@asgardeo/nuxt 0.0.0 → 0.1.0

package/dist/runtime/server/utils/serverSession.js

@@ -0,0 +1,44 @@
+import { getCookie, createError } from "h3";
+import { verifySessionToken, getSessionCookieName } from "./session.js";
+import AsgardeoNuxtClient from "../AsgardeoNuxtClient.js";
+import { useRuntimeConfig } from "#imports";
+export async function useServerSession(event) {
+  const config = useRuntimeConfig();
+  const sessionSecret = config.asgardeo?.sessionSecret;
+  const sessionCookie = getCookie(event, getSessionCookieName());
+  if (!sessionCookie) {
+    return null;
+  }
+  try {
+    return await verifySessionToken(sessionCookie, sessionSecret);
+  } catch {
+    return null;
+  }
+}
+export async function requireServerSession(event) {
+  const session = await useServerSession(event);
+  if (!session) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Unauthorized: Authentication required."
+    });
+  }
+  return session;
+}
+export async function verifyAndRehydrateSession(event, sessionSecret) {
+  const sessionCookie = getCookie(event, getSessionCookieName());
+  if (!sessionCookie) {
+    return null;
+  }
+  let session;
+  try {
+    session = await verifySessionToken(sessionCookie, sessionSecret);
+  } catch {
+    return null;
+  }
+  try {
+    await AsgardeoNuxtClient.getInstance().rehydrateSessionFromPayload(session);
+  } catch {
+  }
+  return session;
+}

package/dist/runtime/server/utils/session.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import type { TokenResponse } from '@asgardeo/node';
+import type { H3Event } from 'h3';
+import type { AsgardeoSessionPayload } from '../../types.js';
+/**
+ * Create a signed JWT session token.
+ */
+export declare function createSessionToken(params: {
+    accessToken: string;
+    /** Unix timestamp (seconds) when the access token expires. */
+    accessTokenExpiresAt?: number;
+    expirySeconds?: number;
+    /** Raw ID token string. */
+    idToken?: string;
+    organizationId?: string;
+    /** Refresh token for silent re-auth. */
+    refreshToken?: string;
+    scopes: string;
+    sessionId: string;
+    userId: string;
+}, sessionSecret?: string): Promise<string>;
+/**
+ * Create a signed JWT temp session token (used during OAuth flow).
+ */
+export declare function createTempSessionToken(sessionId: string, sessionSecret?: string, returnTo?: string): Promise<string>;
+/**
+ * Verify and decode a session JWT.
+ */
+export declare function verifySessionToken(token: string, sessionSecret?: string): Promise<AsgardeoSessionPayload>;
+/**
+ * Verify and decode a temp session JWT.
+ */
+export declare function verifyTempSessionToken(token: string, sessionSecret?: string): Promise<{
+    returnTo?: string;
+    sessionId: string;
+}>;
+/**
+ * Session cookie name.
+ */
+export declare function getSessionCookieName(): string;
+/**
+ * Temp session cookie name.
+ */
+export declare function getTempSessionCookieName(): string;
+/**
+ * Session cookie options.
+ */
+type SessionCookieOptions = {
+    httpOnly: boolean;
+    maxAge: number;
+    path: string;
+    sameSite: 'lax';
+    secure: boolean;
+};
+export declare function getSessionCookieOptions(): SessionCookieOptions;
+/**
+ * Temp session cookie options (15 min TTL).
+ */
+export declare function getTempSessionCookieOptions(): SessionCookieOptions;
+/**
+ * Decode a token response into a signed session JWT and write it as the
+ * session cookie on the H3 event.
+ *
+ * Extracted from the inline blocks in `callback.get.ts` and
+ * `organizations/switch.post.ts` so that all three callers (callback.get,
+ * switch.post, and the new `signin.post`) share one implementation.
+ */
+export declare function issueSessionCookie(event: H3Event, sessionId: string, tokenResponse: TokenResponse, sessionSecret?: string): Promise<void>;
+export {};

