@asgardeo/nuxt 0.0.0 → 0.1.0-alpha.0

package/dist/runtime/utils/log.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Mask a token so it is safe to include in logs and error messages.
+ * Shows the first 4 and last 4 characters, replacing the middle with "…".
+ *
+ * @example
+ * maskToken('eyJhbGciOiJIUzI1NiJ9.abc.xyz') // 'eyJh….xyz'
+ */
+export declare function maskToken(token: string): string;
+/**
+ * Create a namespaced logger for a specific SDK subsystem.
+ *
+ * Debug output is suppressed unless the `ASGARDEO_DEBUG` environment
+ * variable is set (any truthy value).
+ *
+ * @example
+ * ```ts
+ * const log = createLogger('session');
+ * log.info('Session created for', maskToken(accessToken));
+ * log.debug('Full payload', payload); // only logged when ASGARDEO_DEBUG=true
+ * ```
+ */
+export declare function createLogger(subsystem: string): {
+    debug: (...args: unknown[]) => void;
+    error: (...args: unknown[]) => void;
+    info: (...args: unknown[]) => void;
+    warn: (...args: unknown[]) => void;
+};

package/dist/runtime/utils/log.js

@@ -0,0 +1,25 @@
+const PREFIX = "@asgardeo/nuxt";
+export function maskToken(token) {
+  if (!token) return "(empty)";
+  if (token.length <= 8) return "***";
+  return `${token.slice(0, 4)}\u2026${token.slice(-4)}`;
+}
+export function createLogger(subsystem) {
+  const tag = `[${PREFIX}:${subsystem}]`;
+  return {
+    debug: (...args) => {
+      if (process.env["ASGARDEO_DEBUG"]) {
+        console.log(tag, ...args);
+      }
+    },
+    error: (...args) => {
+      console.error(tag, ...args);
+    },
+    info: (...args) => {
+      console.log(tag, ...args);
+    },
+    warn: (...args) => {
+      console.warn(tag, ...args);
+    }
+  };
+}

package/dist/runtime/utils/url-validation.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Validate a `returnTo` / redirect URL supplied by the client.
+ *
+ * Rules (defence-in-depth against open-redirect attacks):
+ * 1. Must be a non-empty string.
+ * 2. Must start with `/` (relative path only — no protocol, no host).
+ * 3. Must NOT start with `//` (protocol-relative URL — resolves as absolute).
+ * 4. Must NOT contain a `\` after the leading `/` (browser normalises `\` to `/`).
+ * 5. Must NOT contain a `%2F` or `%5C` in the first two chars after `/`
+ *    (encoded slashes/backslashes that bypass rule 3/4 after URL decoding).
+ *
+ * Returns the validated URL as-is on success, or throws `AsgardeoError`
+ * with `ErrorCode.OpenRedirectBlocked` on failure.
+ *
+ * @example
+ * ```ts
+ * const safe = validateReturnUrl('/dashboard');          // '/dashboard'
+ * validateReturnUrl('//evil.com');                        // throws
+ * validateReturnUrl('https://evil.com');                  // throws
+ * validateReturnUrl('/\\evil.com');                       // throws
+ * ```
+ */
+export declare function validateReturnUrl(url: unknown): string;
+/**
+ * Safe variant of `validateReturnUrl` that returns a fallback instead of throwing.
+ *
+ * @example
+ * ```ts
+ * const url = safeReturnUrl(query.returnTo, '/dashboard');
+ * ```
+ */
+export declare function safeReturnUrl(url: unknown, fallback?: string): string;

