chore: Move token from params to headers (#11281)

* chore: Move token from params to body

* chore: Add type

* wip

* chore: clean up

* clean ip

integration-tests/http/__tests__/auth/admin/auth.spec.ts

@@ -150,6 +150,9 @@ medusaIntegrationTestRunner({
           .post("/auth/user/emailpass/reset-password", {})
           .catch((e) => e)
 
+        expect(errResponse.response.data.message).toEqual(
+          "Invalid request: Field 'identifier' is required"
+        )
         expect(errResponse.response.status).toEqual(400)
       })
 
@@ -170,15 +173,6 @@ medusaIntegrationTestRunner({
         expect(response.status).toEqual(201)
       })
 
-      it("should fail to generate token for existing user but no provider, but still respond with 201", async () => {
-        const response = await api.post(
-          "/auth/user/non-existing-provider/reset-password",
-          { identifier: "admin@medusa.js" }
-        )
-
-        expect(response.status).toEqual(201)
-      })
-
       it("should successfully reset password", async () => {
         // Register user
         await api.post("/auth/user/emailpass/register", {
@@ -199,10 +193,14 @@ medusaIntegrationTestRunner({
         })
 
         const response = await api.post(
-          `/auth/user/emailpass/update?token=${result}`,
+          `/auth/user/emailpass/update`,
           {
-            email: "test@medusa-commerce.com",
             password: "new_password",
+          },
+          {
+            headers: {
+              authorization: `Bearer ${result}`,
+            },
           }
         )
 
@@ -250,10 +248,15 @@ medusaIntegrationTestRunner({
         })
 
         const response = await api.post(
-          `/auth/user/emailpass/update?token=${result}`,
+          `/auth/user/emailpass/update`,
           {
             email: "test+new@medusa-commerce.com",
             password: "new_password",
+          },
+          {
+            headers: {
+              authorization: `Bearer ${result}`,
+            },
           }
         )
 
@@ -306,10 +309,17 @@ medusaIntegrationTestRunner({
         jest.advanceTimersByTime(15 * 60 * 1000)
 
         const response = await api
-          .post(`/auth/user/emailpass/update?token=${result}`, {
-            email: "test@medusa-commerce.com",
+          .post(
+            `/auth/user/emailpass/update`,
+            {
               password: "new_password",
-          })
+            },
+            {
+              headers: {
+                authorization: `Bearer ${result}`,
+              },
+            }
+          )
           .catch((e) => e)
 
         expect(response.response.status).toEqual(401)
@@ -363,10 +373,17 @@ medusaIntegrationTestRunner({
         jest.advanceTimersByTime(15 * 60 * 1000)
 
         const response = await api
-          .post(`/auth/customer/emailpass/update?token=${result}`, {
-            email: "test@medusa-commerce.com",
+          .post(
+            `/auth/customer/emailpass/update`,
+            {
               password: "new_password",
-          })
+            },
+            {
+              headers: {
+                authorization: `Bearer ${result}`,
+              },
+            }
+          )
           .catch((e) => e)
 
         expect(response.response.status).toEqual(401)
@@ -398,10 +415,17 @@ medusaIntegrationTestRunner({
         jest.advanceTimersByTime(15 * 60 * 1000)
 
         const response = await api
-          .post(`/auth/user/emailpass/update?token=${result}`, {
-            email: "test@medusa-commerce.com",
+          .post(
+            `/auth/user/emailpass/update`,
+            {
               password: "new_password",
-          })
+            },
+            {
+              headers: {
+                authorization: `Bearer ${result}`,
+              },
+            }
+          )
           .catch((e) => e)
 
         expect(response.response.status).toEqual(401)

packages/admin/dashboard/src/hooks/api/auth.tsx

@@ -62,7 +62,7 @@ export const useLogout = (options?: UseMutationOptions<void, FetchError>) => {
 
 export const useUpdateProviderForEmailPass = (
   token: string,
-  options?: UseMutationOptions<void, FetchError, { password: string }>
+  options?: UseMutationOptions<void, FetchError, HttpTypes.AdminUpdateProvider>
 ) => {
   return useMutation({
     mutationFn: (payload) =>

packages/core/core-flows/src/auth/workflows/generate-reset-password-token.ts

@@ -90,11 +90,6 @@ export const generateResetPasswordTokenWorkflow = createWorkflow(
       eventName: AuthWorkflowEvents.PASSWORD_RESET,
       data: {
         entity_id: input.entityId,
-        /**
-         * Use `actor_type` instead. Will be removed in a future version.
-         * @deprecated
-         */
-        actorType: input.actorType,
         actor_type: input.actorType,
         token,
       },

