README

Force-login closed storefront, a registration toggle, and an allowed-paths whitelist for Marpod B2B — the equivalent of bitExpert/magento2-force-login.

What it does

Force login: when enabled, every storefront page redirects an anonymous visitor to the login page, except a fixed set of always-reachable core routes (login, logout, password reset, account confirmation, the 404 page) and whatever additional paths you configure. After logging in, the customer is returned to the page they originally requested.
Registration toggle: independent of the setting above. When disabled, customer/account/create is blocked (redirects to login with a message) and the "Create an Account" link/panel is hidden everywhere it appears — the header link (Magento\Customer\Block\Account\RegisterLink) and the login page's own "New Customer?" box (Magento\Customer\Block\Form\Login\Info) are two unrelated blocks with no shared base narrower than AbstractBlock; both are covered.
Allowed paths: a configurable whitelist of request paths (e.g. /contact) reachable by anyone regardless of the force-login setting.
Company invitations: the B2B Company invitation acceptance controller remains reachable so it can validate the token, display login feedback, and preserve the post-login return URL.

This module does not require Marpod_B2bCompany — it only checks whether a customer is logged in, not company membership. It only affects the storefront; the Admin panel and REST/GraphQL APIs have their own separate authentication and are not touched by this module.

Configuration

Stores > Configuration > B2B > Closed Store (section marpod_b2b, group closed_store, website/store view scope):

enabled — require login for the storefront (default: no);
registration_enabled — allow registration (default: yes);
allowed_paths — one request path per line, e.g. /contact or /privacy-policy-cookie-restriction-mode.

A critical operational note about Full Page Cache / Varnish

Anonymous page responses are shared across every guest by the full page cache (Varnish or the built-in cache) and are served directly from that cache — a cached response never reaches Marpod\B2bClosedStore\Observer\EnforceLoginObserver. Saving these settings through the Admin UI's System Configuration form is safe: Magento's core Magento_CacheInvalidate module already purges Varnish automatically on any config save (controller_action_postdispatch_adminhtml_system_config_save → Magento\CacheInvalidate\Observer\InvalidateVarnishObserver), the same way it does for every other setting — nothing module-specific was needed for that path.

Changing these settings via CLI (bin/magento config:set) does not purge Varnish. Pages cached before the change remain reachable by guests until they expire naturally or you purge the cache explicitly (System > Cache Management > Flush Cache Storage, or your Varnish host's own purge/ban mechanism). Always verify with a fresh, uncached request after a CLI-driven change.

Requirements

PHP 8.5
Magento 2.4.9-compatible framework packages
mar-pod-b2b/module-b2b-core

Installation

Run from the Magento project root:

composer require mar-pod-b2b/module-b2b-closed-store:@dev
bin/magento module:enable Marpod_B2bClosedStore
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:clean

Development

The planned scope, dependency rules, and test strategy are documented in packages/B2B_LIGHT_PLAN.md in the development Magento project.

Unit tests:

vendor/bin/phpunit -c dev/tests/unit/phpunit.xml.dist packages/module-b2b-closed-store/Test/Unit

Limitations

storefront pages only; REST/GraphQL API endpoints and static assets are not gated;
no per-customer-group or per-company exceptions — the whitelist is path-based only;
the always-allowed core routes are a fixed list in code, not configurable, by design (so a misconfigured allow-list can never lock out the login flow itself).

Uninstallation

Safe to remove at any time — this module owns no persistent data (no database tables), only configuration values under marpod_b2b/closed_store, which are cleared when the module is removed.

mar-pod-b2b / module-b2b-closed-store

Maintainers

Package info

Statistics

Security