medusa-product-helper 0.0.7 → 0.0.9

package/.medusa/server/src/api/admin/wishlist/stats/route.js

@@ -4,6 +4,18 @@ exports.GET = void 0;
 const wishlist_1 = require("../../../../modules/wishlist");
 const GET = async (req, res) => {
     try {
+        const authContext = req.auth_context;
+        const actorId = authContext?.actor_id;
+        const actorType = authContext?.actor_type;
+        if (!actorId) {
+            res.status(401).json({ message: "Unauthorized" });
+            return;
+        }
+        const adminActorTypes = ["user", "api-key"];
+        if (!actorType || !adminActorTypes.includes(actorType)) {
+            res.status(403).json({ message: "Only admin actors can access wishlist stats" });
+            return;
+        }
         const wishlistService = req.scope.resolve(wishlist_1.WISHLIST_MODULE);
         const productId = req.query.product_id;
         // If product_id is provided, return count for that product only
@@ -29,4 +41,4 @@ const GET = async (req, res) => {
     }
 };
 exports.GET = GET;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL2FkbWluL3dpc2hsaXN0L3N0YXRzL3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLDJEQUE4RDtBQUd2RCxNQUFNLEdBQUcsR0FBRyxLQUFLLEVBQ3RCLEdBQWtCLEVBQ2xCLEdBQW1CLEVBQ0osRUFBRTtJQUNqQixJQUFJLENBQUM7UUFDSCxNQUFNLGVBQWUsR0FBMEIsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQzlELDBCQUFlLENBQ2hCLENBQUE7UUFFRCxNQUFNLFNBQVMsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLFVBQWdDLENBQUE7UUFFNUQsZ0VBQWdFO1FBQ2hFLElBQUksU0FBUyxFQUFFLENBQUM7WUFDZCxNQUFNLE1BQU0sR0FBRyxNQUFNLGVBQWUsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUE7WUFDbkUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFVBQVUsS0FBSyxTQUFTLENBQUMsQ0FBQTtZQUU1RCxHQUFHLENBQUMsSUFBSSxDQUFDO2dCQUNQLFVBQVUsRUFBRSxTQUFTO2dCQUNyQixjQUFjLEVBQUUsS0FBSyxFQUFFLGNBQWMsSUFBSSxDQUFDO2FBQzNDLENBQUMsQ0FBQTtZQUNGLE9BQU07UUFDUixDQUFDO1FBRUQsNENBQTRDO1FBQzVDLE1BQU0sTUFBTSxHQUFHLE1BQU0sZUFBZSxDQUFDLGlCQUFpQixFQUFFLENBQUE7UUFFeEQsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFBO0lBQzdCLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksS0FBSyxFQUFFLENBQUM7WUFDM0IsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUE7WUFDaEQsT0FBTTtRQUNSLENBQUM7UUFDRCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxDQUFDLENBQUE7SUFDNUQsQ0FBQztBQUNILENBQUMsQ0FBQTtBQWxDWSxRQUFBLEdBQUcsT0FrQ2YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL2FkbWluL3dpc2hsaXN0L3N0YXRzL3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLDJEQUE4RDtBQUd2RCxNQUFNLEdBQUcsR0FBRyxLQUFLLEVBQ3RCLEdBQWtCLEVBQ2xCLEdBQW1CLEVBQ0osRUFBRTtJQUNqQixJQUFJLENBQUM7UUFDSCxNQUFNLFdBQVcsR0FBSSxHQUFXLENBQUMsWUFBWSxDQUFBO1FBQzdDLE1BQU0sT0FBTyxHQUFHLFdBQVcsRUFBRSxRQUFRLENBQUE7UUFDckMsTUFBTSxTQUFTLEdBQUcsV0FBVyxFQUFFLFVBQVUsQ0FBQTtRQUV6QyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxjQUFjLEVBQUUsQ0FBQyxDQUFBO1lBQ2pELE9BQU07UUFDUixDQUFDO1FBRUQsTUFBTSxlQUFlLEdBQUcsQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLENBQUE7UUFDM0MsSUFBSSxDQUFDLFNBQVMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN2RCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSw2Q0FBNkMsRUFBRSxDQUFDLENBQUE7WUFDaEYsT0FBTTtRQUNSLENBQUM7UUFFRCxNQUFNLGVBQWUsR0FBMEIsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQzlELDBCQUFlLENBQ2hCLENBQUE7UUFFRCxNQUFNLFNBQVMsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLFVBQWdDLENBQUE7UUFFNUQsZ0VBQWdFO1FBQ2hFLElBQUksU0FBUyxFQUFFLENBQUM7WUFDZCxNQUFNLE1BQU0sR0FBRyxNQUFNLGVBQWUsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUE7WUFDbkUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFVBQVUsS0FBSyxTQUFTLENBQUMsQ0FBQTtZQUU1RCxHQUFHLENBQUMsSUFBSSxDQUFDO2dCQUNQLFVBQVUsRUFBRSxTQUFTO2dCQUNyQixjQUFjLEVBQUUsS0FBSyxFQUFFLGNBQWMsSUFBSSxDQUFDO2FBQzNDLENBQUMsQ0FBQTtZQUNGLE9BQU07UUFDUixDQUFDO1FBRUQsNENBQTRDO1FBQzVDLE1BQU0sTUFBTSxHQUFHLE1BQU0sZUFBZSxDQUFDLGlCQUFpQixFQUFFLENBQUE7UUFFeEQsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFBO0lBQzdCLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksS0FBSyxFQUFFLENBQUM7WUFDM0IsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUE7WUFDaEQsT0FBTTtRQUNSLENBQUM7UUFDRCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxDQUFDLENBQUE7SUFDNUQsQ0FBQztBQUNILENBQUMsQ0FBQTtBQWpEWSxRQUFBLEdBQUcsT0FpRGYifQ==