package/dist/runtime/utils/url-validation.js

@@ -0,0 +1,38 @@
+import { AsgardeoError } from "../errors/asgardeo-error.js";
+import { ErrorCode } from "../errors/error-codes.js";
+export function validateReturnUrl(url) {
+  if (typeof url !== "string" || url.trim() === "") {
+    throw new AsgardeoError("returnTo must be a non-empty string.", ErrorCode.OpenRedirectBlocked, { statusCode: 400 });
+  }
+  const trimmed = url.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//")) {
+    throw new AsgardeoError(
+      `Open redirect blocked: returnTo "${trimmed}" must be a relative path starting with a single "/".`,
+      ErrorCode.OpenRedirectBlocked,
+      { statusCode: 400 }
+    );
+  }
+  if (trimmed.length > 1 && trimmed[1] === "\\") {
+    throw new AsgardeoError(
+      `Open redirect blocked: returnTo "${trimmed}" contains a backslash.`,
+      ErrorCode.OpenRedirectBlocked,
+      { statusCode: 400 }
+    );
+  }
+  const decoded = decodeURIComponent(trimmed.slice(1, 5).toLowerCase());
+  if (decoded.startsWith("/") || decoded.startsWith("\\")) {
+    throw new AsgardeoError(
+      `Open redirect blocked: returnTo "${trimmed}" contains an encoded redirect sequence.`,
+      ErrorCode.OpenRedirectBlocked,
+      { statusCode: 400 }
+    );
+  }
+  return trimmed;
+}
+export function safeReturnUrl(url, fallback = "/") {
+  try {
+    return validateReturnUrl(url);
+  } catch {
+    return fallback;
+  }
+}

package/dist/types.d.mts

@@ -4,6 +4,4 @@ import type { default as Module } from './module.mjs'
 
 export type ModuleOptions = typeof Module extends NuxtModule<infer O> ? Partial<O> : Record<string, any>
 
-export { type BasicUserInfo } from '../dist/runtime/types.js'
-
 export { default } from './module.mjs'

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@asgardeo/nuxt",
-  "version": "0.0.0",
+  "version": "0.1.0-alpha.0",
   "description": "Nuxt module for Asgardeo - Authentication and Identity Management",
   "author": "WSO2",
   "license": "Apache-2.0",
-  "homepage": "https://github.com/asgardeo/web-ui-sdks/tree/main/packages/nuxt#readme",
+  "homepage": "https://github.com/asgardeo/javascript/tree/main/packages/nuxt#readme",
   "bugs": {
-    "url": "https://github.com/asgardeo/web-ui-sdks/issues"
+    "url": "https://github.com/asgardeo/javascript/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/asgardeo/web-ui-sdks",
+    "url": "https://github.com/asgardeo/javascript",
     "directory": "packages/nuxt"
   },
   "keywords": [
@@ -30,6 +30,18 @@
     ".": {
       "types": "./dist/types.d.mts",
       "import": "./dist/module.mjs"
+    },
+    "./server": {
+      "types": "./dist/runtime/server/index.d.ts",
+      "import": "./dist/runtime/server/index.js"
+    },
+    "./errors": {
+      "types": "./dist/runtime/errors/index.d.ts",
+      "import": "./dist/runtime/errors/index.js"
+    },
+    "./utils": {
+      "types": "./dist/runtime/utils/index.d.ts",
+      "import": "./dist/runtime/utils/index.js"
     }
   },
   "main": "./dist/module.mjs",
@@ -37,6 +49,15 @@
     "*": {
       ".": [
         "./dist/types.d.mts"
+      ],
+      "server": [
+        "./dist/runtime/server/index.d.ts"
+      ],
+      "errors": [
+        "./dist/runtime/errors/index.d.ts"
+      ],
+      "utils": [
+        "./dist/runtime/utils/index.d.ts"
       ]
     }
   },
@@ -46,35 +67,39 @@
     "README.md"
   ],
   "dependencies": {
-    "@asgardeo/auth-node": "^0.1.3",
-    "@nuxt/kit": "^3.16.2",
-    "defu": "^6.1.4"
+    "@nuxt/kit": "3.16.2",
+    "defu": "6.1.4",
+    "jose": "^6.0.11",
+    "@asgardeo/browser": "0.7.0",
+    "@asgardeo/vue": "0.3.3",
+    "@asgardeo/node": "0.0.75"
+  },
+  "peerDependencies": {
+    "nuxt": ">=3.10.0",
+    "vue": ">=3.5.0"
   },
   "devDependencies": {
-    "@nuxt/devtools": "^2.4.0",
-    "@nuxt/eslint-config": "^1.3.0",
-    "@nuxt/module-builder": "^1.0.1",
-    "@nuxt/schema": "^3.16.2",
-    "@nuxt/test-utils": "^3.17.2",
-    "@types/node": "latest",
-    "changelogen": "^0.6.1",
-    "cookie-es": "^2.0.0",
+    "@nuxt/devtools": "2.4.0",
+    "@nuxt/module-builder": "1.0.1",
+    "@nuxt/schema": "3.16.2",
+    "@nuxt/test-utils": "3.17.2",
+    "@types/node": "22.13.4",
+    "changelogen": "0.6.1",
+    "cookie-es": "2.0.0",
     "eslint": "8.57.0",
-    "nuxt": "^3.16.2",
-    "typescript": "~5.8.3",
-    "vitest": "^3.1.1",
-    "vue-tsc": "^2.2.8"
+    "h3": "1.15.11",
+    "nuxt": "3.16.2",
+    "typescript": "5.8.3",
+    "vitest": "3.1.1",
+    "vue-tsc": "2.2.8"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
     "build": "nuxt module-build prepare && nuxt module-build build",
-    "dev": "nuxi dev playground",
-    "dev:build": "nuxi build playground",
-    "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground",
     "lint": "nuxt prepare && eslint .",
     "test": "vitest run --passWithNoTests",
-    "typecheck": "nuxt prepare && vue-tsc --noEmit"
+    "typecheck": "nuxt module-build prepare && vue-tsc --noEmit"
   }
 }

