feat(auth): add authentication endpoints

packages/auth/integration-tests/__tests__/services/module/providers.spec.ts

@@ -83,7 +83,7 @@ describe("AuthModuleService - AuthProvider", () => {
       const { success, error } = await service.authenticate(
         "emailpass",
         {
-          scope: "non-existing",
+          authScope: "non-existing",
         } as any
       )
 

packages/auth/integration-tests/__tests__/services/providers/username-password.spec.ts

@@ -1,6 +1,6 @@
-import { AuthenticationInput, IAuthModuleService } from "@medusajs/types"
 import { MedusaModule, Modules } from "@medusajs/modules-sdk"
 
+import { IAuthModuleService } from "@medusajs/types"
 import { MikroOrmWrapper } from "../../../utils"
 import Scrypt from "scrypt-kdf"
 import { SqlEntityManager } from "@mikro-orm/postgresql"
@@ -73,8 +73,8 @@ describe("AuthModuleService - AuthProvider", () => {
           email: "test@test.com",
           password: password,
         },
-        scope: "store",
-      })
+        authScope: "store",
+      } as any)
 
       expect(res).toEqual({
         success: true,
@@ -92,8 +92,8 @@ describe("AuthModuleService - AuthProvider", () => {
 
       const res = await service.authenticate("emailpass", {
         body: { email: "test@test.com" },
-        scope: "store",
-      })
+        authScope: "store",
+      } as any)
 
       expect(res).toEqual({
         success: false,
@@ -106,8 +106,8 @@ describe("AuthModuleService - AuthProvider", () => {
 
       const res = await service.authenticate("emailpass", {
         body: { password: "supersecret" },
-        scope: "store",
-      })
+        authScope: "store",
+      } as any)
 
       expect(res).toEqual({
         success: false,
@@ -139,8 +139,8 @@ describe("AuthModuleService - AuthProvider", () => {
           email: "test@test.com",
           password: "password",
         },
-        scope: "store",
-      })
+        authScope: "store",
+      } as any)
 
       expect(res).toEqual({
         success: false,

packages/auth/package.json

@@ -55,7 +55,7 @@
     "@mikro-orm/migrations": "5.9.7",
     "@mikro-orm/postgresql": "5.9.7",
     "awilix": "^8.0.0",
-    "dotenv": "^16.1.4",
+    "dotenv": "16.3.1",
     "jsonwebtoken": "^9.0.2",
     "knex": "2.4.2",
     "scrypt-kdf": "^2.0.1",

packages/auth/src/providers/email-password.ts

@@ -1,4 +1,4 @@
-import { AbstractAuthModuleProvider, isString } from "@medusajs/utils"
+import { AbstractAuthModuleProvider, MedusaError, isString } from "@medusajs/utils"
 import { AuthenticationInput, AuthenticationResponse } from "@medusajs/types"
 
 import { AuthUserService } from "@services"
@@ -16,6 +16,14 @@ class EmailPasswordProvider extends AbstractAuthModuleProvider {
     this.authUserSerivce_ = authUserService
   }
 
+  private getHashConfig(scope: string) {
+    const scopeConfig = this.scopes_[scope].hashConfig as
+      | Scrypt.ScryptParams
+      | undefined
+
+    return scopeConfig ?? { logN: 15, r: 8, p: 1 }
+  }
+
   async authenticate(
     userData: AuthenticationInput
   ): Promise<AuthenticationResponse> {
@@ -34,11 +42,40 @@ class EmailPasswordProvider extends AbstractAuthModuleProvider {
         error: "Email should be a string",
       }
     }
-
-    const authUser = await this.authUserSerivce_.retrieveByProviderAndEntityId(
-      email,
-      EmailPasswordProvider.PROVIDER
-    )
+    let authUser
+
+    try {
+      authUser = await this.authUserSerivce_.retrieveByProviderAndEntityId(
+        email,
+        EmailPasswordProvider.PROVIDER
+      )
+    } catch (error) {
+      if (error.type === MedusaError.Types.NOT_FOUND) {
+        const password_hash = await Scrypt.kdf(
+          password,
+          this.getHashConfig(userData.authScope)
+        )
+
+        const [createdAuthUser] = await this.authUserSerivce_.create([
+          {
+            entity_id: email,
+            provider: EmailPasswordProvider.PROVIDER,
+            app_metadata: {
+              scope: userData.authScope,
+            },
+            provider_metadata: {
+              password: password_hash.toString("base64"),
+            },
+          },
+        ])
+
+        return {
+          success: true,
+          authUser: JSON.parse(JSON.stringify(createdAuthUser)),
+        }
+      }
+      return { success: false, error: error.message }
+    }
 
     const password_hash = authUser.provider_metadata?.password
 

packages/auth/src/providers/google.ts

@@ -78,7 +78,7 @@ class GoogleProvider extends AbstractAuthModuleProvider {
 
     const code = req.query?.code ?? req.body?.code
 
-    return await this.validateCallbackToken(code, req.scope, config)
+    return await this.validateCallbackToken(code, req.authScope, config)
   }
 
