feat(auth): Revamp authentication setup (#7387)

* chore: Clean up authentication middlewares

* chore: Rename AuthUser to AuthIdentity

* feat: Define link between user, customer, and auth identity

* feat: Use links for auth, update auth context content

* fix: Adjust user create command with new auth setup

* fix: Make auth login more dynamic, review fixes

* fix: Change test assertions for created by

packages/medusa/src/utils/middlewares/authenticate-middleware.ts

@@ -1,14 +1,9 @@
 import { ModuleRegistrationName } from "@medusajs/modules-sdk"
-import {
-  ApiKeyDTO,
-  AuthUserDTO,
-  ConfigModule,
-  IApiKeyModuleService,
-} from "@medusajs/types"
-import { stringEqualsOrRegexMatch } from "@medusajs/utils"
+import { ApiKeyDTO, ConfigModule, IApiKeyModuleService } from "@medusajs/types"
 import { NextFunction, RequestHandler } from "express"
 import jwt, { JwtPayload } from "jsonwebtoken"
 import {
+  AuthContext,
   AuthenticatedMedusaRequest,
   MedusaRequest,
   MedusaResponse,
@@ -20,13 +15,18 @@ const API_KEY_AUTH = "api-key"
 
 type AuthType = typeof SESSION_AUTH | typeof BEARER_AUTH | typeof API_KEY_AUTH
 
+const ADMIN_SCOPE = "admin"
+const STORE_SCOPE = "store"
+const ALL_SCOPE = "*"
+
+type Scope = typeof ADMIN_SCOPE | typeof STORE_SCOPE | typeof ALL_SCOPE
+
 type MedusaSession = {
-  auth_user: AuthUserDTO
-  scope: string
+  auth_context: AuthContext
 }
 
 export const authenticate = (
-  authScope: string | RegExp,
+  authScope: Scope | Scope[],
   authType: AuthType | AuthType[],
   options: { allowUnauthenticated?: boolean; allowUnregistered?: boolean } = {}
 ): RequestHandler => {
@@ -36,63 +36,58 @@ export const authenticate = (
     next: NextFunction
   ): Promise<void> => {
     const authTypes = Array.isArray(authType) ? authType : [authType]
+    const scopes = Array.isArray(authScope) ? authScope : [authScope]
+    const req_ = req as AuthenticatedMedusaRequest
 
     // We only allow authenticating using a secret API key on the admin
-    if (authTypes.includes(API_KEY_AUTH) && isAdminScope(authScope)) {
+    const isExclusivelyAdmin =
+      scopes.length === 1 && scopes.includes(ADMIN_SCOPE)
+    if (authTypes.includes(API_KEY_AUTH) && isExclusivelyAdmin) {
       const apiKey = await getApiKeyInfo(req)
       if (apiKey) {
-        ;(req as AuthenticatedMedusaRequest).auth = {
+        req_.auth_context = {
           actor_id: apiKey.id,
-          auth_user_id: "",
+          actor_type: "api-key",
+          auth_identity_id: "",
           app_metadata: {},
-          // TODO: Add more limited scope once we have support for it in the API key module
-          scope: "admin",
+          scope: ADMIN_SCOPE,
         }
 
         return next()
       }
     }
 
-    let authUser: AuthUserDTO | null = getAuthUserFromSession(
+    // We try to extract the auth context either from the session or from a JWT token
+    let authContext: AuthContext | null = getAuthContextFromSession(
       req.session,
       authTypes,
-      authScope
+      scopes
     )
 
-    if (!authUser) {
+    if (!authContext) {
       const { http } =
         req.scope.resolve<ConfigModule>("configModule").projectConfig
-      authUser = getAuthUserFromJwtToken(
+      authContext = getAuthContextFromJwtToken(
         req.headers.authorization,
         http.jwtSecret!,
         authTypes,
-        authScope
+        scopes
       )
     }
 
