chore: Add actor type check + more tests (#10005)

packages/core/core-flows/src/auth/workflows/generate-reset-password-token.ts

@@ -45,6 +45,7 @@ export const generateResetPasswordTokenWorkflow = createWorkflow(
           {
             entity_id: input.entityId,
             provider: input.provider,
+            actor_type: input.actorType,
           },
           {
             secret: input.secret,

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/update/route.ts

@@ -13,9 +13,14 @@ export const POST = async (
 
   const authService = req.scope.resolve<IAuthModuleService>(Modules.AUTH)
 
+  const updateData = {
+    ...(req.body as Record<string, unknown>),
+    entity_id: req.auth_context.actor_id, // comes from the validated token
+  }
+
   const { authIdentity, success, error } = await authService.updateProvider(
     auth_provider,
-    req.body as Record<string, unknown>
+    updateData
   )
 
   if (success && authIdentity) {

packages/medusa/src/api/auth/utils/validate-token.ts

@@ -46,6 +46,11 @@ export const validateToken = () => {
       return next(errorObject)
     }
 
+    // E.g. token was requested for a customer, but attempted used for a user
+    if (decoded?.actor_type !== actor_type) {
+      return next(errorObject)
+    }
+
     const [providerIdentity] = await authModule.listProviderIdentities(
       {
         entity_id: decoded.entity_id,
@@ -60,17 +65,15 @@ export const validateToken = () => {
       return next(errorObject)
     }
 
-    let verified: JwtPayload | null = null
-
     try {
-      verified = verify(token as string, http.jwtSecret as string) as JwtPayload
+      verify(token as string, http.jwtSecret as string) as JwtPayload
     } catch (error) {
       return next(errorObject)
     }
 
     req_.auth_context = {
       actor_type,
-      auth_identity_id: verified.auth_identity_id!,
+      auth_identity_id: providerIdentity.auth_identity_id!,
       actor_id: providerIdentity.entity_id,
       app_metadata: {},
     }

packages/modules/providers/auth-emailpass/src/services/emailpass.ts

@@ -43,15 +43,15 @@ export class EmailPassAuthService extends AbstractAuthModuleProvider {
   }
 
   async update(
-    data: { email: string; password: string },
+    data: { password: string; entity_id: string },
     authIdentityService: AuthIdentityProviderService
   ) {
-    const { email, password } = data ?? {}
+    const { password, entity_id } = data ?? {}
 
-    if (!email || !isString(email)) {
+    if (!entity_id) {
       return {
         success: false,
-        error: `Cannot update ${this.provider} provider identity without email`,
+        error: `Cannot update ${this.provider} provider identity without entity_id`,
       }
     }
 
@@ -64,7 +64,7 @@ export class EmailPassAuthService extends AbstractAuthModuleProvider {
     try {
       const passwordHash = await this.hashPassword(password)
 
-      authIdentity = await authIdentityService.update(email, {
+      authIdentity = await authIdentityService.update(entity_id, {
         provider_metadata: {
           password: passwordHash,
         },