feat: Revert to using app_metadata for authentication (#7433)

integration-tests/helpers/create-admin-user.ts

@@ -1,8 +1,7 @@
-import { ModuleRegistrationName, Modules } from "@medusajs/modules-sdk"
+import { ModuleRegistrationName } from "@medusajs/modules-sdk"
 import { IAuthModuleService, IUserModuleService } from "@medusajs/types"
 import jwt from "jsonwebtoken"
 import { getContainer } from "../environment-helpers/use-container"
-import { ContainerRegistrationKeys } from "@medusajs/utils"
 
 export const adminHeaders = {
   headers: { "x-medusa-access-token": "test_token" },
@@ -21,8 +20,6 @@ export const createAdminUser = async (
   const authModule: IAuthModuleService = appContainer.resolve(
     ModuleRegistrationName.AUTH
   )
-  const remoteLink = appContainer.resolve(ContainerRegistrationKeys.REMOTE_LINK)
-
   const user = await userModule.create({
     first_name: "Admin",
     last_name: "User",
@@ -35,19 +32,10 @@ export const createAdminUser = async (
     provider_metadata: {
       password: "somepassword",
     },
-  })
+    app_metadata: {
-
-  // Ideally we simulate a signup process than manually linking here.
-  await remoteLink.create([
-    {
-      [Modules.USER]: {
       user_id: user.id,
     },
-      [Modules.AUTH]: {
+  })
-        auth_identity_id: authIdentity.id,
-      },
-    },
-  ])
 
   const token = jwt.sign(
     {

integration-tests/modules/helpers/create-authenticated-customer.ts

@@ -2,7 +2,6 @@ import { CreateCustomerDTO, MedusaContainer } from "@medusajs/types"
 
 import { ModuleRegistrationName, Modules } from "@medusajs/modules-sdk"
 import jwt from "jsonwebtoken"
-import { ContainerRegistrationKeys } from "@medusajs/utils"
 
 export const createAuthenticatedCustomer = async (
   appContainer: MedusaContainer,
@@ -13,7 +12,6 @@ export const createAuthenticatedCustomer = async (
   const customerModuleService = appContainer.resolve(
     ModuleRegistrationName.CUSTOMER
   )
-  const remoteLink = appContainer.resolve(ContainerRegistrationKeys.REMOTE_LINK)
 
   const customer = await customerModuleService.create({
     first_name: "John",
@@ -25,19 +23,10 @@ export const createAuthenticatedCustomer = async (
   const authIdentity = await authService.create({
     entity_id: "store_user",
     provider: "emailpass",
-  })
+    app_metadata: {
-
-  // Ideally we simulate a signup process than manually linking here.
-  await remoteLink.create([
-    {
-      [Modules.CUSTOMER]: {
       customer_id: customer.id,
     },
-      [Modules.AUTH]: {
+  })
-        auth_identity_id: authIdentity.id,
-      },
-    },
-  ])
 
   const token = jwt.sign(
     {

packages/core/core-flows/src/auth/index.ts

@@ -0,0 +1 @@
+export * from "./steps"

packages/core/core-flows/src/auth/steps/index.ts

@@ -0,0 +1 @@
+export * from "./set-auth-app-metadata"

