Robustness

packages/medusa/src/api/routes/store/carts/delete-payment-session.js

@@ -0,0 +1,14 @@
+export default async (req, res) => {
+  const { id, provider_id } = req.params
+
+  try {
+    const cartService = req.scope.resolve("cartService")
+
+    let cart = await cartService.deletePaymentSession(id, provider_id)
+    cart = await cartService.decorate(cart, [], ["region"])
+
+    res.status(200).json({ cart })
+  } catch (err) {
+    throw err
+  }
+}

packages/medusa/src/api/routes/store/carts/index.js

@@ -35,6 +35,11 @@ export default app => {
     "/:id/payment-sessions",
     middlewares.wrap(require("./create-payment-sessions").default)
   )
+
+  route.delete(
+    "/:id/payment-sessions/:provider_id",
+    middlewares.wrap(require("./delete-payment-session").default)
+  )
   route.post(
     "/:id/payment-method",
     middlewares.wrap(require("./update-payment-method").default)

packages/medusa/src/api/routes/store/customers/index.js

@@ -25,10 +25,6 @@ export default app => {
 
   route.get("/:id", middlewares.wrap(require("./get-customer").default))
   route.post("/:id", middlewares.wrap(require("./update-customer").default))
-  route.post(
-    "/:id/password",
-    middlewares.wrap(require("./update-password").default)
-  )
 
   route.post(
     "/:id/addresses",

packages/medusa/src/api/routes/store/customers/reset-password.js

@@ -20,13 +20,14 @@ export default async (req, res) => {
     const customer = await customerService.retrieveByEmail(value.email)
 
     const decodedToken = await jwt.verify(value.token, customer.password_hash)
-    if (!decodedToken || decodedToken.customer_id !== customer._id) {
+    if (!decodedToken || !customer._id.equals(decodedToken.customer_id)) {
       res.status(401).send("Invalid or expired password reset token")
+      return
     }
 
-    await customerService.update(customer._id, { password: value.password })
-
-    const updated = await customerService.retrieve(customer._id)
+    const updated = await customerService.update(customer._id, {
+      password: value.password,
+    })
     const data = await customerService.decorate(customer)
     res.status(200).json({ customer: data })
   } catch (error) {

packages/medusa/src/api/routes/store/customers/update-customer.js

@@ -16,10 +16,12 @@ export default async (req, res) => {
 
   try {
     const customerService = req.scope.resolve("customerService")
-    await customerService.update(id, value)
-
-    const customer = await customerService.retrieve(id)
-    const data = await customerService.decorate(customer)
+    const customer = await customerService.update(id, value)
+    const data = await customerService.decorate(
+      customer,
+      ["email", "first_name", "last_name", "shipping_addresses"],
+      ["orders"]
+    )
     res.status(200).json({ customer: data })
   } catch (err) {
     throw err

packages/medusa/src/api/routes/store/customers/update-password.js

@@ -1,26 +0,0 @@
-import { Validator, MedusaError } from "medusa-core-utils"
-
-export default async (req, res) => {
-  const { id } = req.params
-
-  const schema = Validator.object().keys({
-    password: Validator.string().required(),
-  })
-
-  const { value, error } = schema.validate(req.body)
-  if (error) {
-    throw new MedusaError(MedusaError.Types.INVALID_DATA, error.details)
-  }
-
-  try {
-    const customerService = req.scope.resolve("customerService")
-
-    await customerService.update(id, value)
-
-    const customer = await customerService.retrieve(id)
-    const data = await customerService.decorate(customer)
-    res.status(200).json({ customer: data })
-  } catch (err) {
-    throw err
-  }
-}

packages/medusa/src/loaders/api.js

@@ -1,3 +1,4 @@
+import bodyParser from "body-parser"
 import { getConfigFile } from "medusa-core-utils"
 
 import routes from "../api"
@@ -5,6 +6,9 @@ import routes from "../api"
 export default async ({ app, rootDirectory, container }) => {
   const { configModule } = getConfigFile(rootDirectory, `medusa-config`)
   const config = (configModule && configModule.projectConfig) || {}
+
+  app.use(bodyParser.json())
   app.use("/", routes(container, config))
+
   return app
 }

