Revamp the authentication setup (#7419)

* feat: Add email pass authentication provider package

* feat: Revamp auth module and remove concept of scope

* feat: Revamp the auth module to be more standardized in how providers are loaded

* feat: Switch from scope to actor type for authentication

* feat: Add support for per-actor auth methods

* feat: Add emailpass auth provider by default

* fix: Add back app_metadata in auth module

integration-tests/api/__tests__/admin/auth.js

@@ -33,7 +33,7 @@ medusaIntegrationTestRunner({
           })
         },
         async () => {
-          return await api.post("/auth/admin/emailpass", {
+          return await api.post("/auth/user/emailpass", {
             email: "admin@medusa.js",
             password: "secret_password",
           })
@@ -63,7 +63,7 @@ medusaIntegrationTestRunner({
 
     it("should test the entire authentication lifecycle", async () => {
       // sign in
-      const response = await api.post("/auth/admin/emailpass", {
+      const response = await api.post("/auth/user/emailpass", {
         email: "admin@medusa.js",
         password: "secret_password",
       })

integration-tests/api/__tests__/admin/user.js

@@ -175,7 +175,7 @@ medusaIntegrationTestRunner({
         token = await breaking(
           () => null,
           async () => {
-            const emailPassResponse = await api.post("/auth/admin/emailpass", {
+            const emailPassResponse = await api.post("/auth/user/emailpass", {
               email: "test@test123.com",
               password: "test123",
             })
@@ -230,7 +230,7 @@ medusaIntegrationTestRunner({
 
       // V2 only test
       it.skip("should throw, if session/bearer auth is present for existing user", async () => {
-        const emailPassResponse = await api.post("/auth/admin/emailpass", {
+        const emailPassResponse = await api.post("/auth/user/emailpass", {
           email: "test@test123.com",
           password: "test123",
         })

integration-tests/api/medusa-config.js

@@ -41,22 +41,7 @@ module.exports = {
       options: { ttl: cacheTTL },
     },
     workflows: true,
-    [Modules.AUTH]: {
-      scope: "internal",
-      resources: "shared",
-      resolve: "@medusajs/auth",
-      options: {
-        providers: [
-          {
-            name: "emailpass",
-            scopes: {
-              admin: {},
-              store: {},
-            },
-          },
-        ],
-      },
-    },
+    [Modules.AUTH]: true,
     [Modules.USER]: {
       scope: "internal",
       resources: "shared",

integration-tests/helpers/create-admin-user.ts

@@ -32,7 +32,6 @@ export const createAdminUser = async (
   const authIdentity = await authModule.create({
     provider: "emailpass",
     entity_id: "admin@medusa.js",
-    scope: "admin",
     provider_metadata: {
       password: "somepassword",
     },
@@ -55,8 +54,6 @@ export const createAdminUser = async (
       actor_id: user.id,
       actor_type: "user",
       auth_identity_id: authIdentity.id,
-      scope: "admin",
-      app_metadata: {},
     },
     "test"
   )

integration-tests/modules/__tests__/auth/admin/email-password-provider.spec.ts

@@ -43,14 +43,13 @@ medusaIntegrationTestRunner({
         await authService.create({
           provider: "emailpass",
           entity_id: email,
-          scope: "admin",
           provider_metadata: {
             password: passwordHash,
           },
         })
 
         const response = await api
-          .post(`/auth/admin/emailpass`, {
+          .post(`/auth/user/emailpass`, {
             email: email,
             password: password,
           })
@@ -75,14 +74,13 @@ medusaIntegrationTestRunner({
         await authService.create({
           provider: "emailpass",
           entity_id: email,
-          scope: "admin",
           provider_metadata: {
             password: passwordHash,
           },
         })
 
         const error = await api
-          .post(`/auth/admin/emailpass`, {
+          .post(`/auth/user/emailpass`, {
             email: email,
             password: "incorrect-password",
           })
@@ -101,7 +99,7 @@ medusaIntegrationTestRunner({
         ).toString("base64")
 
         const error = await api
-          .post(`/auth/admin/emailpass`, {
+          .post(`/auth/user/emailpass`, {
             email: "should-not-exist",
             password: "should-not-exist",
           })

integration-tests/modules/__tests__/customer/store/create-customer.spec.ts

@@ -38,7 +38,6 @@ medusaIntegrationTestRunner({
         const authIdentity = await authService.create({
           entity_id: "store_user",
           provider: "emailpass",
-          scope: "store",
         })
 
         const token = jwt.sign(authIdentity, http.jwtSecret)

integration-tests/modules/__tests__/invites/accept-invite.spec.ts

@@ -27,7 +27,7 @@ medusaIntegrationTestRunner({
       })
 
       it("should fail to accept an invite with an invalid invite token", async () => {
-        const authResponse = await api.post(`/auth/admin/emailpass`, {
+        const authResponse = await api.post(`/auth/user/emailpass`, {
           email: "potential_member@test.com",
           password: "supersecret",
         })
@@ -58,7 +58,7 @@ medusaIntegrationTestRunner({
           email: "potential_member@test.com",
         })
 
-        const authResponse = await api.post(`/auth/admin/emailpass`, {
+        const authResponse = await api.post(`/auth/user/emailpass`, {
           email: "potential_member@test.com",
           password: "supersecret",
         })
@@ -92,7 +92,7 @@ medusaIntegrationTestRunner({
           email: "potential_member@test.com",
         })
 
-        const authResponse = await api.post(`/auth/admin/emailpass`, {
+        const authResponse = await api.post(`/auth/user/emailpass`, {
           email: "some-email@test.com",
           password: "supersecret",
         })

integration-tests/modules/helpers/create-authenticated-customer.ts

@@ -25,7 +25,6 @@ export const createAuthenticatedCustomer = async (
   const authIdentity = await authService.create({
     entity_id: "store_user",
     provider: "emailpass",
-    scope: "store",
   })
 
   // Ideally we simulate a signup process than manually linking here.
@@ -45,8 +44,6 @@ export const createAuthenticatedCustomer = async (
       actor_id: customer.id,
       actor_type: "customer",
       auth_identity_id: authIdentity.id,
-      scope: "store",
-      app_metadata: {},
     },
     http.jwtSecret
   )

integration-tests/modules/medusa-config.js

@@ -47,22 +47,7 @@ module.exports = {
     medusa_v2: enableMedusaV2,
   },
   modules: {
-    [Modules.AUTH]: {
-      scope: "internal",
-      resources: "shared",
-      resolve: "@medusajs/auth",
-      options: {
-        providers: [
-          {
-            name: "emailpass",
-            scopes: {
-              admin: {},
-              store: {},
-            },
-          },
-        ],
-      },
-    },
+    [Modules.AUTH]: true,
     [Modules.USER]: {
       scope: "internal",
       resources: "shared",

integration-tests/scripts/cli/login.sh

@@ -5,7 +5,7 @@ status_code=$(curl \
   -H "Content-Type: application/json"\
   -d '{"email":"'$1'", "password":"'$2'"}'\
   --write-out %{http_code}\
-  http://localhost:9000/auth/admin/emailpass)
+  http://localhost:9000/auth/user/emailpass)
 
 if [[ "$status_code" -ne 200 ]] ; then
   echo "Site status changed to $status_code"