packages/core/framework/src/http/middlewares/authenticate-middleware.ts

@@ -170,7 +170,7 @@ const getAuthContextFromSession = (
   return null
 }
 
-const getAuthContextFromJwtToken = (
+export const getAuthContextFromJwtToken = (
   authHeader: string | undefined,
   jwtSecret: string,
   authTypes: AuthType[],

packages/core/js-sdk/src/auth/index.ts

@@ -280,16 +280,14 @@ export class Auth {
   updateProvider = async (
     actor: string,
     provider: string,
-    body: Record<string, unknown>,
+    body: HttpTypes.AdminUpdateProvider,
     token: string
   ) => {
-    await this.client.fetch(
-      `/auth/${actor}/${provider}/update?token=${token}`,
-      {
+    await this.client.fetch(`/auth/${actor}/${provider}/update`, {
       method: "POST",
       body,
-      }
-    )
+      headers: { Authorization: `Bearer ${token}` },
+    })
   }
 
   /**

packages/core/types/src/http/auth/payloads.ts

@@ -5,3 +5,7 @@ export interface AdminSignUpWithEmailPassword {
 
 export interface AdminSignInWithEmailPassword
   extends AdminSignUpWithEmailPassword {}
+
+export interface AdminUpdateProvider {
+  [key: string]: unknown // Allow for any additional fields, this will vary depending on the provider
+}

packages/medusa/src/api/auth/utils/validate-token.ts

@@ -1,5 +1,6 @@
 import {
   AuthenticatedMedusaRequest,
+  getAuthContextFromJwtToken,
   MedusaNextFunction,
   MedusaRequest,
   MedusaResponse,
@@ -10,20 +11,37 @@ import {
   MedusaError,
   Modules,
 } from "@medusajs/framework/utils"
-import { decode, JwtPayload, verify } from "jsonwebtoken"
+import { HttpTypes } from "@medusajs/types"
+
+export interface UpdateProviderJwtPayload {
+  entity_id: string
+  actor_type: string
+  provider: string
+}
 
 // Middleware to validate that a token is valid
 export const validateToken = () => {
   return async (
-    req: MedusaRequest,
+    req: MedusaRequest<HttpTypes.AdminUpdateProvider>,
     res: MedusaResponse,
     next: MedusaNextFunction
   ) => {
     const { actor_type, auth_provider } = req.params
-    const { token } = req.query
 
     const req_ = req as AuthenticatedMedusaRequest
 
+    // @ts-ignore
+    const { http } = req_.scope.resolve<ConfigModule>(
+      ContainerRegistrationKeys.CONFIG_MODULE
+    ).projectConfig
+
+    const token = getAuthContextFromJwtToken(
+      req.headers.authorization,
+      http.jwtSecret as string,
+      ["bearer"],
+      [actor_type]
+    ) as UpdateProviderJwtPayload | null
+
     const errorObject = new MedusaError(
       MedusaError.Types.UNAUTHORIZED,
       `Invalid token`
@@ -33,27 +51,15 @@ export const validateToken = () => {
       return next(errorObject)
     }
 
-    // @ts-ignore
-    const { http } = req_.scope.resolve<ConfigModule>(
-      ContainerRegistrationKeys.CONFIG_MODULE
-    ).projectConfig
-
     const authModule = req.scope.resolve<IAuthModuleService>(Modules.AUTH)
 
-    const decoded = decode(token as string) as JwtPayload
-
-    if (!decoded?.entity_id) {
-      return next(errorObject)
-    }
-
-    // E.g. token was requested for a customer, but attempted used for a user
-    if (decoded?.actor_type !== actor_type) {
+    if (!token?.entity_id) {
       return next(errorObject)
     }
 
     const [providerIdentity] = await authModule.listProviderIdentities(
       {
-        entity_id: decoded.entity_id,
+        entity_id: token.entity_id,
         provider: auth_provider,
       },
       {
@@ -65,12 +71,6 @@ export const validateToken = () => {
       return next(errorObject)
     }
 
-    try {
-      verify(token as string, http.jwtSecret as string) as JwtPayload
-    } catch (error) {
-      return next(errorObject)
-    }
-
     req_.auth_context = {
       actor_type,
       auth_identity_id: providerIdentity.auth_identity_id!,