-    const isMedusaScope = isAdminScope(authScope) || isStoreScope(authScope)
-
-    const isRegistered =
-      !isMedusaScope ||
-      (authUser?.app_metadata?.user_id &&
-        stringEqualsOrRegexMatch(authScope, "admin")) ||
-      (authUser?.app_metadata?.customer_id &&
-        stringEqualsOrRegexMatch(authScope, "store"))
-
-    if (
-      authUser &&
-      (isRegistered || (!isRegistered && options.allowUnregistered))
-    ) {
-      ;(req as AuthenticatedMedusaRequest).auth = {
-        actor_id: getActorId(authUser, authScope) as string, // TODO: fix types for auth_users not in the medusa system
-        auth_user_id: authUser.id,
-        app_metadata: authUser.app_metadata,
-        scope: authUser.scope,
-      }
-
+    // If the entity is authenticated, and it is a registered user/customer we can continue
+    if (!!authContext?.actor_id && authContext.actor_type !== "unknown") {
+      req_.auth_context = authContext
       return next()
     }
 
+    // If the entity is authenticated, but there is no user/customer yet, we can continue (eg. in the case of a user invite) if allow unregistered is set
+    if (authContext?.auth_identity_id && options.allowUnregistered) {
+      req_.auth_context = authContext
+      return next()
+    }
+
+    // If we allow unauthenticated requests (i.e public endpoints), just continue
     if (options.allowUnauthenticated) {
       return next()
     }
@@ -144,31 +139,32 @@ const getApiKeyInfo = async (req: MedusaRequest): Promise<ApiKeyDTO | null> => {
   }
 }
 
-const getAuthUserFromSession = (
+const getAuthContextFromSession = (
   session: Partial<MedusaSession> = {},
   authTypes: AuthType[],
-  authScope: string | RegExp
-): AuthUserDTO | null => {
+  scopes: Scope[]
+): AuthContext | null => {
   if (!authTypes.includes(SESSION_AUTH)) {
     return null
   }
 
   if (
-    session.auth_user &&
-    stringEqualsOrRegexMatch(authScope, session.auth_user.scope)
+    session.auth_context &&
+    (scopes.includes("*") ||
+      scopes.includes(session.auth_context.scope as Scope))
   ) {
-    return session.auth_user
+    return session.auth_context
   }
 
   return null
 }
 
-const getAuthUserFromJwtToken = (
+const getAuthContextFromJwtToken = (
   authHeader: string | undefined,
   jwtSecret: string,
   authTypes: AuthType[],
-  authScope: string | RegExp
-): AuthUserDTO | null => {
+  scopes: Scope[]
+): AuthContext | null => {
   if (!authTypes.includes(BEARER_AUTH)) {
     return null
   }
@@ -189,8 +185,8 @@ const getAuthUserFromJwtToken = (
       // verify token and set authUser
       try {
         const verified = jwt.verify(token, jwtSecret) as JwtPayload
-        if (stringEqualsOrRegexMatch(authScope, verified.scope)) {
-          return verified as AuthUserDTO
+        if (scopes.includes("*") || scopes.includes(verified.scope)) {
+          return verified as AuthContext
         }
       } catch (err) {
         return null
@@ -200,26 +196,3 @@ const getAuthUserFromJwtToken = (
 
   return null
 }
-
-const getActorId = (
-  authUser: AuthUserDTO,
-  scope: string | RegExp
-): string | undefined => {
-  if (stringEqualsOrRegexMatch(scope, "admin")) {
-    return authUser.app_metadata.user_id as string
-  }
-
-  if (stringEqualsOrRegexMatch(scope, "store")) {
-    return authUser.app_metadata.customer_id as string
-  }
-
-  return undefined
-}
-
-const isAdminScope = (authScope: string | RegExp): boolean => {
-  return stringEqualsOrRegexMatch(authScope, "admin")
-}
-
-const isStoreScope = (authScope: string | RegExp): boolean => {
-  return stringEqualsOrRegexMatch(authScope, "store")
-}