Skip to main content

@acromedia/gesso-shopware-middleware

8.2.0​

Minor Changes​

  • 2ccc25a: Implement Shopware authentication (useAuth).

    @acromedia/gesso-shopware replaces the useAuth stub with the full auth surface on Shopware's public Store API account routes: login (POST /account/login, then POST /account/customer), logout, password.passwordResetEmail (recovery-password), and password.passwordReset (recovery-password-confirm). Login returns the rotated sw-context-token on the customer as options.accessToken — the same slot BigCommerce uses for its customer access token, and the field GessoAuthOptions copies onto the next-auth JWT — so a login performed server-side inside authorize carries its Store API session forward. Logout drops the gesso-sw-context cookie so the next visit opens a clean guest session. Adds the optional shopwareRecoveryStorefrontUrl and cookieName config keys.

    @acromedia/gesso-shopware-middleware adds the exists action — an Admin-API account-exists probe (GET /api/middleware/shopware/exists?email=) that answers with the bare customer id or a 404, backing useAuth.exists and next-auth's GessoAdapter.getUserByEmail. It returns only the id, so an email-keyed probe cannot expose a customer's name, addresses, or order history. getContextToken now also reads the token from the JWT's accessToken key, where GessoAuthOptions stores it by default.

8.1.0​

Minor Changes​

  • 0d108e1: GESSO-2429-feat: add Shopware 6 API-middleware plugin

    New @acromedia/gesso-shopware-middleware package implementing the Provider contract from @acromedia/gesso-api-middleware. It is the server-side companion to the browser-side @acromedia/gesso-shopware commerce plugin — anything that needs a secret or a privileged lookup lives here, not in the bundle that ships to the browser.

    • Routes /api/middleware/shopware/{action} to Shopware's REST Store API (/store-api) and, for elevated operations, its Admin API (/api). Storefront, customer-scoped actions (address, customer, orders) authenticate with the sales-channel sw-access-key plus the logged-in customer's sw-context-token; admin-scoped actions (customers, payments) authenticate the integration itself via the Admin API OAuth2 client_credentials grant.
    • Reads the customer's sw-context-token from the next-auth session JWT (a forwarded sw-context-token request header is honoured as a fallback), echoes Shopware's rotated token back in an sw-context-token response header so the client can persist it.
    • Talks to both APIs through the official @shopware/api-client SDK (pinned), wrapped in a thin StoreApiClient/AdminApiClient in src/rest.ts — mirroring how @acromedia/gesso-shopware wraps the same SDK. The admin client memoizes one OAuth2 client per host + integration id so the bearer is cached and auto-refreshed across requests, staying within Shopware SaaS's token rate limit.
    • Ships as a dual ESM + CJS package built with tsup; unit-tested with Vitest (Store API and Admin API mocked with MSW).