lBRUQsTUFBTSxPQUFPLEdBQUcsTUFBTSxzQkFBc0IsQ0FBQyxlQUFlLENBQzFELFlBQVksQ0FBQyxXQUFXLEVBQ3hCLHFCQUFxQixDQUN0QixDQUFBO0lBRUQsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUMxQixPQUFPLEVBQUU7WUFDUCxFQUFFLEVBQUUsT0FBTyxDQUFDLEVBQUU7WUFDZCxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVc7WUFDaEMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNO1lBQ3RCLHFCQUFxQixFQUFFLE9BQU8sQ0FBQyxxQkFBcUI7WUFDcEQsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNO1NBQ3ZCO0tBQ0YsQ0FBQyxDQUFBO0FBQ0osQ0FBQyxDQUFBO0FBekRZLFFBQUEsSUFBSSxRQXlEaEIifQ==

package/.medusa/server/src/api/store/customers/account-deletion/request/route.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const account_deletion_request_1 = require("../../../../../modules/account-deletion-request");
+const otp_verification_1 = require("../../../../../modules/otp-verification/models/otp-verification");
+const send_otp_workflow_1 = __importDefault(require("../../../../../workflows/send-otp-workflow"));
+const validators_1 = require("../validators");
+const POST = async (req, res) => {
+    const authContext = req
+        .auth_context;
+    const customerId = authContext?.actor_id ?? authContext?.user_id;
+    if (!customerId) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.UNAUTHORIZED, "Authentication required");
+    }
+    const parsed = validators_1.RequestDeletionSchema.safeParse(req.body ?? {});
+    if (!parsed.success) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, parsed.error.errors.map((e) => e.message).join("; ") || "Invalid input");
+    }
+    const accountDeletionService = req.scope.resolve(account_deletion_request_1.ACCOUNT_DELETION_REQUEST_MODULE);
+    const active = await accountDeletionService.getActiveByCustomerId(customerId);
+    if (active) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "An active deletion request already exists. Cancel it first.");
+    }
+    const { result } = await (0, send_otp_workflow_1.default)(req.scope).run({
+        input: {
+            customer_id: customerId,
+            type: otp_verification_1.OtpPurpose.ACCOUNT_DELETION_REQUEST,
+        },
+    });
+    return res.status(200).json({
+        token: result.token,
+        expires_at: result.expires_at,
+    });
+};
+exports.POST = POST;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVycy9hY2NvdW50LWRlbGV0aW9uL3JlcXVlc3Qvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQ0EscURBQXVEO0FBQ3ZELDhGQUFpRztBQUVqRyxzR0FBNEY7QUFDNUYsbUdBQXdFO0FBQ3hFLDhDQUFxRDtBQUU5QyxNQUFNLElBQUksR0FBRyxLQUFLLEVBQUUsR0FBa0IsRUFBRSxHQUFtQixFQUFFLEVBQUU7SUFDcEUsTUFBTSxXQUFXLEdBQUksR0FBa0U7U0FDcEYsWUFBWSxDQUFBO0lBQ2YsTUFBTSxVQUFVLEdBQUcsV0FBVyxFQUFFLFFBQVEsSUFBSSxXQUFXLEVBQUUsT0FBTyxDQUFBO0lBRWhFLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNoQixNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5Qix5QkFBeUIsQ0FDMUIsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxrQ0FBcUIsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQTtJQUM5RCxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3BCLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxlQUFlLENBQ3hFLENBQUE7SUFDSCxDQUFDO0lBRUQsTUFBTSxzQkFBc0IsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FDOUMsMERBQStCLENBQ2hDLENBQUE7SUFFRCxNQUFNLE1BQU0sR0FBRyxNQUFNLHNCQUFzQixDQUFDLHFCQUFxQixDQUFDLFVBQVUsQ0FBQyxDQUFBO0lBQzdFLElBQUksTUFBTSxFQUFFLENBQUM7UUFDWCxNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5Qiw2REFBNkQsQ0FDOUQsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxJQUFBLDJCQUFlLEVBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsQ0FBQztRQUN0RCxLQUFLLEVBQUU7WUFDTCxXQUFXLEVBQUUsVUFBVTtZQUN2QixJQUFJLEVBQUUsNkJBQVUsQ0FBQyx3QkFBd0I7U0FDMUM7S0FDRixDQUFDLENBQUE7SUFFRixPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQzFCLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSztRQUNuQixVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7S0FDOUIsQ0FBQyxDQUFBO0FBQ0osQ0FBQyxDQUFBO0FBM0NZLFFBQUEsSUFBSSxRQTJDaEIifQ==

