order-management 0.0.12 → 0.0.14

package/.medusa/server/src/api/store/guest-orders/[id]/invoice/route.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = GET;
+const utils_1 = require("@medusajs/framework/utils");
+// import { INVOICE_MODULE } from "../../../../../medusa-invoice-sbl/src/modules/invoice"
+// import InvoiceModuleService from "../../../../../medusa-invoice-sbl/src/modules/invoice/service"
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+async function GET(req, res) {
+    const authHeader = req.headers.authorization;
+    const { id } = req.params;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        res.status(401).json({ message: "Missing or invalid Authorization header" });
+        return;
+    }
+    const token = authHeader.split(" ")[1];
+    const secret = process.env.JWT_SECRET || "medusa-secret-guest-access";
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (!decoded || !decoded.guest_identifier) {
+            res.status(401).json({ message: "Invalid token payload" });
+            return;
+        }
+        const { guest_identifier } = decoded;
+        // Resolve Query to fetch order and verify ownership
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        // 1. Find GUEST customer IDs associated with this email
+        const { data: customers } = await query.graph({
+            entity: "customer",
+            fields: ["id"],
+            filters: {
+                email: guest_identifier,
+                has_account: false
+            }
+        });
+        if (customers.length === 0) {
+            res.status(404).json({ message: "Order not found or access denied" });
+            return;
+        }
+        const guestCustomerIds = customers.map(c => c.id);
+        // 2. Fetch the specific order ONLY if it belongs to these guest customer IDs
+        const { data: orders } = await query.graph({
+            entity: "order",
+            fields: ["id"],
+            filters: {
+                id: id,
+                customer_id: guestCustomerIds
+            }
+        });
+        if (orders.length === 0) {
+            res.status(404).json({ message: "Order not found or access denied" });
+            return;
+        }
+        // 3. Generate Invoice PDF
+        // Try to resolve the invoice service if it exists
+        try {
+            // Note: INVOICE_MODULE and InvoiceModuleService would be imported from the invoice plugin
+            // For now, we use a placeholder or check if the service is registered
+            const invoiceService = req.scope.resolve("invoiceModuleService");
+            if (invoiceService) {
+                const pdfBuffer = await invoiceService.generateInvoice(id, req.scope);
+                res.setHeader("Content-Type", "application/pdf");
+                res.setHeader("Content-Disposition", `attachment; filename=invoice-${id}.pdf`);
+                res.status(200).send(pdfBuffer);
+                return;
+            }
+        }
+        catch (invoiceError) {
+            console.error(`[Invoice Download] Invoice service not available: ${invoiceError}`);
+        }
+        res.status(200).json({
+            message: "Invoice generation is not available in this environment, but the endpoint is correctly verifying permissions.",
+            order_id: id
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(401).json({ message: "Unauthorized or invalid token", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2d1ZXN0LW9yZGVycy9baWRdL2ludm9pY2Uvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFNQSxrQkF3RkM7QUE3RkQscURBQXFFO0FBQ3JFLHlGQUF5RjtBQUN6RixtR0FBbUc7QUFDbkcsZ0VBQThDO0FBRXZDLEtBQUssVUFBVSxHQUFHLENBQ3JCLEdBQWtCLEVBQ2xCLEdBQW1CO0lBRW5CLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFBO0lBQzVDLE1BQU0sRUFBRSxFQUFFLEVBQUUsR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFBO0lBRXpCLElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDbkQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUseUNBQXlDLEVBQUUsQ0FBQyxDQUFBO1FBQzVFLE9BQU07SUFDVixDQUFDO0lBRUQsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUN0QyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSw0QkFBNEIsQ0FBQTtJQUVyRSxJQUFJLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxzQkFBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFlLENBQUE7UUFFdkQsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3hDLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQTtZQUMxRCxPQUFNO1FBQ1YsQ0FBQztRQUVELE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxHQUFHLE9BQU8sQ0FBQTtRQUVwQyxvREFBb0Q7UUFDcEQsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsS0FBSyxDQUFDLENBQUE7UUFFaEUsd0RBQXdEO1FBQ3hELE1BQU0sRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQzFDLE1BQU0sRUFBRSxVQUFVO1lBQ2xCLE1BQU0sRUFBRSxDQUFDLElBQUksQ0FBQztZQUNkLE9BQU8sRUFBRTtnQkFDTCxLQUFLLEVBQUUsZ0JBQWdCO2dCQUN2QixXQUFXLEVBQUUsS0FBSzthQUNyQjtTQUNKLENBQUMsQ0FBQTtRQUVGLElBQUksU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6QixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxrQ0FBa0MsRUFBRSxDQUFDLENBQUE7WUFDckUsT0FBTTtRQUNWLENBQUM7UUFFRCxNQUFNLGdCQUFnQixHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUE7UUFFakQsNkVBQTZFO1FBQzdFLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQ3ZDLE1BQU0sRUFBRSxPQUFPO1lBQ2YsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUFDO1lBQ2QsT0FBTyxFQUFFO2dCQUNMLEVBQUUsRUFBRSxFQUFFO2dCQUNOLFdBQVcsRUFBRSxnQkFBZ0I7YUFDaEM7U0FDSixDQUFDLENBQUE7UUFFRixJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdEIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsa0NBQWtDLEVBQUUsQ0FBQyxDQUFBO1lBQ3JFLE9BQU07UUFDVixDQUFDO1FBRUQsMEJBQTBCO1FBQzFCLGtEQUFrRDtRQUNsRCxJQUFJLENBQUM7WUFDRCwwRkFBMEY7WUFDMUYsc0VBQXNFO1lBQ3RFLE1BQU0sY0FBYyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLHNCQUFzQixDQUFRLENBQUE7WUFFdkUsSUFBSSxjQUFjLEVBQUUsQ0FBQztnQkFDakIsTUFBTSxTQUFTLEdBQUcsTUFBTSxjQUFjLENBQUMsZUFBZSxDQUFDLEVBQUUsRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUE7Z0JBRXJFLEdBQUcsQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFLGlCQUFpQixDQUFDLENBQUE7Z0JBQ2hELEdBQUcsQ0FBQyxTQUFTLENBQUMscUJBQXFCLEVBQUUsZ0NBQWdDLEVBQUUsTUFBTSxDQUFDLENBQUE7Z0JBQzlFLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFBO2dCQUMvQixPQUFNO1lBQ1YsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLFlBQVksRUFBRSxDQUFDO1lBQ3BCLE9BQU8sQ0FBQyxLQUFLLENBQUMscURBQXFELFlBQVksRUFBRSxDQUFDLENBQUE7UUFDdEYsQ0FBQztRQUVELEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDO1lBQ2pCLE9BQU8sRUFBRSwrR0FBK0c7WUFDeEgsUUFBUSxFQUFFLEVBQUU7U0FDZixDQUFDLENBQUE7SUFFTixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNiLE1BQU0sWUFBWSxHQUFHLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQTtRQUM3RSxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQTtJQUMzRixDQUFDO0FBQ0wsQ0FBQyJ9

package/.medusa/server/src/api/store/guest-orders/[id]/returns/route.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const utils_1 = require("@medusajs/framework/utils");
+// import { IOrderModuleService } from "@medusajs/framework/types"
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+async function POST(req, res) {
+    const authHeader = req.headers.authorization;
+    const { id } = req.params;
+    const { items, reason_id, note } = req.body;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        res.status(401).json({ message: "Missing or invalid Authorization header" });
+        return;
+    }
+    if (!items || !items.length) {
+        res.status(400).json({ message: "Items are required for return" });
+        return;
+    }
+    const token = authHeader.split(" ")[1];
+    const secret = process.env.JWT_SECRET || "medusa-secret-guest-access";
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (!decoded || !decoded.guest_identifier) {
+            res.status(401).json({ message: "Invalid token payload" });
+            return;
+        }
+        const { guest_identifier } = decoded;
+        // Resolve Query to fetch order and verify ownership
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        // 1. Find GUEST customer IDs associated with this email
+        const { data: customers } = await query.graph({
+            entity: "customer",
+            fields: ["id"],
+            filters: {
+                email: guest_identifier,
+                has_account: false
+            }
+        });
+        if (customers.length === 0) {
+            res.status(404).json({ message: "Order not found or access denied" });
+            return;
+        }
+        const guestCustomerIds = customers.map(c => c.id);
+        // 2. Fetch the specific order ONLY if it belongs to these guest customer IDs
+        const { data: orders } = await query.graph({
+            entity: "order",
+            fields: ["id"],
+            filters: {
+                id: id,
+                customer_id: guestCustomerIds
+            }
+        });
+        if (orders.length === 0) {
+            res.status(404).json({ message: "Order not found or access denied" });
+            return;
+        }
+        // 3. Create Return Request
+        // In Medusa v2, we use order workflows or direct module calls.
+        // For simplicity and to fit the current architecture, we'll suggest using a workflow if available or direct module interaction.
+        // Since we are building a plugin, we'll use the available services.
