@asgardeo/nuxt 0.0.0 → 0.1.0

package/dist/runtime/server/AsgardeoNuxtClient.js

@@ -0,0 +1,366 @@
+import {
+  AsgardeoNodeClient,
+  LegacyAsgardeoNodeClient,
+  getBrandingPreference,
+  getMeOrganizations,
+  getAllOrganizations,
+  createOrganization,
+  getOrganization,
+  getScim2Me,
+  getSchemas,
+  flattenUserSchema,
+  generateFlattenedUserProfile,
+  updateMeProfile,
+  initializeEmbeddedSignInFlow,
+  executeEmbeddedSignInFlow,
+  executeEmbeddedSignUpFlow
+} from "@asgardeo/node";
+class AsgardeoNuxtClient extends AsgardeoNodeClient {
+  static instance;
+  legacy;
+  isInitialized = false;
+  constructor() {
+    super();
+    this.legacy = new LegacyAsgardeoNodeClient();
+  }
+  /**
+   * Get the singleton instance of AsgardeoNuxtClient.
+   */
+  static getInstance() {
+    if (!AsgardeoNuxtClient.instance) {
+      AsgardeoNuxtClient.instance = new AsgardeoNuxtClient();
+    }
+    return AsgardeoNuxtClient.instance;
+  }
+  /**
+   * Initializes the underlying legacy client with OAuth/OIDC settings derived
+   * from the Nuxt module config. Idempotent — repeated calls are no-ops after
+   * the first successful initialization.
+   */
+  async initialize(config, storage) {
+    if (this.isInitialized) {
+      return true;
+    }
+    const authConfig = {
+      afterSignInUrl: config.afterSignInUrl,
+      afterSignOutUrl: config.afterSignOutUrl || "/",
+      baseUrl: config.baseUrl,
+      clientId: config.clientId,
+      clientSecret: config.clientSecret || void 0,
+      enablePKCE: true,
+      scopes: config.scopes || ["openid", "profile"]
+    };
+    const result = await this.legacy.initialize(authConfig, storage);
+    this.isInitialized = true;
+    return result;
+  }
+  async reInitialize(config) {
+    await this.legacy.reInitialize(config);
+    return true;
+  }
+  /**
+   * Seeds the legacy in-memory token store from a verified session JWT payload.
+   *
+   * The signed session cookie is the source of truth for tokens in this SDK — it
+   * survives server restarts and new worker processes. The underlying
+   * {@link LegacyAsgardeoNodeClient}, however, keeps tokens in a
+   * {@link MemoryCacheStore} keyed by `sessionId`, and its
+   * `getAccessToken` / `getUser` / `getDecodedIdToken` / `signOut` paths all
+   * read from that store. Without rehydration, those calls fail whenever the
+   * in-memory store and the cookie diverge (the classic case: `nuxi dev`
+   * restart while the browser still holds a valid session cookie).
+   *
+   * Writes the snake_case token shape the legacy helper expects
+   * (see `AuthenticationHelper.processTokenResponse`). Safe to call on every
+   * request — it's an in-memory write and the cookie always reflects the
+   * freshest tokens (the refresh path re-issues the cookie too).
+   */
+  async rehydrateSessionFromPayload(session) {
+    if (!this.isInitialized || !session?.sessionId || !session?.accessToken) {
+      return;
+    }
+    const storageManager = await this.legacy.getStorageManager();
+    const iatSeconds = typeof session.iat === "number" ? session.iat : Math.floor(Date.now() / 1e3);
+    const expiresInSeconds = typeof session.accessTokenExpiresAt === "number" ? Math.max(0, session.accessTokenExpiresAt - iatSeconds) : 3600;
+    await storageManager.setSessionData(
+      {
+        access_token: session.accessToken,
+        created_at: iatSeconds * 1e3,
+        expires_in: String(expiresInSeconds || 3600),
+        id_token: session.idToken ?? "",
+        refresh_token: session.refreshToken ?? "",
+        scope: session.scopes ?? "",
+        session_state: "",
+        token_type: "Bearer"
+      },
+      session.sessionId
+    );
+  }
+  /**
+   * Initiates the authorization code flow, handles an embedded sign-in step,
+   * or exchanges a code for tokens.
+   *
+   * Overload 1 — **redirect-flow** (existing callers like `signin.get.ts`):
+   * ```
+   * signIn(authURLCallback, sessionId, code?, sessionState?, state?, config?)
+   * ```
+   * Overload 2 — **embedded flow initiate** (flowId === ''):
+   * ```
+   * signIn({flowId: ''}, request, sessionId)
+   * ```
+   * Dispatches to `initializeEmbeddedSignInFlow`.
+   *
+   * Overload 3 — **embedded flow execute** (flowId set):
+   * ```
+   * signIn(payload, request, sessionId)
+   * ```
+   * Dispatches to `executeEmbeddedSignInFlow`.
+   *
+   * Overload 4 — **code exchange** (completion after embedded flow):