package/.medusa/server/src/api/store/customers/account-deletion/validators.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfirmCancelSchema = exports.CancelRequestSchema = exports.ConfirmDeletionSchema = exports.RequestDeletionSchema = void 0;
+const zod_1 = require("zod");
+exports.RequestDeletionSchema = zod_1.z.object({
+    reason: zod_1.z.string().max(2000).optional().nullable(),
+});
+exports.ConfirmDeletionSchema = zod_1.z.object({
+    token: zod_1.z.string().min(1, "Token is required"),
+    code: zod_1.z.string().min(1, "OTP code is required"),
+});
+exports.CancelRequestSchema = zod_1.z
+    .object({
+    email: zod_1.z.string().email("Valid email address").optional(),
+    phone: zod_1.z
+        .string()
+        .regex(/^\+?[0-9]{8,15}$/, "Invalid phone number format")
+        .optional(),
+})
+    .refine((data) => data.email || data.phone, {
+    message: "Either email or phone is required",
+});
+exports.ConfirmCancelSchema = zod_1.z.object({
+    token: zod_1.z.string().min(1, "Token is required"),
+    code: zod_1.z.string().min(1, "OTP code is required"),
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdG9ycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uLy4uL3NyYy9hcGkvc3RvcmUvY3VzdG9tZXJzL2FjY291bnQtZGVsZXRpb24vdmFsaWRhdG9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSw2QkFBdUI7QUFFVixRQUFBLHFCQUFxQixHQUFHLE9BQUMsQ0FBQyxNQUFNLENBQUM7SUFDNUMsTUFBTSxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxFQUFFO0NBQ25ELENBQUMsQ0FBQTtBQUVXLFFBQUEscUJBQXFCLEdBQUcsT0FBQyxDQUFDLE1BQU0sQ0FBQztJQUM1QyxLQUFLLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsbUJBQW1CLENBQUM7SUFDN0MsSUFBSSxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLHNCQUFzQixDQUFDO0NBQ2hELENBQUMsQ0FBQTtBQUVXLFFBQUEsbUJBQW1CLEdBQUcsT0FBQztLQUNqQyxNQUFNLENBQUM7SUFDTixLQUFLLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUN6RCxLQUFLLEVBQUUsT0FBQztTQUNMLE1BQU0sRUFBRTtTQUNSLEtBQUssQ0FBQyxrQkFBa0IsRUFBRSw2QkFBNkIsQ0FBQztTQUN4RCxRQUFRLEVBQUU7Q0FDZCxDQUFDO0tBQ0QsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxLQUFLLEVBQUU7SUFDMUMsT0FBTyxFQUFFLG1DQUFtQztDQUM3QyxDQUFDLENBQUE7QUFFUyxRQUFBLG1CQUFtQixHQUFHLE9BQUMsQ0FBQyxNQUFNLENBQUM7SUFDMUMsS0FBSyxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLG1CQUFtQixDQUFDO0lBQzdDLElBQUksRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxzQkFBc0IsQ0FBQztDQUNoRCxDQUFDLENBQUEifQ==

package/.medusa/server/src/api/store/customers/me/contact/route.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const otp_verification_1 = require("../../../../../modules/otp-verification/models/otp-verification");
+const config_1 = require("../../../../../config");
+const send_contact_change_otp_workflow_1 = __importDefault(require("../../../../../workflows/send-contact-change-otp-workflow"));
+const EMAIL_REGEX = /^\S+@\S+\.\S+$/;
+const PHONE_REGEX = /^\+?[0-9]{8,15}$/;
+/**
+ * POST /store/customers/me/contact
+ *
+ * Authenticated endpoint for requesting a phone or email change.
+ * Validates the new value, checks for duplicates, generates an OTP with the
+ * new_value embedded in the signed JWT (no metadata staging), sends the OTP
+ * to the new contact, and returns the token + expiry for use at /verify.