+        // This is a placeholder for the actual return workflow/module call in Medusa v2
+        // Typically: createReturnWorkflow(req.scope).run({ input: { order_id: id, items, ... } })
+        res.status(200).json({
+            message: "Return request initiated successfully. This is a mock implementation of the return creation logic.",
+            order_id: id,
+            items
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(401).json({ message: "Unauthorized or invalid token", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2d1ZXN0LW9yZGVycy9baWRdL3JldHVybnMvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFLQSxvQkF3RkM7QUE1RkQscURBQThFO0FBQzlFLGtFQUFrRTtBQUNsRSxnRUFBOEM7QUFFdkMsS0FBSyxVQUFVLElBQUksQ0FDdEIsR0FBa0IsRUFDbEIsR0FBbUI7SUFFbkIsTUFBTSxVQUFVLEdBQUcsR0FBRyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUE7SUFDNUMsTUFBTSxFQUFFLEVBQUUsRUFBRSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUE7SUFDekIsTUFBTSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLEdBQUcsR0FBRyxDQUFDLElBSXRDLENBQUE7SUFFRCxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ25ELEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHlDQUF5QyxFQUFFLENBQUMsQ0FBQTtRQUM1RSxPQUFNO0lBQ1YsQ0FBQztJQUVELElBQUksQ0FBQyxLQUFLLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsK0JBQStCLEVBQUUsQ0FBQyxDQUFBO1FBQ2xFLE9BQU07SUFDVixDQUFDO0lBRUQsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUN0QyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSw0QkFBNEIsQ0FBQTtJQUVyRSxJQUFJLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxzQkFBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFlLENBQUE7UUFFdkQsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3hDLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQTtZQUMxRCxPQUFNO1FBQ1YsQ0FBQztRQUVELE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxHQUFHLE9BQU8sQ0FBQTtRQUVwQyxvREFBb0Q7UUFDcEQsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsS0FBSyxDQUFDLENBQUE7UUFFaEUsd0RBQXdEO1FBQ3hELE1BQU0sRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQzFDLE1BQU0sRUFBRSxVQUFVO1lBQ2xCLE1BQU0sRUFBRSxDQUFDLElBQUksQ0FBQztZQUNkLE9BQU8sRUFBRTtnQkFDTCxLQUFLLEVBQUUsZ0JBQWdCO2dCQUN2QixXQUFXLEVBQUUsS0FBSzthQUNyQjtTQUNKLENBQUMsQ0FBQTtRQUVGLElBQUksU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6QixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxrQ0FBa0MsRUFBRSxDQUFDLENBQUE7WUFDckUsT0FBTTtRQUNWLENBQUM7UUFFRCxNQUFNLGdCQUFnQixHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUE7UUFFakQsNkVBQTZFO1FBQzdFLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQ3ZDLE1BQU0sRUFBRSxPQUFPO1lBQ2YsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUFDO1lBQ2QsT0FBTyxFQUFFO2dCQUNMLEVBQUUsRUFBRSxFQUFFO2dCQUNOLFdBQVcsRUFBRSxnQkFBZ0I7YUFDaEM7U0FDSixDQUFDLENBQUE7UUFFRixJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdEIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsa0NBQWtDLEVBQUUsQ0FBQyxDQUFBO1lBQ3JFLE9BQU07UUFDVixDQUFDO1FBRUQsMkJBQTJCO1FBQzNCLCtEQUErRDtRQUMvRCxnSUFBZ0k7UUFDaEksb0VBQW9FO1FBRXBFLGdGQUFnRjtRQUNoRiwwRkFBMEY7UUFFMUYsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7WUFDakIsT0FBTyxFQUFFLG9HQUFvRztZQUM3RyxRQUFRLEVBQUUsRUFBRTtZQUNaLEtBQUs7U0FDUixDQUFDLENBQUE7SUFFTixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNiLE1BQU0sWUFBWSxHQUFHLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQTtRQUM3RSxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQTtJQUMzRixDQUFDO0FBQ0wsQ0FBQyJ9

package/.medusa/server/src/api/store/guest-orders/[id]/route.js

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = GET;
+const utils_1 = require("@medusajs/framework/utils");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+async function GET(req, res) {
+    const authHeader = req.headers.authorization;
+    const { id } = req.params;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        res.status(401).json({ message: "Missing or invalid Authorization header" });
+        return;
+    }
+    const token = authHeader.split(" ")[1];
+    const secret = process.env.JWT_SECRET || "medusa-secret-guest-access";
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (!decoded || !decoded.guest_identifier) {
+            res.status(401).json({ message: "Invalid token payload" });
+            return;
+        }
+        const { guest_identifier } = decoded;
+        // Resolve Query to fetch order
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        // 1. Find GUEST customer IDs associated with this email
+        const { data: customers } = await query.graph({
+            entity: "customer",
+            fields: ["id"],
+            filters: {
+                email: guest_identifier,
+                has_account: false
+            }
+        });
+        if (customers.length === 0) {
+            res.status(404).json({ message: "Order not found or access denied" });