package/dist/runtime/server/utils/session.js

@@ -0,0 +1,106 @@
+import { CookieConfig } from "@asgardeo/node";
+import { setCookie } from "h3";
+import { SignJWT, jwtVerify } from "jose";
+const DEFAULT_EXPIRY_SECONDS = 3600;
+function getSecret(sessionSecret) {
+  const secret = sessionSecret || process.env["ASGARDEO_SESSION_SECRET"];
+  if (!secret) {
+    if (process.env["NODE_ENV"] === "production") {
+      throw new Error(
+        "[asgardeo] ASGARDEO_SESSION_SECRET environment variable is required in production. Set it to a secure random string of at least 32 characters."
+      );
+    }
+    console.warn(
+      "[asgardeo] Using default session secret for development. Set ASGARDEO_SESSION_SECRET for production."
+    );
+    return new TextEncoder().encode("asgardeo-dev-secret-not-for-production");
+  }
+  return new TextEncoder().encode(secret);
+}
+export async function createSessionToken(params, sessionSecret) {
+  const secret = getSecret(sessionSecret);
+  return new SignJWT({
+    accessToken: params.accessToken,
+    accessTokenExpiresAt: params.accessTokenExpiresAt,
+    idToken: params.idToken,
+    organizationId: params.organizationId,
+    refreshToken: params.refreshToken,
+    scopes: params.scopes,
+    sessionId: params.sessionId,
+    type: "session"
+  }).setProtectedHeader({ alg: "HS256" }).setSubject(params.userId).setIssuedAt().setExpirationTime(Date.now() / 1e3 + (params.expirySeconds ?? DEFAULT_EXPIRY_SECONDS)).sign(secret);
+}
+export async function createTempSessionToken(sessionId, sessionSecret, returnTo) {
+  const secret = getSecret(sessionSecret);
+  const payload = {
+    sessionId,
+    type: "temp"
+  };
+  if (returnTo) {
+    payload["returnTo"] = returnTo;
+  }
+  return new SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(secret);
+}
+export async function verifySessionToken(token, sessionSecret) {
+  const secret = getSecret(sessionSecret);
+  const { payload } = await jwtVerify(token, secret);
+  return payload;
+}
+export async function verifyTempSessionToken(token, sessionSecret) {
+  const secret = getSecret(sessionSecret);
+  const { payload } = await jwtVerify(token, secret);
+  if (payload["type"] !== "temp") {
+    throw new Error("Invalid token type: expected temp session");
+  }
+  return {
+    returnTo: payload["returnTo"],
+    sessionId: payload["sessionId"]
+  };
+}
+export function getSessionCookieName() {
+  return CookieConfig.SESSION_COOKIE_NAME;
+}
+export function getTempSessionCookieName() {
+  return CookieConfig.TEMP_SESSION_COOKIE_NAME;
+}
+export function getSessionCookieOptions() {
+  return {
+    httpOnly: true,
+    maxAge: DEFAULT_EXPIRY_SECONDS,
+    path: "/",
+    sameSite: "lax",
+    secure: process.env["NODE_ENV"] === "production"
+  };
+}
+export function getTempSessionCookieOptions() {
+  return {
+    httpOnly: true,
+    maxAge: 15 * 60,
+    path: "/",
+    sameSite: "lax",
+    secure: process.env["NODE_ENV"] === "production"
+  };
+}
+export async function issueSessionCookie(event, sessionId, tokenResponse, sessionSecret) {
+  const { default: AsgardeoNuxtClient } = await import("../AsgardeoNuxtClient.js");
+  const client = AsgardeoNuxtClient.getInstance();
+  const idToken = await client.getDecodedIdToken(sessionId, tokenResponse.idToken);
+  const userId = idToken.sub || sessionId;
+  const organizationId = idToken["user_org"] || idToken["organization_id"];
+  const expiresInSeconds = parseInt(tokenResponse.expiresIn ?? "3600", 10);
+  const accessTokenExpiresAt = Math.floor(Date.now() / 1e3) + (Number.isFinite(expiresInSeconds) ? expiresInSeconds : 3600);
+  const sessionToken = await createSessionToken(
+    {
+      accessToken: tokenResponse.accessToken,
+      accessTokenExpiresAt,
+      idToken: tokenResponse.idToken || void 0,
+      organizationId,
+      refreshToken: tokenResponse.refreshToken || void 0,
+      scopes: tokenResponse.scope || "",
+      sessionId,
+      userId
+    },
+    sessionSecret
+  );
+  setCookie(event, getSessionCookieName(), sessionToken, getSessionCookieOptions());
+}

