order-management 0.0.13 → 0.0.15

package/.medusa/server/src/api/store/guest-orders/[id]/invoice/route.js

@@ -0,0 +1,71 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = GET;
+const utils_1 = require("@medusajs/framework/utils");
+// import { INVOICE_MODULE } from "../../../../../medusa-invoice-sbl/src/modules/invoice"
+// import InvoiceModuleService from "../../../../../medusa-invoice-sbl/src/modules/invoice/service"
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+async function GET(req, res) {
+    const authHeader = req.headers.authorization;
+    const { id } = req.params;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        res.status(401).json({ message: "Missing or invalid Authorization header" });
+        return;
+    }
+    const token = authHeader.split(" ")[1];
+    const secret = process.env.JWT_SECRET || "medusa-secret-guest-access";
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (!decoded || !decoded.guest_identifier) {
+            res.status(401).json({ message: "Invalid token payload" });
+            return;
+        }
+        const { guest_identifier } = decoded;
+        // Resolve Query to fetch order and verify ownership
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        // Fetch the specific order and include customer info
+        const { data: orders } = await query.graph({
+            entity: "order",
+            fields: ["id", "customer.has_account"],
+            filters: {
+                id: id,
+                email: guest_identifier
+            }
+        });
+        const order = orders[0];
+        // Ensure the order exists and either has no customer record or the customer does NOT have an account
+        if (!order || (order.customer && order.customer.has_account === true)) {
+            res.status(404).json({ message: "Order not found or access denied" });
+            return;
+        }
+        // 3. Generate Invoice PDF
+        // Try to resolve the invoice service if it exists
+        try {
+            // Note: INVOICE_MODULE and InvoiceModuleService would be imported from the invoice plugin
+            // For now, we use a placeholder or check if the service is registered
+            const invoiceService = req.scope.resolve("invoiceModuleService");
+            if (invoiceService) {
+                const pdfBuffer = await invoiceService.generateInvoice(id, req.scope);
+                res.setHeader("Content-Type", "application/pdf");
+                res.setHeader("Content-Disposition", `attachment; filename=invoice-${id}.pdf`);
+                res.status(200).send(pdfBuffer);
+                return;
+            }
+        }
+        catch (invoiceError) {
+            console.error(`[Invoice Download] Invoice service not available: ${invoiceError}`);
+        }
+        res.status(200).json({
+            message: "Invoice generation is not available in this environment, but the endpoint is correctly verifying permissions.",
+            order_id: id
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(401).json({ message: "Unauthorized or invalid token", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2d1ZXN0LW9yZGVycy9baWRdL2ludm9pY2Uvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFNQSxrQkEwRUM7QUEvRUQscURBQXFFO0FBQ3JFLHlGQUF5RjtBQUN6RixtR0FBbUc7QUFDbkcsZ0VBQThDO0FBRXZDLEtBQUssVUFBVSxHQUFHLENBQ3JCLEdBQWtCLEVBQ2xCLEdBQW1CO0lBRW5CLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFBO0lBQzVDLE1BQU0sRUFBRSxFQUFFLEVBQUUsR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFBO0lBRXpCLElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDbkQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUseUNBQXlDLEVBQUUsQ0FBQyxDQUFBO1FBQzVFLE9BQU07SUFDVixDQUFDO0lBRUQsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUN0QyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSw0QkFBNEIsQ0FBQTtJQUVyRSxJQUFJLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxzQkFBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFlLENBQUE7UUFFdkQsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3hDLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQTtZQUMxRCxPQUFNO1FBQ1YsQ0FBQztRQUVELE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxHQUFHLE9BQU8sQ0FBQTtRQUVwQyxvREFBb0Q7UUFDcEQsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsS0FBSyxDQUFDLENBQUE7UUFFaEUscURBQXFEO1FBQ3JELE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQ3ZDLE1BQU0sRUFBRSxPQUFPO1lBQ2YsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLHNCQUFzQixDQUFDO1lBQ3RDLE9BQU8sRUFBRTtnQkFDTCxFQUFFLEVBQUUsRUFBRTtnQkFDTixLQUFLLEVBQUUsZ0JBQWdCO2FBQzFCO1NBQ0osQ0FBQyxDQUFBO1FBRUYsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFBO1FBRXZCLHFHQUFxRztRQUNyRyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLFdBQVcsS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3BFLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLGtDQUFrQyxFQUFFLENBQUMsQ0FBQTtZQUNyRSxPQUFNO1FBQ1YsQ0FBQztRQUVELDBCQUEwQjtRQUMxQixrREFBa0Q7UUFDbEQsSUFBSSxDQUFDO1lBQ0QsMEZBQTBGO1lBQzFGLHNFQUFzRTtZQUN0RSxNQUFNLGNBQWMsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBUSxDQUFBO1lBRXZFLElBQUksY0FBYyxFQUFFLENBQUM7Z0JBQ2pCLE1BQU0sU0FBUyxHQUFHLE1BQU0sY0FBYyxDQUFDLGVBQWUsQ0FBQyxFQUFFLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFBO2dCQUVyRSxHQUFHLENBQUMsU0FBUyxDQUFDLGNBQWMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFBO2dCQUNoRCxHQUFHLENBQUMsU0FBUyxDQUFDLHFCQUFxQixFQUFFLGdDQUFnQyxFQUFFLE1BQU0sQ0FBQyxDQUFBO2dCQUM5RSxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQTtnQkFDL0IsT0FBTTtZQUNWLENBQUM7UUFDTCxDQUFDO1FBQUMsT0FBTyxZQUFZLEVBQUUsQ0FBQztZQUNwQixPQUFPLENBQUMsS0FBSyxDQUFDLHFEQUFxRCxZQUFZLEVBQUUsQ0FBQyxDQUFBO1FBQ3RGLENBQUM7UUFFRCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUNqQixPQUFPLEVBQUUsK0dBQStHO1lBQ3hILFFBQVEsRUFBRSxFQUFFO1NBQ2YsQ0FBQyxDQUFBO0lBRU4sQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDYixNQUFNLFlBQVksR0FBRyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUE7UUFDN0UsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsK0JBQStCLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUE7SUFDM0YsQ0FBQztBQUNMLENBQUMifQ==

package/.medusa/server/src/api/store/guest-orders/[id]/returns/route.js

@@ -0,0 +1,65 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const utils_1 = require("@medusajs/framework/utils");
+// import { IOrderModuleService } from "@medusajs/framework/types"
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+async function POST(req, res) {
+    const authHeader = req.headers.authorization;
+    const { id } = req.params;
+    const { items, reason_id, note } = req.body;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        res.status(401).json({ message: "Missing or invalid Authorization header" });
+        return;
+    }
+    if (!items || !items.length) {
+        res.status(400).json({ message: "Items are required for return" });
+        return;
+    }
+    const token = authHeader.split(" ")[1];
+    const secret = process.env.JWT_SECRET || "medusa-secret-guest-access";
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (!decoded || !decoded.guest_identifier) {
+            res.status(401).json({ message: "Invalid token payload" });
+            return;
+        }
+        const { guest_identifier } = decoded;
+        // Resolve Query to fetch order and verify ownership
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        // Fetch the specific order and include customer info
+        const { data: orders } = await query.graph({
+            entity: "order",
+            fields: ["id", "customer.has_account"],
+            filters: {
+                id: id,
+                email: guest_identifier
+            }
+        });
+        const order = orders[0];
+        // Ensure the order exists and either has no customer record or the customer does NOT have an account
+        if (!order || (order.customer && order.customer.has_account === true)) {
+            res.status(404).json({ message: "Order not found or access denied" });
+            return;
+        }
+        // 3. Create Return Request
+        // In Medusa v2, we use order workflows or direct module calls.
+        // For simplicity and to fit the current architecture, we'll suggest using a workflow if available or direct module interaction.
+        // Since we are building a plugin, we'll use the available services.
+        // This is a placeholder for the actual return workflow/module call in Medusa v2
+        // Typically: createReturnWorkflow(req.scope).run({ input: { order_id: id, items, ... } })
+        res.status(200).json({
+            message: "Return request initiated successfully. This is a mock implementation of the return creation logic.",
+            order_id: id,
+            items
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(401).json({ message: "Unauthorized or invalid token", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2d1ZXN0LW9yZGVycy9baWRdL3JldHVybnMvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFLQSxvQkEwRUM7QUE5RUQscURBQThFO0FBQzlFLGtFQUFrRTtBQUNsRSxnRUFBOEM7QUFFdkMsS0FBSyxVQUFVLElBQUksQ0FDdEIsR0FBa0IsRUFDbEIsR0FBbUI7SUFFbkIsTUFBTSxVQUFVLEdBQUcsR0FBRyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUE7SUFDNUMsTUFBTSxFQUFFLEVBQUUsRUFBRSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUE7SUFDekIsTUFBTSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLEdBQUcsR0FBRyxDQUFDLElBSXRDLENBQUE7SUFFRCxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ25ELEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHlDQUF5QyxFQUFFLENBQUMsQ0FBQTtRQUM1RSxPQUFNO0lBQ1YsQ0FBQztJQUVELElBQUksQ0FBQyxLQUFLLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsK0JBQStCLEVBQUUsQ0FBQyxDQUFBO1FBQ2xFLE9BQU07SUFDVixDQUFDO0lBRUQsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUN0QyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSw0QkFBNEIsQ0FBQTtJQUVyRSxJQUFJLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxzQkFBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFlLENBQUE7UUFFdkQsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3hDLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQTtZQUMxRCxPQUFNO1FBQ1YsQ0FBQztRQUVELE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxHQUFHLE9BQU8sQ0FBQTtRQUVwQyxvREFBb0Q7UUFDcEQsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsS0FBSyxDQUFDLENBQUE7UUFFaEUscURBQXFEO1FBQ3JELE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQ3ZDLE1BQU0sRUFBRSxPQUFPO1lBQ2YsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLHNCQUFzQixDQUFDO1lBQ3RDLE9BQU8sRUFBRTtnQkFDTCxFQUFFLEVBQUUsRUFBRTtnQkFDTixLQUFLLEVBQUUsZ0JBQWdCO2FBQzFCO1NBQ0osQ0FBQyxDQUFBO1FBRUYsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFBO1FBRXZCLHFHQUFxRztRQUNyRyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLFdBQVcsS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3BFLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLGtDQUFrQyxFQUFFLENBQUMsQ0FBQTtZQUNyRSxPQUFNO1FBQ1YsQ0FBQztRQUVELDJCQUEyQjtRQUMzQiwrREFBK0Q7UUFDL0QsZ0lBQWdJO1FBQ2hJLG9FQUFvRTtRQUVwRSxnRkFBZ0Y7UUFDaEYsMEZBQTBGO1FBRTFGLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDO1lBQ2pCLE9BQU8sRUFBRSxvR0FBb0c7WUFDN0csUUFBUSxFQUFFLEVBQUU7WUFDWixLQUFLO1NBQ1IsQ0FBQyxDQUFBO0lBRU4sQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDYixNQUFNLFlBQVksR0FBRyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUE7UUFDN0UsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsK0JBQStCLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUE7SUFDM0YsQ0FBQztBQUNMLENBQUMifQ==