+            return;
+        }
+        const guestCustomerIds = customers.map(c => c.id);
+        // 2. Fetch the specific order ONLY if it belongs to these guest customer IDs
+        const { data: orders } = await query.graph({
+            entity: "order",
+            fields: [
+                "*",
+                "items.*",
+                "shipping_address.*",
+                "billing_address.*",
+                "shipping_methods.*",
+                "fulfillments.*",
+                "fulfillments.items.*",
+                "payments.*",
+                "total"
+            ],
+            filters: {
+                id: id,
+                customer_id: guestCustomerIds
+            }
+        });
+        const order = orders[0];
+        if (!order) {
+            res.status(404).json({ message: "Order not found or access denied" });
+            return;
+        }
+        res.status(200).json({
+            order
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(401).json({ message: "Unauthorized or invalid token", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2d1ZXN0LW9yZGVycy9baWRdL3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBSUEsa0JBZ0ZDO0FBbkZELHFEQUFxRTtBQUNyRSxnRUFBOEM7QUFFdkMsS0FBSyxVQUFVLEdBQUcsQ0FDckIsR0FBa0IsRUFDbEIsR0FBbUI7SUFFbkIsTUFBTSxVQUFVLEdBQUcsR0FBRyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUE7SUFDNUMsTUFBTSxFQUFFLEVBQUUsRUFBRSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUE7SUFFekIsSUFBSSxDQUFDLFVBQVUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUNuRCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSx5Q0FBeUMsRUFBRSxDQUFDLENBQUE7UUFDNUUsT0FBTTtJQUNWLENBQUM7SUFFRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFBO0lBQ3RDLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxJQUFJLDRCQUE0QixDQUFBO0lBRXJFLElBQUksQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLHNCQUFHLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQWUsQ0FBQTtRQUV2RCxJQUFJLENBQUMsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDeEMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsQ0FBQyxDQUFBO1lBQzFELE9BQU07UUFDVixDQUFDO1FBRUQsTUFBTSxFQUFFLGdCQUFnQixFQUFFLEdBQUcsT0FBTyxDQUFBO1FBRXBDLCtCQUErQjtRQUMvQixNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxpQ0FBeUIsQ0FBQyxLQUFLLENBQUMsQ0FBQTtRQUVoRSx3REFBd0Q7UUFDeEQsTUFBTSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUM7WUFDMUMsTUFBTSxFQUFFLFVBQVU7WUFDbEIsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUFDO1lBQ2QsT0FBTyxFQUFFO2dCQUNMLEtBQUssRUFBRSxnQkFBZ0I7Z0JBQ3ZCLFdBQVcsRUFBRSxLQUFLO2FBQ3JCO1NBQ0osQ0FBQyxDQUFBO1FBRUYsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pCLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLGtDQUFrQyxFQUFFLENBQUMsQ0FBQTtZQUNyRSxPQUFNO1FBQ1YsQ0FBQztRQUVELE1BQU0sZ0JBQWdCLEdBQUcsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQTtRQUVqRCw2RUFBNkU7UUFDN0UsTUFBTSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUM7WUFDdkMsTUFBTSxFQUFFLE9BQU87WUFDZixNQUFNLEVBQUU7Z0JBQ0osR0FBRztnQkFDSCxTQUFTO2dCQUNULG9CQUFvQjtnQkFDcEIsbUJBQW1CO2dCQUNuQixvQkFBb0I7Z0JBQ3BCLGdCQUFnQjtnQkFDaEIsc0JBQXNCO2dCQUN0QixZQUFZO2dCQUNaLE9BQU87YUFDVjtZQUNELE9BQU8sRUFBRTtnQkFDTCxFQUFFLEVBQUUsRUFBRTtnQkFDTixXQUFXLEVBQUUsZ0JBQWdCO2FBQ2hDO1NBQ0osQ0FBQyxDQUFBO1FBRUYsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFBO1FBRXZCLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNULEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLGtDQUFrQyxFQUFFLENBQUMsQ0FBQTtZQUNyRSxPQUFNO1FBQ1YsQ0FBQztRQUVELEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDO1lBQ2pCLEtBQUs7U0FDUixDQUFDLENBQUE7SUFFTixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNiLE1BQU0sWUFBWSxHQUFHLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQTtRQUM3RSxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQTtJQUMzRixDQUFDO0FBQ0wsQ0FBQyJ9

package/.medusa/server/src/api/store/guest-orders/route.js

@@ -0,0 +1,63 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = GET;
+const utils_1 = require("@medusajs/framework/utils");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+async function GET(req, res) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        res.status(401).json({ message: "Missing or invalid Authorization header" });
+        return;
+    }
+    const token = authHeader.split(" ")[1];
+    const secret = process.env.JWT_SECRET || "medusa-secret-guest-access";
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (!decoded || !decoded.guest_identifier) {
+            res.status(401).json({ message: "Invalid token payload" });
+            return;
+        }
+        const { guest_identifier } = decoded;
+        // Resolve Query to fetch orders
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        // 1. Find GUEST customer IDs associated with this email
