feat(medusa): Authentication overhaul (#4064)

* implemented bearer auth

* changed naming strat

* changed session auth to not use jwt

* typo

* changed auth header prefix for admin api token auth

* fixed supporting functions to work with new session type

* removed database calls for bearer auth improving performance

* removed unused deps

* changed auth in tests

* added integration tests

* Accepted suggested change

Co-authored-by: Carlos R. L. Rodrigues <37986729+carlos-r-l-rodrigues@users.noreply.github.com>

* Typo

Co-authored-by: Oliver Windall Juhl <59018053+olivermrbl@users.noreply.github.com>

* more typos

Co-authored-by: Oliver Windall Juhl <59018053+olivermrbl@users.noreply.github.com>

* proper formatting

Co-authored-by: Oliver Windall Juhl <59018053+olivermrbl@users.noreply.github.com>

* removed endregion

Co-authored-by: Oliver Windall Juhl <59018053+olivermrbl@users.noreply.github.com>

* removed startregion

Co-authored-by: Oliver Windall Juhl <59018053+olivermrbl@users.noreply.github.com>

* fixed admin JWT integration test

* added more fixes to integration tests

* Update OAS

* Create fluffy-donkeys-hope.md

* created API reference for new auth

* implemented getToken in medusa-js

* Apply suggestions from code review

Co-authored-by: Shahed Nasser <shahednasser@gmail.com>

* Apply suggestions from code review

Co-authored-by: Shahed Nasser <shahednasser@gmail.com>

* deleted files which should be autogenerated

* Update fluffy-donkeys-hope.md

* JSDoc update

Co-authored-by: Oli Juhl <59018053+olivermrbl@users.noreply.github.com>

* added missing route exports

* implemented runtime domain safety in jwt token manager

* fixed jwt manager

* lint get-token files

* Update fluffy-donkeys-hope.md

* Revert "deleted files which should be autogenerated"

This reverts commit cd5e86623b822e6a6ac37322b952143ccc493df9.

* Revert "Apply suggestions from code review"

This reverts commit f02f07ce58fd9fcc2dfc80cadbb9df2665108d65.

* Revert "created API reference for new auth"

This reverts commit c9eafbb36453f5cf8047c79e94f470cb2d023c7d.

* renamed header for sending api access tokens

* medusa-js - changed apiKey header

---------

Co-authored-by: Oliver Windall Juhl <59018053+olivermrbl@users.noreply.github.com>
Co-authored-by: Carlos R. L. Rodrigues <37986729+carlos-r-l-rodrigues@users.noreply.github.com>
Co-authored-by: olivermrbl <oliver@mrbltech.com>
Co-authored-by: Shahed Nasser <shahednasser@gmail.com>

integration-tests/plugins/helpers/call-helpers.js

@@ -0,0 +1,100 @@
+const { useApi } = require("../../helpers/use-api")
+
+const header = {
+  headers: {
+    "x-medusa-access-token": "test_token",
+  },
+}
+
+const resolveCall = async (path, payload, header) => {
+  const api = useApi()
+  let res
+  try {
+    const resp = await api.post(path, payload, header)
+    res = resp.status
+  } catch (expectedException) {
+    try {
+      res = expectedException.response.status
+    } catch (_) {
+      console.error(expectedException)
+    }
+  }
+  return res
+}
+
+const determineFail = (actual, expected, path) => {
+  if (expected !== actual) {
+    console.log(`failed at path : ${path}`)
+  }
+  expect(actual).toEqual(expected)
+}
+
+/**
+ * Allows you to wrap a Call function so that you may reuse some input values.
+ * @param {Function} fun - the function to call with partial information
+ * @param {Object} input - the constant input which we want to supply now
+ * @returns
+ */
+module.exports.partial = function (fun, input = {}) {
+  return async (remaining) => await fun({ ...remaining, ...input })
+}
+
+/**
+ * Allows you to assert a specific code result from a POST call.
+ * @param {Object} input - the information needed to make the call
+ * (path & payload) and the expected code (code)
+ */
+module.exports.expectPostCallToReturn = async function (
+  input = {
+    code,
+    path,
+    payload: {},
+  }
+) {
+  const res = await resolveCall(input.path, input.payload, header)
+  determineFail(res, input.code, input.path)
+}
+
+/**
+ * Allows you to assert a specific code result from multiple POST
+ * calls.
+ * @param {Object} input - the collection of objects to execute
+ * calls from (col), a function which yields the path (pathf),
+ * and another one which provides the payload (payloadf), as
+ * well as the code (code) which we want to assert.
+ */
+module.exports.expectAllPostCallsToReturn = async function (
+  input = {
+    code,
+    col,
+    pathf,
+    payloadf,
+  }
+) {
+  for (const i of input.col) {
+    const res = await resolveCall(
+      input.pathf(i),
+      input.payloadf ? input.payloadf(i) : {},
+      header
+    )
+    determineFail(res, input.code, input.pathf(i))
+  }
+}
+
+/**
+ * Allows you to retrieve a specific object the response
+ * from get call,
+ * and simultaneously assert that the call was successful.
+ * @param {Object} param0 - contains the path which to
+ * call (path), and the object within the response.data (get)
+ * we want to retrieve.
+ * @returns {Object} found within response.data corresponding
+ * to the get parameter provided.
+ */
+module.exports.callGet = async function ({ path, get }) {
+  const api = useApi()
+  const res = await api.get(path, header)
+
+  determineFail(res.status, 200, path)
+  return res?.data[get]
+}