fix(auth-emailpass): allow email update in updateProvider method

[ashif323]

What

Fixes #14921

authModuleService.updateProvider was not allowing email updates for emailpass provider. Only password updates were supported despite the docs stating email can also be updated.

Why

In EmailPassAuthService.update(), the email field was completely absent from the type signature and never destructured or saved. Only password was handled.

How

• Added email? to the update method type signature
• Email is now saved to user_metadata when passed
• Password remains optional and independent of email update
• Added 3 integration tests covering the new behavior

---

Note

Medium Risk
Touches authentication provider update logic by allowing user_metadata.email updates and always calling the identity service update, which could affect identity persistence if callers relied on previous no-op behavior. Also expands admin price list remote query fields to include nested price details, potentially increasing payload size and query cost.

Overview
Auth email/password provider: EmailPassAuthService.update now accepts optional email and password, hashes and updates the password in provider_metadata, and persists email changes to user_metadata; new integration tests cover missing entity_id, password-only updates, and email-only updates.

Admin price lists: Expands adminPriceListRemoteQueryFields in price-lists/query-config.ts to include additional nested prices.* fields (ids, amounts/quantities, raw values, timestamps, rules, and variant id) in admin price list queries.

^{Reviewed by Cursor Bugbot for commit d4565f9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5d4388a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

@ashif323 is attempting to deploy a commit to the medusajs Team on Vercel.

A member of the Team first needs to authorize it.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d4565f9. Configure here.}

[cursor]

Empty metadata objects always sent to update call

Medium Severity

The update method always passes both provider_metadata and user_metadata to authIdentityService.update(), even when they're empty objects. When only updating email, provider_metadata: {} is sent; when only updating password, user_metadata: {} is sent; when neither is provided, both are {}. This is safe only because MikroORM's assign uses mergeObjectProperties: true, which merges rather than replaces JSON columns. If that option ever changes or the update pipeline is refactored, empty objects would overwrite existing data (e.g., wiping the password hash). The update payload object could be built conditionally so only non-empty metadata fields are included.

Additional Locations (1)

• packages/modules/providers/auth-emailpass/src/services/emailpass.ts#L60-L71

 

^{Reviewed by Cursor Bugbot for commit d4565f9. Configure here.}

[shahednasser]

@medusajs-bot review this

[medusa-os-bot]

Thank you for your contribution!

After reviewing this PR, we need a few things addressed before we can move forward:

Required changes:

• Add a changeset for @medusajs/auth-emailpass. This is a bug fix so the bump type should be patch. Run yarn changeset from the root to generate one — the message should follow the format fix(auth-emailpass): short description.
• Add a Testing section to the PR description, following the pull request template. Describe how a reviewer can reproduce the original bug and verify it is fixed.

Concerns:

The PR description says "Email is now saved to user_metadata when passed." However, in the emailpass provider, entity_id is the login identifier — it is what authenticate uses to look up the auth identity:

authIdentity = await authIdentityService.retrieve({
  entity_id: email,
})

The AuthIdentityProviderService.update interface only supports updating provider_metadata and user_metadata, not entity_id. This means after this fix a user's user_metadata.email would reflect the new email, but they would still need to authenticate with their original email (the one stored as entity_id).

Could you clarify whether the intent is to update user_metadata.email for display/profile purposes, or to change the actual login email? If the latter, entity_id would also need to be updated, which requires a different approach at the AuthIdentityProviderService level.

Thanks!