package/.medusa/server/src/api/store/wishlist/[product_id]/route.js

@@ -9,12 +9,17 @@ const DELETE = async (req, res) => {
             res.status(400).json({ message: "product_id is required" });
             return;
         }
-        // Get customer ID from auth context
-        const customerId = req.auth_context?.actor_id;
+        // Enforce that only authenticated customers can delete wishlist entries
+        const authContext = req.auth_context;
+        const customerId = authContext?.actor_id;
         if (!customerId) {
             res.status(401).json({ message: "Unauthorized" });
             return;
         }
+        if (authContext?.actor_type !== "customer") {
+            res.status(403).json({ message: "Only customers can remove wishlist items" });
+            return;
+        }
         // Execute remove from wishlist workflow
         const { result } = await (0, remove_from_wishlist_1.removeFromWishlistWorkflow)(req.scope).run({
             input: {
@@ -33,4 +38,4 @@ const DELETE = async (req, res) => {
     }
 };
 exports.DELETE = DELETE;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL3dpc2hsaXN0L1twcm9kdWN0X2lkXS9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFDQSxxRkFBdUY7QUFFaEYsTUFBTSxNQUFNLEdBQUcsS0FBSyxFQUN6QixHQUFrQixFQUNsQixHQUFtQixFQUNKLEVBQUU7SUFDakIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLFVBQVUsRUFBRSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUE7UUFFakMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ2hCLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHdCQUF3QixFQUFFLENBQUMsQ0FBQTtZQUMzRCxPQUFNO1FBQ1IsQ0FBQztRQUVELG9DQUFvQztRQUNwQyxNQUFNLFVBQVUsR0FBSSxHQUFXLENBQUMsWUFBWSxFQUFFLFFBQVEsQ0FBQTtRQUV0RCxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDaEIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsY0FBYyxFQUFFLENBQUMsQ0FBQTtZQUNqRCxPQUFNO1FBQ1IsQ0FBQztRQUVELHdDQUF3QztRQUN4QyxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxJQUFBLGlEQUEwQixFQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLENBQUM7WUFDakUsS0FBSyxFQUFFO2dCQUNMLFdBQVcsRUFBRSxVQUFVO2dCQUN2QixVQUFVLEVBQUUsVUFBVTthQUN2QjtTQUNGLENBQUMsQ0FBQTtRQUVGLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUE7SUFDdkMsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLEtBQUssWUFBWSxLQUFLLEVBQUUsQ0FBQztZQUMzQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQTtZQUNoRCxPQUFNO1FBQ1IsQ0FBQztRQUNELEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQTtJQUM1RCxDQUFDO0FBQ0gsQ0FBQyxDQUFBO0FBcENZLFFBQUEsTUFBTSxVQW9DbEIifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL3dpc2hsaXN0L1twcm9kdWN0X2lkXS9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFDQSxxRkFBdUY7QUFFaEYsTUFBTSxNQUFNLEdBQUcsS0FBSyxFQUN6QixHQUFrQixFQUNsQixHQUFtQixFQUNKLEVBQUU7SUFDakIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLFVBQVUsRUFBRSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUE7UUFFakMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ2hCLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHdCQUF3QixFQUFFLENBQUMsQ0FBQTtZQUMzRCxPQUFNO1FBQ1IsQ0FBQztRQUVELHdFQUF3RTtRQUN4RSxNQUFNLFdBQVcsR0FBSSxHQUFXLENBQUMsWUFBWSxDQUFBO1FBQzdDLE1BQU0sVUFBVSxHQUFHLFdBQVcsRUFBRSxRQUFRLENBQUE7UUFFeEMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ2hCLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLGNBQWMsRUFBRSxDQUFDLENBQUE7WUFDakQsT0FBTTtRQUNSLENBQUM7UUFFRCxJQUFJLFdBQVcsRUFBRSxVQUFVLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDM0MsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsMENBQTBDLEVBQUUsQ0FBQyxDQUFBO1lBQzdFLE9BQU07UUFDUixDQUFDO1FBRUQsd0NBQXdDO1FBQ3hDLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLElBQUEsaURBQTBCLEVBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsQ0FBQztZQUNqRSxLQUFLLEVBQUU7Z0JBQ0wsV0FBVyxFQUFFLFVBQVU7Z0JBQ3ZCLFVBQVUsRUFBRSxVQUFVO2FBQ3ZCO1NBQ0YsQ0FBQyxDQUFBO1FBRUYsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQTtJQUN2QyxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUksS0FBSyxZQUFZLEtBQUssRUFBRSxDQUFDO1lBQzNCLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFBO1lBQ2hELE9BQU07UUFDUixDQUFDO1FBQ0QsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsQ0FBQyxDQUFBO0lBQzVELENBQUM7QUFDSCxDQUFDLENBQUE7QUExQ1ksUUFBQSxNQUFNLFVBMENsQiJ9