+ *
+ * Request body (exactly one field required):
+ *   { phone: string } | { email: string }
+ */
+const POST = async (req, res) => {
+    const customerId = req.auth_context.actor_id;
+    const configModule = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+    const options = (0, config_1.resolveCustomerRegistrationOptions)(configModule);
+    const { phone: rawPhone, email: rawEmail } = (req.body ?? {});
+    const phone = rawPhone?.trim() || undefined;
+    const email = rawEmail?.trim() || undefined;
+    if (!phone && !email) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Either phone or email is required");
+    }
+    if (phone && email) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Only one of phone or email can be changed at a time");
+    }
+    const knex = req.scope.resolve(utils_1.ContainerRegistrationKeys.PG_CONNECTION);
+    const customerService = req.scope.resolve(utils_1.Modules.CUSTOMER);
+    const customer = await customerService.retrieveCustomer(customerId);
+    if (phone) {
+        if (!PHONE_REGEX.test(phone)) {
+            throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Invalid phone number format. Must be 8–15 digits, optionally prefixed with +");
+        }
+        if (phone === customer.phone) {
+            throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "New phone number is the same as the current one");
+        }
+        // Reject if login.identifier doesn't support phone
+        if (options.login.identifier !== "phone" &&
+            options.login.identifier !== "both") {
+            throw new utils_1.MedusaError(utils_1.MedusaError.Types.NOT_ALLOWED, "Phone-based login is not enabled for this store");
+        }
+        // Duplicate check
+        const existing = await knex.raw(`SELECT id FROM customer WHERE phone = ? AND has_account = true LIMIT 1`, [phone]);
+        if (existing.rows?.[0] ?? existing[0]?.[0]) {
+            throw new utils_1.MedusaError(utils_1.MedusaError.Types.DUPLICATE_ERROR, "A customer with this phone number already exists");
+        }
+        const { result } = await (0, send_contact_change_otp_workflow_1.default)(req.scope).run({
+            input: {
+                customer_id: customerId,
+                new_value: phone,
+                contact_type: "phone",
+                otp_type: otp_verification_1.OtpPurpose.PHONE_VERIFICATION,
+            },
+        });
+        return res.status(200).json({ token: result.token, expires_at: result.expires_at });
+    }
+    // email branch
+    if (!EMAIL_REGEX.test(email)) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "Invalid email format");
+    }
+    if (email === customer.email) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "New email is the same as the current one");
+    }
+    // Reject if login.identifier doesn't support email
+    if (options.login.identifier !== "email" &&
+        options.login.identifier !== "both") {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.NOT_ALLOWED, "Email-based login is not enabled for this store");
+    }
+    // Duplicate check
+    const existingEmail = await knex.raw(`SELECT id FROM customer WHERE email = ? AND has_account = true LIMIT 1`, [email]);
+    if (existingEmail.rows?.[0] ?? existingEmail[0]?.[0]) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.DUPLICATE_ERROR, "A customer with this email already exists");
+    }
+    const { result } = await (0, send_contact_change_otp_workflow_1.default)(req.scope).run({
+        input: {
+            customer_id: customerId,
+            new_value: email,
+            contact_type: "email",
+            otp_type: otp_verification_1.OtpPurpose.EMAIL_VERIFICATION,
+        },
+    });
+    return res.status(200).json({ token: result.token, expires_at: result.expires_at });
+};
