@asgardeo/nuxt 0.0.0 → 0.1.0-alpha.0

package/dist/runtime/{composables/asgardeo/useAuth.d.ts → errors/index.d.ts}

@@ -15,5 +15,5 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { AuthInterface } from '../../types.js';
-export declare const useAuth: () => AuthInterface;
+export { AsgardeoError } from './asgardeo-error.js';
+export { ErrorCode } from './error-codes.js';

package/dist/runtime/errors/index.js

@@ -0,0 +1,2 @@
+export { AsgardeoError } from "./asgardeo-error.js";
+export { ErrorCode } from "./error-codes.js";

package/dist/runtime/middleware/auth.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Named route middleware for protecting pages.
+ *
+ * Registered under the name `'auth'` by the Nuxt module, so pages can
+ * opt in by string reference:
+ *
+ * ```vue
+ * <script setup>
+ * definePageMeta({ middleware: ['auth'] });
+ * </script>
+ * ```
+ *
+ * Equivalent to `defineAsgardeoMiddleware()` with no options: redirects
+ * unauthenticated users to `/api/auth/signin?returnTo=<path>`. For scope
+ * or organization gating, use `defineAsgardeoMiddleware({ ... })` directly.
+ */
+declare const _default: import("#app").RouteMiddleware;
+export default _default;

package/dist/runtime/middleware/auth.js

@@ -0,0 +1,2 @@
+import { defineAsgardeoMiddleware } from "./defineAsgardeoMiddleware.js";
+export default defineAsgardeoMiddleware();

package/dist/runtime/middleware/defineAsgardeoMiddleware.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { defineNuxtRouteMiddleware } from '#app';
+export interface AsgardeoMiddlewareOptions {
+    /**
+     * The path to redirect unauthenticated (or unauthorised) requests to.
+     * Defaults to `'/api/auth/signin'`.
+     */
+    redirectTo?: string;
+    /**
+     * If `true`, the middleware will also require that the user has an
+     * `organizationId` in their session.  Redirects to `redirectTo` if not.
+     */
+    requireOrganization?: boolean;
+    /**
+     * Required OAuth scopes.  The middleware checks that every listed scope
+     * is present in the session before allowing access.
+     */
+    requireScopes?: string[];
+}
+/**
+ * Typed factory for Asgardeo route middleware.
+ *
+ * Usage in a page component:
+ * ```vue
+ * <script setup>
+ * definePageMeta({
+ *   middleware: [defineAsgardeoMiddleware({ requireOrganization: true })]
+ * });
+ * </script>
+ * ```
+ *
+ * Or add it as a named middleware in `middleware/` and reference by name.
+ *
+ * The built-in `'auth'` middleware registered by this module is equivalent
+ * to calling `defineAsgardeoMiddleware()` with no options.
+ */
+export declare function defineAsgardeoMiddleware(options?: AsgardeoMiddlewareOptions): ReturnType<typeof defineNuxtRouteMiddleware>;

package/dist/runtime/middleware/defineAsgardeoMiddleware.js

@@ -0,0 +1,24 @@
+import { defineNuxtRouteMiddleware, navigateTo, useState } from "#app";
+const DEFAULT_REDIRECT_TO = "/api/auth/signin";
+export function defineAsgardeoMiddleware(options = {}) {
+  const { redirectTo = DEFAULT_REDIRECT_TO, requireOrganization = false, requireScopes = [] } = options;
+  return defineNuxtRouteMiddleware((to) => {
+    const authState = useState("asgardeo:auth");
+    if (!authState.value?.isSignedIn) {
+      const returnTo = encodeURIComponent(to.fullPath);
+      return navigateTo(`${redirectTo}?returnTo=${returnTo}`, { external: true });
+    }
+    const user = authState.value.user;
+    if (requireOrganization && !user?.["organizationId"]) {
+      return navigateTo(redirectTo, { external: true });
+    }
+    if (requireScopes.length > 0) {
+      const sessionScopes = String(user?.["scopes"] ?? "").split(" ");
+      const hasAllScopes = requireScopes.every((s) => sessionScopes.includes(s));
+      if (!hasAllScopes) {
+        return navigateTo(redirectTo, { external: true });
+      }
+    }
+    return void 0;
+  });
+}