package/.medusa/server/src/api/store/wishlist/route.js

@@ -8,12 +8,17 @@ const POST = async (req, res) => {
     try {
         // Validate request body
         const validated = validators_1.AddToWishlistSchema.parse(req.body);
-        // Get customer ID from auth context
-        const customerId = req.auth_context?.actor_id;
+        // Enforce that only authenticated customers can mutate wishlists
+        const authContext = req.auth_context;
+        const customerId = authContext?.actor_id;
         if (!customerId) {
             res.status(401).json({ message: "Unauthorized" });
             return;
         }
+        if (authContext?.actor_type !== "customer") {
+            res.status(403).json({ message: "Only customers can update wishlists" });
+            return;
+        }
         // Execute add to wishlist workflow
         const { result } = await (0, add_to_wishlist_1.addToWishlistWorkflow)(req.scope).run({
             input: {
@@ -34,12 +39,17 @@ const POST = async (req, res) => {
 exports.POST = POST;
 const GET = async (req, res) => {
     try {
-        // Get customer ID from auth context
-        const customerId = req.auth_context?.actor_id;
+        // Restrict wishlist reads to authenticated customers
+        const authContext = req.auth_context;
+        const customerId = authContext?.actor_id;
         if (!customerId) {
             res.status(401).json({ message: "Unauthorized" });
             return;
         }
+        if (authContext?.actor_type !== "customer") {
+            res.status(403).json({ message: "Only customers can read their wishlist" });
+            return;
+        }
         // Parse query parameters
         const includeDetails = req.query.include_details === "true" ||
             req.query.include_details === "1";
@@ -63,4 +73,4 @@ const GET = async (req, res) => {
     }
 };
 exports.GET = GET;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL3dpc2hsaXN0L3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLHdFQUEwRTtBQUMxRSxrRUFBcUU7QUFDckUsNkNBQWtEO0FBRTNDLE1BQU0sSUFBSSxHQUFHLEtBQUssRUFDdkIsR0FBa0IsRUFDbEIsR0FBbUIsRUFDSixFQUFFO0lBQ2pCLElBQUksQ0FBQztRQUNILHdCQUF3QjtRQUN4QixNQUFNLFNBQVMsR0FBRyxnQ0FBbUIsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFBO1FBRXJELG9DQUFvQztRQUNwQyxNQUFNLFVBQVUsR0FBSSxHQUFXLENBQUMsWUFBWSxFQUFFLFFBQVEsQ0FBQTtRQUV0RCxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDaEIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsY0FBYyxFQUFFLENBQUMsQ0FBQTtZQUNqRCxPQUFNO1FBQ1IsQ0FBQztRQUVELG1DQUFtQztRQUNuQyxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxJQUFBLHVDQUFxQixFQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLENBQUM7WUFDNUQsS0FBSyxFQUFFO2dCQUNMLFdBQVcsRUFBRSxVQUFVO2dCQUN2QixVQUFVLEVBQUUsU0FBUyxDQUFDLFVBQVU7YUFDakM7U0FDRixDQUFDLENBQUE7UUFFRixHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsYUFBYSxFQUFFLE1BQU0sQ0FBQyxhQUFhLEVBQUUsQ0FBQyxDQUFBO0lBQ25ELENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksS0FBSyxFQUFFLENBQUM7WUFDM0IsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUE7WUFDaEQsT0FBTTtRQUNSLENBQUM7UUFDRCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxDQUFDLENBQUE7SUFDNUQsQ0FBQztBQUNILENBQUMsQ0FBQTtBQWhDWSxRQUFBLElBQUksUUFnQ2hCO0FBRU0sTUFBTSxHQUFHLEdBQUcsS0FBSyxFQUN0QixHQUFrQixFQUNsQixHQUFtQixFQUNKLEVBQUU7SUFDakIsSUFBSSxDQUFDO1FBQ0gsb0NBQW9DO1FBQ3BDLE1BQU0sVUFBVSxHQUFJLEdBQVcsQ0FBQyxZQUFZLEVBQUUsUUFBUSxDQUFBO1FBRXRELElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNoQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxjQUFjLEVBQUUsQ0FBQyxDQUFBO1lBQ2pELE9BQU07UUFDUixDQUFDO1FBRUQseUJBQXlCO1FBQ3pCLE1BQU0sY0FBYyxHQUNsQixHQUFHLENBQUMsS0FBSyxDQUFDLGVBQWUsS0FBSyxNQUFNO1lBQ3BDLEdBQUcsQ0FBQyxLQUFLLENBQUMsZUFBZSxLQUFLLEdBQUcsQ0FBQTtRQUVuQyxnQ0FBZ0M7UUFDaEMsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sSUFBQSxrQ0FBbUIsRUFBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxDQUFDO1lBQzFELEtBQUssRUFBRTtnQkFDTCxXQUFXLEVBQUUsVUFBVTtnQkFDdkIsT0FBTyxFQUFFO29CQUNQLGNBQWMsRUFBRSxjQUFjO2lCQUMvQjthQUNGO1NBQ0YsQ0FBQyxDQUFBO1FBRUYsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQTtJQUN6QyxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUksS0FBSyxZQUFZLEtBQUssRUFBRSxDQUFDO1lBQzNCLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFBO1lBQ2hELE9BQU07UUFDUixDQUFDO1FBQ0QsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsQ0FBQyxDQUFBO0lBQzVELENBQUM7QUFDSCxDQUFDLENBQUE7QUFwQ1ksUUFBQSxHQUFHLE9Bb0NmIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL3dpc2hsaXN0L3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLHdFQUEwRTtBQUMxRSxrRUFBcUU7QUFDckUsNkNBQWtEO0FBRTNDLE1BQU0sSUFBSSxHQUFHLEtBQUssRUFDdkIsR0FBa0IsRUFDbEIsR0FBbUIsRUFDSixFQUFFO0lBQ2pCLElBQUksQ0FBQztRQUNILHdCQUF3QjtRQUN4QixNQUFNLFNBQVMsR0FBRyxnQ0FBbUIsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFBO1FBRXJELGlFQUFpRTtRQUNqRSxNQUFNLFdBQVcsR0FBSSxHQUFXLENBQUMsWUFBWSxDQUFBO1FBQzdDLE1BQU0sVUFBVSxHQUFHLFdBQVcsRUFBRSxRQUFRLENBQUE7UUFFeEMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ2hCLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLGNBQWMsRUFBRSxDQUFDLENBQUE7WUFDakQsT0FBTTtRQUNSLENBQUM7UUFFRCxJQUFJLFdBQVcsRUFBRSxVQUFVLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDM0MsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUscUNBQXFDLEVBQUUsQ0FBQyxDQUFBO1lBQ3hFLE9BQU07UUFDUixDQUFDO1FBRUQsbUNBQW1DO1FBQ25DLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLElBQUEsdUNBQXFCLEVBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsQ0FBQztZQUM1RCxLQUFLLEVBQUU7Z0JBQ0wsV0FBVyxFQUFFLFVBQVU7Z0JBQ3ZCLFVBQVUsRUFBRSxTQUFTLENBQUMsVUFBVTthQUNqQztTQUNGLENBQUMsQ0FBQTtRQUVGLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxhQUFhLEVBQUUsTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUE7SUFDbkQsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLEtBQUssWUFBWSxLQUFLLEVBQUUsQ0FBQztZQUMzQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQTtZQUNoRCxPQUFNO1FBQ1IsQ0FBQztRQUNELEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQTtJQUM1RCxDQUFDO0FBQ0gsQ0FBQyxDQUFBO0FBdENZLFFBQUEsSUFBSSxRQXNDaEI7QUFFTSxNQUFNLEdBQUcsR0FBRyxLQUFLLEVBQ3RCLEdBQWtCLEVBQ2xCLEdBQW1CLEVBQ0osRUFBRTtJQUNqQixJQUFJLENBQUM7UUFDSCxxREFBcUQ7UUFDckQsTUFBTSxXQUFXLEdBQUksR0FBVyxDQUFDLFlBQVksQ0FBQTtRQUM3QyxNQUFNLFVBQVUsR0FBRyxXQUFXLEVBQUUsUUFBUSxDQUFBO1FBRXhDLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNoQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxjQUFjLEVBQUUsQ0FBQyxDQUFBO1lBQ2pELE9BQU07UUFDUixDQUFDO1FBRUQsSUFBSSxXQUFXLEVBQUUsVUFBVSxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQzNDLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLENBQUMsQ0FBQTtZQUMzRSxPQUFNO1FBQ1IsQ0FBQztRQUVELHlCQUF5QjtRQUN6QixNQUFNLGNBQWMsR0FDbEIsR0FBRyxDQUFDLEtBQUssQ0FBQyxlQUFlLEtBQUssTUFBTTtZQUNwQyxHQUFHLENBQUMsS0FBSyxDQUFDLGVBQWUsS0FBSyxHQUFHLENBQUE7UUFFbkMsZ0NBQWdDO1FBQ2hDLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLElBQUEsa0NBQW1CLEVBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsQ0FBQztZQUMxRCxLQUFLLEVBQUU7Z0JBQ0wsV0FBVyxFQUFFLFVBQVU7Z0JBQ3ZCLE9BQU8sRUFBRTtvQkFDUCxjQUFjLEVBQUUsY0FBYztpQkFDL0I7YUFDRjtTQUNGLENBQUMsQ0FBQTtRQUVGLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUE7SUFDekMsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLEtBQUssWUFBWSxLQUFLLEVBQUUsQ0FBQztZQUMzQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQTtZQUNoRCxPQUFNO1FBQ1IsQ0FBQztRQUNELEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQTtJQUM1RCxDQUFDO0FBQ0gsQ0FBQyxDQUFBO0FBMUNZLFFBQUEsR0FBRyxPQTBDZiJ9

