Replace Meshkee password when linking an existing account to a new site.

Cross-site register now updates the password to the signup value and documents passwordUpdated for storefronts.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/auth/auth.service.ts

@@ -97,10 +97,19 @@ export class AuthService {
       }
     }
 
+    const linkedExistingAccount = Boolean(existingUser);
+
     const user = await this.prisma.$transaction(async (tx) => {
-      const account =
-        existingUser ??
-        (await tx.user.create({
+      let account = existingUser;
+
+      if (account) {
+        // Cross-site join: replace Meshkee password with the one entered on this signup.
+        account = await tx.user.update({
+          where: { id: account.id },
+          data: { passwordHash },
+        });
+      } else {
+        account = await tx.user.create({
           data: {
             cellNumber: dto.cellNumber,
             passwordHash,
@@ -109,7 +118,8 @@ export class AuthService {
             lastName: dto.lastName,
             cellVerifiedAt: smsEnabled ? null : new Date(),
           },
-        }));
+        });
+      }
 
       await tx.businessCustomer.create({
         data: {
@@ -143,10 +153,15 @@ export class AuthService {
     const tokens = await this.issueTokens(authUser);
 
     return {
-      message: smsEnabled
-        ? 'Registration successful. Please verify your cell number with OTP.'
-        : 'Registration successful. SMS verification is disabled — account auto-verified.',
+      message: linkedExistingAccount
+        ? smsEnabled
+          ? 'Joined this website. Your Meshkee password was updated to the one you just entered. Please verify your cell number with OTP.'
+          : 'Joined this website. Your Meshkee password was updated to the one you just entered.'
+        : smsEnabled
+          ? 'Registration successful. Please verify your cell number with OTP.'
+          : 'Registration successful. SMS verification is disabled — account auto-verified.',
       smsEnabled,
+      passwordUpdated: linkedExistingAccount,
       user: this.serializeUser(authUser),
       registeredBusiness: {
         id: business.id,

src/auth/dto/register.dto.ts

@@ -37,7 +37,8 @@ export class RegisterDto {
 
   /**
    * When true, link an existing Meshkee account (other websites) to this tenant
-   * without requiring the existing password. Existing password and profile stay unchanged.
+   * without requiring the existing password. Profile stays unchanged; the password
+   * is replaced with the one submitted in this registration.
    */
   @IsOptional()
   @IsBoolean()