+exports.POST = POST;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVycy9tZS9jb250YWN0L3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUNBLHFEQUlrQztBQUVsQyxzR0FBNEY7QUFDNUYsa0RBRzhCO0FBQzlCLGlJQUFvRztBQUVwRyxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQTtBQUNwQyxNQUFNLFdBQVcsR0FBRyxrQkFBa0IsQ0FBQTtBQUV0Qzs7Ozs7Ozs7OztHQVVHO0FBQ0ksTUFBTSxJQUFJLEdBQUcsS0FBSyxFQUN2QixHQUErQixFQUMvQixHQUFtQixFQUNuQixFQUFFO0lBQ0YsTUFBTSxVQUFVLEdBQUcsR0FBRyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUE7SUFFNUMsTUFBTSxZQUFZLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsYUFBYSxDQUFDLENBQUE7SUFDL0UsTUFBTSxPQUFPLEdBQUcsSUFBQSwyQ0FBa0MsRUFBQyxZQUFpQyxDQUFDLENBQUE7SUFFckYsTUFBTSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxFQUFFLENBRzNELENBQUE7SUFFRCxNQUFNLEtBQUssR0FBRyxRQUFRLEVBQUUsSUFBSSxFQUFFLElBQUksU0FBUyxDQUFBO0lBQzNDLE1BQU0sS0FBSyxHQUFHLFFBQVEsRUFBRSxJQUFJLEVBQUUsSUFBSSxTQUFTLENBQUE7SUFFM0MsSUFBSSxDQUFDLEtBQUssSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ3JCLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLG1DQUFtQyxDQUNwQyxDQUFBO0lBQ0gsQ0FBQztJQUVELElBQUksS0FBSyxJQUFJLEtBQUssRUFBRSxDQUFDO1FBQ25CLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLHFEQUFxRCxDQUN0RCxDQUFBO0lBQ0gsQ0FBQztJQUVELE1BQU0sSUFBSSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLGFBQWEsQ0FBQyxDQUFBO0lBQ3ZFLE1BQU0sZUFBZSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUF5QixlQUFPLENBQUMsUUFBUSxDQUFDLENBQUE7SUFDbkYsTUFBTSxRQUFRLEdBQUcsTUFBTSxlQUFlLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLENBQUE7SUFFbkUsSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUNWLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDN0IsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsOEVBQThFLENBQy9FLENBQUE7UUFDSCxDQUFDO1FBRUQsSUFBSSxLQUFLLEtBQUssUUFBUSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQzdCLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLGlEQUFpRCxDQUNsRCxDQUFBO1FBQ0gsQ0FBQztRQUVELG1EQUFtRDtRQUNuRCxJQUNFLE9BQU8sQ0FBQyxLQUFLLENBQUMsVUFBVSxLQUFLLE9BQU87WUFDcEMsT0FBTyxDQUFDLEtBQUssQ0FBQyxVQUFVLEtBQUssTUFBTSxFQUNuQyxDQUFDO1lBQ0QsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFDN0IsaURBQWlELENBQ2xELENBQUE7UUFDSCxDQUFDO1FBRUQsa0JBQWtCO1FBQ2xCLE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLEdBQUcsQ0FDN0Isd0VBQXdFLEVBQ3hFLENBQUMsS0FBSyxDQUFDLENBQ1IsQ0FBQTtRQUNELElBQUksUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDM0MsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLGVBQWUsRUFDakMsa0RBQWtELENBQ25ELENBQUE7UUFDSCxDQUFDO1FBRUQsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sSUFBQSwwQ0FBNEIsRUFBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxDQUFDO1lBQ25FLEtBQUssRUFBRTtnQkFDTCxXQUFXLEVBQUUsVUFBVTtnQkFDdkIsU0FBUyxFQUFFLEtBQUs7Z0JBQ2hCLFlBQVksRUFBRSxPQUFPO2dCQUNyQixRQUFRLEVBQUUsNkJBQVUsQ0FBQyxrQkFBa0I7YUFDeEM7U0FDRixDQUFDLENBQUE7UUFFRixPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFBO0lBQ3JGLENBQUM7SUFFRCxlQUFlO0lBQ2YsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsS0FBTSxDQUFDLEVBQUUsQ0FBQztRQUM5QixNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5QixzQkFBc0IsQ0FDdkIsQ0FBQTtJQUNILENBQUM7SUFFRCxJQUFJLEtBQUssS0FBSyxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDN0IsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsMENBQTBDLENBQzNDLENBQUE7SUFDSCxDQUFDO0lBRUQsbURBQW1EO0lBQ25ELElBQ0UsT0FBTyxDQUFDLEtBQUssQ0FBQyxVQUFVLEtBQUssT0FBTztRQUNwQyxPQUFPLENBQUMsS0FBSyxDQUFDLFVBQVUsS0FBSyxNQUFNLEVBQ25DLENBQUM7UUFDRCxNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUM3QixpREFBaUQsQ0FDbEQsQ0FBQTtJQUNILENBQUM7SUFFRCxrQkFBa0I7SUFDbEIsTUFBTSxhQUFhLEdBQUcsTUFBTSxJQUFJLENBQUMsR0FBRyxDQUNsQyx3RUFBd0UsRUFDeEUsQ0FBQyxLQUFLLENBQUMsQ0FDUixDQUFBO0lBQ0QsSUFBSSxhQUFhLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNyRCxNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsZUFBZSxFQUNqQywyQ0FBMkMsQ0FDNUMsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxJQUFBLDBDQUE0QixFQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLENBQUM7UUFDbkUsS0FBSyxFQUFFO1lBQ0wsV0FBVyxFQUFFLFVBQVU7WUFDdkIsU0FBUyxFQUFFLEtBQU07WUFDakIsWUFBWSxFQUFFLE9BQU87WUFDckIsUUFBUSxFQUFFLDZCQUFVLENBQUMsa0JBQWtCO1NBQ3hDO0tBQ0YsQ0FBQyxDQUFBO0lBRUYsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQTtBQUNyRixDQUFDLENBQUE7QUFySVksUUFBQSxJQUFJLFFBcUloQiJ9

package/.medusa/server/src/api/store/customers/me/contact/verify/route.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const generate_jwt_token_1 = require("@medusajs/medusa/api/auth/utils/generate-jwt-token");
+const otp_verification_1 = require("../../../../../../modules/otp-verification");
+const config_1 = require("../../../../../../config");
+const update_contact_workflow_1 = __importDefault(require("../../../../../../workflows/update-contact-workflow"));
+/**
+ * POST /store/customers/me/contact/verify
+ *
+ * Authenticated endpoint for confirming a phone or email change.