package/.medusa/server/src/api/store/guest-orders/[id]/route.js

@@ -0,0 +1,64 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = GET;
+const utils_1 = require("@medusajs/framework/utils");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+async function GET(req, res) {
+    const authHeader = req.headers.authorization;
+    const { id } = req.params;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        res.status(401).json({ message: "Missing or invalid Authorization header" });
+        return;
+    }
+    const token = authHeader.split(" ")[1];
+    const secret = process.env.JWT_SECRET || "medusa-secret-guest-access";
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (!decoded || !decoded.guest_identifier) {
+            res.status(401).json({ message: "Invalid token payload" });
+            return;
+        }
+        const { guest_identifier, customer_id } = decoded;
+        // Resolve Query to fetch order
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        // Fetch the specific order and include customer info
+        const { data: orders } = await query.graph({
+            entity: "order",
+            fields: [
+                "*",
+                "items.*",
+                "shipping_address.*",
+                "billing_address.*",
+                "shipping_methods.*",
+                "fulfillments.*",
+                "fulfillments.items.*",
+                "payments.*",
+                "total",
+                "customer.id",
+                "customer.has_account"
+            ],
+            filters: {
+                id: id,
+                customer_id: customer_id ? [customer_id] : undefined,
+                email: !customer_id ? guest_identifier : undefined
+            }
+        });
+        const order = orders[0];
+        // Ensure the order exists and either has no customer record or the customer does NOT have an account
+        if (!order || (order.customer && order.customer.has_account === true)) {
+            res.status(404).json({ message: "Order not found or access denied" });
+            return;
+        }
+        res.status(200).json({
+            order
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(401).json({ message: "Unauthorized or invalid token", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2d1ZXN0LW9yZGVycy9baWRdL3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBSUEsa0JBbUVDO0FBdEVELHFEQUFxRTtBQUNyRSxnRUFBOEM7QUFFdkMsS0FBSyxVQUFVLEdBQUcsQ0FDckIsR0FBa0IsRUFDbEIsR0FBbUI7SUFFbkIsTUFBTSxVQUFVLEdBQUcsR0FBRyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUE7SUFDNUMsTUFBTSxFQUFFLEVBQUUsRUFBRSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUE7SUFFekIsSUFBSSxDQUFDLFVBQVUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUNuRCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSx5Q0FBeUMsRUFBRSxDQUFDLENBQUE7UUFDNUUsT0FBTTtJQUNWLENBQUM7SUFFRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFBO0lBQ3RDLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxJQUFJLDRCQUE0QixDQUFBO0lBRXJFLElBQUksQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLHNCQUFHLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQWUsQ0FBQTtRQUV2RCxJQUFJLENBQUMsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDeEMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsQ0FBQyxDQUFBO1lBQzFELE9BQU07UUFDVixDQUFDO1FBRUQsTUFBTSxFQUFFLGdCQUFnQixFQUFFLFdBQVcsRUFBRSxHQUFHLE9BQU8sQ0FBQTtRQUVqRCwrQkFBK0I7UUFDL0IsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsS0FBSyxDQUFDLENBQUE7UUFFaEUscURBQXFEO1FBQ3JELE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQ3ZDLE1BQU0sRUFBRSxPQUFPO1lBQ2YsTUFBTSxFQUFFO2dCQUNKLEdBQUc7Z0JBQ0gsU0FBUztnQkFDVCxvQkFBb0I7Z0JBQ3BCLG1CQUFtQjtnQkFDbkIsb0JBQW9CO2dCQUNwQixnQkFBZ0I7Z0JBQ2hCLHNCQUFzQjtnQkFDdEIsWUFBWTtnQkFDWixPQUFPO2dCQUNQLGFBQWE7Z0JBQ2Isc0JBQXNCO2FBQ3pCO1lBQ0QsT0FBTyxFQUFFO2dCQUNMLEVBQUUsRUFBRSxFQUFFO2dCQUNOLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVM7Z0JBQ3BELEtBQUssRUFBRSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLFNBQVM7YUFDckQ7U0FDSixDQUFDLENBQUE7UUFFRixNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUE7UUFFdkIscUdBQXFHO1FBQ3JHLElBQUksQ0FBQyxLQUFLLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsV0FBVyxLQUFLLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDcEUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsa0NBQWtDLEVBQUUsQ0FBQyxDQUFBO1lBQ3JFLE9BQU07UUFDVixDQUFDO1FBRUQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7WUFDakIsS0FBSztTQUNSLENBQUMsQ0FBQTtJQUVOLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2IsTUFBTSxZQUFZLEdBQUcsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsZUFBZSxDQUFBO1FBQzdFLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLCtCQUErQixFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFBO0lBQzNGLENBQUM7QUFDTCxDQUFDIn0=

package/.medusa/server/src/api/store/guest-orders/route.js

@@ -0,0 +1,79 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = GET;
+const utils_1 = require("@medusajs/framework/utils");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+async function GET(req, res) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        res.status(401).json({ message: "Missing or invalid Authorization header" });
+        return;
+    }
+    const token = authHeader.split(" ")[1];
+    const secret = process.env.JWT_SECRET || "medusa-secret-guest-access";
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (!decoded || !decoded.guest_identifier) {
+            res.status(401).json({ message: "Invalid token payload" });
+            return;
+        }
+        const { guest_identifier, customer_id } = decoded;
+        // Resolve Query to fetch orders
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        console.log(`[Guest Orders Debug] Fetching orders for: ${guest_identifier} (CID: ${customer_id || 'N/A'})`);
+        let guestIds = customer_id ? [customer_id] : [];
+        // 1. Fallback: Fetch guest customers for this email if ID is missing from token
+        if (guestIds.length === 0) {
+            const { data: guestCustomers } = await query.graph({
+                entity: "customer",
+                fields: ["id"],
+                filters: {
+                    email: guest_identifier,
+                    has_account: false
+                }
+            });
+            guestIds = guestCustomers.map(c => c.id);
+            console.log(`[Guest Orders Debug] Fallback lookup found IDs: ${guestIds.join(", ")}`);
+        }
+        if (guestIds.length === 0) {
+            res.status(200).json({ orders: [], count: 0, guest_identifier });
+            return;
+        }
+        // 2. Fetch orders tied to these specific guest customer IDs
+        const { data: orders } = await query.graph({
+            entity: "order",
+            fields: [
+                "id",
+                "display_id",
+                "email",
+                "customer_id",
+                "status",
+                "total",
+                "currency_code",
+                "created_at",
+                "items.*"
+            ],
+            filters: {
+                customer_id: guestIds,
+            },
+            // @ts-ignore
+            sort: ["-created_at"]
+        });
+        // 3. Simple filter for canceled orders
+        const guestOrders = orders.filter(o => o.status !== "canceled");
+        console.log(`[Guest Orders Debug] Found ${guestOrders.length} valid guest orders`);
+        res.status(200).json({
+            orders: guestOrders.slice(0, 10), // Limit to recent 10
+            count: guestOrders.length,
+            guest_identifier
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(401).json({ message: "Unauthorized or invalid token", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2d1ZXN0LW9yZGVycy9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUlBLGtCQXNGQztBQXpGRCxxREFBcUU7QUFDckUsZ0VBQThDO0FBRXZDLEtBQUssVUFBVSxHQUFHLENBQ3JCLEdBQWtCLEVBQ2xCLEdBQW1CO0lBRW5CLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFBO0lBRTVDLElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDbkQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUseUNBQXlDLEVBQUUsQ0FBQyxDQUFBO1FBQzVFLE9BQU07SUFDVixDQUFDO0lBRUQsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUN0QyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSw0QkFBNEIsQ0FBQTtJQUVyRSxJQUFJLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxzQkFBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFlLENBQUE7UUFFdkQsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3hDLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQTtZQUMxRCxPQUFNO1FBQ1YsQ0FBQztRQUVELE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsR0FBRyxPQUFPLENBQUE7UUFFakQsZ0NBQWdDO1FBQ2hDLE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFBO1FBRWhFLE9BQU8sQ0FBQyxHQUFHLENBQUMsNkNBQTZDLGdCQUFnQixVQUFVLFdBQVcsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFBO1FBRTNHLElBQUksUUFBUSxHQUFhLFdBQVcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFBO1FBRXpELGdGQUFnRjtRQUNoRixJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDeEIsTUFBTSxFQUFFLElBQUksRUFBRSxjQUFjLEVBQUUsR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUM7Z0JBQy9DLE1BQU0sRUFBRSxVQUFVO2dCQUNsQixNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUM7Z0JBQ2QsT0FBTyxFQUFFO29CQUNMLEtBQUssRUFBRSxnQkFBZ0I7b0JBQ3ZCLFdBQVcsRUFBRSxLQUFLO2lCQUNyQjthQUNKLENBQUMsQ0FBQTtZQUNGLFFBQVEsR0FBRyxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFBO1lBQ3hDLE9BQU8sQ0FBQyxHQUFHLENBQUMsbURBQW1ELFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFBO1FBQ3pGLENBQUM7UUFFRCxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDeEIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQyxDQUFBO1lBQ2hFLE9BQU07UUFDVixDQUFDO1FBRUQsNERBQTREO1FBQzVELE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQ3ZDLE1BQU0sRUFBRSxPQUFPO1lBQ2YsTUFBTSxFQUFFO2dCQUNKLElBQUk7Z0JBQ0osWUFBWTtnQkFDWixPQUFPO2dCQUNQLGFBQWE7Z0JBQ2IsUUFBUTtnQkFDUixPQUFPO2dCQUNQLGVBQWU7Z0JBQ2YsWUFBWTtnQkFDWixTQUFTO2FBQ1o7WUFDRCxPQUFPLEVBQUU7Z0JBQ0wsV0FBVyxFQUFFLFFBQVE7YUFDeEI7WUFDRCxhQUFhO1lBQ2IsSUFBSSxFQUFFLENBQUMsYUFBYSxDQUFDO1NBQ3hCLENBQUMsQ0FBQTtRQUVGLHVDQUF1QztRQUN2QyxNQUFNLFdBQVcsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUMsQ0FBQTtRQUUvRCxPQUFPLENBQUMsR0FBRyxDQUFDLDhCQUE4QixXQUFXLENBQUMsTUFBTSxxQkFBcUIsQ0FBQyxDQUFBO1FBRWxGLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDO1lBQ2pCLE1BQU0sRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsRUFBRSxxQkFBcUI7WUFDdkQsS0FBSyxFQUFFLFdBQVcsQ0FBQyxNQUFNO1lBQ3pCLGdCQUFnQjtTQUNuQixDQUFDLENBQUE7SUFFTixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNiLE1BQU0sWUFBWSxHQUFHLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQTtRQUM3RSxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQTtJQUMzRixDQUFDO0FBQ0wsQ0FBQyJ9

