feat: Remove returning token from customer and user endpoints (#7523)

* chore: Move generateJwtToken to utils

* feat: Stop returning token on user and customer endpoints

packages/admin-next/dashboard/src/hooks/api/customers.tsx

@@ -58,7 +58,7 @@ export const useCustomers = (
 
 export const useCreateCustomer = (
   options?: UseMutationOptions<
-    { customer: HttpTypes.AdminCustomer; token: string },
+    { customer: HttpTypes.AdminCustomer },
     Error,
     HttpTypes.AdminCreateCustomer
   >

packages/core/js-sdk/src/admin/index.ts

@@ -179,7 +179,6 @@ export class Admin {
     ) => {
       return this.client.fetch<{
         customer: HttpTypes.AdminCustomer
-        token: string
       }>(`/admin/customers`, {
         method: "POST",
         headers,

packages/core/js-sdk/src/store/index.ts

@@ -349,7 +349,6 @@ export class Store {
     ) => {
       return this.client.fetch<{
         customer: HttpTypes.StoreCustomer
-        token: string
       }>(`/store/customers`, {
         method: "POST",
         headers,

packages/core/utils/package.json

@@ -37,6 +37,7 @@
     "awilix": "^8.0.1",
     "bignumber.js": "^9.1.2",
     "dotenv": "^16.4.5",
+    "jsonwebtoken": "^9.0.2",
     "knex": "2.4.2",
     "ulid": "^2.3.0"
   },

packages/core/utils/src/auth/index.ts

@@ -1 +1,2 @@
 export * from "./abstract-auth-provider"
+export * from "./token"

packages/core/utils/src/auth/token.ts

@@ -1,14 +1,13 @@
-import { AuthContext } from "../../../types/routing"
 import jwt from "jsonwebtoken"
 
 export const generateJwtToken = (
-  authContext: AuthContext,
+  tokenPayload: Record<string, unknown>,
   jwtConfig: {
     secret: string
     expiresIn: string
   }
 ) => {
-  return jwt.sign(authContext, jwtConfig.secret, {
+  return jwt.sign(tokenPayload, jwtConfig.secret, {
     expiresIn: jwtConfig.expiresIn,
   })
 }

packages/medusa/package.json

@@ -69,7 +69,6 @@
     "glob": "^7.1.6",
     "ioredis": "^5.2.5",
     "ioredis-mock": "8.4.0",
-    "jsonwebtoken": "^9.0.0",
     "lodash": "^4.17.21",
     "medusa-telemetry": "^0.0.17",
     "morgan": "^1.9.1",

packages/medusa/src/api/admin/users/route.ts

@@ -10,7 +10,6 @@ import {
   MedusaResponse,
 } from "../../../types/routing"
 import { refetchUser } from "./helpers"
-import { generateJwtToken } from "../../utils/auth/token"
 
 export const GET = async (
   req: AuthenticatedMedusaRequest,
@@ -57,32 +56,13 @@ export const POST = async (
 
   const { result } = await createUserAccountWorkflow(req.scope).run(input)
 
-  const { http } = req.scope.resolve(
-    ContainerRegistrationKeys.CONFIG_MODULE
-  ).projectConfig
-  const { jwtSecret, jwtExpiresIn } = http
-  const token = generateJwtToken(
-    {
-      actor_id: result.id,
-      actor_type: "user",
-      auth_identity_id: req.auth_context.auth_identity_id,
-      app_metadata: {
-        user_id: result.id,
-      },
-    },
-    {
-      secret: jwtSecret,
-      expiresIn: jwtExpiresIn,
-    }
-  )
-
   const user = await refetchUser(
     result.id,
     req.scope,
     req.remoteQueryConfig.fields
   )
 
-  res.status(200).json({ user, token })
+  res.status(200).json({ user })
 }
 
 export const AUTHENTICATE = false

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/callback/route.ts

@@ -4,9 +4,12 @@ import {
   IAuthModuleService,
   ConfigModule,
 } from "@medusajs/types"
-import { ContainerRegistrationKeys, MedusaError } from "@medusajs/utils"
+import {
+  ContainerRegistrationKeys,
+  MedusaError,
+  generateJwtToken,
+} from "@medusajs/utils"
 import { MedusaRequest, MedusaResponse } from "../../../../../types/routing"
-import { generateJwtToken } from "../../../../utils/auth/token"
 
 export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
   const { actor_type, auth_provider } = req.params

