feat: Remove returning token from customer and user endpoints (#7523)

* chore: Move generateJwtToken to utils

* feat: Stop returning token on user and customer endpoints

packages/medusa/package.json

@@ -69,7 +69,6 @@
     "glob": "^7.1.6",
     "ioredis": "^5.2.5",
     "ioredis-mock": "8.4.0",
-    "jsonwebtoken": "^9.0.0",
     "lodash": "^4.17.21",
     "medusa-telemetry": "^0.0.17",
     "morgan": "^1.9.1",

packages/medusa/src/api/admin/users/route.ts

@@ -10,7 +10,6 @@ import {
   MedusaResponse,
 } from "../../../types/routing"
 import { refetchUser } from "./helpers"
-import { generateJwtToken } from "../../utils/auth/token"
 
 export const GET = async (
   req: AuthenticatedMedusaRequest,
@@ -57,32 +56,13 @@ export const POST = async (
 
   const { result } = await createUserAccountWorkflow(req.scope).run(input)
 
-  const { http } = req.scope.resolve(
-    ContainerRegistrationKeys.CONFIG_MODULE
-  ).projectConfig
-  const { jwtSecret, jwtExpiresIn } = http
-  const token = generateJwtToken(
-    {
-      actor_id: result.id,
-      actor_type: "user",
-      auth_identity_id: req.auth_context.auth_identity_id,
-      app_metadata: {
-        user_id: result.id,
-      },
-    },
-    {
-      secret: jwtSecret,
-      expiresIn: jwtExpiresIn,
-    }
-  )
-
   const user = await refetchUser(
     result.id,
     req.scope,
     req.remoteQueryConfig.fields
   )
 
-  res.status(200).json({ user, token })
+  res.status(200).json({ user })
 }
 
 export const AUTHENTICATE = false

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/callback/route.ts

@@ -4,9 +4,12 @@ import {
   IAuthModuleService,
   ConfigModule,
 } from "@medusajs/types"
-import { ContainerRegistrationKeys, MedusaError } from "@medusajs/utils"
+import {
+  ContainerRegistrationKeys,
+  MedusaError,
+  generateJwtToken,
+} from "@medusajs/utils"
 import { MedusaRequest, MedusaResponse } from "../../../../../types/routing"
-import { generateJwtToken } from "../../../../utils/auth/token"
 
 export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
   const { actor_type, auth_provider } = req.params

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/route.ts

@@ -4,9 +4,12 @@ import {
   IAuthModuleService,
   ConfigModule,
 } from "@medusajs/types"
-import { ContainerRegistrationKeys, MedusaError } from "@medusajs/utils"
+import {
+  ContainerRegistrationKeys,
+  MedusaError,
+  generateJwtToken,
+} from "@medusajs/utils"
 import { MedusaRequest, MedusaResponse } from "../../../../types/routing"
-import { generateJwtToken } from "../../../utils/auth/token"
 
 export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
   const { actor_type, auth_provider } = req.params

packages/medusa/src/api/store/customers/route.ts

@@ -2,12 +2,11 @@ import {
   AuthenticatedMedusaRequest,
   MedusaResponse,
 } from "../../../types/routing"
-import { ContainerRegistrationKeys, MedusaError } from "@medusajs/utils"
+import { MedusaError } from "@medusajs/utils"
 
 import { createCustomerAccountWorkflow } from "@medusajs/core-flows"
 import { refetchCustomer } from "./helpers"
 import { StoreCreateCustomerType } from "./validators"
-import { generateJwtToken } from "../../utils/auth/token"
 
 export const POST = async (
   req: AuthenticatedMedusaRequest<StoreCreateCustomerType>,
@@ -28,30 +27,11 @@ export const POST = async (
     input: { customersData, authIdentityId: req.auth_context.auth_identity_id },
   })
 
-  const { http } = req.scope.resolve(
-    ContainerRegistrationKeys.CONFIG_MODULE
-  ).projectConfig
-  const { jwtSecret, jwtExpiresIn } = http
-  const token = generateJwtToken(
-    {
-      actor_id: result.id,
-      actor_type: "customer",
-      auth_identity_id: req.auth_context.auth_identity_id,
-      app_metadata: {
-        customer_id: result.id,
-      },
-    },
-    {
-      secret: jwtSecret,
-      expiresIn: jwtExpiresIn,
-    }
-  )
-
   const customer = await refetchCustomer(
     result.id,
     req.scope,
     req.remoteQueryConfig.fields
   )
 
-  res.status(200).json({ customer, token })
+  res.status(200).json({ customer })
 }

packages/medusa/src/api/utils/auth/token.ts

@@ -1,14 +0,0 @@
-import { AuthContext } from "../../../types/routing"
-import jwt from "jsonwebtoken"
-
-export const generateJwtToken = (
-  authContext: AuthContext,
-  jwtConfig: {
-    secret: string
-    expiresIn: string
-  }
-) => {
-  return jwt.sign(authContext, jwtConfig.secret, {
-    expiresIn: jwtConfig.expiresIn,
-  })
-}

packages/medusa/src/loaders/helpers/routing/__fixtures__/server/index.ts

@@ -6,10 +6,10 @@ import {
 import {
   ContainerRegistrationKeys,
   createMedusaContainer,
+  generateJwtToken,
 } from "@medusajs/utils"
 import { asValue } from "awilix"
 import express from "express"
-import jwt from "jsonwebtoken"
 import querystring from "querystring"
 import supertest from "supertest"
 import apiLoader from "../../../../api"
@@ -121,7 +121,7 @@ export const createServer = async (rootDir) => {
       )
       headers.Cookie = headers.Cookie || ""
       if (opts.adminSession) {
-        const token = jwt.sign(
+        const token = generateJwtToken(
           {
             actor_id: opts.adminSession.userId || opts.adminSession.jwt?.userId,
             actor_type: "user",
@@ -130,14 +130,17 @@ export const createServer = async (rootDir) => {
                 opts.adminSession.userId || opts.adminSession.jwt?.userId,
             },
           },
-          config.projectConfig.http.jwtSecret!
+          {
+            secret: config.projectConfig.http.jwtSecret!,
+            expiresIn: "1d",
+          }
         )
 
         headers.Authorization = `Bearer ${token}`
       }
 
       if (opts.clientSession) {
-        const token = jwt.sign(
+        const token = generateJwtToken(
           {
             actor_id:
               opts.clientSession.customer_id ||
@@ -149,7 +152,7 @@ export const createServer = async (rootDir) => {
                 opts.clientSession.jwt?.customer_id,
             },
           },
-          config.projectConfig.http.jwtSecret!
+          { secret: config.projectConfig.http.jwtSecret!, expiresIn: "1d" }
         )
 
         headers.Authorization = `Bearer ${token}`