+   * ```
+   * signIn({code, state, session_state}, {}, sessionId)
+   * ```
+   * Falls through to the legacy redirect-flow code-exchange path.
+   */
+  signIn(...args) {
+    const arg0 = args[0];
+    if (typeof arg0 === "object" && arg0 !== null && "flowId" in arg0) {
+      const sessionId = args[2];
+      if (arg0.flowId === "") {
+        return this.getAuthorizeRequestUrl(
+          { client_secret: "{{clientSecret}}", response_mode: "direct" },
+          sessionId
+        ).then((authorizeUrl) => {
+          const url = new URL(authorizeUrl);
+          return initializeEmbeddedSignInFlow({
+            payload: Object.fromEntries(url.searchParams.entries()),
+            url: `${url.origin}${url.pathname}`
+          });
+        });
+      }
+      const request = args[1] ?? {};
+      return executeEmbeddedSignInFlow({
+        payload: arg0,
+        url: request.url
+      });
+    }
+    if (typeof arg0 === "object" && arg0 !== null && ("code" in arg0 || "state" in arg0)) {
+      const payload = arg0;
+      const code = typeof payload.code === "string" ? payload.code : void 0;
+      const sessionState = typeof payload.session_state === "string" ? payload.session_state : void 0;
+      const state = typeof payload.state === "string" ? payload.state : void 0;
+      const extraParams = {};
+      if (code) {
+        extraParams.code = code;
+      }
+      if (sessionState) {
+        extraParams.session_state = sessionState;
+      }
+      if (state) {
+        extraParams.state = state;
+      }
+      return this.legacy.signIn(args[3], args[2], code, sessionState, state, extraParams);
+    }
+    return this.legacy.signIn(args[0], args[1], args[2], args[3], args[4], args[5]);
+  }
+  async signUp(payloadOrOptions) {
+    if (!payloadOrOptions || !("flowType" in payloadOrOptions)) {
+      return void 0;
+    }
+    const configData = await this.legacy.getConfigData?.();
+    const baseUrl = configData?.baseUrl;
+    const response = await executeEmbeddedSignUpFlow({
+      baseUrl,
+      payload: payloadOrOptions
+    });
+    return response;
+  }
+  /**
+   * Returns the OAuth2 authorization URL.
+   * Used by the redirect-flow GET handler and the embedded-flow initiation path.
+   *
+   * Mirrors `AsgardeoNextClient.getAuthorizeRequestUrl`.
+   */
+  async getAuthorizeRequestUrl(customParams, userId) {
+    return this.legacy.getSignInUrl(customParams, userId);
+  }
+  /**
+   * Clears the session and returns the RP-Initiated Logout URL.
+   * Accepts either `(sessionId: string)` or `(options?, sessionId?, callback?)`.
+   */
+  async signOut(...args) {
+    const sessionId = typeof args[0] === "string" ? args[0] : args[1];
+    return this.legacy.signOut(sessionId);
+  }
+  getUser(sessionId) {
+    return this.legacy.getUser(sessionId);
+  }
+  getAccessToken(sessionId) {
+    return this.legacy.getAccessToken(sessionId);
+  }
+  /**
+   * Decodes and returns the ID token claims for the given session.
+   * Exposed here (as on {@link AsgardeoNextClient}) so route handlers can
+   * access ID token claims without falling back to the legacy client.
+   */
+  getDecodedIdToken(sessionId, idToken) {
+    return this.legacy.getDecodedIdToken(sessionId, idToken);
+  }
+  isSignedIn(sessionId) {
+    return this.legacy.isSignedIn(sessionId);
+  }
+  exchangeToken(config, sessionId) {
+    return this.legacy.exchangeToken(config, sessionId);
+  }
+  /**
+   * Fetches the flattened SCIM2 user profile for the given session.
+   * Mirrors `AsgardeoNextClient.getUserProfile` — calls `getScim2Me` +
+   * `getSchemas` + `generateFlattenedUserProfile` and falls back to
+   * `getUser` claims if SCIM2 is unavailable.
+   */
+  async getUserProfile(sessionId) {
+    const accessToken = await this.getAccessToken(sessionId);
+    const configData = await this.legacy.getConfigData?.();
+    const baseUrl = configData?.baseUrl ?? "";
+    try {
+      const authHeaders = { Authorization: `Bearer ${accessToken}` };
+      const [profile, schemas] = await Promise.all([
+        getScim2Me({ baseUrl, headers: authHeaders }),
+        getSchemas({ baseUrl, headers: authHeaders })
+      ]);
+      const processedSchemas = flattenUserSchema(schemas);
+      return {
+        flattenedProfile: generateFlattenedUserProfile(profile, processedSchemas),
+        profile,
+        schemas: processedSchemas
+      };
+    } catch {
