medusa-admin-account

Reusable Medusa v2 plugin that lets the signed-in admin user or Mercur seller member change their own emailpass email and password.

Features

• Generic Medusa admin page at /account.
• Mercur operator admin page at /dashboard/account.
• Mercur seller page at /seller/account.
• Authenticated GET /admin/account/email and GET /vendor/account/email routes for the current login email.
• Authenticated POST /admin/account/email and POST /vendor/account/email routes with exactly new_email and current_password.
• Authenticated POST /admin/account/password and POST /vendor/account/password routes.
• Email changes require the current password, normalize the new address to lowercase, update both the login and profile email, and sign out on success.
• Exactly two request fields: new_password and confirm_password.
• Eight-character minimum, exact confirmation, and sign-out after success.
• No module, database table, or migration. Password storage remains owned by Medusa's Auth module and the configured emailpass provider.

Mercur credentials belong to the authenticated member, not the shared seller. The vendor route always resolves the caller from req.auth_context.auth_identity_id; it does not accept a target identity from the request.

For email changes, the profile update and login-identifier update run as a compensating workflow. Generic Medusa installs resolve the built-in User module. Mercur installs resolve the optional seller module at runtime to update the authenticated member. The package does not import Mercur code, and email-change requests never accept a target user, member, or auth identity.

Changing email applies immediately; the plugin does not send a verification or notification email. The previous password remains valid with the new email.

Install

Build the plugin and add it to the Medusa application's dependencies:

npm run build

plugins: [
  {
    resolve: "medusa-admin-account",
    options: {},
  },
]

The standard ./admin export includes CommonJS and ESM dashboard extensions. Mercur applications can additionally load the optional ESM-only ./vendor export. The package itself does not import Mercur runtime code.

Compatibility

• Medusa v2: ^2.13.4
• Medusa UI: ^4.1.1
• Tested host: Mercur 2.1.1

Development

npm test
npm run build