packages/core/core-flows/src/auth/steps/set-auth-app-metadata.ts

@@ -0,0 +1,64 @@
+import { StepResponse, createStep } from "@medusajs/workflows-sdk"
+
+import { ModuleRegistrationName } from "@medusajs/modules-sdk"
+import { IAuthModuleService } from "@medusajs/types"
+import { isDefined } from "@medusajs/utils"
+
+type StepInput = {
+  authIdentityId: string
+  actorType: string
+  value: string
+}
+
+export const setAuthAppMetadataStepId = "set-auth-app-metadata"
+export const setAuthAppMetadataStep = createStep(
+  setAuthAppMetadataStepId,
+  async (data: StepInput, { container }) => {
+    const service = container.resolve<IAuthModuleService>(
+      ModuleRegistrationName.AUTH
+    )
+
+    const key = `${data.actorType}_id`
+    const authIdentity = await service.retrieve(data.authIdentityId)
+
+    const appMetadata = authIdentity.app_metadata || {}
+    if (isDefined(appMetadata[key])) {
+      throw new Error(`Key ${key} already exists in app metadata`)
+    }
+
+    appMetadata[key] = data.value
+
+    await service.update({
+      id: authIdentity.id,
+      app_metadata: appMetadata,
+    })
+
+    return new StepResponse(authIdentity, {
+      id: authIdentity.id,
+      key: key,
+    })
+  },
+  async (idAndKey, { container }) => {
+    if (!idAndKey) {
+      return
+    }
+
+    const { id, key } = idAndKey
+
+    const service = container.resolve<IAuthModuleService>(
+      ModuleRegistrationName.AUTH
+    )
+
+    const authIdentity = await service.retrieve(id)
+
+    const appMetadata = authIdentity.app_metadata || {}
+    if (isDefined(appMetadata[key])) {
+      delete appMetadata[key]
+    }
+
+    await service.update({
+      id: authIdentity.id,
+      app_metadata: appMetadata,
+    })
+  }
+)

packages/core/core-flows/src/customer/workflows/create-customer-account.ts

@@ -2,8 +2,7 @@ import { CreateCustomerDTO, CustomerDTO } from "@medusajs/types"
 import { createWorkflow, WorkflowData } from "@medusajs/workflows-sdk"
 import { createCustomersStep } from "../steps"
 import { transform } from "@medusajs/workflows-sdk"
-import { Modules } from "@medusajs/modules-sdk"
+import { setAuthAppMetadataStep } from "../../auth"
-import { createLinkStep } from "../../common"
 
 type WorkflowInput = {
   authIdentityId: string
@@ -21,19 +20,12 @@ export const createCustomerAccountWorkflow = createWorkflow(
       (customers: CustomerDTO[]) => customers[0]
     )
 
-    const link = transform(
+    setAuthAppMetadataStep({
-      { customer, authIdentityId: input.authIdentityId },
+      authIdentityId: input.authIdentityId,
-      (data) => {
+      actorType: "customer",
-        return [
+      value: customer.id,
-          {
+    })
-            [Modules.CUSTOMER]: { customer_id: data.customer.id },
-            [Modules.AUTH]: { auth_identity_id: data.authIdentityId },
-          },
-        ]
-      }
-    )
 
-    createLinkStep(link)
     return customer
   }
 )

packages/core/core-flows/src/index.ts

@@ -1,4 +1,5 @@
 export * from "./api-key"
+export * from "./auth"
 export * from "./common"
 export * from "./customer"
 export * from "./customer-group"

packages/core/core-flows/src/invite/workflows/accept-invite.ts

@@ -7,8 +7,7 @@ import {
 import { createUsersStep } from "../../user"
 import { deleteInvitesStep } from "../steps"
 import { validateTokenStep } from "../steps/validate-token"
-import { Modules } from "@medusajs/modules-sdk"
+import { setAuthAppMetadataStep } from "../../auth"
-import { createLinkStep } from "../../common"
 
 export const acceptInviteWorkflowId = "accept-invite-workflow"
 export const acceptInviteWorkflow = createWorkflow(
@@ -32,20 +31,17 @@ export const acceptInviteWorkflow = createWorkflow(
 
     const users = createUsersStep(createUserInput)
 
-    const link = transform(
+    const authUserInput = transform({ input, users }, ({ input, users }) => {
-      { users, authIdentityId: input.auth_identity_id },
+      const createdUser = users[0]
-      (data) => {
-        const user = data.users[0]
-        return [
-          {
-            [Modules.USER]: { user_id: user.id },
-            [Modules.AUTH]: { auth_identity_id: data.authIdentityId },
-          },
-        ]
-      }
-    )
 
-    createLinkStep(link)
+      return {
+        authIdentityId: input.auth_identity_id,
+        actorType: "user",
+        value: createdUser.id,
+      }
+    })
+
+    setAuthAppMetadataStep(authUserInput)
     deleteInvitesStep([invite.id])
 
     return users

packages/core/core-flows/src/user/workflows/create-user-account.ts

@@ -5,8 +5,7 @@ import {
   transform,
 } from "@medusajs/workflows-sdk"
 import { createUsersStep } from "../steps"
-import { Modules } from "@medusajs/modules-sdk"
+import { setAuthAppMetadataStep } from "../../auth"
-import { createLinkStep } from "../../common"
 
 type WorkflowInput = {
   authIdentityId: string
@@ -20,19 +19,11 @@ export const createUserAccountWorkflow = createWorkflow(
     const users = createUsersStep([input.userData])
     const user = transform(users, (users: UserDTO[]) => users[0])
 