package/dist/runtime/plugins/asgardeo.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import '../types/augments.d.js';
+/**
+ * Universal Nuxt plugin (runs on both server and client) that wires up the
+ * Asgardeo Vue SDK.
+ *
+ * Responsibilities — mirrors the split between `AsgardeoServerProvider` and
+ * `AsgardeoClientProvider` in the Next.js SDK:
+ *
+ *  1. **Auth state** — hydrate `useState('asgardeo:auth')` from the Nitro
+ *     plugin's `event.context.asgardeo` so SSR and client agree on signed-in
+ *     status and the user object.
+ *  2. **ASGARDEO_KEY** — provide the primary auth context at the app level.
+ *     Action helpers (`signIn` / `signOut` / `signUp`) use Nuxt's
+ *     `navigateTo` so redirects work on both server and client.
+ *  3. **AsgardeoRoot** — register the wrapper component that mounts the rest
+ *     of the provider tree (`I18nProvider`, `BrandingProvider`,
+ *     `ThemeProvider`, `FlowProvider`, `UserProvider`, `OrganizationProvider`)
+ *     so downstream composables receive real context values.
+ *  4. **AsgardeoPlugin (delegated)** — install the Vue SDK plugin in
+ *     delegated mode so it skips browser-only initialisation (SSR-safe).
+ */
+declare const _default: import("#app").Plugin<Record<string, unknown>> & import("#app").ObjectPlugin<Record<string, unknown>>;
+export default _default;