+      const user = await this.getUser(sessionId);
+      return { flattenedProfile: user, profile: user, schemas: [] };
+    }
+  }
+  /**
+   * Extracts the current organisation from the decoded ID token.
+   * Returns null when the user is not acting within an organisation.
+   */
+  async getCurrentOrganization(sessionId) {
+    try {
+      const idToken = await this.getDecodedIdToken(sessionId);
+      if (!idToken?.org_id) {
+        return null;
+      }
+      return {
+        id: idToken.org_id,
+        name: idToken.org_name ?? "",
+        orgHandle: idToken.org_handle ?? ""
+      };
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Returns the list of organisations the authenticated user is a member of.
+   */
+  async getMyOrganizations(sessionId) {
+    const accessToken = await this.getAccessToken(sessionId);
+    const configData = await this.legacy.getConfigData?.();
+    const baseUrl = configData?.baseUrl ?? "";
+    return getMeOrganizations({
+      baseUrl,
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+  }
+  /**
+   * Fetches the branding preference for the tenant / application.
+   * Delegates to the standalone `getBrandingPreference` API helper from
+   * `@asgardeo/node`, which does not require an authenticated session.
+   */
+  // eslint-disable-next-line class-methods-use-this
+  async getBrandingPreference(config) {
+    return getBrandingPreference(config);
+  }
+  /**
+   * Updates the SCIM2 /Me profile for the authenticated user.
+   * Mirrors `AsgardeoNextClient.updateUserProfile`.
+   */
+  async updateUserProfile(config, sessionId) {
+    const accessToken = await this.getAccessToken(sessionId);
+    const configData = await this.legacy.getConfigData?.();
+    const baseUrl = configData?.baseUrl ?? "";
+    return updateMeProfile({
+      ...config,
+      // pass-through, includes payload
+      baseUrl,
+      headers: { ...config.headers, Authorization: `Bearer ${accessToken}` }
+    });
+  }
+  /**
+   * Retrieves all organisations accessible to the authenticated user
+   * (paginated). Mirrors `AsgardeoNextClient.getAllOrganizations`.
+   */
+  async getAllOrganizations(options, sessionId) {
+    const resolvedSessionId = sessionId ?? "";
+    const accessToken = await this.getAccessToken(resolvedSessionId);
+    const configData = await this.legacy.getConfigData?.();
+    const baseUrl = configData?.baseUrl ?? "";
+    return getAllOrganizations({
+      baseUrl,
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+  }
+  /**
+   * Creates a new sub-organisation. Mirrors `AsgardeoNextClient.createOrganization`.
+   */
+  async createOrganization(payload, sessionId) {
+    const accessToken = await this.getAccessToken(sessionId);
+    const configData = await this.legacy.getConfigData?.();
+    const baseUrl = configData?.baseUrl ?? "";
+    return createOrganization({
+      baseUrl,
+      headers: { Authorization: `Bearer ${accessToken}` },
+      payload
+    });
+  }
+  /**
+   * Fetches the details of a single organisation by ID.
+   * Mirrors `AsgardeoNextClient.getOrganization`.
+   */
+  async getOrganization(organizationId, sessionId) {
+    const accessToken = await this.getAccessToken(sessionId);
+    const configData = await this.legacy.getConfigData?.();
+    const baseUrl = configData?.baseUrl ?? "";
+    return getOrganization({
+      baseUrl,
+      headers: { Authorization: `Bearer ${accessToken}` },
+      organizationId
+    });
+  }
+  /**
+   * Performs an organisation-switch token exchange and returns the new
+   * `TokenResponse`. The caller (the Nitro route) is responsible for
+   * persisting the new session cookie.
+   *
+   * Mirrors `AsgardeoNextClient.switchOrganization`.
+   */
+  async switchOrganization(organization, sessionId) {
+    if (!organization.id) {
+      throw new Error("Organization ID is required for switching organizations.");
+    }
+    const exchangeConfig = {
+      attachToken: false,
+      data: {
+        client_id: "{{clientId}}",
+        client_secret: "{{clientSecret}}",
+        grant_type: "organization_switch",
+        scope: "{{scopes}}",
+        switching_organization: organization.id,
+        token: "{{accessToken}}"
+      },
+      id: "organization-switch",
+      returnsSession: true,
+      signInRequired: true
+    };
+    return this.legacy.exchangeToken(exchangeConfig, sessionId);
+  }
+}
+export default AsgardeoNuxtClient;