   // abstractable
@@ -97,14 +97,15 @@ class GoogleProvider extends AbstractAuthModuleProvider {
       )
     } catch (error) {
       if (error.type === MedusaError.Types.NOT_FOUND) {
-        authUser = await this.authUserSerivce_.create([
+        const [createdAuthUser] = await this.authUserSerivce_.create([
           {
             entity_id,
-            provider_id: GoogleProvider.PROVIDER,
+            provider: GoogleProvider.PROVIDER,
             user_metadata: jwtData!.payload,
             app_metadata: { scope },
           },
         ])
+        authUser = createdAuthUser
       } else {
         return { success: false, error: error.message }
       }
@@ -120,12 +121,12 @@ class GoogleProvider extends AbstractAuthModuleProvider {
     { clientID, callbackURL, clientSecret }: ProviderConfig
   ) {
     const client = this.getAuthorizationCodeHandler({ clientID, clientSecret })
-
+    
     const tokenParams = {
       code,
       redirect_uri: callbackURL,
     }
-
+    
     try {
       const accessToken = await client.getToken(tokenParams)
 
@@ -135,24 +136,18 @@ class GoogleProvider extends AbstractAuthModuleProvider {
     }
   }
 
-  private getConfigFromScope(config: AuthProviderScope): ProviderConfig {
-    const providerConfig: Partial<ProviderConfig> = {}
+  private getConfigFromScope(config: AuthProviderScope & Partial<ProviderConfig>): ProviderConfig {
+    const providerConfig: Partial<ProviderConfig> = { ...config }
 
-    if (config.clientId) {
-      providerConfig.clientID = config.clientId
-    } else {
+    if (!providerConfig.clientID) {
       throw new Error("Google clientID is required")
-    }
+    } 
 
-    if (config.clientSecret) {
-      providerConfig.clientSecret = config.clientSecret
-    } else {
+    if (!providerConfig.clientSecret) {
       throw new Error("Google clientSecret is required")
     }
 
-    if (config.callbackURL) {
-      providerConfig.callbackURL = config.callbackUrl
-    } else {
+    if (!providerConfig.callbackURL) {
       throw new Error("Google callbackUrl is required")
     }
 
@@ -173,7 +168,7 @@ class GoogleProvider extends AbstractAuthModuleProvider {
   ): Promise<ProviderConfig> {
     await this.authProviderService_.retrieve(GoogleProvider.PROVIDER)
 
-    const scopeConfig = this.scopes_[req.scope]
+    const scopeConfig = this.scopes_[req.authScope]
 
     const config = this.getConfigFromScope(scopeConfig)
 

packages/auth/src/services/auth-module.ts

@@ -400,7 +400,7 @@ export default class AuthModuleService<
 
   protected getRegisteredAuthenticationProvider(
     provider: string,
-    { scope }: AuthenticationInput
+    { authScope }: AuthenticationInput
   ): AbstractAuthModuleProvider {
     let containerProvider: AbstractAuthModuleProvider
     try {
@@ -412,7 +412,7 @@ export default class AuthModuleService<
       )
     }
 
-    containerProvider.validateScope(scope)
+    containerProvider.validateScope(authScope)
 
     return containerProvider
   }

packages/auth/src/types/services/auth-user.ts

@@ -12,7 +12,7 @@ export type AuthUserDTO = {
 
 export type CreateAuthUserDTO = {
   entity_id: string
-  provider_id: string
+  provider: string
   provider_metadata?: Record<string, unknown>
   user_metadata?: Record<string, unknown>
   app_metadata?: Record<string, unknown>

packages/customer/package.json

@@ -55,7 +55,7 @@
     "@mikro-orm/migrations": "5.9.7",
     "@mikro-orm/postgresql": "5.9.7",
     "awilix": "^8.0.0",
-    "dotenv": "^16.1.4",
+    "dotenv": "16.3.1",
     "knex": "2.4.2"
   }
 }