package/dist/runtime/plugins/asgardeo.js

@@ -0,0 +1,129 @@
+import { getRedirectBasedSignUpUrl } from "@asgardeo/browser";
+import { AsgardeoPlugin, ASGARDEO_KEY } from "@asgardeo/vue";
+import { computed } from "vue";
+import AsgardeoRoot from "../components/AsgardeoRoot.js";
+import { defineNuxtPlugin, useState, useRequestEvent, useRuntimeConfig, navigateTo } from "#app";
+import "../types/augments.d";
+export default defineNuxtPlugin((nuxtApp) => {
+  const publicConfig = useRuntimeConfig().public.asgardeo;
+  if (import.meta.client && import.meta.dev) {
+    if (!publicConfig?.baseUrl || !publicConfig?.clientId) {
+      console.warn(
+        "[@asgardeo/nuxt] Missing baseUrl or clientId. Set NUXT_PUBLIC_ASGARDEO_BASE_URL and NUXT_PUBLIC_ASGARDEO_CLIENT_ID, or configure `asgardeo` in nuxt.config. Auth endpoints will not function until this is resolved."
+      );
+    }
+  }
+  const authState = useState("asgardeo:auth", () => ({
+    isLoading: true,
+    isSignedIn: false,
+    user: null
+  }));
+  const userProfileState = useState("asgardeo:user-profile", () => null);
+  const currentOrgState = useState("asgardeo:current-org", () => null);
+  const myOrgsState = useState("asgardeo:my-orgs", () => []);
+  const brandingState = useState(
+    "asgardeo:branding",
+    () => null
+  );
+  if (import.meta.server) {
+    const event = useRequestEvent();
+    const ssr = event?.context?.asgardeo?.ssr;
+    if (ssr) {
+      authState.value = {
+        isLoading: false,
+        isSignedIn: ssr.isSignedIn,
+        user: ssr.user
+      };
+      userProfileState.value = ssr.userProfile;
+      currentOrgState.value = ssr.currentOrganization;
+      myOrgsState.value = ssr.myOrganizations;
+      brandingState.value = ssr.brandingPreference;
+    } else {
+      const ssrContext = event?.context?.asgardeo;
+      if (ssrContext) {
+        authState.value = {
+          isLoading: false,
+          isSignedIn: ssrContext.isSignedIn ?? false,
+          user: ssrContext.session?.sub ? { sub: ssrContext.session.sub } : null
+        };
+      } else {
+        const legacyAuth = event?.context?.["__asgardeoAuth"];
+        authState.value = legacyAuth ?? { isLoading: false, isSignedIn: false, user: null };
+      }
+    }
+  }
+  if (import.meta.client) {
+    authState.value = { ...authState.value, isLoading: false };
+  }
+  const isSignedIn = computed(() => authState.value.isSignedIn);
+  const isLoading = computed(() => authState.value.isLoading);
+  const isInitialized = computed(() => !authState.value.isLoading);
+  const user = computed(() => authState.value.user ?? null);
+  const organizationRef = computed(() => currentOrgState.value);
+  const signIn = async (options) => {
+    const returnTo = typeof options?.["returnTo"] === "string" ? options["returnTo"] : void 0;
+    const url = returnTo ? `/api/auth/signin?returnTo=${encodeURIComponent(returnTo)}` : "/api/auth/signin";
+    await navigateTo(url, { external: true });
+  };
+  const signOut = async () => {
+    const res = await $fetch("/api/auth/signout", { method: "POST" });
+    await navigateTo(res.redirectUrl || "/", { external: true });
+  };
+  const signUp = async () => {
+    if (publicConfig.signUpUrl) {
+      await navigateTo(publicConfig.signUpUrl, { external: true });
+      return;
+    }
+    const redirectUrl = getRedirectBasedSignUpUrl({
+      applicationId: publicConfig.applicationId,
+      baseUrl: publicConfig.baseUrl,
+      clientId: publicConfig.clientId
+    });
+    if (redirectUrl) {
+      await navigateTo(redirectUrl, { external: true });
+      return;
+    }
+    await navigateTo("/api/auth/signup", { external: true });
+  };
+  const getAccessToken = async () => {
+    try {
+      const res = await $fetch("/api/auth/token");
+      return res.accessToken ?? "";
+    } catch {
+      return "";
+    }
+  };
+  const noop = async () => void 0;
+  nuxtApp.vueApp.provide(ASGARDEO_KEY, {
+    afterSignInUrl: publicConfig.afterSignInUrl,
+    applicationId: publicConfig.applicationId,
+    baseUrl: publicConfig.baseUrl,
+    clearSession: noop,
+    clientId: publicConfig.clientId,
+    exchangeToken: noop,
+    getAccessToken,
+    getDecodedIdToken: noop,
+    getIdToken: noop,
+    http: { request: noop, requestAll: noop },
+    instanceId: 0,
+    isInitialized,
+    isLoading,
+    isSignedIn,
+    organization: organizationRef,
+    organizationHandle: publicConfig.organizationHandle,
+    platform: void 0,
+    reInitialize: async () => false,
+    signIn,
+    signInOptions: void 0,
+    signInSilently: noop,
+    signInUrl: publicConfig.signInUrl,
+    signOut,
+    signUp,
+    signUpUrl: publicConfig.signUpUrl,
+    storage: void 0,
+    switchOrganization: noop,
+    user
+  });
+  nuxtApp.vueApp.component("AsgardeoRoot", AsgardeoRoot);
+  nuxtApp.vueApp.use(AsgardeoPlugin, { mode: "delegated" });
+});