package/dist/runtime/server/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * @asgardeo/nuxt/server
+ *
+ * Public server-only barrel. Import from this subpath to access
+ * server utilities without bundling them into the client.
+ *
+ * @example
+ * ```ts
+ * import { useServerSession, requireServerSession } from '@asgardeo/nuxt/server';
+ * ```
+ */
+export { useServerSession, requireServerSession } from './utils/serverSession.js';
+export { getValidAccessToken } from './utils/token-refresh.js';
+export { getAsgardeoContext } from './utils/event-context.js';
+export type { AsgardeoEventContext } from './utils/event-context.js';
+export type { AsgardeoSessionPayload, AsgardeoNuxtConfig } from '../types.js';

package/dist/runtime/server/index.js

@@ -0,0 +1,3 @@
+export { useServerSession, requireServerSession } from "./utils/serverSession.js";
+export { getValidAccessToken } from "./utils/token-refresh.js";
+export { getAsgardeoContext } from "./utils/event-context.js";

package/dist/runtime/server/plugins/asgardeo-ssr.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import '../../types/augments.d.js';
+/**
+ * Nitro server plugin — the Nuxt equivalent of `AsgardeoServerProvider` in the
+ * Next.js SDK.
+ *
+ * On every page request it:
+ * 1. Initialises the singleton {@link AsgardeoNuxtClient} once (idempotent).
+ * 2. Verifies the JWT session cookie → resolves `isSignedIn`.
+ * 3. When signed in, detects org context from the ID token (`user_org`) and
+ *    switches `resolvedBaseUrl` to `${baseUrl}/o` when the user is acting
+ *    within an organisation.
+ * 4. In parallel (gated by `preferences`):
+ *    - Fetches user + SCIM2 user profile  (`preferences.user.fetchUserProfile !== false`)
+ *    - Fetches current org + my orgs      (`preferences.user.fetchOrganizations !== false`)
+ *    - Fetches branding preference        (`preferences.theme.inheritFromBranding !== false`)
+ * 5. Writes the full {@link AsgardeoSSRData} to `event.context.asgardeo.ssr`
+ *    so the Nuxt plugin can seed `useState` keys for zero-cost hydration.
+ *
+ * Each fetch is individually wrapped in try/catch so a broken SCIM or branding
+ * call never crashes SSR — the client layer can recover via the existing
+ * `/api/auth/*` routes.
+ */
+declare const _default: import("nitropack/types").NitroAppPlugin;
+export default _default;