+        const { data: customers } = await query.graph({
+            entity: "customer",
+            fields: ["id"],
+            filters: {
+                email: guest_identifier,
+                has_account: false
+            }
+        });
+        if (customers.length === 0) {
+            res.status(200).json({
+                orders: [],
+                count: 0,
+                guest_identifier
+            });
+            return;
+        }
+        const guestCustomerIds = customers.map(c => c.id);
+        // 2. Fetch orders ONLY for these guest customer IDs
+        const { data: orders } = await query.graph({
+            entity: "order",
+            fields: ["*", "items.*", "total"],
+            filters: {
+                customer_id: guestCustomerIds
+            }
+        });
+        res.status(200).json({
+            orders,
+            count: orders.length,
+            guest_identifier
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(401).json({ message: "Unauthorized or invalid token", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2d1ZXN0LW9yZGVycy9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUlBLGtCQW1FQztBQXRFRCxxREFBcUU7QUFDckUsZ0VBQThDO0FBRXZDLEtBQUssVUFBVSxHQUFHLENBQ3JCLEdBQWtCLEVBQ2xCLEdBQW1CO0lBRW5CLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFBO0lBRTVDLElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDbkQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUseUNBQXlDLEVBQUUsQ0FBQyxDQUFBO1FBQzVFLE9BQU07SUFDVixDQUFDO0lBRUQsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUN0QyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSw0QkFBNEIsQ0FBQTtJQUVyRSxJQUFJLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxzQkFBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFlLENBQUE7UUFFdkQsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3hDLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQTtZQUMxRCxPQUFNO1FBQ1YsQ0FBQztRQUVELE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxHQUFHLE9BQU8sQ0FBQTtRQUVwQyxnQ0FBZ0M7UUFDaEMsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsS0FBSyxDQUFDLENBQUE7UUFFaEUsd0RBQXdEO1FBQ3hELE1BQU0sRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQzFDLE1BQU0sRUFBRSxVQUFVO1lBQ2xCLE1BQU0sRUFBRSxDQUFDLElBQUksQ0FBQztZQUNkLE9BQU8sRUFBRTtnQkFDTCxLQUFLLEVBQUUsZ0JBQWdCO2dCQUN2QixXQUFXLEVBQUUsS0FBSzthQUNyQjtTQUNKLENBQUMsQ0FBQTtRQUVGLElBQUksU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6QixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztnQkFDakIsTUFBTSxFQUFFLEVBQUU7Z0JBQ1YsS0FBSyxFQUFFLENBQUM7Z0JBQ1IsZ0JBQWdCO2FBQ25CLENBQUMsQ0FBQTtZQUNGLE9BQU07UUFDVixDQUFDO1FBRUQsTUFBTSxnQkFBZ0IsR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFBO1FBRWpELG9EQUFvRDtRQUNwRCxNQUFNLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQztZQUN2QyxNQUFNLEVBQUUsT0FBTztZQUNmLE1BQU0sRUFBRSxDQUFDLEdBQUcsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDO1lBQ2pDLE9BQU8sRUFBRTtnQkFDTCxXQUFXLEVBQUUsZ0JBQWdCO2FBQ2hDO1NBQ0osQ0FBQyxDQUFBO1FBRUYsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7WUFDakIsTUFBTTtZQUNOLEtBQUssRUFBRSxNQUFNLENBQUMsTUFBTTtZQUNwQixnQkFBZ0I7U0FDbkIsQ0FBQyxDQUFBO0lBRU4sQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDYixNQUFNLFlBQVksR0FBRyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUE7UUFDN0UsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsK0JBQStCLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUE7SUFDM0YsQ0FBQztBQUNMLENBQUMifQ==

package/.medusa/server/src/api/store/otp/request/route.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const otp_service_1 = require("../../../../services/otp-service");
+const utils_1 = require("@medusajs/framework/utils");
+const otpService = new otp_service_1.OtpService();
+async function POST(req, res) {
+    const { email, phone } = req.body;
+    if (!email && !phone) {
+        res.status(400).json({ message: "Email or phone number is required" });
+        return;
+    }
+    const identifier = email || phone;
+    if (!identifier) {
+        res.status(400).json({ message: "Invalid identifier" });
+        return;
+    }
+    try {
+        // Resolve Query to check for registered customers
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        const { data: customers } = await query.graph({
+            entity: "customer",
+            fields: ["has_account"],
+            filters: { email: identifier, has_account: true }
+        });
+        if (customers.length > 0) {
+            res.status(403).json({
+                message: "This email is registered. Please log in to view orders.",
+                is_registered: true
+            });
+            return;
+        }
+        const otp = await otpService.generate(identifier);
+        // In a real implementation, we would send this OTP via the Notification Module.
