fix(medusa): hide password hash (#429)

* auth tests

* customer auth tests

* user auth test

* store auth snapshot

* auth snapshot

* auth with deleted password hashes

* manual field input for test scripts

* fix circleci with double retrieve of user and customer

* add email validation to user

* fix: cleanup

Co-authored-by: Sebastian Rindom <skrindom@gmail.com>

packages/medusa/src/models/customer.ts

@@ -46,7 +46,7 @@ export class Customer {
   )
   shipping_addresses: Address[]
 
-  @Column({ nullable: true })
+  @Column({ nullable: true, select: false })
   password_hash: string
 
   @Column({ nullable: true })

packages/medusa/src/models/user.ts

@@ -26,7 +26,7 @@ export class User {
   @Column({ nullable: true })
   last_name: string
 
-  @Column({ nullable: true })
+  @Column({ nullable: true, select: false })
   password_hash: string
 
   @Column({ nullable: true })

packages/medusa/src/services/auth.js

@@ -76,12 +76,17 @@ class AuthService extends BaseService {
    */
   async authenticate(email, password) {
     try {
-      const user = await this.userService_.retrieveByEmail(email)
+      const userPasswordHash = await this.userService_.retrieveByEmail(email, {
+        select: ["password_hash"],
+      })
+
       const passwordsMatch = await this.comparePassword_(
         password,
-        user.password_hash
+        userPasswordHash.password_hash
       )
+
       if (passwordsMatch) {
+        const user = await this.userService_.retrieveByEmail(email)
         return {
           success: true,
           user,
@@ -113,8 +118,13 @@ class AuthService extends BaseService {
    */
   async authenticateCustomer(email, password) {
     try {
-      const customer = await this.customerService_.retrieveByEmail(email)
-      if (!customer.password_hash) {
+      const customerPasswordHash = await this.customerService_.retrieveByEmail(
+        email,
+        {
+          select: ["password_hash"],
+        }
+      )
+      if (!customerPasswordHash.password_hash) {
         return {
           success: false,
           error: "Invalid email or password",
@@ -123,9 +133,11 @@ class AuthService extends BaseService {
 
       const passwordsMatch = await this.comparePassword_(
         password,
-        customer.password_hash
+        customerPasswordHash.password_hash
       )
+
       if (passwordsMatch) {
+        const customer = await this.customerService_.retrieveByEmail(email)
         return {
           success: true,
           customer,

packages/medusa/src/services/user.js

@@ -48,7 +48,18 @@ class UserService extends BaseService {
    * @return {string} the validated email
    */
   validateEmail_(email) {
-    return email
+    const schema = Validator.string()
+      .email()
+      .required()
+    const { value, error } = schema.validate(email)
+    if (error) {
+      throw new MedusaError(
+        MedusaError.Types.INVALID_DATA,
+        "The email is not valid"
+      )
+    }
+
+    return value.toLowerCase()
   }
 
   /**
@@ -114,13 +125,11 @@ class UserService extends BaseService {
    * @param {string} email - the email of the user to get.
    * @return {Promise<User>} the user document.
    */
-  async retrieveByEmail(email, relations = []) {
+  async retrieveByEmail(email, config = {}) {
     const userRepo = this.manager_.getCustomRepository(this.userRepository_)
 
-    const user = await userRepo.findOne({
-      where: { email },
-      relations,
-    })
+    const query = this.buildQuery_({ email: email.toLowerCase() }, config)
+    const user = await userRepo.findOne(query)
 
     if (!user) {
       throw new MedusaError(