feat(web-api): контракт customer auth для Nuxt SSR (me / refresh / Bearer bind)

core/components/minishop3/config/routes/web.php

@@ -141,27 +141,31 @@
         $customerAuth = static fn (): \MiniShop3\Controllers\Api\Web\CustomerAuthController =>
             new \MiniShop3\Controllers\Api\Web\CustomerAuthController($modx);
 
-        $router->post('/login', function ($params) use ($customerAuth) {
+        $router->post('/login', function () use ($customerAuth) {
             return $customerAuth()->loginFromRequest();
         });
 
-        $router->post('/register', function ($params) use ($customerAuth) {
+        $router->post('/register', function () use ($customerAuth) {
             return $customerAuth()->registerFromRequest();
         });
 
-        $router->post('/logout', function ($params) use ($customerAuth) {
+        $router->get('/me', function () use ($customerAuth) {
+            return $customerAuth()->me();
+        }, [$tokenMiddleware]);
+
+        $router->post('/logout', function () use ($customerAuth) {
             return $customerAuth()->logout();
         }, [$tokenMiddleware]);
 
-        $router->post('/forgot-password', function ($params) use ($customerAuth) {
+        $router->post('/forgot-password', function () use ($customerAuth) {
             return $customerAuth()->forgotPasswordFromRequest();
         });
 
-        $router->post('/reset-password', function ($params) use ($customerAuth) {
+        $router->post('/reset-password', function () use ($customerAuth) {
             return $customerAuth()->resetPasswordFromRequest();
         });
 
-        $router->post('/add', function ($params) use ($modx) {
+        $router->post('/add', function () use ($modx) {
             $ms3 = $modx->services->get('ms3');
             $input = file_get_contents('php://input');
             $data = json_decode($input, true) ?: [];
@@ -170,7 +174,7 @@
             return $controller->updateField($data);
         }, [$tokenMiddleware]);
 
-        $router->get('/token/get', function ($params) use ($modx) {
+        $router->get('/token/get', function () use ($modx) {
             $ms3 = $modx->services->get('ms3');
             $ms3->initialize($modx->context->key ?? 'web');
             $response = $ms3->customer->generateToken();
@@ -182,6 +186,10 @@
             }
         });
 
+        $router->post('/token/refresh', function () use ($customerAuth) {
+            return $customerAuth()->refreshToken();
+        }, [$tokenMiddleware]);
+
         $router->group('/addresses', function ($router) use ($modx) {
             $router->get('', function ($params) use ($modx) {
                 $controller = new \MiniShop3\Controllers\Api\Web\CustomerAddressController($modx);
@@ -192,7 +200,7 @@
                 return $controller->get($params);
             });
 
-            $router->post('', function ($params) use ($modx) {
+            $router->post('', function () use ($modx) {
                 $input = file_get_contents('php://input');
                 $data = json_decode($input, true) ?: [];
 
@@ -219,7 +227,7 @@
             });
         }, [$tokenMiddleware]);
 
-        $router->put('/profile', function ($params) use ($modx) {
+        $router->put('/profile', function () use ($modx) {
             $ms3 = $modx->services->get('ms3');
             $input = file_get_contents('php://input');
             $data = json_decode($input, true) ?: [];
@@ -233,7 +241,7 @@
             return $controller->changeCustomerAddress($params);
         }, [$tokenMiddleware]);
 
-        $router->post('/email/resend-verification', function ($params) use ($modx) {
+        $router->post('/email/resend-verification', function () use ($modx) {
             $ms3 = $modx->services->get('ms3');
             $controller = new \MiniShop3\Controllers\Api\Web\CustomerEmailController($modx, $ms3);
             return $controller->resendVerification();

core/components/minishop3/src/Controllers/Api/Web/CustomerAuthController.php

@@ -4,10 +4,12 @@
 
 use MiniShop3\Router\HttpStatus;
 use MiniShop3\Router\Response;
+use MiniShop3\Services\Customer\CustomerSessionService;
+use MiniShop3\Services\TokenService;
 use MODX\Revolution\modX;
 
 /**
- * CustomerAuthController — login, register, logout, password recovery (Web API).
+ * CustomerAuthController — login, register, logout, password recovery, session (Web API).
  *
  * Delegates to Processors\Api\Customer\* and maps processor failures to HTTP responses.
  */
@@ -49,6 +51,34 @@ public function resetPasswordFromRequest(): Response
         return $this->resetPassword($this->readJsonBody());
     }
 
+    /**
+     * GET /api/v1/customer/me
+     */
+    public function me(): Response
+    {
+        $payload = $this->sessionService()->buildMePayload($this->requestToken());
+        if ($payload === null) {
+            return Response::error('ms3_err_token_invalid', HttpStatus::UNAUTHORIZED);
+        }
+
+        return Response::success($payload);
+    }
+
+    /**
+     * POST /api/v1/customer/token/refresh
+     */
+    public function refreshToken(): Response
+    {
+        /** @var TokenService $tokenService */
+        $tokenService = $this->modx->services->get('ms3_token_service');
+        $rotated = $tokenService->rotateApiToken($this->requestToken());
+        if ($rotated === null) {
+            return Response::error('ms3_err_token_invalid', HttpStatus::UNAUTHORIZED);
+        }
+
+        return Response::success($rotated);
+    }
+
     /**
      * @return array<string, mixed>
      */
@@ -123,6 +153,20 @@ public function resetPassword(array $data): Response
         ]);
     }
 