-    const link = transform(
+    setAuthAppMetadataStep({
-      { user, authIdentityId: input.authIdentityId },
+      authIdentityId: input.authIdentityId,
-      (data) => {
+      actorType: "user",
-        return [
+      value: user.id,
-          {
+    })
-            [Modules.USER]: { user_id: data.user.id },
-            [Modules.AUTH]: { auth_identity_id: data.authIdentityId },
-          },
-        ]
-      }
-    )
-
-    createLinkStep(link)
     return user
   }
 )

packages/core/types/src/auth/common/auth-identity.ts

@@ -22,6 +22,11 @@ export type AuthIdentityDTO = {
    */
   entity_id: string
 
+  /**
+   * Holds information related to the actor IDs tied to the auth identity.
+   */
+  app_metadata?: Record<string, unknown>
+
   /**
    * Holds custom data related to the provider in key-value pairs.
    */
@@ -56,6 +61,11 @@ export type CreateAuthIdentityDTO = {
    */
   entity_id: string
 
+  /**
+   * Holds information related to the actor IDs tied to the auth identity.
+   */
+  app_metadata?: Record<string, unknown>
+
   /**
    * Holds custom data related to the provider in key-value pairs.
    */
@@ -78,6 +88,10 @@ export type UpdateAuthIdentityDTO = {
    */
   id: string
 
+  /**
+   * Holds information related to the actor IDs tied to the auth identity.
+   */
+  app_metadata?: Record<string, unknown>
   /**
    * Holds custom data related to the provider in key-value pairs.
    */
@@ -100,7 +114,7 @@ export interface FilterableAuthIdentityProps
   id?: string[]
 
   /**
-   * Filter the auth identitys by the ID of their auth provider.
+   * Filter the auth identities by the ID of their auth provider.
    */
   provider?: string[] | string
 }

packages/core/types/src/auth/service.ts

@@ -109,16 +109,16 @@ export interface IAuthModuleService extends IModuleService {
   ): Promise<AuthIdentityDTO>
 
   /**
-   * This method retrieves a paginated list of auth identitys based on optional filters and configuration.
+   * This method retrieves a paginated list of auth identities based on optional filters and configuration.
    *
-   * @param {FilterableAuthIdentityProps} filters - The filters to apply on the retrieved auth identitys.
+   * @param {FilterableAuthIdentityProps} filters - The filters to apply on the retrieved auth identities.
    * @param {FindConfig<AuthIdentityDTO>} config - The configurations determining how the auth identity is retrieved. Its properties, such as `select` or `relations`, accept the
    * attributes or relations associated with a auth identity.
    * @param {Context} sharedContext - A context used to share resources, such as transaction manager, between the application and the module.
-   * @returns {Promise<AuthIdentityDTO[]>} The list of auth identitys.
+   * @returns {Promise<AuthIdentityDTO[]>} The list of auth identities.
    *
    * @example
-   * To retrieve a list of auth identitys using their IDs:
+   * To retrieve a list of auth identities using their IDs:
    *
    * ```ts
    * const authIdentities = await authModuleService.list({
@@ -147,16 +147,16 @@ export interface IAuthModuleService extends IModuleService {
   ): Promise<AuthIdentityDTO[]>
 