package/dist/runtime/server/AsgardeoNuxtClient.d.ts

@@ -0,0 +1,182 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { AsgardeoNodeClient, type IdToken, type Organization, type OrganizationDetails, type CreateOrganizationPayload, type Storage, type TokenExchangeRequestConfig, type TokenResponse, type User, type UserProfile, type UpdateMeProfileConfig, type AllOrganizationsApiResponse, type GetBrandingPreferenceConfig, type BrandingPreference, type EmbeddedFlowExecuteRequestPayload, type EmbeddedFlowExecuteResponse, type ExtendedAuthorizeRequestUrlParams, type SignUpOptions } from '@asgardeo/node';
+import type { AsgardeoNuxtConfig, AsgardeoSessionPayload } from '../types.js';
+/**
+ * Singleton Asgardeo client for Nuxt applications.
+ *
+ * Mirrors the {@link AsgardeoNextClient} pattern: a single shared instance per
+ * server process that delegates OAuth/OIDC operations to an internal
+ * {@link LegacyAsgardeoNodeClient}. The legacy client provisions its own default
+ * in-memory store (`MemoryCacheStore`) for PKCE state and tokens so that state
+ * persists across the sign-in → callback boundary.
+ *
+ * Consumers call {@link getInstance} directly from server routes and plugins —
+ * there is no per-request wrapper factory. Initialization happens once per
+ * process (guarded by {@link isInitialized}) from the `asgardeo-init` Nitro
+ * plugin on the first request.
+ *
+ * @example
+ * ```ts
+ * // In a Nitro API route:
+ * export default defineEventHandler(async (event) => {
+ *   const client = AsgardeoNuxtClient.getInstance();
+ *   return client.getUser(sessionId);
+ * });
+ * ```
+ */
+declare class AsgardeoNuxtClient extends AsgardeoNodeClient<AsgardeoNuxtConfig> {
+    private static instance;
+    private legacy;
+    isInitialized: boolean;
+    private constructor();
+    /**
+     * Get the singleton instance of AsgardeoNuxtClient.
+     */
+    static getInstance(): AsgardeoNuxtClient;
+    /**
+     * Initializes the underlying legacy client with OAuth/OIDC settings derived
+     * from the Nuxt module config. Idempotent — repeated calls are no-ops after
+     * the first successful initialization.
+     */
+    initialize(config: AsgardeoNuxtConfig, storage?: Storage): Promise<boolean>;
+    reInitialize(config: Partial<AsgardeoNuxtConfig>): Promise<boolean>;
+    /**
+     * Seeds the legacy in-memory token store from a verified session JWT payload.
+     *
+     * The signed session cookie is the source of truth for tokens in this SDK — it
+     * survives server restarts and new worker processes. The underlying
+     * {@link LegacyAsgardeoNodeClient}, however, keeps tokens in a
+     * {@link MemoryCacheStore} keyed by `sessionId`, and its
+     * `getAccessToken` / `getUser` / `getDecodedIdToken` / `signOut` paths all
+     * read from that store. Without rehydration, those calls fail whenever the
+     * in-memory store and the cookie diverge (the classic case: `nuxi dev`
+     * restart while the browser still holds a valid session cookie).
+     *
+     * Writes the snake_case token shape the legacy helper expects
+     * (see `AuthenticationHelper.processTokenResponse`). Safe to call on every
+     * request — it's an in-memory write and the cookie always reflects the
+     * freshest tokens (the refresh path re-issues the cookie too).
+     */
+    rehydrateSessionFromPayload(session: AsgardeoSessionPayload): Promise<void>;
+    /**
+     * Initiates the authorization code flow, handles an embedded sign-in step,
+     * or exchanges a code for tokens.
+     *
+     * Overload 1 — **redirect-flow** (existing callers like `signin.get.ts`):
+     * ```
+     * signIn(authURLCallback, sessionId, code?, sessionState?, state?, config?)
+     * ```
+     * Overload 2 — **embedded flow initiate** (flowId === ''):
+     * ```
+     * signIn({flowId: ''}, request, sessionId)
+     * ```
+     * Dispatches to `initializeEmbeddedSignInFlow`.
+     *
+     * Overload 3 — **embedded flow execute** (flowId set):
+     * ```
+     * signIn(payload, request, sessionId)
+     * ```
+     * Dispatches to `executeEmbeddedSignInFlow`.
+     *