+ *
+ * 1. Decodes the JWT from /store/customers/me/contact — extracts new_value
+ *    and contact_type without any database lookup.
+ * 2. Validates the OTP code against the stored hashed record.
+ * 3. Runs updateContactWorkflow which atomically:
+ *    - Writes new_value to customer.phone / customer.email
+ *    - Sets phone_verified / email_verified = true
+ *    - Updates provider_identity.entity_id (phonepass / emailpass) when the
+ *      changed field is the active login identifier.
+ * 4. Returns the updated customer + a fresh JWT so the caller is immediately
+ *    re-authenticated with the new identity.
+ *
+ * Request body: { token: string; code: string }
+ */
+const POST = async (req, res) => {
+    const customerId = req.auth_context.actor_id;
+    const { token, code } = (req.body ?? {});
+    if (!token) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "token is required");
+    }
+    if (!code) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "code is required");
+    }
+    const config = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+    const { http } = config.projectConfig;
+    const jwtSecret = http?.jwtSecret || "supersecret";
+    const otpService = req.scope.resolve(otp_verification_1.OTP_VERIFICATION_MODULE);
+    // Decode the contact-change JWT — new_value lives here, not in metadata
+    const decoded = otpService.decodeContactChangeToken(token, jwtSecret);
+    // Ensure the token belongs to the authenticated customer
+    if (decoded.customer_id !== customerId) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.UNAUTHORIZED, "Token does not match the authenticated customer");
+    }
+    // Validate the OTP record (expiry, attempts, already-used)
+    // and verify the submitted code against the stored hash.
+    // These are the same private-method-backed operations used by verifyOtp().
+    await otpService.verifyOtp({ token, code }, jwtSecret);
+    const options = (0, config_1.resolveCustomerRegistrationOptions)(config);
+    const { result } = await (0, update_contact_workflow_1.default)(req.scope).run({
+        input: {
+            customer_id: customerId,
+            new_value: decoded.new_value,
+            contact_type: decoded.contact_type,
+            login_identifier: options.login.identifier,
+        },
+    });
+    // Generate a fresh login token so the caller stays authenticated
+    let loginToken;
+    try {
+        const knex = req.scope.resolve(utils_1.ContainerRegistrationKeys.PG_CONNECTION);
+        const authRow = await knex.raw(`SELECT id FROM auth_identity WHERE app_metadata->>'customer_id' = ? LIMIT 1`, [customerId]);
+        const authIdentityId = (authRow.rows?.[0] ?? authRow[0]?.[0])?.id;
+        if (authIdentityId) {
+            const authService = req.scope.resolve(utils_1.Modules.AUTH);
+            const authIdentity = await authService.retrieveAuthIdentity(authIdentityId);
+            loginToken = await (0, generate_jwt_token_1.generateJwtTokenForAuthIdentity)({ authIdentity, actorType: "customer" }, { secret: jwtSecret, expiresIn: http.jwtExpiresIn || "7d" });
+        }
+    }
+    catch {
+        // Token generation is best-effort; the contact update already succeeded
+    }
+    return res.status(200).json({
+        customer: result.customer,
+        token: loginToken ?? null,
+    });
+};