   /**
-   * This method retrieves a paginated list of auth identitys along with the total count of available auth identitys satisfying the provided filters.
+   * This method retrieves a paginated list of auth identities along with the total count of available auth identities satisfying the provided filters.
    *
-   * @param {FilterableAuthIdentityProps} filters - The filters to apply on the retrieved auth identitys.
+   * @param {FilterableAuthIdentityProps} filters - The filters to apply on the retrieved auth identities.
    * @param {FindConfig<AuthIdentityDTO>} config - The configurations determining how the auth identity is retrieved. Its properties, such as `select` or `relations`, accept the
    * attributes or relations associated with a auth identity.
    * @param {Context} sharedContext - A context used to share resources, such as transaction manager, between the application and the module.
-   * @returns {Promise<[AuthIdentityDTO[], number]>} The list of auth identitys along with their total count.
+   * @returns {Promise<[AuthIdentityDTO[], number]>} The list of auth identities along with their total count.
    *
    * @example
-   * To retrieve a list of auth identitys using their IDs:
+   * To retrieve a list of auth identities using their IDs:
    *
    * ```ts
    * const [authIdentities, count] =
@@ -187,11 +187,11 @@ export interface IAuthModuleService extends IModuleService {
   ): Promise<[AuthIdentityDTO[], number]>
 
   /**
-   * This method creates auth identitys.
+   * This method creates auth identities.
    *
-   * @param {CreateAuthIdentityDTO[]} data - The auth identitys to be created.
+   * @param {CreateAuthIdentityDTO[]} data - The auth identities to be created.
    * @param {Context} sharedContext - A context used to share resources, such as transaction manager, between the application and the module.
-   * @returns {Promise<AuthIdentityDTO[]>} The created auth identitys.
+   * @returns {Promise<AuthIdentityDTO[]>} The created auth identities.
    *
    * @example
    * const authIdentities = await authModuleService.create([
@@ -231,7 +231,7 @@ export interface IAuthModuleService extends IModuleService {
   /**
    * This method updates existing auths.
    *
-   * @param {UpdateAuthIdentityDTO[]} data - The attributes to update in the auth identitys.
+   * @param {UpdateAuthIdentityDTO[]} data - The attributes to update in the auth identities.
    * @param {Context} sharedContext - A context used to share resources, such as transaction manager, between the application and the module.
    * @returns {Promise<AuthIdentityDTO[]>} The updated auths.
    *

packages/core/utils/src/link/links.ts

@@ -86,16 +86,4 @@ export const LINKS = {
     Modules.FULFILLMENT,
     "fulfillment_id"
   ),
-  UserAuth: composeLinkName(
-    Modules.USER,
-    "user_id",
-    Modules.AUTH,
-    "auth_identity_id"
-  ),
-  CustomerAuth: composeLinkName(
-    Modules.CUSTOMER,
-    "customer_id",
-    Modules.AUTH,
-    "auth_identity_id"
-  ),
 }

packages/medusa/src/api/admin/users/route.ts

@@ -73,6 +73,9 @@ export const POST = async (
       actor_id: result.id,
       actor_type: "user",
       auth_identity_id: req.auth_context.auth_identity_id,
+      app_metadata: {
+        user_id: result.id,
+      },
     },
     {
       secret: jwtSecret,

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/callback/route.ts

@@ -4,17 +4,12 @@ import {
   IAuthModuleService,
   ConfigModule,
 } from "@medusajs/types"
-import {
+import { ContainerRegistrationKeys, MedusaError } from "@medusajs/utils"
-  ContainerRegistrationKeys,
-  MedusaError,
-  remoteQueryObjectFromString,
-} from "@medusajs/utils"
 import { MedusaRequest, MedusaResponse } from "../../../../../types/routing"
 import { generateJwtToken } from "../../../../utils/auth/token"
 
 export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
   const { actor_type, auth_provider } = req.params
-  const remoteQuery = req.scope.resolve(ContainerRegistrationKeys.REMOTE_QUERY)
   const config: ConfigModule = req.scope.resolve(
     ContainerRegistrationKeys.CONFIG_MODULE
   )
@@ -45,14 +40,8 @@ export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
   const { success, error, authIdentity, successRedirectUrl } =
     await service.validateCallback(auth_provider, authData)
 
-  const queryObject = remoteQueryObjectFromString({
+  const entityIdKey = `${actor_type}_id`
-    entryPoint: "auth_identity",
+  const entityId = authIdentity.app_metadata?.[entityIdKey]
-    fields: [`${actor_type}.id`],
-    variables: { id: authIdentity.id },
-  })
-  const [actorData] = await remoteQuery(queryObject)
-  const entityId = actorData?.[actor_type]?.id
-
   if (success) {
     const { http } = req.scope.resolve(
       ContainerRegistrationKeys.CONFIG_MODULE
@@ -64,6 +53,9 @@ export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
         actor_id: entityId,
         actor_type,
         auth_identity_id: authIdentity.id,
+        app_metadata: {
+          [entityIdKey]: entityId,
+        },
       },
       {
         secret: jwtSecret,