package/dist/runtime/composables/asgardeo/useAuth.js

@@ -1,129 +0,0 @@
-import { navigateTo } from "#imports";
-export const useAuth = () => {
-  const signIn = async (callbackUrl) => {
-    const options = {
-      external: true,
-      query: {}
-    };
-    const redirectParam = callbackUrl || (typeof window !== "undefined" ? window.location.pathname : "/");
-    options.query = { callbackUrl: redirectParam };
-    options.external = true;
-    await navigateTo("/api/auth/signin", options);
-  };
-  const getIdToken = async () => {
-    try {
-      const response = await fetch("/api/auth/get-id-token", {
-        credentials: "include",
-        method: "GET"
-      });
-      if (!response.ok) {
-        return null;
-      }
-      const data = await response.json();
-      return data.idToken;
-    } catch (error) {
-      return null;
-    }
-  };
-  const getAccessToken = async () => {
-    try {
-      const response = await fetch("/api/auth/get-access-token", {
-        credentials: "include",
-        method: "GET"
-      });
-      if (!response.ok) {
-        return null;
-      }
-      const data = await response.json();
-      return data.accessToken;
-    } catch (error) {
-      return null;
-    }
-  };
-  const getDecodedIDToken = async () => {
-    try {
-      const response = await fetch(`/api/auth/get-decoded-id-token`, {
-        credentials: "include",
-        method: "GET"
-      });
-      if (!response.ok) {
-        return null;
-      }
-      const data = await response.json();
-      return data.decodedIDToken;
-    } catch (error) {
-      return null;
-    }
-  };
-  const revokeAccessToken = async () => {
-    await fetch("/api/auth/revoke-token", {
-      method: "POST"
-    }).catch((error) => error.data);
-  };
-  const isAuthenticated = async () => {
-    try {
-      const response = await fetch("/api/auth/isAuthenticated", {
-        credentials: "include",
-        method: "GET"
-      });
-      if (!response.ok) {
-        return false;
-      }
-      return await response.json();
-    } catch (error) {
-      return false;
-    }
-  };
-  const signOut = async () => {
-    const options = { external: true };
-    await navigateTo("/api/auth/signout", options);
-  };
-  const getBasicUserInfo = async () => {
-    try {
-      const userInfo = await $fetch("/api/auth/user", {
-        method: "GET"
-      });
-      return userInfo;
-    } catch (error) {
-      return null;
-    }
-  };
-  const getOIDCServiceEndpoints = async () => {
-    try {
-      const response = await fetch("/api/auth/get-oidc-endpoints", {
-        method: "GET"
-      });
-      if (!response.ok) {
-        return null;
-      }
-      return await response.json();
-    } catch (error) {
-      return null;
-    }
-  };
-  const getDataLayer = async () => {
-    try {
-      const response = await fetch("/api/auth/get-data-layer", {
-        method: "GET"
-      });
-      if (!response.ok) {
-        return null;
-      }
-      return await response.json();
-    } catch (error) {
-      return null;
-    }
-  };
-  return {
-    getAccessToken,
-    getBasicUserInfo,
-    getDataLayer,
-    getDecodedIDToken,
-    getIdToken,
-    getOIDCServiceEndpoints,
-    isAuthenticated,
-    revokeAccessToken,
-    signIn,
-    signOut
-  };
-};