package/dist/runtime/server/plugins/asgardeo-ssr.js

@@ -0,0 +1,134 @@
+import { getRequestURL } from "h3";
+import { defineNitroPlugin } from "nitropack/runtime";
+import { createLogger } from "../../utils/log.js";
+import AsgardeoNuxtClient from "../AsgardeoNuxtClient.js";
+import { verifyAndRehydrateSession } from "../utils/serverSession.js";
+import { useRuntimeConfig } from "#imports";
+import "../../types/augments.d";
+const log = createLogger("asgardeo-ssr");
+const CALLBACK_PATH = "/api/auth/callback";
+function resolveCallbackUrl(event) {
+  const url = getRequestURL(event, { xForwardedHost: true, xForwardedProto: true });
+  return `${url.origin}${CALLBACK_PATH}`;
+}
+export default defineNitroPlugin((nitro) => {
+  nitro.hooks.hook("request", async (event) => {
+    const client = AsgardeoNuxtClient.getInstance();
+    if (!client.isInitialized) {
+      const config2 = useRuntimeConfig(event);
+      const publicConfig2 = config2.public.asgardeo;
+      const privateConfig = config2.asgardeo;
+      if (!publicConfig2?.baseUrl || !publicConfig2?.clientId) {
+        log.error(
+          "Missing required config: baseUrl and clientId. Set NUXT_PUBLIC_ASGARDEO_BASE_URL and NUXT_PUBLIC_ASGARDEO_CLIENT_ID."
+        );
+        return;
+      }
+      const sessionSecret2 = process.env["ASGARDEO_SESSION_SECRET"] || privateConfig?.sessionSecret;
+      if (!sessionSecret2) {
+        if (process.env["NODE_ENV"] === "production") {
+          log.error(
+            "ASGARDEO_SESSION_SECRET is required in production. Set it to a secure random string of at least 32 characters. Refusing to initialize Asgardeo client."
+          );
+          return;
+        }
+        log.warn(
+          "ASGARDEO_SESSION_SECRET is not set. Using an insecure default for development only. Set ASGARDEO_SESSION_SECRET before deploying."
+        );
+      }
+      try {
+        await client.initialize({
+          afterSignInUrl: resolveCallbackUrl(event),
+          afterSignOutUrl: publicConfig2.afterSignOutUrl || "/",
+          baseUrl: publicConfig2.baseUrl,
+          clientId: publicConfig2.clientId,
+          clientSecret: privateConfig?.clientSecret || void 0,
+          scopes: publicConfig2.scopes || ["openid", "profile"]
+        });
+      } catch (err) {
+        log.error("Failed to initialize Asgardeo client:", err);
+        return;
+      }
+    }
+    const url = event.path || "";
+    if (url.startsWith("/api/") || url.startsWith("/_nuxt/") || url.startsWith("/__nuxt_")) {
+      return;
+    }
+    const config = useRuntimeConfig(event);
+    const publicConfig = config.public.asgardeo;
+    const prefs = publicConfig?.preferences;
+    const sessionSecret = process.env["ASGARDEO_SESSION_SECRET"] || config.asgardeo?.sessionSecret;
+    const session = await verifyAndRehydrateSession(
+      event,
+      sessionSecret
+    );
+    if (!session) {
+      const eventContext2 = event.context;
+      eventContext2.asgardeo = { isSignedIn: false, session: null };
+      return;
+    }
+    const baseUrl = publicConfig?.baseUrl ?? "";
+    let resolvedBaseUrl = baseUrl;
+    try {
+      if (session.organizationId) {
+        resolvedBaseUrl = `${baseUrl}/o`;
+      } else {
+        const idToken = await client.getDecodedIdToken(
+          session.sessionId
+        );
+        if (idToken?.["user_org"]) {
+          resolvedBaseUrl = `${baseUrl}/o`;
+        }
+      }
+    } catch {
+    }
+    const shouldFetchProfile = prefs?.user?.fetchUserProfile !== false;
+    const shouldFetchOrgs = prefs?.user?.fetchOrganizations !== false;
+    const shouldFetchBranding = prefs?.theme?.inheritFromBranding !== false;
+    const [userResult, userProfileResult, orgsResult, currentOrgResult, brandingResult] = await Promise.allSettled([
+      // Always fetch the basic user object (needed for AsgardeoAuthState.user)
+      client.getUser(session.sessionId),
+      // SCIM2 user profile (flattened + schemas)
+      shouldFetchProfile ? client.getUserProfile(session.sessionId) : Promise.resolve(null),
+      // User's organisations
+      shouldFetchOrgs ? client.getMyOrganizations(session.sessionId) : Promise.resolve([]),
+      // Current organisation (derived from the ID token)
+      shouldFetchOrgs ? client.getCurrentOrganization(session.sessionId) : Promise.resolve(null),
+      // Branding preference (does not require a session)
+      shouldFetchBranding ? client.getBrandingPreference({ baseUrl: resolvedBaseUrl }) : Promise.resolve(null)
+    ]);
+    if (userResult.status === "rejected") {
+      log.debug("Failed to fetch user:", userResult.reason);
+    }
+    if (userProfileResult.status === "rejected") {
+      log.warn("Failed to fetch user profile (SCIM2):", userProfileResult.reason);
+    }
+    if (orgsResult.status === "rejected") {
+      log.warn("Failed to fetch my organisations:", orgsResult.reason);
+    }
+    if (currentOrgResult.status === "rejected") {
+      log.warn("Failed to resolve current organisation:", currentOrgResult.reason);
+    }
+    if (brandingResult.status === "rejected") {
+      log.warn("Failed to fetch branding preference:", brandingResult.reason);
+    }
+    const ssrData = {
+      brandingPreference: brandingResult.status === "fulfilled" ? brandingResult.value : null,
+      currentOrganization: currentOrgResult.status === "fulfilled" ? currentOrgResult.value : null,
+      isSignedIn: true,
+      myOrganizations: orgsResult.status === "fulfilled" && Array.isArray(orgsResult.value) ? orgsResult.value : [],
+      resolvedBaseUrl,
+      session,
+      user: userResult.status === "fulfilled" ? userResult.value : null,
+      userProfile: userProfileResult.status === "fulfilled" ? userProfileResult.value : null
+    };
+    const eventContext = event.context;
+    eventContext.asgardeo = { isSignedIn: true, session, ssr: ssrData };
+    const authState = {
+      isLoading: false,
+      isSignedIn: true,
+      user: ssrData.user
+    };
+    eventContext["__asgardeoAuth"] = authState;
+  });
+});

