Independent commerce user registry — completely separate from ERP users. Google & Apple Sign-In, email/password, opaque session cookies, address book, GDPR compliance.
Commerce users are a completely independent registry — ERP employees cannot log into the storefront and vice versa. Each has their own JWT signing key, session lifetime and session table.
OAuth2 redirect flow with PKCE state. Finds or creates a commerce user by email. Links multiple providers to one account.
Supports privacy-relay emails. Works on first login only (Apple hides email on repeat). Same find-or-create flow.
bcrypt-hashed passwords, email verification link, forgot/reset password flow, change password.
32-byte random token → SHA-256 hash stored in DB. httpOnly SameSite=Lax cookie. Expires in 7 days. Multiple active sessions supported.
Email/password or Google/Apple OAuth2. Welcome email sent with verification link.
32-byte random token → SHA-256 hash in commerce_sessions. httpOnly SameSite=Lax cookie set. SSR-compatible.
Heart button on products → wishlist. Product ratings and reviews require auth. Address book pre-fills checkout.
SSE stream on /orders/:id/status-stream — updates status without page reload.
Download all personal data as JSON. One-click account deletion — data anonymized, sessions revoked, OAuth accounts unlinked.