+        const notificationModule = req.scope.resolve(utils_1.Modules.NOTIFICATION);
+        // For now, we will log it to the console for easy testing.
+        console.log(`[OTP Service] Generated OTP for ${identifier}: ${otp}`);
+        try {
+            // Send OTP via Notification Module
+            const subject = "Your Verification Code";
+            const htmlContent = `
+              <div style="font-family: Arial, sans-serif; padding: 20px;">
+                <h2>Verification Code</h2>
+                <p>Your OTP code is:</p>
+                <h1 style="color: #2563eb; letter-spacing: 5px;">${otp}</h1>
+                <p>This code will expire in 15 minutes.</p>
+              </div>
+            `;
+            const textContent = `Your verification code is: ${otp}. It expires in 15 minutes.`;
+            console.log("[OTP Debug] Sending OTP email with HTML content...");
+            await notificationModule.createNotifications({
+                to: identifier,
+                channel: email ? "email" : "sms",
+                template: "otp-request",
+                data: {
+                    otp,
+                    subject,
+                    html: htmlContent,
+                    text: textContent,
+                    body: htmlContent
+                },
+            });
+            console.log(`[OTP Service] OTP sent to ${identifier}`);
+        }
+        catch (notifError) {
+            console.error(`[OTP Service] Failed to send notification: ${notifError}`);
+        }
+        res.status(200).json({ message: "OTP sent successfully" });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(500).json({ message: "Failed to generate OTP", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL290cC9yZXF1ZXN0L3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBTUEsb0JBK0VDO0FBcEZELGtFQUE2RDtBQUM3RCxxREFBOEU7QUFFOUUsTUFBTSxVQUFVLEdBQUcsSUFBSSx3QkFBVSxFQUFFLENBQUE7QUFFNUIsS0FBSyxVQUFVLElBQUksQ0FDdEIsR0FBa0IsRUFDbEIsR0FBbUI7SUFFbkIsTUFBTSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsR0FBRyxHQUFHLENBQUMsSUFBMEMsQ0FBQTtJQUV2RSxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDbkIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsbUNBQW1DLEVBQUUsQ0FBQyxDQUFBO1FBQ3RFLE9BQU07SUFDVixDQUFDO0lBRUQsTUFBTSxVQUFVLEdBQUcsS0FBSyxJQUFJLEtBQUssQ0FBQTtJQUNqQyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDZCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxDQUFDLENBQUE7UUFDdkQsT0FBTTtJQUNWLENBQUM7SUFFRCxJQUFJLENBQUM7UUFDRCxrREFBa0Q7UUFDbEQsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsS0FBSyxDQUFDLENBQUE7UUFDaEUsTUFBTSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUM7WUFDMUMsTUFBTSxFQUFFLFVBQVU7WUFDbEIsTUFBTSxFQUFFLENBQUMsYUFBYSxDQUFDO1lBQ3ZCLE9BQU8sRUFBRSxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRTtTQUNwRCxDQUFDLENBQUE7UUFFRixJQUFJLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdkIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7Z0JBQ2pCLE9BQU8sRUFBRSx5REFBeUQ7Z0JBQ2xFLGFBQWEsRUFBRSxJQUFJO2FBQ3RCLENBQUMsQ0FBQTtZQUNGLE9BQU07UUFDVixDQUFDO1FBRUQsTUFBTSxHQUFHLEdBQUcsTUFBTSxVQUFVLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFBO1FBRWpELGdGQUFnRjtRQUNoRixNQUFNLGtCQUFrQixHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGVBQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQTtRQUVsRSwyREFBMkQ7UUFDM0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxtQ0FBbUMsVUFBVSxLQUFLLEdBQUcsRUFBRSxDQUFDLENBQUE7UUFFcEUsSUFBSSxDQUFDO1lBQ0QsbUNBQW1DO1lBQ25DLE1BQU0sT0FBTyxHQUFHLHdCQUF3QixDQUFBO1lBQ3hDLE1BQU0sV0FBVyxHQUFHOzs7O21FQUltQyxHQUFHOzs7YUFHekQsQ0FBQTtZQUNELE1BQU0sV0FBVyxHQUFHLDhCQUE4QixHQUFHLDZCQUE2QixDQUFBO1lBRWxGLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