+ Hello{{#if email}} {{email}}{{/if}}, +
++ We received a request to reset your password. Click the button below to create a new password for your account. +
+diff --git a/www/apps/book/public/llms-full.txt b/www/apps/book/public/llms-full.txt index 0c7819ac84..968cfe30ca 100644 --- a/www/apps/book/public/llms-full.txt +++ b/www/apps/book/public/llms-full.txt @@ -24919,23 +24919,72 @@ Medusa provides the following authentication providers out-of-the-box. You can u *** -# How to Handle Password Reset Token Event +# Send Reset Password Email Notification -In this guide, you'll learn how to handle the `auth.password_reset` event, which is emitted when a request is sent to the [Generate Reset Password Token API route](https://docs.medusajs.com/Users/shahednasser/medusa/www/apps/resources/app/commerce-modules/auth/authentication-route#generate-reset-password-token-route/index.html.md). +In this guide, you'll learn how to handle the `auth.password_reset` event to send a reset password email (or other notification type) to users. Refer to this [Medusa Admin User Guide](https://docs.medusajs.com/user-guide/reset-password/index.html.md) to learn how to reset your user admin password using the dashboard. -You'll create a subscriber that listens to the event. When the event is emitted, the subscriber sends an email notification to the user. +## Reset Password Flow Overview -### Prerequisites + -- [A notification provider module, such as SendGrid](https://docs.medusajs.com/infrastructure-modules/notification/sendgrid/index.html.md) +Users of any actor type (admin, customer, or custom actor type) can request to reset their password. The flow for resetting a password is as follows: -## 1. Create Subscriber +1. The user requests to reset their password either through the frontend (for example, [Medusa Admin](https://docs.medusajs.com/user-guide/reset-password/index.html.md)) or the [Generate Reset Password Token API route](https://docs.medusajs.com/Users/shahednasser/medusa/www/apps/resources/app/commerce-modules/auth/authentication-route#generate-reset-password-token-route/index.html.md). +2. The Medusa application generates a password reset token and emits the `auth.password_reset` event. + - At this point, you can handle the event to send a notification to the user with instructions on how to reset their password. +3. The user receives the notification and clicks on the link to reset their password. + - The user can reset their password either through the frontend (for example, [Medusa Admin](https://docs.medusajs.com/user-guide/reset-password/index.html.md)) or the [Reset Password API route](https://docs.medusajs.com/Users/shahednasser/medusa/www/apps/resources/app/commerce-modules/auth/authentication-route#reset-password-route/index.html.md). -The first step is to create a subscriber that listens to the `auth.password_reset` and sends the user a notification with instructions to reset their password. +In this guide, you'll implement a subscriber that handles the `auth.password_reset` event to send an email notification to the user with instructions on how to reset their password. -Create the file `src/subscribers/handle-reset.ts` with the following content: +After adding the subscriber, you will have a complete reset password flow you can utilize using the Medusa admin, storefront, or API routes. + +*** + +## Prerequisites: Notification Module Provider + +To send an email or notification to the user, you must have a Notification Module Provider set up. + +Medusa provides providers like [SendGrid](https://docs.medusajs.com/Users/shahednasser/medusa/www/apps/resources/app/infrastructure-modules/notification/sendgrid/index.html.md) and [Resend](https://docs.medusajs.com/Users/shahednasser/medusa/www/apps/resources/app/integrations/guides/resend/index.html.md), and you can also [create your own custom provider](https://docs.medusajs.com/references/notification-provider-module/index.html.md). + +Refer to the [Notification Module](https://docs.medusajs.com/Users/shahednasser/medusa/www/apps/resources/app/infrastructure-modules/notification#what-is-a-notification-module-provider/index.html.md) documentation for a list of available providers and how to set them up. + +### Testing with the Local Notification Module Provider + +For testing purposes, you can use the [Local Notification Module Provider](https://docs.medusajs.com/Users/shahednasser/medusa/www/apps/resources/app/infrastructure-modules/notification/local/index.html.md) by adding this to your `medusa-config.ts`: + +```ts title="medusa-config.ts" +module.exports = defineConfig({ + // ... + modules: [ + { + resolve: "@medusajs/medusa/notification", + options: { + providers: [ + // ... + { + resolve: "@medusajs/medusa/notification-local", + id: "local", + options: { + channels: ["email"], + }, + }, + ], + }, + }, + ], +}) +``` + +The Local provider logs email details to your terminal instead of sending actual emails, which is useful for development and testing. + +*** + +## Create the Reset Password Subscriber + +To create a [subscriber](https://docs.medusajs.com/docs/learn/fundamentals/events-and-subscribers/index.html.md) that handles the `auth.password_reset` event, create the file `src/subscribers/password-reset.ts` with the following content: ```ts title="src/subscribers/handle-reset.ts" highlights={highlights} collapsibleLines="1-6" expandMoreLabel="Show Imports" import { @@ -24955,18 +25004,27 @@ export default async function resetPasswordTokenHandler({ const notificationModuleService = container.resolve( Modules.NOTIFICATION ) + const config = container.resolve("configModule") - const urlPrefix = actor_type === "customer" ? - "https://storefront.com" : - "https://admin.com/app" + let urlPrefix = "" + + if (actor_type === "customer") { + urlPrefix = config.admin.storefrontUrl || "https://storefront.com" + } else { + const backendUrl = config.admin.backendUrl !