package/.medusa/server/src/api/store/otp/request/route.js

@@ -0,0 +1,141 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const otp_service_1 = require("../../../../services/otp-service");
+const utils_1 = require("@medusajs/framework/utils");
+const template_1 = require("../../../../utils/template");
+const path_1 = __importDefault(require("path"));
+const otpService = new otp_service_1.OtpService();
+async function POST(req, res) {
+    const { email, phone } = req.body;
+    if (!email && !phone) {
+        res.status(400).json({ message: "Email or phone number is required" });
+        return;
+    }
+    const identifier = email || phone;
+    if (!identifier) {
+        res.status(400).json({ message: "Invalid identifier" });
+        return;
+    }
+    try {
+        // Resolve Query to check for registered customers
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        const { data: customers } = await query.graph({
+            entity: "customer",
+            fields: ["has_account"],
+            filters: { email: identifier, has_account: true }
+        });
+        if (customers.length > 0) {
+            res.status(403).json({
+                message: "This email is registered. Please log in to view orders.",
+                is_registered: true
+            });
+            return;
+        }
+        const otp = await otpService.generate(identifier);
+        // Generate content using template
+        const templatePath = path_1.default.join("src", "templates", "emails", "otp-verification-default.html");
+        const renderedTemplate = (0, template_1.loadAndRenderTemplate)(templatePath, {
+            otp,
+        });
+        const subject = `Your Verification Code: ${otp}`;
+        const expires_in = "15 minutes";
+        // Fallback or use rendered content
+        const htmlContent = renderedTemplate || `<div style="font-family:sans-serif;padding:20px;"><h2>Verification Code</h2><p>Your code is: <b style="font-size:24px;color:#2563eb;">${otp}</b></p><p>Expires in ${expires_in}.</p></div>`;
+        const textContent = `Your verification code is: ${otp}. It expires in ${expires_in}.`;
+        try {
+            // Resolve Notification Service
+            let notificationService = req.scope.resolve(utils_1.Modules.NOTIFICATION, { allowUnregistered: true });
+            if (!notificationService) {
+                try {
+                    notificationService = req.scope.resolve("notificationService");
+                }
+                catch (e) { }
+            }
+            if (!notificationService) {
+                console.error("[OTP Service] No notification service found");
+                res.status(200).json({ message: "OTP generated but notification service unavailable" });
+                return;
+            }
+            // Inspect provider if possible
+            try {
+                const provider = req.scope.resolve("notificationProvider_email", { allowUnregistered: true });
+                if (provider) {
+                    console.log(`[OTP Debug] Email provider detected: ${provider.constructor?.name}`);
+                }
+            }
+            catch (e) { }
+            // EXACT structure from send-order-email.ts
+            const payload = {
+                to: identifier,
+                channel: "email",
+                subject: subject,
+                html: htmlContent,
+                text: textContent,
+                body: htmlContent,
+                data: {
+                    subject: subject,
+                    html: htmlContent,
+                    text: textContent,
+                    otp,
+                    otp_code: otp,
+                },
+            };
+            console.log(`[!!! OTP VERSION 5 !!!] Sending to: ${identifier}. OTP: ${otp}`);
+            try {
+                if (typeof notificationService.createNotifications === "function") {
+                    console.log("[OTP Debug] Executing createNotifications");
+                    await notificationService.createNotifications([payload]);
+                }
+                else if (typeof notificationService.create === "function") {
+                    console.log("[OTP Debug] Executing create");
+                    await notificationService.create(payload);
+                }
+                else if (typeof notificationService.send === "function") {
+                    console.log("[OTP Debug] Executing send");
+                    await notificationService.send("otp-request", {
+                        to: identifier,
+                        data: payload.data
+                    });
+                }
+                // SMTP Fallback for debugging
+                if (process.env.OTP_DEBUG_SMTP === "true") {
+                    try {
+                        const nodemailer = require("nodemailer");
+                        const transporter = nodemailer.createTransport({
+                            host: process.env.SMTP_HOST,
+                            port: process.env.SMTP_PORT ? Number(process.env.SMTP_PORT) : undefined,
+                            secure: process.env.SMTP_SECURE === "true",
+                            auth: process.env.SMTP_AUTH_USER ? { user: process.env.SMTP_AUTH_USER, pass: process.env.SMTP_AUTH_PASS } : undefined,
+                        });
+                        await transporter.sendMail({
+                            from: process.env.SMTP_FROM || process.env.SMTP_AUTH_USER,
+                            to: identifier,
+                            subject: subject,
+                            html: htmlContent,
+                            text: textContent,
+                        });
+                        console.log("[OTP Debug] SMTP Direct sent");
+                    }
+                    catch (sErr) { }
+                }
+                console.log(`[!!! OTP VERSION 5 !!!] Completed for ${identifier}.`);
+            }
+            catch (sendError) {
+                console.error(`[OTP Service] Send failed: ${sendError}`);
+            }
+        }
+        catch (notifError) {
+            console.error(`[OTP Service] Notif error: ${notifError}`);
+        }
+        res.status(200).json({ message: "OTP sent successfully" });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(500).json({ message: "Failed to generate OTP", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL290cC9yZXF1ZXN0L3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBUUEsb0JBMklDO0FBbEpELGtFQUE2RDtBQUM3RCxxREFBOEU7QUFDOUUseURBQWtFO0FBQ2xFLGdEQUF1QjtBQUV2QixNQUFNLFVBQVUsR0FBRyxJQUFJLHdCQUFVLEVBQUUsQ0FBQTtBQUU1QixLQUFLLFVBQVUsSUFBSSxDQUN0QixHQUFrQixFQUNsQixHQUFtQjtJQUVuQixNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxHQUFHLEdBQUcsQ0FBQyxJQUEwQyxDQUFBO0lBRXZFLElBQUksQ0FBQyxLQUFLLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNuQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxtQ0FBbUMsRUFBRSxDQUFDLENBQUE7UUFDdEUsT0FBTTtJQUNWLENBQUM7SUFFRCxNQUFNLFVBQVUsR0FBRyxLQUFLLElBQUksS0FBSyxDQUFBO0lBQ2pDLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNkLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLG9CQUFvQixFQUFFLENBQUMsQ0FBQTtRQUN2RCxPQUFNO0lBQ1YsQ0FBQztJQUVELElBQUksQ0FBQztRQUNELGtEQUFrRDtRQUNsRCxNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxpQ0FBeUIsQ0FBQyxLQUFLLENBQUMsQ0FBQTtRQUNoRSxNQUFNLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQztZQUMxQyxNQUFNLEVBQUUsVUFBVTtZQUNsQixNQUFNLEVBQUUsQ0FBQyxhQUFhLENBQUM7WUFDdkIsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFO1NBQ3BELENBQUMsQ0FBQTtRQUVGLElBQUksU0FBUyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztnQkFDakIsT0FBTyxFQUFFLHlEQUF5RDtnQkFDbEUsYUFBYSxFQUFFLElBQUk7YUFDdEIsQ0FBQyxDQUFBO1lBQ0YsT0FBTTtRQUNWLENBQUM7UUFFRCxNQUFNLEdBQUcsR0FBRyxNQUFNLFVBQVUsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUE7UUFFakQsa0NBQWtDO1FBQ2xDLE1BQU0sWUFBWSxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFdBQVcsRUFBRSxRQUFRLEVBQUUsK0JBQStCLENBQUMsQ0FBQTtRQUM3RixNQUFNLGdCQUFnQixHQUFHLElBQUEsZ0NBQXFCLEVBQUMsWUFBWSxFQUFFO1lBQ3pELEdBQUc7U0FDTixDQUFDLENBQUE7UUFFRixNQUFNLE9BQU8sR0FBRywyQkFBMkIsR0FBRyxFQUFFLENBQUE7UUFDaEQsTUFBTSxVQUFVLEdBQUcsWUFBWSxDQUFBO1FBRS9CLG1DQUFtQztRQUNuQyxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsSUFBSSx5SUFBeUksR0FBRyx5QkFBeUIsVUFBVSxhQUFhLENBQUE7UUFDcE8sTUFBTSxXQUFXLEdBQUcsOEJBQThCLEdBQUcsbUJBQW1CLFVBQVUsR0FBRyxDQUFBO1FBRXJGLElBQUksQ0FBQztZQUNELCtCQUErQjtZQUMvQixJQUFJLG1CQUFtQixHQUFRLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGVBQU8sQ0FBQyxZQUFZLEVBQUUsRUFBRSxpQkFBaUIsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFBO1lBQ25HLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO2dCQUN2QixJQUFJLENBQUM7b0JBQ0QsbUJBQW1CLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMscUJBQXFCLENBQUMsQ0FBQTtnQkFDbEUsQ0FBQztnQkFBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUNuQixDQUFDO1lBRUQsSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUM7Z0JBQ3ZCLE9BQU8sQ0FBQyxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQTtnQkFDNUQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsb0RBQW9ELEVBQUUsQ0FBQyxDQUFBO2dCQUN2RixPQUFNO1lBQ1YsQ0FBQztZQUVELCtCQUErQjtZQUMvQixJQUFJLENBQUM7Z0JBQ0QsTUFBTSxRQUFRLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsNEJBQTRCLEVBQUUsRUFBRSxpQkFBaUIsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFBO2dCQUM3RixJQUFJLFFBQVEsRUFBRSxDQUFDO29CQUNYLE9BQU8sQ0FBQyxHQUFHLENBQUMsd0NBQXdDLFFBQVEsQ0FBQyxXQUFXLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQTtnQkFDckYsQ0FBQztZQUNMLENBQUM7WUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUVmLDJDQUEyQztZQUMzQyxNQUFNLE9BQU8sR0FBUTtnQkFDakIsRUFBRSxFQUFFLFVBQVU7Z0JBQ2QsT0FBTyxFQUFFLE9BQU87Z0JBQ2hCLE9BQU8sRUFBRSxPQUFPO2dCQUNoQixJQUFJLEVBQUUsV0FBVztnQkFDakIsSUFBSSxFQUFFLFdBQVc7Z0JBQ2pCLElBQUksRUFBRSxXQUFXO2dCQUNqQixJQUFJLEVBQUU7b0JBQ0YsT0FBTyxFQUFFLE9BQU87b0JBQ2hCLElBQUksRUFBRSxXQUFXO29CQUNqQixJQUFJLEVBQUUsV0FBVztvQkFDakIsR0FBRztvQkFDSCxRQUFRLEVBQUUsR0FBRztpQkFDaEI7YUFDSixDQUFBO1lBRUQsT0FBTyxDQUFDLEdBQUcsQ0FBQyx1Q0FBdUMsVUFBVSxVQUFVLEdBQUcsRUFBRSxDQUFDLENBQUE7WUFFN0UsSUFBSSxDQUFDO2dCQUNELElBQUksT0FBTyxtQkFBbUIsQ0FBQyxtQkFBbUIsS0FBSyxVQUFVLEVBQUUsQ0FBQztvQkFDaEUsT0FBTyxDQUFDLEdBQUcsQ0FBQywyQ0FBMkMsQ0FBQyxDQUFBO29CQUN4RCxNQUFNLG1CQUFtQixDQUFDLG1CQUFtQixDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQTtnQkFDNUQsQ0FBQztxQkFBTSxJQUFJLE9BQU8sbUJBQW1CLENBQUMsTUFBTSxLQUFLLFVBQVUsRUFBRSxDQUFDO29CQUMxRCxPQUFPLENBQUMsR0FBRyxDQUFDLDhCQUE4QixDQUFDLENBQUE7b0JBQzNDLE1BQU0sbUJBQW1CLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFBO2dCQUM3QyxDQUFDO3FCQUFNLElBQUksT0FBTyxtQkFBbUIsQ0FBQyxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7b0JBQ3hELE9BQU8sQ0FBQyxHQUFHLENBQUMsNEJBQTRCLENBQUMsQ0FBQTtvQkFDekMsTUFBTSxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFO3dCQUMxQyxFQUFFLEVBQUUsVUFBVTt3QkFDZCxJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUk7cUJBQ3JCLENBQUMsQ0FBQTtnQkFDTixDQUFDO2dCQUVELDhCQUE4QjtnQkFDOUIsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsS0FBSyxNQUFNLEVBQUUsQ0FBQztvQkFDeEMsSUFBSSxDQUFDO3dCQUNELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQTt3QkFDeEMsTUFBTSxXQUFXLEdBQUcsVUFBVSxDQUFDLGVBQWUsQ0FBQzs0QkFDM0MsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsU0FBUzs0QkFDM0IsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUzs0QkFDdkUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsV0FBVyxLQUFLLE1BQU07NEJBQzFDLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxFQUFFLENBQUMsQ0FBQyxDQUFDLFNBQVM7eUJBQ3hILENBQUMsQ0FBQTt3QkFDRixNQUFNLFdBQVcsQ0FBQyxRQUFRLENBQUM7NEJBQ3ZCLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFNBQVMsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWM7NEJBQ3pELEVBQUUsRUFBRSxVQUFVOzRCQUNkLE9BQU8sRUFBRSxPQUFPOzRCQUNoQixJQUFJLEVBQUUsV0FBVzs0QkFDakIsSUFBSSxFQUFFLFdBQVc7eUJBQ3BCLENBQUMsQ0FBQTt3QkFDRixPQUFPLENBQUMsR0FBRyxDQUFDLDhCQUE4QixDQUFDLENBQUE7b0JBQy9DLENBQUM7b0JBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7Z0JBQ3RCLENBQUM7Z0JBQ0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyx5Q0FBeUMsVUFBVSxHQUFHLENBQUMsQ0FBQTtZQUN2RSxDQUFDO1lBQUMsT0FBTyxTQUFTLEVBQUUsQ0FBQztnQkFDakIsT0FBTyxDQUFDLEtBQUssQ0FBQyw4QkFBOEIsU0FBUyxFQUFFLENBQUMsQ0FBQTtZQUM1RCxDQUFDO1FBQ0wsQ0FBQztRQUFDLE9BQU8sVUFBVSxFQUFFLENBQUM7WUFDbEIsT0FBTyxDQUFDLEtBQUssQ0FBQyw4QkFBOEIsVUFBVSxFQUFFLENBQUMsQ0FBQTtRQUM3RCxDQUFDO1FBRUQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsQ0FBQyxDQUFBO0lBQzlELENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2IsTUFBTSxZQUFZLEdBQUcsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsZUFBZSxDQUFBO1FBQzdFLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHdCQUF3QixFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFBO0lBQ3BGLENBQUM7QUFDTCxDQUFDIn0=