package/dist/runtime/server/handler.js

@@ -1,231 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { defineEventHandler, sendRedirect, setCookie, deleteCookie, getQuery, getCookie, createError } from "h3";
-import { getAsgardeoSdkInstance } from "./services/asgardeo/index.js";
-function mergeCookieOptions(base, specific) {
-  const defaultBase = {
-    httpOnly: true,
-    path: "/",
-    sameSite: "lax",
-    secure: process.env.NODE_ENV === "production"
-  };
-  return { ...defaultBase, ...base, ...specific };
-}
-export const AsgardeoAuthHandler = (config, options) => {
-  const defaultCookieOptsFromUser = options?.cookies?.defaultOptions ?? {};
-  const sessionIdCookieName = options?.cookies?.sessionId ?? "ASGARDEO_SESSION_ID";
-  const sessionIdCookieOptions = mergeCookieOptions(
-    {
-      // Base defaults (already includes secure, httpOnly, path, sameSite)
-      maxAge: 9e5 / 1e3
-      // Default session length (15 minutes)
-    },
-    { ...defaultCookieOptsFromUser, ...options?.cookies?.sessionIdOptions }
-  );
-  return defineEventHandler(async (event) => {
-    const action = event.context.params?._;
-    const { method } = event.node.req;
-    const authClient = getAsgardeoSdkInstance(config);
-    if (action === "signin" && method === "GET") {
-      try {
-        const sessionId = randomUUID();
-        setCookie(event, sessionIdCookieName, sessionId, sessionIdCookieOptions);
-        await authClient.signIn(
-          (authorizationUrl) => {
-            sendRedirect(event, authorizationUrl, 302);
-          },
-          sessionId,
-          getQuery(event).code?.toString(),
-          getQuery(event).session_state?.toString(),
-          getQuery(event).state?.toString(),
-          {}
-        );
-        return null;
-      } catch (error) {
-        throw createError({
-          data: error.message,
-          statusCode: 500,
-          statusMessage: "Failed to initiate sign in"
-        });
-      }
-    } else if (action === "callback" && method === "GET") {
-      const sessionId = getCookie(event, sessionIdCookieName);
-      if (!sessionId) {
-        throw createError({
-          statusCode: 400,
-          statusMessage: "Authentication callback error: Session ID missing."
-        });
-      }
-      const { code, session_state, state, error, error_description } = getQuery(event);
-      if (!code) {
-        if (error) {
-          throw createError({
-            statusCode: 400,
-            statusMessage: `Authentication failed: ${error_description ?? error}`
-          });
-        }
-        throw createError({
-          statusCode: 400,
-          statusMessage: "Authorization code missing in callback."
-        });
-      }
-      try {
-        const tokenResponse = await authClient.signIn(
-          () => {
-          },
-          // no-op redirect callback
-          sessionId,
-          code.toString(),
-          session_state?.toString() ?? "",
-          state?.toString() ?? ""
-        );
-        if (!tokenResponse?.accessToken && !tokenResponse?.idToken) {
-          throw createError({
-            statusCode: 500,
-            statusMessage: "Token exchange failed: Invalid response from Identity Provider."
-          });
-        }
-        return await sendRedirect(event, options?.defaultCallbackUrl ?? "/", 302);
-      } catch (err) {
-        throw createError({
-          data: err.message ?? "An unexpected error occurred during token exchange",
-          statusCode: 500,
-          statusMessage: "Token exchange failed."
-        });
-      }
-    } else if (action === "user" && method === "GET") {
-      const sessionId = getCookie(event, sessionIdCookieName);
-      if (!sessionId) {
-        throw createError({
-          statusCode: 401,
-          statusMessage: "Unauthorized: No active session found."
-        });
-      }
-      try {
-        return await authClient.getBasicUserInfo(sessionId);
-      } catch {
-        throw createError({
-          statusCode: 500,
-          statusMessage: "Failed to retrieve user information."
-        });
-      }
-    } else if (action === "isAuthenticated" && method === "GET") {
-      const sessionId = getCookie(event, sessionIdCookieName);
-      if (!sessionId) return false;
-      try {
-        return await authClient.isAuthenticated(sessionId);
-      } catch {
-        return false;
-      }
-    } else if (action === "get-id-token" && method === "GET") {
-      const sessionId = getCookie(event, sessionIdCookieName);