packages/medusa/src/loaders/express.js

@@ -1,5 +1,4 @@
 import express from "express"
-import bodyParser from "body-parser"
 import session from "client-sessions"
 import cookieParser from "cookie-parser"
 import morgan from "morgan"
@@ -14,7 +13,6 @@ export default async ({ app }) => {
     })
   )
   app.use(cookieParser())
-  app.use(bodyParser.json())
   app.use(
     session({
       cookieName: "session",

packages/medusa/src/services/cart.js

@@ -539,10 +539,7 @@ class CartService extends BaseService {
     const cart = await this.retrieve(cartId)
     const { value, error } = Validator.address().validate(address)
     if (error) {
-      throw new MedusaError(
-        MedusaError.Types.INVALID_DATA,
-        "The address is not valid"
-      )
+      throw new MedusaError(MedusaError.Types.INVALID_DATA, error.message)
     }
 
     address.country_code = address.country_code.toUpperCase()
@@ -573,10 +570,7 @@ class CartService extends BaseService {
     const cart = await this.retrieve(cartId)
     const { value, error } = Validator.address().validate(address)
     if (error) {
-      throw new MedusaError(
-        MedusaError.Types.INVALID_DATA,
-        "The address is not valid"
-      )
+      throw new MedusaError(MedusaError.Types.INVALID_DATA, error.message)
     }
 
     address.country_code = address.country_code.toUpperCase()
@@ -867,6 +861,61 @@ class CartService extends BaseService {
       })
   }
 
+  async deletePaymentSession(cartId, providerId) {
+    const cart = await this.retrieve(cartId)
+    if (cart.payment_sessions) {
+      const session = cart.payment_sessions.find(
+        s => s.provider_id === providerId
+      )
+
+      if (session) {
+        // Delete the session with the provider
+        await this.paymentProviderService_.deleteSession(session)
+
+        const selector = {
+          $pull: { payment_sessions: { provider_id: providerId } },
+        }
+
+        if (
+          cart.payment_method &&
+          cart.payment_method.provider_id === providerId
+        ) {
+          selector["$set"] = { payment_method: null }
+        }
+
+        return this.cartModel_
+          .updateOne({ _id: cart._id }, selector)
+          .then(result => {
+            // Notify subscribers
+            this.eventBus_.emit(CartService.Events.UPDATED, result)
+            return result
+          })
+      }
+    }
+
+    return cart
+  }
+
+  async updatePaymentSession(cartId, providerId, session) {
+    const cart = await this.retrieve(cartId)
+
+    return this.cartModel_
+      .updateOne(
+        {
+          _id: cart._id,
+          "payment_sessions.provider_id": providerId,
+        },
+        {
+          $set: { "payment_sessions.$": session },
+        }
+      )
+      .then(result => {
+        // Notify subscribers
+        this.eventBus_.emit(CartService.Events.UPDATED, result)
+        return result
+      })
+  }
+
   /**
    * Adds the shipping method to the list of shipping methods associated with
    * the cart. Shipping Methods are the ways that an order is shipped, whereas a

packages/medusa/src/services/customer.js

@@ -1,4 +1,4 @@
-import mongoose from "mongoose"
+import jwt from "jsonwebtoken"
 import bcrypt from "bcrypt"
 import _ from "lodash"
 import { Validator, MedusaError } from "medusa-core-utils"
@@ -102,6 +102,8 @@ class CustomerService extends BaseService {
     // Notify subscribers
     this.eventBus_.emit(CustomerService.Events.PASSWORD_RESET, {
       email: customer.email,
+      first_name: customer.first_name,
+      last_name: customer.last_name,
       token,
     })
     return token
@@ -328,7 +330,7 @@ class CustomerService extends BaseService {
    * @param {string[]} expandFields - fields to expand.
    * @return {Customer} return the decorated customer.
    */
-  async decorate(customer, fields, expandFields = []) {
+  async decorate(customer, fields = [], expandFields = []) {
     const requiredFields = ["_id", "metadata"]
     const decorated = _.pick(customer, fields.concat(requiredFields))
 

packages/medusa/src/services/payment-provider.js

@@ -32,6 +32,11 @@ class PaymentProviderService {
     return provider.updatePayment(paymentSession.data, cart)
   }
 
+  deleteSession(paymentSession) {
+    const provider = this.retrieveProvider(paymentSession.provider_id)
+    return provider.deletePayment(paymentSession.data)
+  }
+
   /**
    * Finds a provider given an id
    * @param {string} providerId - the id of the provider to get