package/.medusa/server/src/api/store/otp/verify/route.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const utils_1 = require("@medusajs/framework/utils");
+const otp_service_1 = require("../../../../services/otp-service");
+const otpService = new otp_service_1.OtpService();
+async function POST(req, res) {
+    const { email, phone, otp } = req.body;
+    if ((!email && !phone) || !otp) {
+        res.status(400).json({ message: "Email/Phone and OTP are required" });
+        return;
+    }
+    const identifier = email || phone;
+    if (!identifier) {
+        res.status(400).json({ message: "Invalid identifier" });
+        return;
+    }
+    try {
+        const isValid = await otpService.verify(identifier, otp);
+        if (!isValid) {
+            res.status(401).json({ message: "Invalid or expired OTP" });
+            return;
+        }
+        // Fetch the guest customer ID to include in the token
+        const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        const { data: customers } = await query.graph({
+            entity: "customer",
+            fields: ["id"],
+            filters: {
+                email: identifier,
+                has_account: false
+            }
+        });
+        const customerId = customers.length > 0 ? customers[0].id : undefined;
+        const token = otpService.generateToken(identifier, customerId);
+        res.status(200).json({
+            message: "OTP verified successfully",
+            token,
+            customer_id: customerId
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        res.status(500).json({ message: "Failed to verify OTP", error: errorMessage });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL290cC92ZXJpZnkvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFNQSxvQkFpREM7QUF0REQscURBQXFFO0FBQ3JFLGtFQUE2RDtBQUU3RCxNQUFNLFVBQVUsR0FBRyxJQUFJLHdCQUFVLEVBQUUsQ0FBQTtBQUU1QixLQUFLLFVBQVUsSUFBSSxDQUN0QixHQUFrQixFQUNsQixHQUFtQjtJQUVuQixNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsR0FBRyxHQUFHLENBQUMsSUFBdUQsQ0FBQTtJQUV6RixJQUFJLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQzdCLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLGtDQUFrQyxFQUFFLENBQUMsQ0FBQTtRQUNyRSxPQUFNO0lBQ1YsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLEtBQUssSUFBSSxLQUFLLENBQUE7SUFFakMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2QsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsQ0FBQyxDQUFBO1FBQ3ZELE9BQU07SUFDVixDQUFDO0lBRUQsSUFBSSxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsTUFBTSxVQUFVLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsQ0FBQTtRQUV4RCxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDWCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSx3QkFBd0IsRUFBRSxDQUFDLENBQUE7WUFDM0QsT0FBTTtRQUNWLENBQUM7UUFFRCxzREFBc0Q7UUFDdEQsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsS0FBSyxDQUFDLENBQUE7UUFDaEUsTUFBTSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUM7WUFDMUMsTUFBTSxFQUFFLFVBQVU7WUFDbEIsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUFDO1lBQ2QsT0FBTyxFQUFFO2dCQUNMLEtBQUssRUFBRSxVQUFVO2dCQUNqQixXQUFXLEVBQUUsS0FBSzthQUNyQjtTQUNKLENBQUMsQ0FBQTtRQUVGLE1BQU0sVUFBVSxHQUFHLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUE7UUFDckUsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLGFBQWEsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUE7UUFFOUQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7WUFDakIsT0FBTyxFQUFFLDJCQUEyQjtZQUNwQyxLQUFLO1lBQ0wsV0FBVyxFQUFFLFVBQVU7U0FDMUIsQ0FBQyxDQUFBO0lBQ04sQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDYixNQUFNLFlBQVksR0FBRyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUE7UUFDN0UsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUE7SUFDbEYsQ0FBQztBQUNMLENBQUMifQ==