package/dist/runtime/server/utils/token-refresh.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { type H3Event } from 'h3';
+/**
+ * Return a valid access token for the current request.
+ *
+ * If the stored access token is still fresh (or has no expiry metadata —
+ * e.g. sessions created before Phase 2), it is returned as-is.
+ *
+ * When the token is within `REFRESH_SKEW_SECONDS` of expiring and a
+ * refresh token is present, a `refresh_token` grant is sent to the OIDC
+ * token endpoint.  On success the session cookie is reissued with the new
+ * tokens so subsequent calls within the same browser session are also fresh.
+ *
+ * Throws a 401 if the token is expired and no refresh token is available, or
+ * if the refresh call itself fails.
+ *
+ * @example
+ * ```ts
+ * // In a Nitro API route:
+ * export default defineEventHandler(async (event) => {
+ *   const accessToken = await getValidAccessToken(event);
+ *   // use accessToken to call a protected API
+ * });
+ * ```
+ */
+export declare function getValidAccessToken(event: H3Event): Promise<string>;

package/dist/runtime/server/utils/token-refresh.js

@@ -0,0 +1,65 @@
+import { createError, setCookie } from "h3";
+import { requireServerSession } from "./serverSession.js";
+import { createSessionToken, getSessionCookieName, getSessionCookieOptions } from "./session.js";
+import { useRuntimeConfig } from "#imports";
+const REFRESH_SKEW_SECONDS = 60;
+export async function getValidAccessToken(event) {
+  const session = await requireServerSession(event);
+  const now = Math.floor(Date.now() / 1e3);
+  if (!session.accessTokenExpiresAt || session.accessTokenExpiresAt - REFRESH_SKEW_SECONDS > now) {
+    return session.accessToken;
+  }
+  if (!session.refreshToken) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Session expired. Please sign in again."
+    });
+  }
+  const config = useRuntimeConfig(event);
+  const publicConfig = config.public.asgardeo;
+  const privateConfig = config.asgardeo;
+  const tokenEndpoint = `${publicConfig.baseUrl}/oauth2/token`;
+  const body = new URLSearchParams({
+    client_id: publicConfig.clientId,
+    grant_type: "refresh_token",
+    refresh_token: session.refreshToken
+  });
+  if (privateConfig?.clientSecret) {
+    body.set("client_secret", privateConfig.clientSecret);
+  }
+  let refreshed;
+  try {
+    const res = await fetch(tokenEndpoint, {
+      body,
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      method: "POST"
+    });
+    if (!res.ok) {
+      const errText = await res.text().catch(() => String(res.status));
+      throw new Error(`Token endpoint returned ${res.status}: ${errText}`);
+    }
+    refreshed = await res.json();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error("[asgardeo] Token refresh failed:", msg);
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Token refresh failed. Please sign in again."
+    });
+  }
+  const newSessionToken = await createSessionToken(
+    {
+      accessToken: refreshed.access_token,
+      accessTokenExpiresAt: now + (refreshed.expires_in ?? 3600),
+      idToken: refreshed.id_token ?? session.idToken,
+      organizationId: session.organizationId,
+      refreshToken: refreshed.refresh_token ?? session.refreshToken,
+      scopes: refreshed.scope ?? session.scopes,
+      sessionId: session.sessionId,
+      userId: session.sub
+    },
+    privateConfig?.sessionSecret
+  );
+  setCookie(event, getSessionCookieName(), newSessionToken, getSessionCookieOptions());
+  return refreshed.access_token;
+}