+exports.POST = POST;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVycy9tZS9jb250YWN0L3ZlcmlmeS9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFDQSxxREFJa0M7QUFDbEMsMkZBQW9HO0FBQ3BHLGlGQUFvRjtBQUVwRixxREFHaUM7QUFDakMsa0hBQXVGO0FBRXZGOzs7Ozs7Ozs7Ozs7Ozs7OztHQWlCRztBQUNJLE1BQU0sSUFBSSxHQUFHLEtBQUssRUFDdkIsR0FBK0IsRUFDL0IsR0FBbUIsRUFDbkIsRUFBRTtJQUNGLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFBO0lBRTVDLE1BQU0sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBc0MsQ0FBQTtJQUU3RSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDWCxNQUFNLElBQUksbUJBQVcsQ0FBQyxtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQUUsbUJBQW1CLENBQUMsQ0FBQTtJQUM1RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1YsTUFBTSxJQUFJLG1CQUFXLENBQUMsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUFFLGtCQUFrQixDQUFDLENBQUE7SUFDM0UsQ0FBQztJQUVELE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLGFBQWEsQ0FBQyxDQUFBO0lBQ3pFLE1BQU0sRUFBRSxJQUFJLEVBQUUsR0FBRyxNQUFNLENBQUMsYUFBYSxDQUFBO0lBQ3JDLE1BQU0sU0FBUyxHQUFJLElBQUksRUFBRSxTQUFnQyxJQUFJLGFBQWEsQ0FBQTtJQUUxRSxNQUFNLFVBQVUsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBeUIsMENBQXVCLENBQUMsQ0FBQTtJQUVyRix3RUFBd0U7SUFDeEUsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxTQUFTLENBQUMsQ0FBQTtJQUVyRSx5REFBeUQ7SUFDekQsSUFBSSxPQUFPLENBQUMsV0FBVyxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLGlEQUFpRCxDQUNsRCxDQUFBO0lBQ0gsQ0FBQztJQUVELDJEQUEyRDtJQUMzRCx5REFBeUQ7SUFDekQsMkVBQTJFO0lBQzNFLE1BQU0sVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsRUFBRSxTQUFTLENBQUMsQ0FBQTtJQUV0RCxNQUFNLE9BQU8sR0FBRyxJQUFBLDJDQUFrQyxFQUFDLE1BQTJCLENBQUMsQ0FBQTtJQUUvRSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxJQUFBLGlDQUFxQixFQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLENBQUM7UUFDNUQsS0FBSyxFQUFFO1lBQ0wsV0FBVyxFQUFFLFVBQVU7WUFDdkIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1lBQzVCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtZQUNsQyxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLFVBQVU7U0FDM0M7S0FDRixDQUFDLENBQUE7SUFFRixpRUFBaUU7SUFDakUsSUFBSSxVQUE4QixDQUFBO0lBQ2xDLElBQUksQ0FBQztRQUNILE1BQU0sSUFBSSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLGFBQWEsQ0FBQyxDQUFBO1FBQ3ZFLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLEdBQUcsQ0FDNUIsNkVBQTZFLEVBQzdFLENBQUMsVUFBVSxDQUFDLENBQ2IsQ0FBQTtRQUNELE1BQU0sY0FBYyxHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFBO1FBRWpFLElBQUksY0FBYyxFQUFFLENBQUM7WUFDbkIsTUFBTSxXQUFXLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBTyxDQUFDLElBQUksQ0FBQyxDQUFBO1lBQ25ELE1BQU0sWUFBWSxHQUFHLE1BQU0sV0FBVyxDQUFDLG9CQUFvQixDQUFDLGNBQWMsQ0FBQyxDQUFBO1lBQzNFLFVBQVUsR0FBRyxNQUFNLElBQUEsb0RBQStCLEVBQ2hELEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsRUFDdkMsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsWUFBWSxJQUFJLElBQUksRUFBRSxDQUM1RCxDQUFBO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCx3RUFBd0U7SUFDMUUsQ0FBQztJQUVELE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDMUIsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO1FBQ3pCLEtBQUssRUFBRSxVQUFVLElBQUksSUFBSTtLQUMxQixDQUFDLENBQUE7QUFDSixDQUFDLENBQUE7QUExRVksUUFBQSxJQUFJLFFBMEVoQiJ9

package/.medusa/server/src/api/store/customers/me/route.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PATCH = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+/**
+ * Override of Medusa's built-in PATCH /store/customers/me.
+ *
+ * Phone and email changes require OTP verification and must go through the
+ * dedicated endpoint:
+ *   POST /store/customers/me/contact        — request the change + receive OTP token
+ *   POST /store/customers/me/contact/verify — submit OTP code to apply the change
+ *
+ * All other profile fields (first_name, last_name, etc.) are applied directly
+ * via the customer service, matching Medusa's default behaviour.