package/.medusa/server/src/services/otp-service.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtpService = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+// In-memory store for OTPs. 
+// NOTE: In a real production environment with multiple server instances, 
+// this should be replaced with Redis or a database table.
+const otpStore = new Map();
+class OtpService {
+    /**
+     * Generates a 6-digit OTP for the given identifier (email/phone).
+     * Stores it with a 15-minute expiration.
+     */
+    async generate(identifier) {
+        const otp = Math.floor(100000 + Math.random() * 900000).toString();
+        otpStore.set(identifier, {
+            otp,
+            expiresAt: Date.now() + 15 * 60 * 1000, // 15 minutes
+        });
+        return otp;
+    }
+    /**
+     * Verifies the OTP for the given identifier.
+     * key feature: Deletes the OTP upon successful verification to prevent replay.
+     */
+    async verify(identifier, code) {
+        const data = otpStore.get(identifier);
+        if (!data) {
+            return false;
+        }
+        if (Date.now() > data.expiresAt) {
+            otpStore.delete(identifier);
+            return false;
+        }
+        if (data.otp !== code) {
+            return false;
+        }
+        // OTP is valid, consume it
+        otpStore.delete(identifier);
+        return true;
+    }
+    /**
+     * Generates a JWT token scoped for guest access.
+     */
+    generateToken(identifier, customerId) {
+        // In production, use a secure secret from environment variables
+        const secret = process.env.JWT_SECRET || "medusa-secret-guest-access";
+        return jsonwebtoken_1.default.sign({
+            guest_identifier: identifier,
+            customer_id: customerId,
+            scope: "guest_orders"
+        }, secret, { expiresIn: "1h" });
+    }
+}
+exports.OtpService = OtpService;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3RwLXNlcnZpY2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvc2VydmljZXMvb3RwLXNlcnZpY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQUEsZ0VBQThCO0FBRTlCLDZCQUE2QjtBQUM3QiwwRUFBMEU7QUFDMUUsMERBQTBEO0FBQzFELE1BQU0sUUFBUSxHQUFHLElBQUksR0FBRyxFQUE4QyxDQUFBO0FBRXRFLE1BQWEsVUFBVTtJQUNuQjs7O09BR0c7SUFDSCxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQWtCO1FBQzdCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLEVBQUUsR0FBRyxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQTtRQUVsRSxRQUFRLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRTtZQUNyQixHQUFHO1lBQ0gsU0FBUyxFQUFFLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksRUFBRSxhQUFhO1NBQ3hELENBQUMsQ0FBQTtRQUVGLE9BQU8sR0FBRyxDQUFBO0lBQ2QsQ0FBQztJQUVEOzs7T0FHRztJQUNILEtBQUssQ0FBQyxNQUFNLENBQUMsVUFBa0IsRUFBRSxJQUFZO1FBQ3pDLE1BQU0sSUFBSSxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUE7UUFFckMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ1IsT0FBTyxLQUFLLENBQUE7UUFDaEIsQ0FBQztRQUVELElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUM5QixRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFBO1lBQzNCLE9BQU8sS0FBSyxDQUFBO1FBQ2hCLENBQUM7UUFFRCxJQUFJLElBQUksQ0FBQyxHQUFHLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDcEIsT0FBTyxLQUFLLENBQUE7UUFDaEIsQ0FBQztRQUVELDJCQUEyQjtRQUMzQixRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFBO1FBQzNCLE9BQU8sSUFBSSxDQUFBO0lBQ2YsQ0FBQztJQUVEOztPQUVHO0lBQ0gsYUFBYSxDQUFDLFVBQWtCLEVBQUUsVUFBbUI7UUFDakQsZ0VBQWdFO1FBQ2hFLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxJQUFJLDRCQUE0QixDQUFBO1FBRXJFLE9BQU8sc0JBQUcsQ0FBQyxJQUFJLENBQ1g7WUFDSSxnQkFBZ0IsRUFBRSxVQUFVO1lBQzVCLFdBQVcsRUFBRSxVQUFVO1lBQ3ZCLEtBQUssRUFBRSxjQUFjO1NBQ3hCLEVBQ0QsTUFBTSxFQUNOLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUN0QixDQUFBO0lBQ0wsQ0FBQztDQUNKO0FBMURELGdDQTBEQyJ9