0RBQW9ELENBQUMsQ0FBQTtZQUVqRSxNQUFNLGtCQUFrQixDQUFDLG1CQUFtQixDQUFDO2dCQUN6QyxFQUFFLEVBQUUsVUFBVTtnQkFDZCxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEtBQUs7Z0JBQ2hDLFFBQVEsRUFBRSxhQUFhO2dCQUN2QixJQUFJLEVBQUU7b0JBQ0YsR0FBRztvQkFDSCxPQUFPO29CQUNQLElBQUksRUFBRSxXQUFXO29CQUNqQixJQUFJLEVBQUUsV0FBVztvQkFDakIsSUFBSSxFQUFFLFdBQVc7aUJBQ3BCO2FBQ0osQ0FBQyxDQUFBO1lBQ0YsT0FBTyxDQUFDLEdBQUcsQ0FBQyw2QkFBNkIsVUFBVSxFQUFFLENBQUMsQ0FBQTtRQUMxRCxDQUFDO1FBQUMsT0FBTyxVQUFVLEVBQUUsQ0FBQztZQUNsQixPQUFPLENBQUMsS0FBSyxDQUFDLDhDQUE4QyxVQUFVLEVBQUUsQ0FBQyxDQUFBO1FBQzdFLENBQUM7UUFFRCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxDQUFDLENBQUE7SUFDOUQsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDYixNQUFNLFlBQVksR0FBRyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUE7UUFDN0UsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsd0JBQXdCLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUE7SUFDcEYsQ0FBQztBQUNMLENBQUMifQ==

package/.medusa/server/src/api/store/otp/verify/route.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const otp_service_1 = require("../../../../services/otp-service");
+const otpService = new otp_service_1.OtpService();
+async function POST(req, res) {
+    const { email, phone, otp } = req.body;
+    if ((!email && !phone) || !otp) {
+        res.status(400).json({ message: "Email/Phone and OTP are required" });
+        return;
+    }
+    const identifier = email || phone;
+    if (!identifier) {
+        res.status(400).json({ message: "Invalid identifier" });
+        return;
+    }
+    try {
+        const isValid = await otpService.verify(identifier, otp);
+        if (!isValid) {
+            res.status(401).json({ message: "Invalid or expired OTP" });
+            return;
+        }
+        const token = otpService.generateToken(identifier);
+        res.status(200).json({
+            message: "OTP verified successfully",
+            token
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(500).json({ message: "Failed to verify OTP", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL290cC92ZXJpZnkvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFLQSxvQkFvQ0M7QUF4Q0Qsa0VBQTZEO0FBRTdELE1BQU0sVUFBVSxHQUFHLElBQUksd0JBQVUsRUFBRSxDQUFBO0FBRTVCLEtBQUssVUFBVSxJQUFJLENBQ3RCLEdBQWtCLEVBQ2xCLEdBQW1CO0lBRW5CLE1BQU0sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxHQUFHLEdBQUcsQ0FBQyxJQUF1RCxDQUFBO0lBRXpGLElBQUksQ0FBQyxDQUFDLEtBQUssSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDN0IsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsa0NBQWtDLEVBQUUsQ0FBQyxDQUFBO1FBQ3JFLE9BQU07SUFDVixDQUFDO0lBRUQsTUFBTSxVQUFVLEdBQUcsS0FBSyxJQUFJLEtBQUssQ0FBQTtJQUVqQyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDZCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxDQUFDLENBQUE7UUFDdkQsT0FBTTtJQUNWLENBQUM7SUFFRCxJQUFJLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLEdBQUcsQ0FBQyxDQUFBO1FBRXhELElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNYLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHdCQUF3QixFQUFFLENBQUMsQ0FBQTtZQUMzRCxPQUFNO1FBQ1YsQ0FBQztRQUVELE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLENBQUE7UUFFbEQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7WUFDakIsT0FBTyxFQUFFLDJCQUEyQjtZQUNwQyxLQUFLO1NBQ1IsQ0FBQyxDQUFBO0lBQ04sQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDYixNQUFNLFlBQVksR0FBRyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUE7UUFDN0UsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUE7SUFDbEYsQ0FBQztBQUNMLENBQUMifQ==

package/.medusa/server/src/services/otp-service.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtpService = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+// In-memory store for OTPs. 
