fix: Validate identifier payload for reset password (#9302)

Closes CC-526

integration-tests/http/__tests__/auth/admin/auth.spec.ts

@@ -139,15 +139,23 @@ medusaIntegrationTestRunner({
     describe("Reset password flows", () => {
       it("should generate a reset password token", async () => {
         const response = await api.post("/auth/user/emailpass/reset-password", {
-          email: "admin@medusa.js",
+          identifier: "admin@medusa.js",
         })
 
         expect(response.status).toEqual(201)
       })
 
+      it("should fail if identifier is not provided", async () => {
+        const errResponse = await api
+          .post("/auth/user/emailpass/reset-password", {})
+          .catch((e) => e)
+
+        expect(errResponse.response.status).toEqual(400)
+      })
+
       it("should fail to generate token for non-existing user, but still respond with 201", async () => {
         const response = await api.post("/auth/user/emailpass/reset-password", {
-          email: "non-existing-user@medusa.js",
+          identifier: "non-existing-user@medusa.js",
         })
 
         expect(response.status).toEqual(201)
@@ -156,7 +164,7 @@ medusaIntegrationTestRunner({
       it("should fail to generate token for existing user but no provider, but still respond with 201", async () => {
         const response = await api.post(
           "/auth/user/non-existing-provider/reset-password",
-          { email: "admin@medusa.js" }
+          { identifier: "admin@medusa.js" }
         )
 
         expect(response.status).toEqual(201)
@@ -165,7 +173,7 @@ medusaIntegrationTestRunner({
       it("should fail to generate token for existing user but no provider, but still respond with 201", async () => {
         const response = await api.post(
           "/auth/user/non-existing-provider/reset-password",
-          { email: "admin@medusa.js" }
+          { identifier: "admin@medusa.js" }
         )
 
         expect(response.status).toEqual(201)

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/reset-password/route.ts

@@ -4,13 +4,14 @@ import {
   AuthenticatedMedusaRequest,
   MedusaResponse,
 } from "../../../../../types/routing"
+import { ResetPasswordRequestType } from "../../../validators"
 
 export const POST = async (
-  req: AuthenticatedMedusaRequest,
+  req: AuthenticatedMedusaRequest<ResetPasswordRequestType>,
   res: MedusaResponse
 ) => {
   const { auth_provider, actor_type } = req.params
-  const { identifier } = req.body
+  const { identifier } = req.validatedBody
 
   const { http } = req.scope.resolve(
     ContainerRegistrationKeys.CONFIG_MODULE

packages/medusa/src/api/auth/middlewares.ts

@@ -1,6 +1,8 @@
 import { authenticate, MiddlewareRoute } from "@medusajs/framework/http"
+import { validateAndTransformBody } from "../utils/validate-body"
 import { validateScopeProviderAssociation } from "./utils/validate-scope-provider-association"
 import { validateToken } from "./utils/validate-token"
+import { ResetPasswordRequest } from "./validators"
 
 export const authRoutesMiddlewares: MiddlewareRoute[] = [
   {
@@ -41,7 +43,10 @@ export const authRoutesMiddlewares: MiddlewareRoute[] = [
   {
     method: ["POST"],
     matcher: "/auth/:actor_type/:auth_provider/reset-password",
-    middlewares: [validateScopeProviderAssociation()],
+    middlewares: [
+      validateScopeProviderAssociation(),
+      validateAndTransformBody(ResetPasswordRequest),
+    ],
   },
   {
     method: ["POST"],

packages/medusa/src/api/auth/validators.ts

@@ -0,0 +1,6 @@
+import { z } from "zod"
+
+export const ResetPasswordRequest = z.object({
+  identifier: z.string(),
+})
+export type ResetPasswordRequestType = z.infer<typeof ResetPasswordRequest>