fix(loyalty): honor configured admin auth type in admin SDK#16164
Merged
Conversation
The loyalty plugin's admin SDK was hard-coded to `auth: { type: "session" }`,
so every request its data hooks make (e.g. the Gift Card Products page's
`GET /admin/products?is_giftcard=true`) returned 401 in any app configured
for JWT admin auth (`ADMIN_AUTH_TYPE=jwt`). The pages silently rendered
empty ("No gift card products found") instead of surfacing the failure.
Mirror the dashboard's client config by reading the bundler-injected
`__BACKEND_URL__`, `__AUTH_TYPE__`, and `__JWT_TOKEN_STORAGE_KEY__` globals
so the plugin respects the admin's configured auth type. Add a declaration
file for these globals since `src/admin` is type-checked under a separate
strict tsconfig.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: 5e362da The changes in this PR will be included in the next version bump. This PR includes changesets to release 79 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
What — The loyalty plugin's admin SDK (
packages/plugins/loyalty/src/admin/lib/sdk.ts) was hard-coded toauth: { type: "session" }. This PR makes it read the bundler-injected__BACKEND_URL__,__AUTH_TYPE__, and__JWT_TOKEN_STORAGE_KEY__globals, mirroring the dashboard's own client config, so the plugin honors the admin's configured auth type.Why — In any app configured for JWT admin auth (
ADMIN_AUTH_TYPE=jwt, as documented), there is no session cookie, so every request the plugin's data hooks make returned 401. Concretely, the Gift Card Products page (GET /admin/products?is_giftcard=true) got a 401 and silently rendered "No gift card products found" even when gift-card products existed. The failure was silent, which cost significant debugging time. As-is, the plugin's admin pages are unusable under JWT admin auth.How — Replaced the hard-coded config with the same globals the main dashboard uses. These globals are injected as Vite
definevalues by@medusajs/admin-bundlerfor all bundled admin code (including plugin admin extensions), so no additional wiring is needed. Sincesrc/adminis type-checked under a separate strict tsconfig (the root tsconfig excludes it), avite-env.d.tsdeclaring these globals was added. All of the plugin's data hooks import this single sharedsdk, so the fix propagates everywhere.Testing — Type-checked the plugin admin (
tsc --noEmitundersrc/admin/tsconfig.json) with no new errors. To verify end to end: setADMIN_AUTH_TYPE=jwt, log into the admin, and open Gift Cards → Gift Card Products — the list now loads existing gift-card products instead of returning 401 / rendering empty.Checklist
Additional Context
Resolves DX-2801. The fix mirrors
packages/admin/dashboard/src/lib/client/client.ts.🤖 Generated with Claude Code