fix(medusa) Enforce authentication on users and invites (#953)

packages/medusa/src/api/routes/admin/invites/index.ts

@@ -4,15 +4,15 @@ import { DeleteResponse } from "../../../../types/common"
 import middlewares from "../../../middlewares"
 import "reflect-metadata"
 
-const route = Router()
-
 export const unauthenticatedInviteRoutes = (app) => {
+  const route = Router()
   app.use("/invites", route)
 
   route.post("/accept", middlewares.wrap(require("./accept-invite").default))
 }
 
 export default (app) => {
+  const route = Router()
   app.use("/invites", route)
 
   route.get("/", middlewares.wrap(require("./list-invites").default))

packages/medusa/src/api/routes/admin/users/index.ts

@@ -1,11 +1,10 @@
 import { Router } from "express"
-import _ from "lodash"
 import { User } from "../../../.."
 import { DeleteResponse } from "../../../../types/common"
 import middlewares from "../../../middlewares"
-const route = Router()
 
 export const unauthenticatedUserRoutes = (app) => {
+  const route = Router()
   app.use("/users", route)
 
   route.post(
@@ -20,6 +19,7 @@ export const unauthenticatedUserRoutes = (app) => {
 }
 
 export default (app) => {
+  const route = Router()
   app.use("/users", route)
 
   route.get("/:user_id", middlewares.wrap(require("./get-user").default))