package/.medusa/server/src/shared/wishlist/helper.js

@@ -1,40 +1,98 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getWishlist = getWishlist;
-const wishlist_1 = require("../../modules/wishlist");
-/**
- * Helper function to get customer's wishlist
- * This function can be used directly by UI components without implementing the entire logic
- *
- * @param container - Medusa container instance
- * @param customerId - Customer ID
- * @param options - Options for getting wishlist
- * @returns Promise of wishlist items (IDs or full details based on options)
- *
- * @example
- * // Get only product IDs
- * const wishlist = await getWishlist(container, customerId)
- * // Returns: ['prod_123', 'prod_456']
- *
- * @example
- * // Get full product details
- * const wishlist = await getWishlist(container, customerId, { includeDetails: true })
- * // Returns: [{ product_id: 'prod_123', product: {...}, ... }]
- */
-async function getWishlist(container, customerId, options = {}) {
-    const wishlistService = container.resolve(wishlist_1.WISHLIST_MODULE);
-    const serviceOptions = {
-        includeDetails: options.includeDetails ?? false,
-        productIds: options.productIds,
+exports.createWishlistHelpers = exports.createRemoveFromWishlist = exports.createAddToWishlist = exports.createGetWishlist = exports.removeFromWishlist = exports.addToWishlist = exports.getWishlist = void 0;
+const WISHLIST_ENDPOINT = "/store/wishlist";
+const normalizeBaseUrl = (baseUrl) => {
+    if (!baseUrl) {
+        return "";
+    }
+    return baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+};
+const getClientRequest = (client) => {
+    if (!client) {
+        return undefined;
+    }
+    if ("request" in client && typeof client.request === "function") {
+        return client.request.bind(client);
+    }
+    if ("client" in client && typeof client.client?.request === "function") {
+        return client.client.request.bind(client.client);
+    }
+    return undefined;
+};
+const execute = async (path, init, options) => {
+    const headers = {
+        ...(init.headers ?? {}),
+        ...(options.headers ?? {}),
+    };
+    const normalizedInit = {
+        ...init,
+        headers,
     };
-    const wishlist = await wishlistService.getWishlist(customerId, serviceOptions);
-    // If includeDetails is false, wishlist is an array of product IDs
-    if (!options.includeDetails) {
-        return wishlist;
-    }
-    // If includeDetails is true, we need to enrich with product details
-    // For now, return the wishlist items as-is (they should already have details if includeDetails was true)
-    // In a real implementation, you might want to use remote query to enrich here
-    return wishlist;
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL3NoYXJlZC93aXNobGlzdC9oZWxwZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUE4Q0Esa0NBeUJDO0FBdEVELHFEQUF3RDtBQTBCeEQ7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQWtCRztBQUNJLEtBQUssVUFBVSxXQUFXLENBQy9CLFNBQXdCLEVBQ3hCLFVBQWtCLEVBQ2xCLFVBQW9DLEVBQUU7SUFFdEMsTUFBTSxlQUFlLEdBQTBCLFNBQVMsQ0FBQyxPQUFPLENBQzlELDBCQUFlLENBQ2hCLENBQUE7SUFFRCxNQUFNLGNBQWMsR0FBdUI7UUFDekMsY0FBYyxFQUFFLE9BQU8sQ0FBQyxjQUFjLElBQUksS0FBSztRQUMvQyxVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVU7S0FDL0IsQ0FBQTtJQUVELE1BQU0sUUFBUSxHQUFHLE1BQU0sZUFBZSxDQUFDLFdBQVcsQ0FBQyxVQUFVLEVBQUUsY0FBYyxDQUFDLENBQUE7SUFFOUUsa0VBQWtFO0lBQ2xFLElBQUksQ0FBQyxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDNUIsT0FBTyxRQUFvQixDQUFBO0lBQzdCLENBQUM7SUFFRCxvRUFBb0U7SUFDcEUseUdBQXlHO0lBQ3pHLDhFQUE4RTtJQUM5RSxPQUFPLFFBQWtDLENBQUE7QUFDM0MsQ0FBQyJ9
+    const clientRequest = getClientRequest(options.client);
+    if (clientRequest) {
+        return (await clientRequest(path, normalizedInit));
+    }
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    if (!fetchImpl) {
+        throw new Error("No fetch implementation available. Provide `fetchImpl` or a Medusa client.");
+    }
+    const url = `${normalizeBaseUrl(options.baseUrl)}${path}`;
+    const response = await fetchImpl(url || path, normalizedInit);
+    if (!response.ok) {
+        const body = await response.text();
+        throw new Error(body || `Request failed with status ${response.status}`);
+    }
+    return (await response.json());
+};
+const getWishlist = async (input = {}, options = {}) => {
+    const params = new URLSearchParams();
+    if (input.includeDetails) {
+        params.set("include_details", "true");
+    }
+    const endpoint = params.toString()
+        ? `${WISHLIST_ENDPOINT}?${params.toString()}`
+        : WISHLIST_ENDPOINT;
+    return execute(endpoint, {
+        method: "GET",
+    }, options);
+};
+exports.getWishlist = getWishlist;
+const addToWishlist = async (input, options = {}) => {
+    if (!input.product_id) {
+        throw new Error("product_id is required");
+    }
+    return execute(WISHLIST_ENDPOINT, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            product_id: input.product_id,
+        }),
+    }, options);
+};
+exports.addToWishlist = addToWishlist;
+const removeFromWishlist = async (input, options = {}) => {
+    if (!input.product_id) {
+        throw new Error("product_id is required");
+    }
+    const endpoint = `${WISHLIST_ENDPOINT}/${encodeURIComponent(input.product_id)}`;
+    return execute(endpoint, {
+        method: "DELETE",
+    }, options);
+};
+exports.removeFromWishlist = removeFromWishlist;
+const createGetWishlist = (options = {}) => (input) => (0, exports.getWishlist)(input, options);
+exports.createGetWishlist = createGetWishlist;
+const createAddToWishlist = (options = {}) => (input) => (0, exports.addToWishlist)(input, options);