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/route.ts

@@ -4,17 +4,12 @@ import {
   IAuthModuleService,
   ConfigModule,
 } from "@medusajs/types"
-import {
+import { ContainerRegistrationKeys, MedusaError } from "@medusajs/utils"
-  ContainerRegistrationKeys,
-  MedusaError,
-  remoteQueryObjectFromString,
-} from "@medusajs/utils"
 import { MedusaRequest, MedusaResponse } from "../../../../types/routing"
 import { generateJwtToken } from "../../../utils/auth/token"
 
 export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
   const { actor_type, auth_provider } = req.params
-  const remoteQuery = req.scope.resolve(ContainerRegistrationKeys.REMOTE_QUERY)
   const config: ConfigModule = req.scope.resolve(
     ContainerRegistrationKeys.CONFIG_MODULE
   )
@@ -57,20 +52,17 @@ export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
       ContainerRegistrationKeys.CONFIG_MODULE
     ).projectConfig
 
-    const queryObject = remoteQueryObjectFromString({
+    const entityIdKey = `${actor_type}_id`
-      entryPoint: "auth_identity",
+    const entityId = authIdentity.app_metadata?.[entityIdKey]
-      fields: [`${actor_type}.id`],
-      variables: { id: authIdentity.id },
-    })
-    const [actorData] = await remoteQuery(queryObject)
-    const entityId = actorData?.[actor_type]?.id
-
     const { jwtSecret, jwtExpiresIn } = http
     const token = generateJwtToken(
       {
         actor_id: entityId,
         actor_type,
         auth_identity_id: authIdentity.id,
+        app_metadata: {
+          entityIdKey: entityId,
+        },
       },
       {
         secret: jwtSecret,

packages/medusa/src/api/store/customers/route.ts

@@ -41,6 +41,9 @@ export const POST = async (
       actor_id: result.id,
       actor_type: "customer",
       auth_identity_id: req.auth_context.auth_identity_id,
+      app_metadata: {
+        customer_id: result.id,
+      },
     },
     {
       secret: jwtSecret,

packages/medusa/src/commands/user.js

@@ -7,7 +7,6 @@ import { track } from "medusa-telemetry"
 import loaders from "../loaders"
 import Logger from "../loaders/logger"
 import { ModuleRegistrationName, Modules } from "@medusajs/modules-sdk"
-import { ContainerRegistrationKeys } from "@medusajs/utils"
 
 export default async function ({
   directory,
@@ -33,7 +32,6 @@ export default async function ({
 
     const userService = container.resolve(ModuleRegistrationName.USER)
     const authService = container.resolve(ModuleRegistrationName.AUTH)
-    const remoteLink = container.resolve(ContainerRegistrationKeys.REMOTE_LINK)
 
     const provider = "emailpass"
 
@@ -58,16 +56,12 @@ export default async function ({
         throw new Error(error)
       }
 
-      await remoteLink.create([
+      await authService.update({
-        {
+        id: authIdentity.id,
-          [Modules.USER]: {
+        app_metadata: {
           user_id: user.id,
         },
-          [Modules.AUTH]: {
+      })
-            auth_identity_id: authIdentity.id,
-          },
-        },
-      ])
     }
   } catch (err) {
     console.error(err)

packages/medusa/src/types/routing.ts

@@ -63,6 +63,7 @@ export interface AuthContext {
   actor_id: string
   actor_type: string
   auth_identity_id: string
+  app_metadata: Record<string, unknown>
 }
 
 export interface AuthenticatedMedusaRequest<Body = never>

packages/medusa/src/utils/middlewares/authenticate-middleware.ts

@@ -48,6 +48,7 @@ export const authenticate = (
           actor_id: apiKey.id,
           actor_type: "api-key",
           auth_identity_id: "",
+          app_metadata: {},
         }
 
         return next()