+    private function requestToken(): string
+    {
+        return TokenService::resolveTokenFromRequest();
+    }
+
+    private function sessionService(): CustomerSessionService
+    {
+        /** @var TokenService $tokenService */
+        $tokenService = $this->modx->services->get('ms3_token_service');
+        $ms3 = $this->modx->services->get('ms3');
+
+        return new CustomerSessionService($this->modx, $tokenService, $ms3);
+    }
+
     /**
      * @param array<string, mixed> $properties
      */

core/components/minishop3/src/Middleware/TokenMiddleware.php

@@ -87,24 +87,15 @@ public function handle(array $params)
             $_REQUEST['ms3_token'] = (string) $_SESSION['ms3']['customer_token'];
         }
 
-        // Resolve token from multiple sources
-        $token = $this->resolveToken();
+        // Resolve token (middleware order; login bind uses getBindableTokenString)
+        $token = TokenService::resolveTokenFromRequest();
 
         // If a token is present, always validate it (do not skip via session bypass).
         if (!empty($token)) {
             $resolved = $tokenService->resolveApiToken($token);
 
             if ($resolved['reason'] === 'ok') {
-                $tokenObj = $resolved['token'];
-
-                if (!isset($_SESSION['ms3'])) {
-                    $_SESSION['ms3'] = [];
-                }
-                $_SESSION['ms3']['customer_token'] = $token;
-                $_SESSION['ms3']['customer_id'] = $tokenObj->get('customer_id');
-                $_SESSION['ms3']['customer_token_expires'] = strtotime($tokenObj->get('expires_at'));
-
-                CookieHelper::setTokenCookie($this->modx, $token);
+                $tokenService->syncSessionFromToken($resolved['token']);
                 $_REQUEST['ms3_token'] = $token;
 
                 return null;
@@ -162,39 +153,6 @@ private function clearClientTokenState(): void
         );
     }
 
-    /**
-     * Resolve token from request sources
-     *
-     * @return string Token or empty string
-     */
-    private function resolveToken(): string
-    {
-        // 1. Authorization: Bearer header (for mobile apps)
-        $authHeader = $_SERVER['HTTP_AUTHORIZATION'] ?? '';
-        if (str_starts_with($authHeader, 'Bearer ')) {
-            $token = substr($authHeader, 7);
-            if (!empty($token)) {
-                return $token;
-            }
-        }
-
-        // 2. HTTP_MS3TOKEN header (legacy)
-        $token = $_SERVER['HTTP_MS3TOKEN'] ?? '';
-        if (!empty($token)) {
-            return $token;
-        }
-
-        // 3. $_REQUEST (includes cookie via injection + legacy URL param)
-        $token = $_REQUEST['ms3_token'] ?? $_REQUEST['token'] ?? '';
-        if (!empty($token)) {
-            return $token;
-        }
-
-        // 4. Session cache (must still pass DB validation in handle())
-        return $_SESSION['ms3']['customer_token'] ?? '';
-    }
-
-
     /**
      * Check if route is public
      *

core/components/minishop3/src/Services/Customer/CustomerSessionService.php

@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+
+namespace MiniShop3\Services\Customer;
+
+use MiniShop3\MiniShop3;
+use MiniShop3\Model\msCustomer;
+use MiniShop3\Services\TokenService;
+use MODX\Revolution\modX;
+
+/**
+ * Session introspection payload for GET /customer/me (#571).
+ */
+final class CustomerSessionService
+{
+    public function __construct(
+        private modX $modx,
+        private TokenService $tokenService,
+        private MiniShop3 $ms3,
+    ) {
+    }
+
+    /**
+     * Build GET /customer/me payload from a validated API token string.
+     *
+     * @return array{
+     *     authenticated: bool,
+     *     customer: array<string, mixed>|null,
+     *     token: array{expires_at: string, customer_id: int}
+     * }|null null when token is missing/invalid/expired
+     */
+    public function buildMePayload(string $tokenString): ?array
+    {
+        $resolved = $this->tokenService->resolveApiToken($tokenString);
+        if ($resolved['reason'] !== 'ok' || $resolved['token'] === null) {
+            return null;
+        }
+
+        $tokenObj = $resolved['token'];
+        $customerId = (int) $tokenObj->get('customer_id');
+        $customer = $customerId > 0
+            ? $this->modx->getObject(msCustomer::class, $customerId)
+            : null;
+
+        return [
+            'authenticated' => $customer instanceof msCustomer,
+            'customer' => $customer instanceof msCustomer
+                ? CustomerPublicDto::fromCustomer($customer, $this->modx, $this->ms3)
+                : null,
+            'token' => [
+                'expires_at' => (string) $tokenObj->get('expires_at'),
+                'customer_id' => $customerId,
+            ],
+        ];
+    }
+}