+exports.createAddToWishlist = createAddToWishlist;
+const createRemoveFromWishlist = (options = {}) => (input) => (0, exports.removeFromWishlist)(input, options);
+exports.createRemoveFromWishlist = createRemoveFromWishlist;
+const createWishlistHelpers = (options = {}) => ({
+    getWishlist: (0, exports.createGetWishlist)(options),
+    addToWishlist: (0, exports.createAddToWishlist)(options),
+    removeFromWishlist: (0, exports.createRemoveFromWishlist)(options),
+});
+exports.createWishlistHelpers = createWishlistHelpers;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL3NoYXJlZC93aXNobGlzdC9oZWxwZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsTUFBTSxpQkFBaUIsR0FBRyxpQkFBaUIsQ0FBQTtBQXFFM0MsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLE9BQWdCLEVBQUUsRUFBRTtJQUM1QyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDYixPQUFPLEVBQUUsQ0FBQTtJQUNYLENBQUM7SUFDRCxPQUFPLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQTtBQUMvRCxDQUFDLENBQUE7QUFFRCxNQUFNLGdCQUFnQixHQUFHLENBQUMsTUFBeUIsRUFBRSxFQUFFO0lBQ3JELElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNaLE9BQU8sU0FBUyxDQUFBO0lBQ2xCLENBQUM7SUFFRCxJQUFJLFNBQVMsSUFBSSxNQUFNLElBQUksT0FBTyxNQUFNLENBQUMsT0FBTyxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ2hFLE9BQU8sTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUE7SUFDcEMsQ0FBQztJQUVELElBQUksUUFBUSxJQUFJLE1BQU0sSUFBSSxPQUFPLE1BQU0sQ0FBQyxNQUFNLEVBQUUsT0FBTyxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ3ZFLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUNsRCxDQUFDO0lBRUQsT0FBTyxTQUFTLENBQUE7QUFDbEIsQ0FBQyxDQUFBO0FBRUQsTUFBTSxPQUFPLEdBQUcsS0FBSyxFQUNuQixJQUFZLEVBQ1osSUFBcUIsRUFDckIsT0FBOEIsRUFDbEIsRUFBRTtJQUNkLE1BQU0sT0FBTyxHQUFHO1FBQ2QsR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLElBQUksRUFBRSxDQUFDO1FBQ3ZCLEdBQUcsQ0FBQyxPQUFPLENBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztLQUMzQixDQUFBO0lBQ0QsTUFBTSxjQUFjLEdBQWdCO1FBQ2xDLEdBQUcsSUFBSTtRQUNQLE9BQU87S0FDUixDQUFBO0lBRUQsTUFBTSxhQUFhLEdBQUcsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQ3RELElBQUksYUFBYSxFQUFFLENBQUM7UUFDbEIsT0FBTyxDQUFDLE1BQU0sYUFBYSxDQUFDLElBQUksRUFBRSxjQUFjLENBQUMsQ0FBTSxDQUFBO0lBQ3pELENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsU0FBUyxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUE7SUFDdkQsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLEtBQUssQ0FDYiw0RUFBNEUsQ0FDN0UsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLEdBQUcsR0FBRyxHQUFHLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxJQUFJLEVBQUUsQ0FBQTtJQUN6RCxNQUFNLFFBQVEsR0FBRyxNQUFNLFNBQVMsQ0FBQyxHQUFHLElBQUksSUFBSSxFQUFFLGNBQWMsQ0FBQyxDQUFBO0lBRTdELElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLENBQUM7UUFDakIsTUFBTSxJQUFJLEdBQUcsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUE7UUFDbEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxJQUFJLElBQUksOEJBQThCLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFBO0lBQzFFLENBQUM7SUFFRCxPQUFPLENBQUMsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQU0sQ0FBQTtBQUNyQyxDQUFDLENBQUE7QUFFTSxNQUFNLFdBQVcsR0FBRyxLQUFLLEVBQzlCLFFBQTBCLEVBQUUsRUFDNUIsVUFBaUMsRUFBRSxFQUNMLEVBQUU7SUFDaEMsTUFBTSxNQUFNLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQTtJQUNwQyxJQUFJLEtBQUssQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUN6QixNQUFNLENBQUMsR0FBRyxDQUFDLGlCQUFpQixFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBQ3ZDLENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFO1FBQ2hDLENBQUMsQ0FBQyxHQUFHLGlCQUFpQixJQUFJLE1BQU0sQ0FBQyxRQUFRLEVBQUUsRUFBRTtRQUM3QyxDQUFDLENBQUMsaUJBQWlCLENBQUE7SUFFckIsT0FBTyxPQUFPLENBQ1osUUFBUSxFQUNSO1FBQ0UsTUFBTSxFQUFFLEtBQUs7S0FDZCxFQUNELE9BQU8sQ0FDUixDQUFBO0FBQ0gsQ0FBQyxDQUFBO0FBcEJZLFFBQUEsV0FBVyxlQW9CdkI7QUFFTSxNQUFNLGFBQWEsR0FBRyxLQUFLLEVBQ2hDLEtBQXlCLEVBQ3pCLFVBQWlDLEVBQUUsRUFDSCxFQUFFO0lBQ2xDLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDdEIsTUFBTSxJQUFJLEtBQUssQ0FBQyx3QkFBd0IsQ0FBQyxDQUFBO0lBQzNDLENBQUM7SUFFRCxPQUFPLE9BQU8sQ0FDWixpQkFBaUIsRUFDakI7UUFDRSxNQUFNLEVBQUUsTUFBTTtRQUNkLE9BQU8sRUFBRTtZQUNQLGNBQWMsRUFBRSxrQkFBa0I7U0FDbkM7UUFDRCxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUNuQixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7U0FDN0IsQ0FBQztLQUNILEVBQ0QsT0FBTyxDQUNSLENBQUE7QUFDSCxDQUFDLENBQUE7QUFyQlksUUFBQSxhQUFhLGlCQXFCekI7QUFFTSxNQUFNLGtCQUFrQixHQUFHLEtBQUssRUFDckMsS0FBOEIsRUFDOUIsVUFBaUMsRUFBRSxFQUNFLEVBQUU7SUFDdkMsSUFBSSxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixDQUFDLENBQUE7SUFDM0MsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLEdBQUcsaUJBQWlCLElBQUksa0JBQWtCLENBQ3pELEtBQUssQ0FBQyxVQUFVLENBQ2pCLEVBQUUsQ0FBQTtJQUVILE9BQU8sT0FBTyxDQUNaLFFBQVEsRUFDUjtRQUNFLE1BQU0sRUFBRSxRQUFRO0tBQ2pCLEVBQ0QsT0FBTyxDQUNSLENBQUE7QUFDSCxDQUFDLENBQUE7QUFuQlksUUFBQSxrQkFBa0Isc0JBbUI5QjtBQUVNLE1BQU0saUJBQWlCLEdBQzVCLENBQUMsVUFBaUMsRUFBRSxFQUFFLEVBQUUsQ0FDeEMsQ0FBQyxLQUF3QixFQUFFLEVBQUUsQ0FDM0IsSUFBQSxtQkFBVyxFQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQTtBQUhsQixRQUFBLGlCQUFpQixxQkFHQztBQUV4QixNQUFNLG1CQUFtQixHQUM5QixDQUFDLFVBQWlDLEVBQUUsRUFBRSxFQUFFLENBQ3hDLENBQUMsS0FBeUIsRUFBRSxFQUFFLENBQzVCLElBQUEscUJBQWEsRUFBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUE7QUFIcEIsUUFBQSxtQkFBbUIsdUJBR0M7QUFFMUIsTUFBTSx3QkFBd0IsR0FDbkMsQ0FBQyxVQUFpQyxFQUFFLEVBQUUsRUFBRSxDQUN4QyxDQUFDLEtBQThCLEVBQUUsRUFBRSxDQUNqQyxJQUFBLDBCQUFrQixFQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQTtBQUh6QixRQUFBLHdCQUF3Qiw0QkFHQztBQUUvQixNQUFNLHFCQUFxQixHQUFHLENBQ25DLFVBQWlDLEVBQUUsRUFDbkMsRUFBRSxDQUFDLENBQUM7SUFDSixXQUFXLEVBQUUsSUFBQSx5QkFBaUIsRUFBQyxPQUFPLENBQUM7SUFDdkMsYUFBYSxFQUFFLElBQUEsMkJBQW1CLEVBQUMsT0FBTyxDQUFDO0lBQzNDLGtCQUFrQixFQUFFLElBQUEsZ0NBQXdCLEVBQUMsT0FBTyxDQUFDO0NBQ3RELENBQUMsQ0FBQTtBQU5XLFFBQUEscUJBQXFCLHlCQU1oQyJ9