== "/" ? config.admin.backendUrl : + "http://localhost:9000" + const adminPath = config.admin.path + urlPrefix = `${backendUrl}${adminPath}` + } await notificationModuleService.createNotifications({ to: email, channel: "email", - template: "reset-password-template", + // TODO replace with template ID in notification provider + template: "password-reset", data: { // a URL to a frontend application - url: `${urlPrefix}/reset-password?token=${token}&email=${email}`, + reset_url: `${urlPrefix}/reset-password?token=${token}&email=${email}`, }, }) } @@ -24976,7 +25034,7 @@ export const config: SubscriberConfig = { } ``` -You subscribe to the `auth.password_reset` event. The event has a data payload object with the following properties: +The subscriber receives the following data through the event payload: - `entity_id`: The identifier of the user. When using the `emailpass` provider, it's the user's email. - `token`: The token to reset the user's password. @@ -24984,41 +25042,46 @@ You subscribe to the `auth.password_reset` event. The event has a data payload o This event's payload previously had an `actorType` field. It was renamed to `actor_type` after [Medusa v2.0.7](https://github.com/medusajs/medusa/releases/tag/v2.0.7). -In the subscriber, you: +### Reset Password URL -- Decide the frontend URL based on whether the user is a customer or admin user by checking the value of `actor_type`. -- Resolve the Notification Module and use its `createNotifications` method to send the notification. -- You pass to the `createNotifications` method an object having the following properties: - - `to`: The identifier to send the notification to, which in this case is the email. - - `channel`: The channel to send the notification through, which in this case is email. - - `template`: The template ID in the third-party service. - - `data`: The data payload to pass to the template. You pass the URL to redirect the user to. You must pass the token and email in the URL so that the frontend can send them later to the Medusa application when reseting the password. +Based on the user's actor type, you set the URL prefix to redirect the user to the appropriate frontend page to reset their password: -*** +- If the user is a customer, you set the URL prefix to the storefront URL. +- If the user is an admin, you set the URL prefix to the backend URL, which is constructed from the `config.admin.backendUrl` and `config.admin.path` values. -## 2. Test it Out: Generate Reset Password Token +Note that the Medusa Admin has a reset password form at `/reset-password?token={token}&email={email}`. -To test the subscriber out, send a request to the `/auth/{actor_type}/{auth_provider}/reset-password` API route, replacing `{actor_type}` and `{auth_provider}` with the user's actor type and provider used for authentication respectively. +### Notification Configurations -For example, to generate a reset password token for an admin user using the `emailpass` provider, send the following request: +For the notification, you can configure the following fields: -```bash -curl --location 'http://localhost:9000/auth/user/emailpass/reset-password' \ ---header 'Content-Type: application/json' \ ---data-raw '{ - "identifier": "admin-test@gmail.com" -}' +- `to`: The identifier to send the notification to, which in this case is the email. +- `channel`: The channel to send the notification through, which in this case is email. +- `template`: The template ID of the email to send. This ID depends on the Notification Module provider you use. For example, if you use SendGrid, this would be the ID of the SendGrid template. + - Refer to the [Example Notification Templates](#example-notification-templates) section below for examples of notification templates to use. +- `data`: The data payload to pass to the template. You can pass additional fields, if necessary. + +### Test It Out + +After you set up the Notification Module Provider, create a template in the provider, and create the subscriber, you can test the reset password flow. + +Start the Medusa application with the following command: + +```bash npm2yarn +npm run dev ``` -In the request body, you must pass an `identifier` parameter. Its value is the user's identifier, which is the email in this case. +Then, open the Medusa Admin (locally at `http://localhost:9000/app`) and click on "Reset" in the login form. Then, enter the email of the user you want to reset the password for. -If the token is generated successfully, the request returns a response with `201` status code. In the terminal, you'll find the following message indicating that the `auth.password_reset` event was emitted and your subscriber ran: +Once you reset the password, you should see that the `auth.password_reset` event is emitted in the server's logs: -```plain +```bash info: Processing auth.password_reset which has 1 subscribers ``` -The notification is sent to the user with the frontend URL to enter a new password. +If you're using an email Notification Module Provider, check the user's email inbox for the reset password email with the link to reset their password. + +If you're using the Local provider, check your terminal for the logged email details. *** @@ -25028,10 +25091,305 @@ In your frontend, you must have a page that accepts `token` and `email` query pa The page shows the user password fields to enter their new password, then submits the new password, token, and email to the [Reset Password Route](https://docs.medusajs.com/Users/shahednasser/medusa/www/apps/resources/app/commerce-modules/auth/authentication-route#reset-password-route/index.html.md). +The Medusa Admin already has a reset password page at `/reset-password?token={token}&email={email}`. So, you only need to implement this page in your storefront or custom admin dashboard. + ### Examples - [Storefront Guide: Reset Customer Password](https://docs.medusajs.com/Users/shahednasser/medusa/www/apps/resources/app/storefront-development/customers/reset-password/index.html.md) +*** + +## Example Notification Templates + +The following section provides example notification templates for some Notification Module Providers. + +### SendGrid + +Refer to the [SendGrid Notification Module Provider](https://docs.medusajs.com/Users/shahednasser/medusa/www/apps/resources/app/infrastructure-modules/notification/sendgrid/index.html.md) documentation for more details on how to set up SendGrid. + +The following HTML template can be used with SendGrid to send a reset password email: + +```html + + +
+ + ++ Hello{{#if email}} {{email}}{{/if}}, +
++ We received a request to reset your password. Click the button below to create a new password for your account. +
++ Or copy and paste this URL into your browser: +
+ + {{reset_url}} + ++ This password reset link will expire soon for security reasons. +
++ If you didn't request a password reset, you can safely ignore this email. Your password will remain unchanged. +
+