Marketplace questions: image cleanup on delete & super admin vendor access

[meenal9]

Hi @shahhednassar,

I have two questions (not exactly issues):

1. Product images deletion
   When we delete product images in Medusa, the images are removed from the product but still remain in the database/storage. Over time, with a large number of products, this causes unused images to accumulate even after deleting images or entire products.
   Is there a recommended way to permanently delete images when they are removed from a product, or when we complete remove the product?

2. Super admin access to vendor accounts (Marketplace use case)
   In most vendor/marketplace platforms, a super admin have access to vendor’s profile and access the vendor’s account context to make changes on their behalf (products, inventory, prices, settings, etc.), mainly for support and operational work.

How is this typically handled in a Medusa marketplace setup?

Is there a recommended way for an admin to access or switch into a vendor’s profile?

Any guidance or examples would be really helpful.

Thanks!

[shahednasser]

Hi @meenal9

1. Product images deletion: We've left the image deletion up to the user. We recommend creating a scheduled job that deletes all product images that aren't used by a product.
2. You can change the authenticate middlewares applied on the vendor routes to support admin users as well. For example:

export default defineMiddlewares({
  routes: [
    {
      matcher: "/vendors",
      method: ["POST"],
      middlewares: [
        authenticate("vendor", ["session", "bearer"], {
          allowUnregistered: true,
        }),
        validateAndTransformBody(PostVendorCreateSchema),
      ],
    },
    {
      matcher: "/vendors/*",
      middlewares: [
        authenticate(["vendor", "admin"], ["session", "bearer"]), <--- here
      ]
    },
    {
      matcher: "/vendors/products",
      method: ["POST"],
      middlewares: [
        validateAndTransformBody(AdminCreateProduct),
      ]
    },
  ],
}
)

[meenal9]

Thanks a lot for the detailed explanation @shahhednassar, really appreciate it 🙏

For the product images deletion, that makes sense. We’ll implement a scheduled job to clean up unused images that are no longer linked to any products.

For the vendor access, thanks for sharing the middleware example. We are already doing this (as we discussed a few months ago), and it works well after a few tweaks. However, this approach only allows us to update vendor data through admin routes.

What we actually need is for a super admin to log into the vendor dashboard as another “vendor admin”.
Currently:

We use email + password authentication for vendors. (emailpass method)

There is no URL-based or context-based way to identify or switch into a vendor account.

Because of this, it’s not possible for a super admin to open the vendor dashboard exactly as that vendor for support or debugging.

So the missing piece for us is:
Is there any recommended pattern in Medusa for admin → vendor impersonation / login as vendor (for example, generating a temporary vendor session or token for an admin)?
use (for example) - We need to create products for vendor, if creating through super admin, it would not take vendor data into the product, that product would not be linked to that vendor, as its not been created through that vendor admin.

This is a common feature in most marketplace platforms, and we want to implement it in a secure and supported way.

Thanks again for your guidance!

[shahednasser]

Thank you for the details. There isn't a recommended Medusa way for this. What you mention "generating a temporary vendor session or token for an admin" could work. You can have an API route that does this and when an admin in the admin dashboard clicks "impersonate vendor" it does this + redirects the admin to the vendor dashboard.