package/.medusa/server/src/shared/wishlist/index.js

@@ -1,6 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getWishlist = void 0;
+exports.removeFromWishlist = exports.getWishlist = exports.createWishlistHelpers = exports.createRemoveFromWishlist = exports.createGetWishlist = exports.createAddToWishlist = exports.addToWishlist = void 0;
 var helper_1 = require("./helper");
+Object.defineProperty(exports, "addToWishlist", { enumerable: true, get: function () { return helper_1.addToWishlist; } });
+Object.defineProperty(exports, "createAddToWishlist", { enumerable: true, get: function () { return helper_1.createAddToWishlist; } });
+Object.defineProperty(exports, "createGetWishlist", { enumerable: true, get: function () { return helper_1.createGetWishlist; } });
+Object.defineProperty(exports, "createRemoveFromWishlist", { enumerable: true, get: function () { return helper_1.createRemoveFromWishlist; } });
+Object.defineProperty(exports, "createWishlistHelpers", { enumerable: true, get: function () { return helper_1.createWishlistHelpers; } });
 Object.defineProperty(exports, "getWishlist", { enumerable: true, get: function () { return helper_1.getWishlist; } });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvc2hhcmVkL3dpc2hsaXN0L2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUFzQztBQUE3QixxR0FBQSxXQUFXLE9BQUEifQ==
+Object.defineProperty(exports, "removeFromWishlist", { enumerable: true, get: function () { return helper_1.removeFromWishlist; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvc2hhcmVkL3dpc2hsaXN0L2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQVFpQjtBQVBmLHVHQUFBLGFBQWEsT0FBQTtBQUNiLDZHQUFBLG1CQUFtQixPQUFBO0FBQ25CLDJHQUFBLGlCQUFpQixPQUFBO0FBQ2pCLGtIQUFBLHdCQUF3QixPQUFBO0FBQ3hCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLHFHQUFBLFdBQVcsT0FBQTtBQUNYLDRHQUFBLGtCQUFrQixPQUFBIn0=

package/README.md

@@ -234,6 +234,12 @@ Configure rating-based filtering:
 
 The plugin includes a comprehensive wishlist feature that allows customers to save products they're interested in and admins to view wishlist statistics.
 