-      if (!sessionId) {
-        throw createError({
-          statusCode: 401,
-          statusMessage: "Unauthorized: No active session found."
-        });
-      }
-      try {
-        const idToken = await authClient.getIDToken(sessionId);
-        return { idToken };
-      } catch {
-        throw createError({
-          statusCode: 500,
-          statusMessage: "Failed to retrieve ID token."
-        });
-      }
-    } else if (action === "get-access-token" && method === "GET") {
-      const sessionId = getCookie(event, sessionIdCookieName);
-      if (!sessionId) {
-        throw createError({
-          statusCode: 401,
-          statusMessage: "Unauthorized: No active session found."
-        });
-      }
-      try {
-        const accessToken = await authClient.getAccessToken(sessionId);
-        return { accessToken };
-      } catch {
-        throw createError({
-          statusCode: 500,
-          statusMessage: "Failed to retrieve access token."
-        });
-      }
-    } else if (action === "get-decoded-id-token" && method === "GET") {
-      const sessionId = getCookie(event, sessionIdCookieName);
-      if (!sessionId) {
-        throw createError({
-          statusCode: 401,
-          statusMessage: "Unauthorized: No active session found."
-        });
-      }
-      try {
-        return await authClient.getDecodedIDToken(sessionId);
-      } catch {
-        throw createError({
-          statusCode: 500,
-          statusMessage: "Failed to retrieve decoded ID token."
-        });
-      }
-    } else if (action === "revoke-token" && method === "POST") {
-      const sessionId = getCookie(event, sessionIdCookieName);
-      if (!sessionId) {
-        throw createError({
-          statusCode: 401,
-          statusMessage: "Unauthorized: No active session found."
-        });
-      }
-      try {
-        return await authClient.revokeAccessToken(sessionId);
-      } catch {
-        throw createError({
-          statusCode: 500,
-          statusMessage: "Failed to revoke tokens."
-        });
-      }
-    } else if (action === "get-oidc-endpoints" && method === "GET") {
-      try {
-        return await authClient.getOIDCServiceEndpoints();
-      } catch {
-        throw createError({
-          statusCode: 500,
-          statusMessage: "Failed to retrieve OIDC service endpoints."
-        });
-      }
-    } else if (action === "signout" && method === "GET") {
-      const sessionId = getCookie(event, sessionIdCookieName);
-      if (!sessionId) {
-        return sendRedirect(event, options?.defaultCallbackUrl ?? "/", 302);
-      }
-      try {
-        const signOutURL = await authClient.signOut(sessionId);
-        deleteCookie(event, sessionIdCookieName, sessionIdCookieOptions);
-        if (!signOutURL) {
-          return await sendRedirect(event, "/?error=signout_url_missing", 302);
-        }
-        return await sendRedirect(event, signOutURL, 302);
-      } catch (error) {
-        deleteCookie(event, sessionIdCookieName, sessionIdCookieOptions);
-        throw createError({
-          data: error.message || "An unexpected error occurred during sign out",
-          statusCode: 500,
-          statusMessage: "Sign out failed."
-        });
-      }
-    } else if (action === "get-data-layer" && method === "GET") {
-      try {
-        const dataLayer = await authClient.getDataLayer();
-        return dataLayer;
-      } catch (error) {
-        throw createError({
-          statusCode: 500,
-          statusMessage: "Failed to retrieve Data Layer."
-        });
-      }
-    } else {
-      throw createError({
-        statusCode: 404,
-        statusMessage: `Authentication endpoint not found or method not allowed for action: ${action}`
-      });
-    }
-  });
-};

package/dist/runtime/server/services/asgardeo/index.js

@@ -1,18 +0,0 @@
-import { AsgardeoNodeClient } from "@asgardeo/auth-node";
-let authClientInstance = null;
-export function getAsgardeoSdkInstance(config) {
-  if (authClientInstance) {
-    return authClientInstance;
-  }
-  if (!config) {
-    throw new Error(
-      "[Asgardeo] No configuration provided. You must call getAsgardeoSdkInstance(config) with a valid AuthClientConfig on the first use."
-    );
-  }
-  try {
-    authClientInstance = new AsgardeoNodeClient(config);
-  } catch (error) {
-    throw new Error("[Asgardeo] SDK initialization failed. Check provided configuration and SDK compatibility.");
-  }
-  return authClientInstance;
-}