package/.medusa/server/src/subscribers/send-order-email.js

@@ -22,7 +22,10 @@ function prepareEmailPayload(to, subject, htmlContent) {
         html: htmlContent,
         text: textContent,
         body: htmlContent, // Some providers expect 'body' field
-        template: htmlContent, // Some providers expect 'template' field
+        // NOTE: We intentionally do NOT set `template` to raw HTML here. Some
+        // notification providers interpret `template` as a template identifier and
+        // may switch to template-based sending which can ignore or strip content.
+        // Omit `template` when sending raw HTML content.
         data: {
             subject,
             html: htmlContent,
@@ -106,6 +109,16 @@ async function sendOrderEmailHandler({ event: { data }, container, }) {
             : typeof totalValue === "string"
                 ? totalValue
                 : "N/A";
+        // Check if the email belongs to a registered customer
+        const query = container.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+        const { data: customers } = await query.graph({
+            entity: "customer",
+            fields: ["has_account"],
+            filters: { email: email, has_account: true }
+        });
+        const isRegistered = customers.length > 0;
+        const storefrontUrl = process.env.STOREFRONT_URL || "http://localhost:8000";
+        const claimLink = `${storefrontUrl}/account/orders/claim?order_id=${orderData.id}`;
         const templateData = {
             order_id: orderData.id || "N/A",
             order_status: orderData.status || "N/A",
@@ -115,6 +128,9 @@ async function sendOrderEmailHandler({ event: { data }, container, }) {
             order_items: orderData.items || [],
             shipping_address: orderData.shipping_address || {},
             billing_address: orderData.billing_address || {},
+            // Security/User Context
+            is_registered: isRegistered,
+            claim_link: isRegistered ? claimLink : undefined,
         };
         // Load and render template
         const renderedTemplate = (0, template_1.loadAndRenderTemplate)(templatePath, templateData);
@@ -131,15 +147,99 @@ async function sendOrderEmailHandler({ event: { data }, container, }) {
         // Prepare email payload
         const subject = "Order Confirmation";
         const payload = prepareEmailPayload(email, subject, renderedTemplate);
-        // Send email
+        // Diagnostic summary & send email
+        console.log(`[Order Email Subscriber] Payload keys: ${Object.keys(payload).join(", ")} ; templatePresent=${payload.template ? 'yes' : 'no'}`);
         try {
             if (typeof notificationService.createNotifications === "function") {
-                await notificationService.createNotifications([payload]);
+                console.log(`[Order Email Subscriber] Using createNotifications to send email`);
+                const res = await notificationService.createNotifications([payload]);
+                try {
+                    console.log(`[Order Email Subscriber] createNotifications response: ${JSON.stringify(res)}`);
+                }
+                catch (e) {
+                    console.log(`[Order Email Subscriber] createNotifications response: <non-serializable>`);
+                }
                 console.log(`[Order Email Subscriber] Email sent successfully for order ${orderId}`);
+                // Optional SMTP fallback for debugging/delivery verification. Enable by
+                // setting FORCE_SMTP_REDELIVER=true. This attempts a direct Nodemailer
+                // send using SMTP env vars and logs the SMTP response (messageId, accepted, etc.).
+                if (process.env.FORCE_SMTP_REDELIVER === "true") {
+                    try {
+                        console.log("[Order Email Subscriber] SMTP fallback enabled - attempting direct send via Nodemailer");
+                        // @ts-ignore - optional dependency
+                        const nodemailer = require("nodemailer");
+                        const transportOpts = {
+                            host: process.env.SMTP_HOST,
+                            port: process.env.SMTP_PORT ? Number(process.env.SMTP_PORT) : undefined,
+                            secure: process.env.SMTP_SECURE === "true",
+                            auth: process.env.SMTP_AUTH_USER ? { user: process.env.SMTP_AUTH_USER, pass: process.env.SMTP_AUTH_PASS } : undefined,
+                            logger: true,
+                            debug: true,
+                        };
+                        const transporter = nodemailer.createTransport(transportOpts);
+                        const mailOptions = {
+                            from: process.env.SMTP_FROM || process.env.SMTP_AUTH_USER,
+                            to: payload.to,
+                            subject: payload.subject,
+                            html: payload.html,
+                            text: payload.text,
+                        };
+                        const sendRes = await transporter.sendMail(mailOptions);
+                        try {
+                            console.log(`[Order Email Subscriber] SMTP fallback sendMail response: ${JSON.stringify(sendRes)}`);
+                        }
+                        catch (e) {
+                            console.log(`[Order Email Subscriber] SMTP fallback sendMail response: <non-serializable>`);
+                        }
+                    }
+                    catch (err) {
+                        console.error("[Order Email Subscriber] SMTP fallback failed:", err instanceof Error ? err.message : String(err));
+                    }
+                }
             }
             else if (typeof notificationService.create === "function") {
-                await notificationService.create(payload);
+                console.log(`[Order Email Subscriber] Using create to send email`);
+                const res = await notificationService.create(payload);
+                try {
+                    console.log(`[Order Email Subscriber] create response: ${JSON.stringify(res)}`);
+                }
+                catch (e) {
+                    console.log(`[Order Email Subscriber] create response: <non-serializable>`);
+                }
                 console.log(`[Order Email Subscriber] Email sent successfully for order ${orderId}`);
+                if (process.env.FORCE_SMTP_REDELIVER === "true") {
+                    try {
+                        console.log("[Order Email Subscriber] SMTP fallback enabled - attempting direct send via Nodemailer");
+                        // @ts-ignore - optional dependency
+                        const nodemailer = require("nodemailer");
+                        const transportOpts = {
+                            host: process.env.SMTP_HOST,
+                            port: process.env.SMTP_PORT ? Number(process.env.SMTP_PORT) : undefined,
+                            secure: process.env.SMTP_SECURE === "true",
+                            auth: process.env.SMTP_AUTH_USER ? { user: process.env.SMTP_AUTH_USER, pass: process.env.SMTP_AUTH_PASS } : undefined,
+                            logger: true,
+                            debug: true,
+                        };
+                        const transporter = nodemailer.createTransport(transportOpts);
+                        const mailOptions = {
+                            from: process.env.SMTP_FROM || process.env.SMTP_AUTH_USER,
+                            to: payload.to,
+                            subject: payload.subject,
+                            html: payload.html,
+                            text: payload.text,
+                        };
+                        const sendRes = await transporter.sendMail(mailOptions);
+                        try {
+                            console.log(`[Order Email Subscriber] SMTP fallback sendMail response: ${JSON.stringify(sendRes)}`);
+                        }
+                        catch (e) {
+                            console.log(`[Order Email Subscriber] SMTP fallback sendMail response: <non-serializable>`);
+                        }
+                    }
+                    catch (err) {
+                        console.error("[Order Email Subscriber] SMTP fallback failed:", err instanceof Error ? err.message : String(err));
+                    }
+                }
             }
             else {
                 console.error("[Order Email Subscriber] Notification service does not support sending notifications");
@@ -163,4 +263,4 @@ async function sendOrderEmailHandler({ event: { data }, container, }) {
 exports.config = {
     event: "order.placed",
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VuZC1vcmRlci1lbWFpbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9zdWJzY3JpYmVycy9zZW5kLW9yZGVyLWVtYWlsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQWdFQSx3Q0FnSkM7QUEvTUQscURBQThFO0FBRTlFLDhEQUdpQztBQUNqQyxnREFBaUY7QUFPakY7O0dBRUc7QUFDSCxTQUFTLG1CQUFtQixDQUMxQixFQUFVLEVBQ1YsT0FBZSxFQUNmLFdBQW1CO0lBRW5CLHNDQUFzQztJQUN0QyxNQUFNLFdBQVcsR0FBRyxXQUFXO1NBQzVCLE9BQU8sQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsbUJBQW1CO1NBQzNDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLENBQUMsc0JBQXNCO1NBQzNDLElBQUksRUFBRSxDQUFBO0lBRVQsTUFBTSxPQUFPLEdBYVQ7UUFDRixFQUFFO1FBQ0YsT0FBTyxFQUFFLE9BQU87UUFDaEIsT0FBTztRQUNQLHVDQUF1QztRQUN2QyxJQUFJLEVBQUUsV0FBVztRQUNqQixJQUFJLEVBQUUsV0FBVztRQUNqQixJQUFJLEVBQUUsV0FBVyxFQUFFLHFDQUFxQztRQUN4RCxRQUFRLEVBQUUsV0FBVyxFQUFFLHlDQUF5QztRQUNoRSxJQUFJLEVBQUU7WUFDSixPQUFPO1lBQ1AsSUFBSSxFQUFFLFdBQVc7WUFDakIsSUFBSSxFQUFFLFdBQVc7U0FDbEI7S0FDRixDQUFBO0lBRUQsT0FBTyxPQUFPLENBQUE7QUFDaEIsQ0FBQztBQUVEOzs7R0FHRztBQUNZLEtBQUssVUFBVSxxQkFBcUIsQ0FBQyxFQUNsRCxLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsRUFDZixTQUFTLEdBQzRCO0lBQ3JDLElBQUksQ0FBQztRQUNILHdDQUF3QztRQUN4QyxJQUFJLFlBQVksR0FBa0IsSUFBSSxDQUFBO1FBQ3RDLElBQUksQ0FBQztZQUNILE1BQU0sWUFBWSxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsYUFBYSxDQUFDLENBQUE7WUFDL0UsTUFBTSxhQUFhLEdBQUcsSUFBQSwrQ0FBNkIsRUFBQyxZQUFZLENBQUMsQ0FBQTtZQUNqRSxNQUFNLE9BQU8sR0FBRyxJQUFBLCtDQUE2QixFQUFDLGFBQWEsQ0FBQyxDQUFBO1lBRTVELFlBQVksR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQTtZQUVyQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7Z0JBQ2xCLE9BQU8sQ0FBQyxHQUFHLENBQUMsNkVBQTZFLENBQUMsQ0FBQTtnQkFDMUYsT0FBTTtZQUNSLENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLGlEQUFpRDtZQUNqRCxPQUFPLENBQUMsS0FBSyxDQUFDLG1FQUFtRSxDQUFDLENBQUE7WUFDbEYsT0FBTTtRQUNSLENBQUM7UUFFRCxtQ0FBbUM7UUFDbkMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLEVBQUUsQ0FBQTtRQUV2QixJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixPQUFPLENBQUMsS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUE7WUFDekUsT0FBTTtRQUNSLENBQUM7UUFFRCxnREFBZ0Q7UUFDaEQsOENBQThDO1FBQzlDLElBQUksU0FBa0MsQ0FBQTtRQUV0QyxJQUFJLElBQUksQ0FBQyxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQzdCLHlDQUF5QztZQUN6QyxTQUFTLEdBQUcsSUFBK0IsQ0FBQTtRQUM3QyxDQUFDO2FBQU0sQ0FBQztZQUNOLDBDQUEwQztZQUMxQyxNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFRLGlDQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFBO1lBRXZFLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxHQUFHLEVBQUUsRUFBRSxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQztnQkFDOUMsTUFBTSxFQUFFLE9BQU87Z0JBQ2YsTUFBTSxFQUFFO29CQUNOLElBQUk7b0JBQ0osUUFBUTtvQkFDUixPQUFPO29CQUNQLGFBQWE7b0JBQ2IsT0FBTztvQkFDUCxZQUFZO29CQUNaLFlBQVk7b0JBQ1osU0FBUztvQkFDVCxvQkFBb0I7b0JBQ3BCLG1CQUFtQjtpQkFDcEI7Z0JBQ0QsT0FBTyxFQUFFLEVBQUUsRUFBRSxFQUFFLE9BQU8sRUFBRTthQUN6QixDQUFDLENBQUE7WUFFRixNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQTtZQUV4RCxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7Z0JBQ1gsT0FBTyxDQUFDLEtBQUssQ0FBQywwQ0FBMEMsT0FBTyxZQUFZLENBQUMsQ0FBQTtnQkFDNUUsT0FBTTtZQUNSLENBQUM7WUFFRCxTQUFTLEdBQUcsS0FBZ0MsQ0FBQTtRQUM5QyxDQUFDO1FBRUQsZ0NBQWdDO1FBQ2hDLE1BQU0sS0FBSyxHQUFHLFNBQVMsQ0FBQyxLQUEyQixDQUFBO1FBRW5ELElBQUksQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ2hFLE9BQU8sQ0FBQyxLQUFLLENBQUMsMkRBQTJELE9BQU8sRUFBRSxDQUFDLENBQUE7WUFDbkYsT0FBTTtRQUNSLENBQUM7UUFFRCx3QkFBd0I7UUFDeEIsTUFBTSxVQUFVLEdBQUcsU0FBUyxDQUFDLEtBQUssSUFBSSxTQUFTLENBQUMsV0FBVyxDQUFBO1FBQzNELE1BQU0sVUFBVSxHQUNkLE9BQU8sVUFBVSxLQUFLLFFBQVE7WUFDNUIsQ0FBQyxDQUFDLFVBQVU7WUFDWixDQUFDLENBQUMsT0FBTyxVQUFVLEtBQUssUUFBUTtnQkFDaEMsQ0FBQyxDQUFDLFVBQVU7Z0JBQ1osQ0FBQyxDQUFDLEtBQUssQ0FBQTtRQUVYLE1BQU0sWUFBWSxHQUFzQjtZQUN0QyxRQUFRLEVBQUcsU0FBUyxDQUFDLEVBQWEsSUFBSSxLQUFLO1lBQzNDLFlBQVksRUFBRyxTQUFTLENBQUMsTUFBaUIsSUFBSSxLQUFLO1lBQ25ELFdBQVcsRUFBRSxVQUFVO1lBQ3ZCLFdBQVcsRUFBRyxTQUFTLENBQUMsS0FBZ0IsSUFBSSxLQUFLO1lBQ2pELFVBQVUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxVQUFVLElBQUksU0FBUyxDQUFDLFVBQVUsSUFBSSxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFXO1lBQ2hHLFdBQVcsRUFBRyxTQUFTLENBQUMsS0FBbUIsSUFBSSxFQUFFO1lBQ2pELGdCQUFnQixFQUFHLFNBQVMsQ0FBQyxnQkFBNEMsSUFBSSxFQUFFO1lBQy9FLGVBQWUsRUFBRyxTQUFTLENBQUMsZUFBMkMsSUFBSSxFQUFFO1NBQzlFLENBQUE7UUFFRCwyQkFBMkI7UUFDM0IsTUFBTSxnQkFBZ0IsR0FBRyxJQUFBLGdDQUFxQixFQUFDLFlBQVksRUFBRSxZQUFZLENBQUMsQ0FBQTtRQUUxRSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUN0QixPQUFPLENBQUMsS0FBSyxDQUFDLG1FQUFtRSxZQUFZLEVBQUUsQ0FBQyxDQUFBO1lBQ2hHLE9BQU07UUFDUixDQUFDO1FBRUQsK0JBQStCO1FBQy9CLE1BQU0sbUJBQW1CLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBQyxlQUFPLENBQUMsWUFBWSxDQUdqRSxDQUFBO1FBRUQsSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUM7WUFDekIsT0FBTyxDQUFDLEtBQUssQ0FBQyxpRUFBaUUsQ0FBQyxDQUFBO1lBQ2hGLE9BQU07UUFDUixDQUFDO1FBRUQsd0JBQXdCO1FBQ3hCLE1BQU0sT0FBTyxHQUFHLG9CQUFvQixDQUFBO1FBQ3BDLE1BQU0sT0FBTyxHQUFHLG1CQUFtQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQTtRQUVyRSxhQUFhO1FBQ2IsSUFBSSxDQUFDO1lBQ0gsSUFBSSxPQUFPLG1CQUFtQixDQUFDLG1CQUFtQixLQUFLLFVBQVUsRUFBRSxDQUFDO2dCQUNsRSxNQUFNLG1CQUFtQixDQUFDLG1CQUFtQixDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQTtnQkFDeEQsT0FBTyxDQUFDLEdBQUcsQ0FBQyw4REFBOEQsT0FBTyxFQUFFLENBQUMsQ0FBQTtZQUN0RixDQUFDO2lCQUFNLElBQUksT0FBTyxtQkFBbUIsQ0FBQyxNQUFNLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQzVELE1BQU0sbUJBQW1CLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFBO2dCQUN6QyxPQUFPLENBQUMsR0FBRyxDQUFDLDhEQUE4RCxPQUFPLEVBQUUsQ0FBQyxDQUFBO1lBQ3RGLENBQUM7aUJBQU0sQ0FBQztnQkFDTixPQUFPLENBQUMsS0FBSyxDQUFDLHNGQUFzRixDQUFDLENBQUE7WUFDdkcsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxZQUFZLEdBQ2hCLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQTtZQUN4RCxPQUFPLENBQUMsS0FBSyxDQUFDLDJEQUEyRCxPQUFPLEdBQUcsRUFBRSxZQUFZLENBQUMsQ0FBQTtZQUNsRyxpRUFBaUU7UUFDbkUsQ0FBQztJQUNILENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxZQUFZLEdBQ2hCLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQTtRQUN4RCxPQUFPLENBQUMsS0FBSyxDQUFDLHdEQUF3RCxFQUFFLFlBQVksQ0FBQyxDQUFBO1FBQ3JGLGlFQUFpRTtJQUNuRSxDQUFDO0FBQ0gsQ0FBQztBQUVEOztHQUVHO0FBQ1UsUUFBQSxNQUFNLEdBQXFCO0lBQ3RDLEtBQUssRUFBRSxjQUFjO0NBQ3RCLENBQUEifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VuZC1vcmRlci1lbWFpbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9zdWJzY3JpYmVycy9zZW5kLW9yZGVyLWVtYWlsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQW1FQSx3Q0E4TkM7QUFoU0QscURBQThFO0FBRTlFLDhEQUdpQztBQUNqQyxnREFBaUY7QUFPakY7O0dBRUc7QUFDSCxTQUFTLG1CQUFtQixDQUMxQixFQUFVLEVBQ1YsT0FBZSxFQUNmLFdBQW1CO0lBRW5CLHNDQUFzQztJQUN0QyxNQUFNLFdBQVcsR0FBRyxXQUFXO1NBQzVCLE9BQU8sQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsbUJBQW1CO1NBQzNDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLENBQUMsc0JBQXNCO1NBQzNDLElBQUksRUFBRSxDQUFBO0lBRVQsTUFBTSxPQUFPLEdBYVQ7UUFDRixFQUFFO1FBQ0YsT0FBTyxFQUFFLE9BQU87UUFDaEIsT0FBTztRQUNQLHVDQUF1QztRQUN2QyxJQUFJLEVBQUUsV0FBVztRQUNqQixJQUFJLEVBQUUsV0FBVztRQUNqQixJQUFJLEVBQUUsV0FBVyxFQUFFLHFDQUFxQztRQUN4RCxzRUFBc0U7UUFDdEUsMkVBQTJFO1FBQzNFLDBFQUEwRTtRQUMxRSxpREFBaUQ7UUFDakQsSUFBSSxFQUFFO1lBQ0osT0FBTztZQUNQLElBQUksRUFBRSxXQUFXO1lBQ2pCLElBQUksRUFBRSxXQUFXO1NBQ2xCO0tBQ0YsQ0FBQTtJQUVELE9BQU8sT0FBTyxDQUFBO0FBQ2hCLENBQUM7QUFFRDs7O0dBR0c7QUFDWSxLQUFLLFVBQVUscUJBQXFCLENBQUMsRUFDbEQsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLEVBQ2YsU0FBUyxHQUM0QjtJQUNyQyxJQUFJLENBQUM7UUFDSCx3Q0FBd0M7UUFDeEMsSUFBSSxZQUFZLEdBQWtCLElBQUksQ0FBQTtRQUN0QyxJQUFJLENBQUM7WUFDSCxNQUFNLFlBQVksR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLGFBQWEsQ0FBQyxDQUFBO1lBQy9FLE1BQU0sYUFBYSxHQUFHLElBQUEsK0NBQTZCLEVBQUMsWUFBWSxDQUFDLENBQUE7WUFDakUsTUFBTSxPQUFPLEdBQUcsSUFBQSwrQ0FBNkIsRUFBQyxhQUFhLENBQUMsQ0FBQTtZQUU1RCxZQUFZLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUE7WUFFckMsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO2dCQUNsQixPQUFPLENBQUMsR0FBRyxDQUFDLDZFQUE2RSxDQUFDLENBQUE7Z0JBQzFGLE9BQU07WUFDUixDQUFDO1FBQ0gsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixpREFBaUQ7WUFDakQsT0FBTyxDQUFDLEtBQUssQ0FBQyxtRUFBbUUsQ0FBQyxDQUFBO1lBQ2xGLE9BQU07UUFDUixDQUFDO1FBRUQsbUNBQW1DO1FBQ25DLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxFQUFFLENBQUE7UUFFdkIsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2IsT0FBTyxDQUFDLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFBO1lBQ3pFLE9BQU07UUFDUixDQUFDO1FBRUQsZ0RBQWdEO1FBQ2hELDhDQUE4QztRQUM5QyxJQUFJLFNBQWtDLENBQUE7UUFFdEMsSUFBSSxJQUFJLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUM3Qix5Q0FBeUM7WUFDekMsU0FBUyxHQUFHLElBQStCLENBQUE7UUFDN0MsQ0FBQzthQUFNLENBQUM7WUFDTiwwQ0FBMEM7WUFDMUMsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBUSxpQ0FBeUIsQ0FBQyxLQUFLLENBQUMsQ0FBQTtZQUV2RSxNQUFNLEVBQUUsSUFBSSxFQUFFLE1BQU0sR0FBRyxFQUFFLEVBQUUsR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUM7Z0JBQzlDLE1BQU0sRUFBRSxPQUFPO2dCQUNmLE1BQU0sRUFBRTtvQkFDTixJQUFJO29CQUNKLFFBQVE7b0JBQ1IsT0FBTztvQkFDUCxhQUFhO29CQUNiLE9BQU87b0JBQ1AsWUFBWTtvQkFDWixZQUFZO29CQUNaLFNBQVM7b0JBQ1Qsb0JBQW9CO29CQUNwQixtQkFBbUI7aUJBQ3BCO2dCQUNELE9BQU8sRUFBRSxFQUFFLEVBQUUsRUFBRSxPQUFPLEVBQUU7YUFDekIsQ0FBQyxDQUFBO1lBRUYsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUE7WUFFeEQsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUNYLE9BQU8sQ0FBQyxLQUFLLENBQUMsMENBQTBDLE9BQU8sWUFBWSxDQUFDLENBQUE7Z0JBQzVFLE9BQU07WUFDUixDQUFDO1lBRUQsU0FBUyxHQUFHLEtBQWdDLENBQUE7UUFDOUMsQ0FBQztRQUVELGdDQUFnQztRQUNoQyxNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsS0FBMkIsQ0FBQTtRQUVuRCxJQUFJLENBQUMsS0FBSyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxPQUFPLENBQUMsS0FBSyxDQUFDLDJEQUEyRCxPQUFPLEVBQUUsQ0FBQyxDQUFBO1lBQ25GLE9BQU07UUFDUixDQUFDO1FBRUQsd0JBQXdCO1FBQ3hCLE1BQU0sVUFBVSxHQUFHLFNBQVMsQ0FBQyxLQUFLLElBQUksU0FBUyxDQUFDLFdBQVcsQ0FBQTtRQUMzRCxNQUFNLFVBQVUsR0FDZCxPQUFPLFVBQVUsS0FBSyxRQUFRO1lBQzVCLENBQUMsQ0FBQyxVQUFVO1lBQ1osQ0FBQyxDQUFDLE9BQU8sVUFBVSxLQUFLLFFBQVE7Z0JBQzlCLENBQUMsQ0FBQyxVQUFVO2dCQUNaLENBQUMsQ0FBQyxLQUFLLENBQUE7UUFFYixzREFBc0Q7UUFDdEQsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBUSxpQ0FBeUIsQ0FBQyxLQUFLLENBQUMsQ0FBQTtRQUN2RSxNQUFNLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQztZQUM1QyxNQUFNLEVBQUUsVUFBVTtZQUNsQixNQUFNLEVBQUUsQ0FBQyxhQUFhLENBQUM7WUFDdkIsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFO1NBQzdDLENBQUMsQ0FBQTtRQUVGLE1BQU0sWUFBWSxHQUFHLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFBO1FBQ3pDLE1BQU0sYUFBYSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxJQUFJLHVCQUF1QixDQUFBO1FBQzNFLE1BQU0sU0FBUyxHQUFHLEdBQUcsYUFBYSxrQ0FBa0MsU0FBUyxDQUFDLEVBQUUsRUFBRSxDQUFBO1FBRWxGLE1BQU0sWUFBWSxHQUFzQjtZQUN0QyxRQUFRLEVBQUcsU0FBUyxDQUFDLEVBQWEsSUFBSSxLQUFLO1lBQzNDLFlBQVksRUFBRyxTQUFTLENBQUMsTUFBaUIsSUFBSSxLQUFLO1lBQ25ELFdBQVcsRUFBRSxVQUFVO1lBQ3ZCLFdBQVcsRUFBRyxTQUFTLENBQUMsS0FBZ0IsSUFBSSxLQUFLO1lBQ2pELFVBQVUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxVQUFVLElBQUksU0FBUyxDQUFDLFVBQVUsSUFBSSxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFXO1lBQ2hHLFdBQVcsRUFBRyxTQUFTLENBQUMsS0FBbUIsSUFBSSxFQUFFO1lBQ2pELGdCQUFnQixFQUFHLFNBQVMsQ0FBQyxnQkFBNEMsSUFBSSxFQUFFO1lBQy9FLGVBQWUsRUFBRyxTQUFTLENBQUMsZUFBMkMsSUFBSSxFQUFFO1lBQzdFLHdCQUF3QjtZQUN4QixhQUFhLEVBQUUsWUFBWTtZQUMzQixVQUFVLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVM7U0FDakQsQ0FBQTtRQUVELDJCQUEyQjtRQUMzQixNQUFNLGdCQUFnQixHQUFHLElBQUEsZ0NBQXFCLEVBQUMsWUFBWSxFQUFFLFlBQVksQ0FBQyxDQUFBO1FBRTFFLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3RCLE9BQU8sQ0FBQyxLQUFLLENBQUMsbUVBQW1FLFlBQVksRUFBRSxDQUFDLENBQUE7WUFDaEcsT0FBTTtRQUNSLENBQUM7UUFFRCwrQkFBK0I7UUFDL0IsTUFBTSxtQkFBbUIsR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLGVBQU8sQ0FBQyxZQUFZLENBR2pFLENBQUE7UUFFRCxJQUFJLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztZQUN6QixPQUFPLENBQUMsS0FBSyxDQUFDLGlFQUFpRSxDQUFDLENBQUE7WUFDaEYsT0FBTTtRQUNSLENBQUM7UUFFRCx3QkFBd0I7UUFDeEIsTUFBTSxPQUFPLEdBQUcsb0JBQW9CLENBQUE7UUFDcEMsTUFBTSxPQUFPLEdBQUcsbUJBQW1CLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxnQkFBZ0IsQ0FBQyxDQUFBO1FBRXJFLGtDQUFrQztRQUNsQyxPQUFPLENBQUMsR0FBRyxDQUFDLDBDQUEwQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQWtDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLHNCQUF1QixPQUFlLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUE7UUFDakwsSUFBSSxDQUFDO1lBQ0gsSUFBSSxPQUFPLG1CQUFtQixDQUFDLG1CQUFtQixLQUFLLFVBQVUsRUFBRSxDQUFDO2dCQUNsRSxPQUFPLENBQUMsR0FBRyxDQUFDLGtFQUFrRSxDQUFDLENBQUE7Z0JBQy9FLE1BQU0sR0FBRyxHQUFHLE1BQU0sbUJBQW1CLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxPQUFPLENBQVEsQ0FBQyxDQUFBO2dCQUMzRSxJQUFJLENBQUM7b0JBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQywwREFBMEQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUE7Z0JBQUMsQ0FBQztnQkFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO29CQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsMkVBQTJFLENBQUMsQ0FBQTtnQkFBQyxDQUFDO2dCQUMzTSxPQUFPLENBQUMsR0FBRyxDQUFDLDhEQUE4RCxPQUFPLEVBQUUsQ0FBQyxDQUFBO2dCQUVwRix3RUFBd0U7Z0JBQ3hFLHVFQUF1RTtnQkFDdkUsbUZBQW1GO2dCQUNuRixJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0JBQW9CLEtBQUssTUFBTSxFQUFFLENBQUM7b0JBQ2hELElBQUksQ0FBQzt3QkFDSCxPQUFPLENBQUMsR0FBRyxDQUFDLHdGQUF3RixDQUFDLENBQUE7d0JBQ3JHLG1DQUFtQzt3QkFDbkMsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFBO3dCQUN4QyxNQUFNLGFBQWEsR0FBUTs0QkFDekIsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsU0FBUzs0QkFDM0IsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUzs0QkFDdkUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsV0FBVyxLQUFLLE1BQU07NEJBQzFDLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxFQUFFLENBQUMsQ0FBQyxDQUFDLFNBQVM7NEJBQ3JILE1BQU0sRUFBRSxJQUFJOzRCQUNaLEtBQUssRUFBRSxJQUFJO3lCQUNaLENBQUE7d0JBQ0QsTUFBTSxXQUFXLEdBQUcsVUFBVSxDQUFDLGVBQWUsQ0FBQyxhQUFhLENBQUMsQ0FBQTt3QkFDN0QsTUFBTSxXQUFXLEdBQVE7NEJBQ3ZCLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFNBQVMsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWM7NEJBQ3pELEVBQUUsRUFBRyxPQUFlLENBQUMsRUFBRTs0QkFDdkIsT0FBTyxFQUFHLE9BQWUsQ0FBQyxPQUFPOzRCQUNqQyxJQUFJLEVBQUcsT0FBZSxDQUFDLElBQUk7NEJBQzNCLElBQUksRUFBRyxPQUFlLENBQUMsSUFBSTt5QkFDNUIsQ0FBQTt3QkFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLFdBQVcsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUE7d0JBQ3ZELElBQUksQ0FBQzs0QkFBQyxPQUFPLENBQUMsR0FBRyxDQUFDLDZEQUE2RCxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQTt3QkFBQyxDQUFDO3dCQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7NEJBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyw4RUFBOEUsQ0FBQyxDQUFBO3dCQUFDLENBQUM7b0JBQ3ZOLENBQUM7b0JBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQzt3QkFDYixPQUFPLENBQUMsS0FBSyxDQUFDLGdEQUFnRCxFQUFFLEdBQUcsWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFBO29CQUNuSCxDQUFDO2dCQUNILENBQUM7WUFDSCxDQUFDO2lCQUFNLElBQUksT0FBTyxtQkFBbUIsQ0FBQyxNQUFNLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQzVELE9BQU8sQ0FBQyxHQUFHLENBQUMscURBQXFELENBQUMsQ0FBQTtnQkFDbEUsTUFBTSxHQUFHLEdBQUcsTUFBTSxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsT0FBYyxDQUFDLENBQUE7Z0JBQzVELElBQUksQ0FBQztvQkFBQyxPQUFPLENBQUMsR0FBRyxDQUFDLDZDQUE2QyxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQTtnQkFBQyxDQUFDO2dCQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7b0JBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyw4REFBOEQsQ0FBQyxDQUFBO2dCQUFDLENBQUM7Z0JBQ2pMLE9BQU8sQ0FBQyxHQUFHLENBQUMsOERBQThELE9BQU8sRUFBRSxDQUFDLENBQUE7Z0JBQ3BGLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxvQkFBb0IsS0FBSyxNQUFNLEVBQUUsQ0FBQztvQkFDaEQsSUFBSSxDQUFDO3dCQUNILE9BQU8sQ0FBQyxHQUFHLENBQUMsd0ZBQXdGLENBQUMsQ0FBQTt3QkFDckcsbUNBQW1DO3dCQUNuQyxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsWUFBWSxDQUFDLENBQUE7d0JBQ3hDLE1BQU0sYUFBYSxHQUFROzRCQUN6QixJQUFJLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxTQUFTOzRCQUMzQixJQUFJLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTOzRCQUN2RSxNQUFNLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLEtBQUssTUFBTTs0QkFDMUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUzs0QkFDckgsTUFBTSxFQUFFLElBQUk7NEJBQ1osS0FBSyxFQUFFLElBQUk7eUJBQ1osQ0FBQTt3QkFDRCxNQUFNLFdBQVcsR0FBRyxVQUFVLENBQUMsZUFBZSxDQUFDLGFBQWEsQ0FBQyxDQUFBO3dCQUM3RCxNQUFNLFdBQVcsR0FBUTs0QkFDdkIsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsU0FBUyxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYzs0QkFDekQsRUFBRSxFQUFHLE9BQWUsQ0FBQyxFQUFFOzRCQUN2QixPQUFPLEVBQUcsT0FBZSxDQUFDLE9BQU87NEJBQ2pDLElBQUksRUFBRyxPQUFlLENBQUMsSUFBSTs0QkFDM0IsSUFBSSxFQUFHLE9BQWUsQ0FBQyxJQUFJO3lCQUM1QixDQUFBO3dCQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sV0FBVyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQTt3QkFDdkQsSUFBSSxDQUFDOzRCQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsNkRBQTZELElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxDQUFBO3dCQUFDLENBQUM7d0JBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQzs0QkFBQyxPQUFPLENBQUMsR0FBRyxDQUFDLDhFQUE4RSxDQUFDLENBQUE7d0JBQUMsQ0FBQztvQkFDdk4sQ0FBQztvQkFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO3dCQUNiLE9BQU8sQ0FBQyxLQUFLLENBQUMsZ0RBQWdELEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUE7b0JBQ25ILENBQUM7Z0JBQ0gsQ0FBQztZQUNILENBQUM7aUJBQU0sQ0FBQztnQkFDTixPQUFPLENBQUMsS0FBSyxDQUFDLHNGQUFzRixDQUFDLENBQUE7WUFDdkcsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxZQUFZLEdBQ2hCLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQTtZQUN4RCxPQUFPLENBQUMsS0FBSyxDQUFDLDJEQUEyRCxPQUFPLEdBQUcsRUFBRSxZQUFZLENBQUMsQ0FBQTtZQUNsRyxpRUFBaUU7UUFDbkUsQ0FBQztJQUNILENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxZQUFZLEdBQ2hCLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQTtRQUN4RCxPQUFPLENBQUMsS0FBSyxDQUFDLHdEQUF3RCxFQUFFLFlBQVksQ0FBQyxDQUFBO1FBQ3JGLGlFQUFpRTtJQUNuRSxDQUFDO0FBQ0gsQ0FBQztBQUVEOztHQUVHO0FBQ1UsUUFBQSxNQUFNLEdBQXFCO0lBQ3RDLEtBQUssRUFBRSxjQUFjO0NBQ3RCLENBQUEifQ==

