fix: Validate identifier payload for reset password (#9302)

Closes CC-526

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/reset-password/route.ts

@@ -4,13 +4,14 @@ import {
   AuthenticatedMedusaRequest,
   MedusaResponse,
 } from "../../../../../types/routing"
+import { ResetPasswordRequestType } from "../../../validators"
 
 export const POST = async (
-  req: AuthenticatedMedusaRequest,
+  req: AuthenticatedMedusaRequest<ResetPasswordRequestType>,
   res: MedusaResponse
 ) => {
   const { auth_provider, actor_type } = req.params
-  const { identifier } = req.body
+  const { identifier } = req.validatedBody
 
   const { http } = req.scope.resolve(
     ContainerRegistrationKeys.CONFIG_MODULE

packages/medusa/src/api/auth/middlewares.ts

@@ -1,6 +1,8 @@
 import { authenticate, MiddlewareRoute } from "@medusajs/framework/http"
+import { validateAndTransformBody } from "../utils/validate-body"
 import { validateScopeProviderAssociation } from "./utils/validate-scope-provider-association"
 import { validateToken } from "./utils/validate-token"
+import { ResetPasswordRequest } from "./validators"
 
 export const authRoutesMiddlewares: MiddlewareRoute[] = [
   {
@@ -41,7 +43,10 @@ export const authRoutesMiddlewares: MiddlewareRoute[] = [
   {
     method: ["POST"],
     matcher: "/auth/:actor_type/:auth_provider/reset-password",
-    middlewares: [validateScopeProviderAssociation()],
+    middlewares: [
+      validateScopeProviderAssociation(),
+      validateAndTransformBody(ResetPasswordRequest),
+    ],
   },
   {
     method: ["POST"],

packages/medusa/src/api/auth/validators.ts

@@ -0,0 +1,6 @@
+import { z } from "zod"
+
+export const ResetPasswordRequest = z.object({
+  identifier: z.string(),
+})
+export type ResetPasswordRequestType = z.infer<typeof ResetPasswordRequest>