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/route.ts

@@ -4,9 +4,12 @@ import {
   IAuthModuleService,
   ConfigModule,
 } from "@medusajs/types"
-import { ContainerRegistrationKeys, MedusaError } from "@medusajs/utils"
+import {
+  ContainerRegistrationKeys,
+  MedusaError,
+  generateJwtToken,
+} from "@medusajs/utils"
 import { MedusaRequest, MedusaResponse } from "../../../../types/routing"
-import { generateJwtToken } from "../../../utils/auth/token"
 
 export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
   const { actor_type, auth_provider } = req.params

packages/medusa/src/api/store/customers/route.ts

@@ -2,12 +2,11 @@ import {
   AuthenticatedMedusaRequest,
   MedusaResponse,
 } from "../../../types/routing"
-import { ContainerRegistrationKeys, MedusaError } from "@medusajs/utils"
+import { MedusaError } from "@medusajs/utils"
 
 import { createCustomerAccountWorkflow } from "@medusajs/core-flows"
 import { refetchCustomer } from "./helpers"
 import { StoreCreateCustomerType } from "./validators"
-import { generateJwtToken } from "../../utils/auth/token"
 
 export const POST = async (
   req: AuthenticatedMedusaRequest<StoreCreateCustomerType>,
@@ -28,30 +27,11 @@ export const POST = async (
     input: { customersData, authIdentityId: req.auth_context.auth_identity_id },
   })
 
-  const { http } = req.scope.resolve(
-    ContainerRegistrationKeys.CONFIG_MODULE
-  ).projectConfig
-  const { jwtSecret, jwtExpiresIn } = http
-  const token = generateJwtToken(
-    {
-      actor_id: result.id,
-      actor_type: "customer",
-      auth_identity_id: req.auth_context.auth_identity_id,
-      app_metadata: {
-        customer_id: result.id,
-      },
-    },
-    {
-      secret: jwtSecret,
-      expiresIn: jwtExpiresIn,
-    }
-  )
-
   const customer = await refetchCustomer(
     result.id,
     req.scope,
     req.remoteQueryConfig.fields
   )
 
-  res.status(200).json({ customer, token })
+  res.status(200).json({ customer })
 }

packages/medusa/src/loaders/helpers/routing/__fixtures__/server/index.ts

@@ -6,10 +6,10 @@ import {
 import {
   ContainerRegistrationKeys,
   createMedusaContainer,
+  generateJwtToken,
 } from "@medusajs/utils"
 import { asValue } from "awilix"
 import express from "express"
-import jwt from "jsonwebtoken"
 import querystring from "querystring"
 import supertest from "supertest"
 import apiLoader from "../../../../api"
@@ -121,7 +121,7 @@ export const createServer = async (rootDir) => {
       )
       headers.Cookie = headers.Cookie || ""
       if (opts.adminSession) {
-        const token = jwt.sign(
+        const token = generateJwtToken(
           {
             actor_id: opts.adminSession.userId || opts.adminSession.jwt?.userId,
             actor_type: "user",
@@ -130,14 +130,17 @@ export const createServer = async (rootDir) => {
                 opts.adminSession.userId || opts.adminSession.jwt?.userId,
             },
           },
-          config.projectConfig.http.jwtSecret!
+          {
+            secret: config.projectConfig.http.jwtSecret!,
+            expiresIn: "1d",
+          }
         )
 
         headers.Authorization = `Bearer ${token}`
       }
 
       if (opts.clientSession) {
-        const token = jwt.sign(
+        const token = generateJwtToken(
           {
             actor_id:
               opts.clientSession.customer_id ||
@@ -149,7 +152,7 @@ export const createServer = async (rootDir) => {
                 opts.clientSession.jwt?.customer_id,
             },
           },
-          config.projectConfig.http.jwtSecret!
+          { secret: config.projectConfig.http.jwtSecret!, expiresIn: "1d" }
         )
 
         headers.Authorization = `Bearer ${token}`

packages/modules/providers/auth-google/integration-tests/__tests__/services.spec.ts

@@ -1,9 +1,8 @@
-import { MedusaError } from "@medusajs/utils"
+import { generateJwtToken, MedusaError } from "@medusajs/utils"
 import { GoogleAuthService } from "../../src/services/google"
 jest.setTimeout(100000)
 import { http, HttpResponse } from "msw"
 import { setupServer } from "msw/node"
-import jwt from "jsonwebtoken"
 
 const sampleIdPayload = {
   iss: "https://accounts.google.com",
@@ -20,10 +19,12 @@ const sampleIdPayload = {
   given_name: "Test",
   family_name: "Admin",
   iat: 1716891837,
-  exp: 1716895437,
 }
 
-const encodedIdToken = jwt.sign(sampleIdPayload, "test")
+const encodedIdToken = generateJwtToken(sampleIdPayload, {
+  secret: "test",
+  expiresIn: "1d",
+})
 
 const baseUrl = "https://someurl.com"
 

yarn.lock

@@ -5572,7 +5572,6 @@ __metadata:
     ioredis: ^5.2.5
     ioredis-mock: 8.4.0
     jest: ^25.5.4
-    jsonwebtoken: ^9.0.0
     lodash: ^4.17.21
     medusa-telemetry: ^0.0.17
     morgan: ^1.9.1
@@ -6197,6 +6196,7 @@ __metadata:
     dotenv: ^16.4.5
     express: ^4.18.2
     jest: ^29.6.3
+    jsonwebtoken: ^9.0.2
     knex: 2.4.2
     rimraf: ^5.0.1
     ts-jest: ^29.1.1