Members and auth

Customers (members), their addresses and profile, storefront login, and the reference location data. The users module owns it.

How this page was verified

Read on 2026-09-15 from the backend users module, the storefront /auth and /user areas, and the admin /admin/members area.

The model

Tables: members, member_addresses, member_profile_pictures, plus the cart tables (see Cart and checkout) and stores / store_images / collaboration_stores. Reference locations are ref_countries, ref_provinces, ref_cities, ref_districts, ref_subdistricts — used by addresses and the store locator.

Member auth (storefront)

Backend storefront-members-auth resolver (front*): loginAsMember, registerAsMember, verifyMember, requestResetMemberPassword, resetMemberPassword, frontMe, frontRefreshToken. Passwords are bcrypt; registration requires email verification. This is the member JWT realm (jwt-member strategy) — separate from admin auth. See API and auth.

Storefront side: NextAuth Credentials provider → loginAsMember (src/app/auth.ts); token in the NextAuth session, sent as Bearer; expiry → frontRefreshToken, failure → forced sign-out. UI in src/modules/auth/components/ (form-signin, form-register, form-request-reset-password, form-reset-password). Routes /auth/signin, /auth/register, /auth/verify, /auth/reset-password. Only a Credentials provider — no social login on the storefront.

Member account (storefront)

/user/*: profile (/user/profile), address book (/user/address + add/edit), order history (/user/my-order, see Orders). Data via frontMemberAddress(es) and the ref-location queries; profile update is a REST PUT on front/members.

Addresses and locations

storefront-members-addresses resolver: address CRUD plus frontCountries / frontProvinces / frontCities / frontDistricts / frontSubdistricts. Same location tables back the store locator (frontStores, frontCitiesWithActiveStores) and the storefront /store-locator page (behind NEXT_PUBLIC_FEAT_STORE_LOCATOR).

Admin

/admin/members — list, add-member, edit-member, and [slug] with member addresses (add-address / edit-address). Backend CMS resolver members: members, member, dashboardMember, memberFilterBounds, newMemberId, address CRUD, ref-location queries; plus a members Excel export and migration/notify helpers. Stores are managed at /admin/stores.

Gotchas

• Two realms. A member token is not an admin token; the guards and secrets differ.
• Reference locations are shared. Addresses, the store locator and courier rates all lean on the ref_* tables.
• member.recalculate_favorites and order.completed events update member stats after an order (users/services/members.service.ts).