+ */
+const PATCH = async (req, res) => {
+    const customerId = req.auth_context.actor_id;
+    const body = (req.body ?? {});
+    if (body.phone !== undefined) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.NOT_ALLOWED, "Phone changes require OTP verification. Use POST /store/customers/me/contact to request a change.");
+    }
+    if (body.email !== undefined) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.NOT_ALLOWED, "Email changes require OTP verification. Use POST /store/customers/me/contact to request a change.");
+    }
+    const customerService = req.scope.resolve(utils_1.Modules.CUSTOMER);
+    if (Object.keys(body).length > 0) {
+        await customerService.updateCustomers(customerId, body);
+    }
+    const updated = await refetchCustomer(customerId, req.scope);
+    return res.status(200).json({ customer: updated });
+};
+exports.PATCH = PATCH;
+async function refetchCustomer(customerId, scope) {
+    const remoteQuery = scope.resolve(utils_1.ContainerRegistrationKeys.REMOTE_QUERY);
+    const queryObject = (0, utils_1.remoteQueryObjectFromString)({
+        entryPoint: "customer",
+        variables: { filters: { id: customerId } },
+        fields: [
+            "id",
+            "email",
+            "first_name",
+            "last_name",
+            "phone",
+            "has_account",
+            "metadata",
+            "created_at",
+            "updated_at",
+        ],
+    });
+    const customers = await remoteQuery(queryObject);
+    return customers[0];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVycy9tZS9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFFQSxxREFLa0M7QUFHbEM7Ozs7Ozs7Ozs7R0FVRztBQUNJLE1BQU0sS0FBSyxHQUFHLEtBQUssRUFDeEIsR0FBK0IsRUFDL0IsR0FBbUIsRUFDbkIsRUFBRTtJQUNGLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFBO0lBQzVDLE1BQU0sSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxFQUFFLENBQTRCLENBQUE7SUFFeEQsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzdCLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxXQUFXLEVBQzdCLG1HQUFtRyxDQUNwRyxDQUFBO0lBQ0gsQ0FBQztJQUVELElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM3QixNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUM3QixtR0FBbUcsQ0FDcEcsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLGVBQWUsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBeUIsZUFBTyxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBRW5GLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDakMsTUFBTSxlQUFlLENBQUMsZUFBZSxDQUNuQyxVQUFVLEVBQ1YsSUFBNkQsQ0FDOUQsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLGVBQWUsQ0FBQyxVQUFVLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQzVELE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQTtBQUNwRCxDQUFDLENBQUE7QUFoQ1ksUUFBQSxLQUFLLFNBZ0NqQjtBQUVELEtBQUssVUFBVSxlQUFlLENBQUMsVUFBa0IsRUFBRSxLQUFzQjtJQUN2RSxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLFlBQVksQ0FBQyxDQUFBO0lBQ3pFLE1BQU0sV0FBVyxHQUFHLElBQUEsbUNBQTJCLEVBQUM7UUFDOUMsVUFBVSxFQUFFLFVBQVU7UUFDdEIsU0FBUyxFQUFFLEVBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxFQUFFLFVBQVUsRUFBRSxFQUFFO1FBQzFDLE1BQU0sRUFBRTtZQUNOLElBQUk7WUFDSixPQUFPO1lBQ1AsWUFBWTtZQUNaLFdBQVc7WUFDWCxPQUFPO1lBQ1AsYUFBYTtZQUNiLFVBQVU7WUFDVixZQUFZO1lBQ1osWUFBWTtTQUNiO0tBQ0YsQ0FBQyxDQUFBO0lBQ0YsTUFBTSxTQUFTLEdBQUcsTUFBTSxXQUFXLENBQUMsV0FBVyxDQUFDLENBQUE7SUFDaEQsT0FBTyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUE7QUFDckIsQ0FBQyJ9

package/.medusa/server/src/api/store/customers/otp/send/route.js

@@ -9,15 +9,12 @@ const otp_verification_1 = require("../../../../../modules/otp-verification/mode
 const send_otp_workflow_1 = __importDefault(require("../../../../../workflows/send-otp-workflow"));
 const POST = async (req, res) => {
     const { customer_id, type } = req.body;
-    console.log("=== [otp/send] Route Called ===");
-    console.log("Request body:", { customer_id, type });
     if (!customer_id) {
         throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "customer_id is required");