+// NOTE: In a real production environment with multiple server instances, 
+// this should be replaced with Redis or a database table.
+const otpStore = new Map();
+class OtpService {
+    /**
+     * Generates a 6-digit OTP for the given identifier (email/phone).
+     * Stores it with a 15-minute expiration.
+     */
+    async generate(identifier) {
+        const otp = Math.floor(100000 + Math.random() * 900000).toString();
+        otpStore.set(identifier, {
+            otp,
+            expiresAt: Date.now() + 15 * 60 * 1000, // 15 minutes
+        });
+        return otp;
+    }
+    /**
+     * Verifies the OTP for the given identifier.
+     * key feature: Deletes the OTP upon successful verification to prevent replay.
+     */
+    async verify(identifier, code) {
+        const data = otpStore.get(identifier);
+        if (!data) {
+            return false;
+        }
+        if (Date.now() > data.expiresAt) {
+            otpStore.delete(identifier);
+            return false;
+        }
+        if (data.otp !== code) {
+            return false;
+        }
+        // OTP is valid, consume it
+        otpStore.delete(identifier);
+        return true;
+    }
+    /**
+     * Generates a JWT token scoped for guest access.
+     */
+    generateToken(identifier) {
+        // In production, use a secure secret from environment variables
+        const secret = process.env.JWT_SECRET || "medusa-secret-guest-access";
+        return jsonwebtoken_1.default.sign({
+            guest_identifier: identifier,
+            scope: "guest_orders"
+        }, secret, { expiresIn: "1h" });
+    }
+}
+exports.OtpService = OtpService;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3RwLXNlcnZpY2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvc2VydmljZXMvb3RwLXNlcnZpY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQUEsZ0VBQThCO0FBRTlCLDZCQUE2QjtBQUM3QiwwRUFBMEU7QUFDMUUsMERBQTBEO0FBQzFELE1BQU0sUUFBUSxHQUFHLElBQUksR0FBRyxFQUE4QyxDQUFBO0FBRXRFLE1BQWEsVUFBVTtJQUNuQjs7O09BR0c7SUFDSCxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQWtCO1FBQzdCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLEVBQUUsR0FBRyxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQTtRQUVsRSxRQUFRLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRTtZQUNyQixHQUFHO1lBQ0gsU0FBUyxFQUFFLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksRUFBRSxhQUFhO1NBQ3hELENBQUMsQ0FBQTtRQUVGLE9BQU8sR0FBRyxDQUFBO0lBQ2QsQ0FBQztJQUVEOzs7T0FHRztJQUNILEtBQUssQ0FBQyxNQUFNLENBQUMsVUFBa0IsRUFBRSxJQUFZO1FBQ3pDLE1BQU0sSUFBSSxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUE7UUFFckMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ1IsT0FBTyxLQUFLLENBQUE7UUFDaEIsQ0FBQztRQUVELElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUM5QixRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFBO1lBQzNCLE9BQU8sS0FBSyxDQUFBO1FBQ2hCLENBQUM7UUFFRCxJQUFJLElBQUksQ0FBQyxHQUFHLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDcEIsT0FBTyxLQUFLLENBQUE7UUFDaEIsQ0FBQztRQUVELDJCQUEyQjtRQUMzQixRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFBO1FBQzNCLE9BQU8sSUFBSSxDQUFBO0lBQ2YsQ0FBQztJQUVEOztPQUVHO0lBQ0gsYUFBYSxDQUFDLFVBQWtCO1FBQzVCLGdFQUFnRTtRQUNoRSxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSw0QkFBNEIsQ0FBQTtRQUVyRSxPQUFPLHNCQUFHLENBQUMsSUFBSSxDQUNYO1lBQ0ksZ0JBQWdCLEVBQUUsVUFBVTtZQUM1QixLQUFLLEVBQUUsY0FBYztTQUN4QixFQUNELE1BQU0sRUFDTixFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FDdEIsQ0FBQTtJQUNMLENBQUM7Q0FDSjtBQXpERCxnQ0F5REMifQ==