customer-registration 0.0.134 → 0.0.135

package/.medusa/server/src/api/store/customers/otp/shared/email-auth-helpers.js

@@ -28,7 +28,7 @@ async function lookupCustomerByEmail(scope, email) {
     const result = await knex.raw(`SELECT id, email, has_account, first_name, last_name
      FROM customer
      WHERE lower(email) = lower(?)
-     ORDER BY created_at DESC
+     ORDER BY has_account DESC NULLS LAST, created_at DESC
      LIMIT 1`, [normalized]);
     const row = firstKnexRow(result);
     if (!row?.id) {

package/.medusa/server/src/api/store/customers/otp/shared/phone-auth-helpers.js

@@ -29,7 +29,7 @@ async function lookupCustomerByPhone(scope, phone) {
     const result = await knex.raw(`SELECT id, email, phone, has_account, first_name, last_name
      FROM customer
      WHERE phone = ?
-     ORDER BY created_at DESC
+     ORDER BY has_account DESC NULLS LAST, created_at DESC
      LIMIT 1`, [normalized]);
     const row = firstKnexRow(result);
     if (!row?.id) {

package/README.md

@@ -787,6 +787,32 @@ Placeholder module service for registration-related extension points.
 5. **Channel-aware password reset**  
    Use `/auth/customer/emailpass/reset-password` and `/auth/customer/emailpass/update` with email, phone, or `email_or_phone`.
 
+## Known Issues & Fixes
+
+### Issue: OTP login treats registered users as new when a guest row also exists
+
+**Problem:**
+For some returning users, email/phone OTP verify failed with Medusa's
+`Customer with this email already has an account` (or the phone equivalent).
+Send OTP could also report `is_new_user: true` incorrectly.
+
+**Root Cause:**
+Guest checkout and registration can leave two `customer` rows for the same
+email or phone (`has_account = true` and a later `has_account = false` guest).
+OTP lookup used `ORDER BY created_at DESC LIMIT 1`, so it preferred the newer
+guest and the verify flow tried to create another account.
+
+**Solution:**
+`lookupCustomerByEmail` / `lookupCustomerByPhone` now order by
+`has_account DESC NULLS LAST, created_at DESC`, so a registered account always
+wins. Guest rows are used only when no registered account exists. No data
+migration is required.
+
+**Prevention:**
+- Prefer registered customers (`has_account = true`) in any identifier lookup
+  that drives login vs register.
+- Keep regression tests that assert the SQL ordering contract.
+
 ## Troubleshooting
 
 ### `storefrontUrl is required when password_reset is configured`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "customer-registration",
-  "version": "0.0.134",
+  "version": "0.0.135",
   "description": "Medusa plugin that overrides store customer registration, enforces email/phone verification flags, and provides OTP management module.",
   "author": "Medusa (https://medusajs.com)",
   "license": "MIT",