feat: Update authentication middleware (#6447)

* authentication middleware update

* disable customer authentication

* call correct feature flag method

* fix authentication middleware for store/customers

* fix integration tests and add middleware for admin customers

* update seeders

* customer groups fix

* add authentication middleware for all admin endpoints

* Feat(medusa, user): require authentication for invite accept (#6448)

* initial invite token validation for authentication invocation

* remove invite auth

* remove unused import

* cleanup tests

* refactor to auth instead of auth_user

* pr feedback

* update authenticatedRequest type

* update store authenticated endpoints

* update routes with type

* fix build

* fix build

* fix build

* use auth middleware for api-keys

packages/medusa/src/utils/authenticate-middleware.ts

@@ -1,8 +1,13 @@
-import { MedusaRequest, MedusaResponse } from "../types/routing"
+import { AuthUserDTO, IUserModuleService } from "@medusajs/types"
+import {
+  AuthenticatedMedusaRequest,
+  MedusaRequest,
+  MedusaResponse,
+} from "../types/routing"
 import { NextFunction, RequestHandler } from "express"
 import jwt, { JwtPayload } from "jsonwebtoken"
 
-import { AuthUserDTO } from "@medusajs/types"
+import { StringChain } from "lodash"
 import { stringEqualsOrRegexMatch } from "@medusajs/utils"
 
 const SESSION_AUTH = "session"
@@ -18,7 +23,7 @@ type AuthType = "session" | "bearer"
 export const authenticate = (
   authScope: string | RegExp,
   authType: AuthType | AuthType[],
-  options: { allowUnauthenticated?: boolean } = {}
+  options: { allowUnauthenticated?: boolean; allowUnregistered?: boolean } = {}
 ): RequestHandler => {
   return async (
     req: MedusaRequest,
@@ -67,9 +72,24 @@ export const authenticate = (
       }
     }
 
-    if (authUser) {
-      req.auth_user = {
-        id: authUser.id,
+    const isMedusaScope =
+      stringEqualsOrRegexMatch(authScope, "admin") ||
+      stringEqualsOrRegexMatch(authScope, "store")
+
+    const isRegistered =
+      !isMedusaScope ||
+      (authUser?.app_metadata?.user_id &&
+        stringEqualsOrRegexMatch(authScope, "admin")) ||
+      (authUser?.app_metadata?.customer_id &&
+        stringEqualsOrRegexMatch(authScope, "store"))
+
+    if (
+      authUser &&
+      (isRegistered || (!isRegistered && options.allowUnregistered))
+    ) {
+      ;(req as AuthenticatedMedusaRequest).auth = {
+        actor_id: getActorId(authUser, authScope) as string, // TODO: fix types for auth_users not in the medusa system
+        auth_user_id: authUser.id,
         app_metadata: authUser.app_metadata,
         scope: authUser.scope,
       }
@@ -83,3 +103,18 @@ export const authenticate = (
     res.status(401).json({ message: "Unauthorized" })
   }
 }
+
+const getActorId = (
+  authUser: AuthUserDTO,
+  scope: string | RegExp
+): string | undefined => {
+  if (stringEqualsOrRegexMatch(scope, "admin")) {
+    return authUser.app_metadata.user_id as string
+  }
+
+  if (stringEqualsOrRegexMatch(scope, "store")) {
+    return authUser.app_metadata.customer_id as string
+  }
+
+  return undefined
+}