+### Security & Access Control
+
+- Store-facing wishlist routes authenticate strictly as customers. Customer IDs are always derived from the session or JWT auth context and never taken from the request payload, so an admin or API client cannot spoof a customer identifier.
+- Admin-facing wishlist statistics are available only to admin actors (`user` sessions or secret API keys). Customer tokens receive a `403` response when attempting to access `/admin/wishlist/stats`.
+- This separation ensures only customers can manage their wishlist entries while only admins can inspect aggregate wishlist state.
+
 ### Module Registration
 
 The wishlist module is automatically registered when you add the plugin to your Medusa configuration. No additional configuration is required for basic usage.
@@ -422,59 +428,79 @@ curl "https://your-store.com/admin/wishlist/stats?product_id=prod_123" \
   -H "Authorization: Bearer ADMIN_TOKEN"
 ```
 
-### Helper Function
+### Helper Functions
 
-The plugin provides a helper function that can be used directly by UI components without implementing the entire logic.
+The plugin exposes lightweight helpers that wrap the Store API endpoints. They are ideal for server-side storefronts that need to call the wishlist endpoints while relying on the authenticated customer's session (no customer ID is ever passed in the payload).
 
-#### Import the Helper
+#### Imports
 
 ```typescript
-import { getWishlist } from "medusa-product-helper/wishlist-helper"
+import {
+  addToWishlist,
+  getWishlist,
+  removeFromWishlist,
+  createWishlistHelpers,
+} from "medusa-product-helper/wishlist-helper"
 ```
 
-#### Usage Examples
+#### Example Usage
 
-**Get only product IDs**:
 ```typescript
-import { getWishlist } from "medusa-product-helper/wishlist-helper"
+// Add a product
+await addToWishlist(
+  { product_id: "prod_123" },
+  {
+    baseUrl: "https://store.example.com",
+    headers: {
+      Cookie: "connect.sid=...", // or Authorization header
+    },
+  }
+)
 
-// In your component or service
-const productIds = await getWishlist(container, customerId)
-// Returns: ['prod_123', 'prod_456']
+// Read wishlist with details
+const { wishlist } = await getWishlist(
+  { includeDetails: true },
+  {
+    baseUrl: "https://store.example.com",
+    headers: {
+      Cookie: "connect.sid=...",
+    },
+  }
+)
+
+// Remove a product
+await removeFromWishlist(
+  { product_id: "prod_123" },
+  {
+    baseUrl: "https://store.example.com",
+    headers: {
+      Cookie: "connect.sid=...",
+    },
+  }
+)
 ```
 
-**Get full product details**:
-```typescript
-import { getWishlist } from "medusa-product-helper/wishlist-helper"
+#### Configuration Options
 
-const wishlist = await getWishlist(container, customerId, {
-  includeDetails: true
-})
-// Returns: [
-//   {
-//     product_id: 'prod_123',
-//     product: { ... },
-//     id: 'wish_123',
-//     created_at: Date
-//   },
-//   ...
-// ]
-```
+All helper calls accept the following options:
 
-**Filter by specific products**:
-```typescript
-import { getWishlist } from "medusa-product-helper/wishlist-helper"
+- `client`: Medusa JS/SDK client instance. When provided, network requests are delegated to `client.request`.
+- `baseUrl`: Base URL for the Store API (e.g., `https://store.example.com`). Required when a client is not provided.
+- `fetchImpl`: Custom `fetch` implementation for SSR or React Native environments. Defaults to `globalThis.fetch`.
+- `headers`: Additional headers appended to every request (useful for `Cookie` / `Authorization` headers).
 
-const wishlist = await getWishlist(container, customerId, {
-  includeDetails: true,
-  productIds: ['prod_123', 'prod_456']
-})
-```
+You can also generate pre-configured helpers:
 
-#### Helper Options
+```typescript
+const wishlist = createWishlistHelpers({
+  baseUrl: "https://store.example.com",
+  headers: { Cookie: "connect.sid=..." },
+})
 
-- `includeDetails` (boolean, default: `false`): If `true`, returns full product details. If `false`, returns only product IDs.
-- `productIds` (string[], optional): Filter wishlist by specific product IDs.
+await wishlist.addToWishlist({ product_id: "prod_123" })
+const { wishlist: items } = await wishlist.getWishlist({ includeDetails: true })
+await wishlist.removeFromWishlist({ product_id: "prod_123" })
+```
 
 ### Using Workflows Directly
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "medusa-product-helper",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "description": "A starter for Medusa plugins.",
   "author": "Medusa (https://medusajs.com)",
   "license": "MIT",