package/README.md

@@ -39,8 +39,10 @@ This starter is compatible with versions >= 2.4.0 of `@medusajs/medusa`.
 ## Features
 
 - **Order Management**: Cancel and reorder functionality for orders
-- **Order Confirmation Emails**: Automatically sends email notifications when orders are placed (requires template configuration)
+- **Guest Order Portal**: Complete look-up system for guest users (OTP-based)
+- **Order Confirmation Emails**: Automatically sends email notifications when orders are placed (with "Claim Order" support for registered users)
 - **Return Orders Admin Panel**: Complete return orders management section in the Medusa Admin Panel with list view, filtering, search, detail pages, and status management
+- **Guest Returns & Invoices**: Secure endpoints for guest users to initiate returns and download invoices
 
 ## Configuration
 
@@ -112,6 +114,29 @@ The plugin supports the following return statuses:
 
 Status updates are tracked in the return's metadata with timestamps and admin user IDs.
 
+## Guest Order Portal
+
+The Guest Order Portal allows users who placed orders without an account to view their order status, initiate returns, and download invoices securely via an OTP (One-Time Password) system.
+
+### Security Features
+
+- **Strict Separation**: Guest orders are strictly filtered by unique guest customer IDs. Registered account orders will never be exposed in the guest portal.
+- **Access Control**: The portal uses short-lived JWT tokens issued upon successful OTP verification.
+- **Account Protection**: Emails belonging to registered accounts are blocked from the guest OTP flow to prevent unauthorized access and encourage secure logins.
+
+### Store API Endpoints
+
+The plugin provides the following store API endpoints for the Guest Order Portal:
+
+- `POST /store/otp/request` - Request an OTP for an email or phone number.
+- `POST /store/otp/verify` - Verify the OTP and receive a guest JWT token.
+- `GET /store/guest-orders` - List summary of orders for the verified guest identifier.
+- `GET /store/guest-orders/:id` - Get full details for a specific guest order (includes items, shipping status, etc.).
+- `POST /store/guest-orders/:id/returns` - Initiate a return request for a guest order.
+- `GET /store/guest-orders/:id/invoice` - Download a PDF invoice for the guest order.
+
+**Note**: All `GET` and `POST` requests to guest order endpoints require the JWT token in the `Authorization: Bearer <token>` header.
+
 ## Email Templates
 
 The plugin supports custom HTML templates for order confirmation emails. Templates use variable replacement with `{{variable_name}}` syntax.
@@ -177,6 +202,8 @@ The following variables are available in order confirmation email templates:
 | `{{order_items}}` | Order items array (JSON stringified) | `[{"title":"Product","quantity":1}]` |
 | `{{shipping_address}}` | Shipping address object (JSON stringified) | `{"first_name":"John",...}` |
 | `{{billing_address}}` | Billing address object (JSON stringified) | `{"first_name":"John",...}` |
+| `{{is_registered}}` | Whether the customer email has a registered account | `true` |
+| `{{claim_link}}` | Link for registered users to claim their guest order | `http://.../claim?order_id=...` |
 
 ## Getting Started
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "order-management",
-  "version": "0.0.13",
+  "version": "0.0.15",
   "description": "A starter for Medusa plugins.",
   "author": "Medusa (https://medusajs.com)",
   "license": "MIT",
@@ -36,14 +36,16 @@
     "@medusajs/admin-sdk": "2.11.2",
     "@medusajs/cli": "2.11.2",
     "@medusajs/framework": "2.11.2",
+    "@medusajs/icons": "2.11.2",
     "@medusajs/medusa": "2.11.2",
     "@medusajs/test-utils": "2.11.2",
     "@medusajs/ui": "4.0.25",
-    "@medusajs/icons": "2.11.2",
     "@swc/core": "1.5.7",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^20.0.0",
     "@types/react": "^18.3.2",
     "@types/react-dom": "^18.2.25",
+    "jsonwebtoken": "^9.0.3",
     "prop-types": "^15.8.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
@@ -56,10 +58,10 @@
     "@medusajs/admin-sdk": "2.11.2",
     "@medusajs/cli": "2.11.2",
     "@medusajs/framework": "2.11.2",
-    "@medusajs/test-utils": "2.11.2",
+    "@medusajs/icons": "2.11.2",
     "@medusajs/medusa": "2.11.2",
-    "@medusajs/ui": "4.0.25",
-    "@medusajs/icons": "2.11.2"
+    "@medusajs/test-utils": "2.11.2",
+    "@medusajs/ui": "4.0.25"
   },
   "engines": {
     "node": ">=20"