packages/medusa/src/api-v2/auth/[scope]/[authProvider]/callback/route.ts

@@ -0,0 +1,36 @@
+import { MedusaRequest, MedusaResponse } from "../../../../../types/routing"
+import { AuthenticationInput, IAuthModuleService } from "@medusajs/types"
+import { ModuleRegistrationName } from "@medusajs/modules-sdk"
+import { MedusaError } from "@medusajs/utils"
+
+export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
+  const { scope, authProvider } = req.params
+
+  const service: IAuthModuleService = req.scope.resolve(
+    ModuleRegistrationName.AUTH
+  )
+
+  const authData = { ...req } as unknown as AuthenticationInput
+  authData.authScope = scope
+
+  const authResult = await service.validateCallback(authProvider, authData)
+
+  const { success, error, authUser, location } = authResult
+  if (location) {
+    res.redirect(location)
+    return
+  }
+
+  if (!success && error) {
+    throw new MedusaError(MedusaError.Types.UNAUTHORIZED, error)
+  } else if (success) {
+    req.session.authUser = authUser
+    req.session.scope = authUser.app_metadata.scope
+
+    res.status(200).json({ authUser })
+  }
+}
+
+export const POST = async (req: MedusaRequest, res: MedusaResponse) => {
+  await GET(req, res)
+}

packages/medusa/src/api-v2/auth/[scope]/[authProvider]/route.ts

@@ -0,0 +1,36 @@
+import { MedusaRequest, MedusaResponse } from "../../../../types/routing"
+import { AuthenticationInput, IAuthModuleService } from "@medusajs/types"
+import { ModuleRegistrationName } from "@medusajs/modules-sdk"
+import { MedusaError } from "@medusajs/utils"
+
+export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
+  const { scope, authProvider } = req.params
+
+  const service: IAuthModuleService = req.scope.resolve(
+    ModuleRegistrationName.AUTH
+  )
+
+  const authData = { ...req } as unknown as AuthenticationInput
+  authData.authScope = scope
+
+  const authResult = await service.authenticate(authProvider, authData)
+
+  const { success, error, authUser, location } = authResult
+  if (location) {
+    res.redirect(location)
+    return
+  }
+
+  if (!success && error) {
+    throw new MedusaError(MedusaError.Types.UNAUTHORIZED, error)
+  } else if (success) {
+    req.session.auth_user = authUser
+    req.session.scope = authUser.app_metadata.scope
+
+    res.status(200).json({ authUser })
+  }
+}
+
+export const POST = async (req: MedusaRequest, res: MedusaResponse) => {
+  await GET(req, res)
+}

packages/medusa/src/api-v2/store/customers/me/route.ts

@@ -1,8 +1,9 @@
-import { ModuleRegistrationName } from "@medusajs/modules-sdk"
 import { MedusaRequest, MedusaResponse } from "../../../../types/routing"
 
+import { ModuleRegistrationName } from "@medusajs/modules-sdk"
+
 export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
-  const id = req.auth_user!.app_metadata.customer_id
+  const id = req.session.auth_user!.app_metadata.customer_id
 
   const customerModule = req.scope.resolve(ModuleRegistrationName.CUSTOMER)
 

packages/medusa/src/api-v2/store/customers/middlewares.ts

@@ -1,8 +1,10 @@
+import * as QueryConfig from "./query-config"
+
+import { StoreGetCustomersMeParams, StorePostCustomersReq } from "./validators"
 import { transformBody, transformQuery } from "../../../api/middlewares"
+
 import { MiddlewareRoute } from "../../../loaders/helpers/routing/types"
-import { StorePostCustomersReq, StoreGetCustomersMeParams } from "./validators"
-import authenticate from "../../../utils/authenticate-middleware"
-import * as QueryConfig from "./query-config"
+import { authenticate } from "../../../utils/authenticate-middleware"
 
 export const storeCustomerRoutesMiddlewares: MiddlewareRoute[] = [
   {

packages/medusa/src/api-v2/store/customers/query-config.ts

@@ -17,7 +17,7 @@ export const defaultStoreCustomersFields: (keyof CustomerDTO)[] = [
 ]
 
 export const retrieveTransformQueryConfig = {
-  defaultFields: defaultStoreCustomersFields,
+  defaultFields: defaultStoreCustomersFields as string[],
   defaultRelations: defaultStoreCustomersRelations,
   allowedRelations: allowedStoreCustomersRelations,
   isList: false,