packages/modules/auth/src/index.ts

@@ -1,5 +1,3 @@
 import { moduleDefinition } from "./module-definition"
 
 export default moduleDefinition
-
-export * from "./loaders"

packages/modules/auth/src/loaders/index.ts

@@ -1 +0,0 @@
-export * from "./providers"

packages/modules/link-modules/src/definitions/customer-auth.ts

@@ -1,61 +0,0 @@
-import { Modules } from "@medusajs/modules-sdk"
-import { ModuleJoinerConfig } from "@medusajs/types"
-import { LINKS } from "@medusajs/utils"
-
-export const CustomerAuth: ModuleJoinerConfig = {
-  serviceName: LINKS.CustomerAuth,
-  isLink: true,
-  databaseConfig: {
-    tableName: "customer_auth_identity",
-    idPrefix: "cusauth",
-  },
-  alias: [
-    {
-      name: "customer_auth_identity",
-    },
-    {
-      name: "customer_auth_identities",
-    },
-  ],
-  primaryKeys: ["id", "customer_id", "auth_identity_id"],
-  relationships: [
-    {
-      serviceName: Modules.CUSTOMER,
-      primaryKey: "id",
-      foreignKey: "customer_id",
-      alias: "customer",
-    },
-    {
-      serviceName: Modules.AUTH,
-      primaryKey: "id",
-      foreignKey: "auth_identity_id",
-      alias: "auth",
-    },
-  ],
-  extends: [
-    {
-      serviceName: Modules.CUSTOMER,
-      fieldAlias: {
-        auth_identity: "auth_link.auth_identity",
-      },
-      relationship: {
-        serviceName: LINKS.CustomerAuth,
-        primaryKey: "customer_id",
-        foreignKey: "id",
-        alias: "auth_link",
-      },
-    },
-    {
-      serviceName: Modules.AUTH,
-      fieldAlias: {
-        customer: "customer_link.customer",
-      },
-      relationship: {
-        serviceName: LINKS.CustomerAuth,
-        primaryKey: "auth_identity_id",
-        foreignKey: "id",
-        alias: "customer_link",
-      },
-    },
-  ],
-}

packages/modules/link-modules/src/definitions/index.ts

@@ -14,5 +14,3 @@ export * from "./region-payment-provider"
 export * from "./sales-channel-location"
 export * from "./shipping-option-price-set"
 export * from "./order-fulfillment"
-export * from "./user-auth"
-export * from "./customer-auth"

packages/modules/link-modules/src/definitions/user-auth.ts

@@ -1,61 +0,0 @@
-import { Modules } from "@medusajs/modules-sdk"
-import { ModuleJoinerConfig } from "@medusajs/types"
-import { LINKS } from "@medusajs/utils"
-
-export const UserAuth: ModuleJoinerConfig = {
-  serviceName: LINKS.UserAuth,
-  isLink: true,
-  databaseConfig: {
-    tableName: "user_auth_identity",
-    idPrefix: "usrauth",
-  },
-  alias: [
-    {
-      name: "user_auth_identity",
-    },
-    {
-      name: "user_auth_identities",
-    },
-  ],
-  primaryKeys: ["id", "user_id", "auth_identity_id"],
-  relationships: [
-    {
-      serviceName: Modules.USER,
-      primaryKey: "id",
-      foreignKey: "user_id",
-      alias: "user",
-    },
-    {
-      serviceName: Modules.AUTH,
-      primaryKey: "id",
-      foreignKey: "auth_identity_id",
-      alias: "auth",
-    },
-  ],
-  extends: [
-    {
-      serviceName: Modules.USER,
-      fieldAlias: {
-        auth_identity: "auth_link.auth_identity",
-      },
-      relationship: {
-        serviceName: LINKS.UserAuth,
-        primaryKey: "user_id",
-        foreignKey: "id",
-        alias: "auth_link",
-      },
-    },
-    {
-      serviceName: Modules.AUTH,
-      fieldAlias: {
-        user: "user_link.user",
-      },
-      relationship: {
-        serviceName: LINKS.UserAuth,
-        primaryKey: "auth_identity_id",
-        foreignKey: "id",
-        alias: "user_link",
-      },
-    },
-  ],
-}