+     * Overload 4 — **code exchange** (completion after embedded flow):
+     * ```
+     * signIn({code, state, session_state}, {}, sessionId)
+     * ```
+     * Falls through to the legacy redirect-flow code-exchange path.
+     */
+    signIn(...args: any[]): Promise<any>;
+    /**
+     * Executes the embedded sign-up flow step.
+     * Mirrors `AsgardeoNextClient.signUp` with an `EmbeddedFlowExecuteRequestPayload`.
+     */
+    signUp(options?: SignUpOptions): Promise<void>;
+    signUp(payload: EmbeddedFlowExecuteRequestPayload): Promise<EmbeddedFlowExecuteResponse>;
+    /**
+     * Returns the OAuth2 authorization URL.
+     * Used by the redirect-flow GET handler and the embedded-flow initiation path.
+     *
+     * Mirrors `AsgardeoNextClient.getAuthorizeRequestUrl`.
+     */
+    getAuthorizeRequestUrl(customParams: ExtendedAuthorizeRequestUrlParams, userId?: string): Promise<string>;
+    /**
+     * Clears the session and returns the RP-Initiated Logout URL.
+     * Accepts either `(sessionId: string)` or `(options?, sessionId?, callback?)`.
+     */
+    signOut(...args: any[]): Promise<string>;
+    getUser(sessionId?: string): Promise<User>;
+    getAccessToken(sessionId?: string): Promise<string>;
+    /**
+     * Decodes and returns the ID token claims for the given session.
+     * Exposed here (as on {@link AsgardeoNextClient}) so route handlers can
+     * access ID token claims without falling back to the legacy client.
+     */
+    getDecodedIdToken(sessionId?: string, idToken?: string): Promise<IdToken>;
+    isSignedIn(sessionId?: string): Promise<boolean>;
+    exchangeToken(config: TokenExchangeRequestConfig, sessionId?: string): Promise<TokenResponse | Response>;
+    /**
+     * Fetches the flattened SCIM2 user profile for the given session.
+     * Mirrors `AsgardeoNextClient.getUserProfile` — calls `getScim2Me` +
+     * `getSchemas` + `generateFlattenedUserProfile` and falls back to
+     * `getUser` claims if SCIM2 is unavailable.
+     */
+    getUserProfile(sessionId: string): Promise<UserProfile>;
+    /**
+     * Extracts the current organisation from the decoded ID token.
+     * Returns null when the user is not acting within an organisation.
+     */
+    getCurrentOrganization(sessionId: string): Promise<Organization | null>;
+    /**
+     * Returns the list of organisations the authenticated user is a member of.
+     */
+    getMyOrganizations(sessionId: string): Promise<Organization[]>;
+    /**
+     * Fetches the branding preference for the tenant / application.
+     * Delegates to the standalone `getBrandingPreference` API helper from
+     * `@asgardeo/node`, which does not require an authenticated session.
+     */
+    getBrandingPreference(config: GetBrandingPreferenceConfig): Promise<BrandingPreference>;
+    /**
+     * Updates the SCIM2 /Me profile for the authenticated user.
+     * Mirrors `AsgardeoNextClient.updateUserProfile`.
+     */
+    updateUserProfile(config: UpdateMeProfileConfig, sessionId: string): Promise<User>;
+    /**
+     * Retrieves all organisations accessible to the authenticated user
+     * (paginated). Mirrors `AsgardeoNextClient.getAllOrganizations`.
+     */
+    getAllOrganizations(options?: any, sessionId?: string): Promise<AllOrganizationsApiResponse>;
+    /**
+     * Creates a new sub-organisation. Mirrors `AsgardeoNextClient.createOrganization`.
+     */
+    createOrganization(payload: CreateOrganizationPayload, sessionId: string): Promise<Organization>;
+    /**
+     * Fetches the details of a single organisation by ID.
+     * Mirrors `AsgardeoNextClient.getOrganization`.
+     */
+    getOrganization(organizationId: string, sessionId: string): Promise<OrganizationDetails>;
+    /**
+     * Performs an organisation-switch token exchange and returns the new
+     * `TokenResponse`. The caller (the Nitro route) is responsible for
+     * persisting the new session cookie.
+     *
+     * Mirrors `AsgardeoNextClient.switchOrganization`.
+     */
+    switchOrganization(organization: Organization, sessionId: string): Promise<TokenResponse | Response>;
+}
+export default AsgardeoNuxtClient;