package/dist/runtime/server/routes/auth/branding/branding.get.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import type { BrandingPreference } from '@asgardeo/node';
+/**
+ * GET /api/auth/branding
+ *
+ * Returns the branding preference for the current tenant / organisation context.
+ * Resolves the correct `baseUrl` (org-scoped if the session is inside an org).
+ * Does not require an authenticated session — unauthenticated callers receive
+ * the root-tenant branding.
+ *
+ * Used by `AsgardeoRoot.revalidateBranding` to refresh client-side branding
+ * state without a full page reload.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<BrandingPreference | null>>;
+export default _default;

package/dist/runtime/server/routes/auth/branding/branding.get.js

@@ -0,0 +1,40 @@
+import { defineEventHandler, createError } from "h3";
+import AsgardeoNuxtClient from "../../../AsgardeoNuxtClient.js";
+import { verifyAndRehydrateSession } from "../../../utils/serverSession.js";
+import { useRuntimeConfig } from "#imports";
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig(event);
+  const publicConfig = config.public.asgardeo;
+  const sessionSecret = config.asgardeo?.sessionSecret;
+  const baseUrl = publicConfig?.baseUrl ?? "";
+  let resolvedBaseUrl = baseUrl;
+  try {
+    const session = await verifyAndRehydrateSession(
+      event,
+      sessionSecret
+    );
+    if (session) {
+      if (session.organizationId) {
+        resolvedBaseUrl = `${baseUrl}/o`;
+      } else {
+        const client = AsgardeoNuxtClient.getInstance();
+        const idToken = await client.getDecodedIdToken(
+          session.sessionId
+        );
+        if (idToken?.["user_org"]) {
+          resolvedBaseUrl = `${baseUrl}/o`;
+        }
+      }
+    }
+  } catch {
+  }
+  try {
+    const client = AsgardeoNuxtClient.getInstance();
+    return await client.getBrandingPreference({ baseUrl: resolvedBaseUrl });
+  } catch (err) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: `Failed to retrieve branding preference: ${err instanceof Error ? err.message : String(err)}`
+    });
+  }
+});

package/dist/runtime/server/routes/auth/organizations/current.get.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import type { Organization } from '@asgardeo/node';
+/**
+ * GET /api/auth/organizations/current
+ *
+ * Returns the organisation the authenticated user is currently acting within,
+ * derived from the session's ID token (`org_id` / `org_name` claims).
+ * Returns `null` when the user is not inside an organisation context.
+ *
+ * Used by `AsgardeoRoot.revalidateCurrentOrganization` callback.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<Organization | null>>;
+export default _default;