     }
     if (!type || !Object.values(otp_verification_1.OtpPurpose).includes(type)) {
         throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Type must be one of: ${Object.values(otp_verification_1.OtpPurpose).join(", ")}`);
     }
-    console.log("=== [otp/send] Starting Workflow ===");
     // Execute workflow
     const { result } = await (0, send_otp_workflow_1.default)(req.scope).run({
         input: {
@@ -25,12 +22,10 @@ const POST = async (req, res) => {
             type: type,
         },
     });
-    console.log("=== [otp/send] Workflow Completed ===");
-    console.log("Result:", { token: result.token, expires_at: result.expires_at });
     return res.status(200).json({
         token: result.token,
         expires_at: result.expires_at,
     });
 };
 exports.POST = POST;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVycy9vdHAvc2VuZC9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFDQSxxREFBdUQ7QUFDdkQsc0dBQTRGO0FBQzVGLG1HQUF3RTtBQUVqRSxNQUFNLElBQUksR0FBRyxLQUFLLEVBQUUsR0FBa0IsRUFBRSxHQUFtQixFQUFFLEVBQUU7SUFDcEUsTUFBTSxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsR0FBRyxHQUFHLENBQUMsSUFHakMsQ0FBQTtJQUVELE9BQU8sQ0FBQyxHQUFHLENBQUMsaUNBQWlDLENBQUMsQ0FBQTtJQUM5QyxPQUFPLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBRSxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFBO0lBRW5ELElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNqQixNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5Qix5QkFBeUIsQ0FDMUIsQ0FBQTtJQUNILENBQUM7SUFFRCxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyw2QkFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLElBQWtCLENBQUMsRUFBRSxDQUFDO1FBQ3JFLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLHdCQUF3QixNQUFNLENBQUMsTUFBTSxDQUFDLDZCQUFVLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FDL0QsQ0FBQTtJQUNILENBQUM7SUFFRCxPQUFPLENBQUMsR0FBRyxDQUFDLHNDQUFzQyxDQUFDLENBQUE7SUFFbkQsbUJBQW1CO0lBQ25CLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLElBQUEsMkJBQWUsRUFBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxDQUFDO1FBQ3RELEtBQUssRUFBRTtZQUNMLFdBQVc7WUFDWCxJQUFJLEVBQUUsSUFBa0I7U0FDekI7S0FDRixDQUFDLENBQUE7SUFFRixPQUFPLENBQUMsR0FBRyxDQUFDLHVDQUF1QyxDQUFDLENBQUE7SUFDcEQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxTQUFTLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUE7SUFFOUUsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUMxQixLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUs7UUFDbkIsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO0tBQzlCLENBQUMsQ0FBQTtBQUNKLENBQUMsQ0FBQTtBQXhDWSxRQUFBLElBQUksUUF3Q2hCIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2N1c3RvbWVycy9vdHAvc2VuZC9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFDQSxxREFBdUQ7QUFDdkQsc0dBQTRGO0FBQzVGLG1HQUF3RTtBQUVqRSxNQUFNLElBQUksR0FBRyxLQUFLLEVBQUUsR0FBa0IsRUFBRSxHQUFtQixFQUFFLEVBQUU7SUFDcEUsTUFBTSxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsR0FBRyxHQUFHLENBQUMsSUFHakMsQ0FBQTtJQUVELElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNqQixNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5Qix5QkFBeUIsQ0FDMUIsQ0FBQTtJQUNILENBQUM7SUFFRCxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyw2QkFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLElBQWtCLENBQUMsRUFBRSxDQUFDO1FBQ3JFLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLHdCQUF3QixNQUFNLENBQUMsTUFBTSxDQUFDLDZCQUFVLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FDL0QsQ0FBQTtJQUNILENBQUM7SUFHRCxtQkFBbUI7SUFDbkIsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sSUFBQSwyQkFBZSxFQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLENBQUM7UUFDdEQsS0FBSyxFQUFFO1lBQ0wsV0FBVztZQUNYLElBQUksRUFBRSxJQUFrQjtTQUN6QjtLQUNGLENBQUMsQ0FBQTtJQUVGLE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDMUIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLO1FBQ25CLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtLQUM5QixDQUFDLENBQUE7QUFDSixDQUFDLENBQUE7QUFqQ1ksUUFBQSxJQUFJLFFBaUNoQiJ9