package/dist/runtime/types/augments.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import type {AsgardeoSessionPayload, AsgardeoSSRData} from './types';
+
+/**
+ * Nuxt schema augmentation — adds `asgardeo` to NuxtConfig / NuxtOptions
+ * and ensures the runtime config shapes are fully typed.
+ */
+declare module '@nuxt/schema' {
+  interface NuxtConfig {
+    asgardeo?: import('./types').AsgardeoNuxtConfig;
+  }
+  interface NuxtOptions {
+    asgardeo?: import('./types').AsgardeoNuxtConfig;
+  }
+}
+
+/**
+ * H3 event context augmentation — provides a typed `event.context.asgardeo`
+ * property so server plugins and API routes no longer need `as any` casts.
+ *
+ * Set by the Nitro `asgardeo-ssr` plugin on every page request.
+ */
+declare module 'h3' {
+  interface H3EventContext {
+    /**
+     * Resolved auth state for the current request.
+     * Populated by the Nitro `asgardeo-ssr` plugin during SSR page requests.
+     * `null` when the request is an API route or when the session is absent/invalid.
+     */
+    asgardeo?: {
+      isSignedIn: boolean;
+      session: AsgardeoSessionPayload | null;
+      /**
+       * Rich SSR payload populated by the Nitro `asgardeo-ssr` plugin.
+       * Contains the user, userProfile, organisations, and branding data
+       * resolved on the server and seeded into `useState` keys for
+       * zero-cost client hydration.
+       */
+      ssr?: AsgardeoSSRData;
+    };
+  }
+}
+
+export {};

package/dist/runtime/types.d.ts

@@ -15,53 +15,130 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import type { BasicUserInfo, DataLayer, IdTokenPayload, OIDCEndpoints } from '@asgardeo/auth-node';
-export interface ModuleOptions {
+import type { BrandingPreference, I18nPreferences, Organization, User, UserProfile } from '@asgardeo/node';
+import type { JWTPayload } from 'jose';
+/**
+ * Configuration for the Asgardeo Nuxt module.
+ */
+export interface AsgardeoNuxtConfig {
+    /** URL to redirect to after sign-in (default: '/') */
+    afterSignInUrl?: string;
+    /** URL to redirect to after sign-out (default: '/') */
+    afterSignOutUrl?: string;
     /**
-     * The base URL of your Asgardeo organization tenant.
-     * e.g., https://api.asgardeo.io/t/your_org_name
-     * @default process.env.ASGARDEO_BASE_URL
+     * Asgardeo application id (`spId`) — appended to the redirect-based sign-up
+     * URL when present. Mirrors `applicationId` in the React/Next.js SDKs.
      */
-    baseUrl: string;
+    applicationId?: string;
+    /** Base URL of the Asgardeo org tenant (e.g. https://api.asgardeo.io/t/your_org) */
+    baseUrl?: string;
+    /** OAuth2 Client ID */
+    clientId?: string;
+    /** OAuth2 Client Secret (server-only, use ASGARDEO_CLIENT_SECRET env var) */
+    clientSecret?: string;
     /**
-     * Asgardeo Application Client ID.
-     * @default process.env.ASGARDEO_CLIENT_ID
+     * Feature-gating preferences that control which server-side data fetches
+     * the Nitro plugin performs on every SSR request.
      */
-    clientID: string;
+    preferences?: {
+        /** i18n configuration forwarded to `I18nProvider`. */
+        i18n?: I18nPreferences;
+        theme?: {
+            /**
+             * When true (default), the Nitro plugin fetches the branding preference
+             * from Asgardeo and passes it to `BrandingProvider` / `ThemeProvider`.
+             */
+            inheritFromBranding?: boolean;
+            /**
+             * Theme mode forwarded to the Vue SDK's `ThemeProvider`.
+             * - `'light'` (default) | `'dark'`: Fixed color scheme. Toggle at runtime with `useTheme().toggleTheme()`.
+             * - `'system'`: Follows the OS `prefers-color-scheme`.
+             * - `'class'`: Reads a CSS class on `<html>` (works well with Tailwind dark-mode).
+             * - `'branding'`: Follows the active theme from the tenant's branding preference.
+             */
+            mode?: 'light' | 'dark' | 'system' | 'class' | 'branding';
+        };
+        user?: {
+            /** Whether to fetch the user's organisations during SSR (default: true). */
+            fetchOrganizations?: boolean;
+            /** Whether to fetch the SCIM2 user profile during SSR (default: true). */
+            fetchUserProfile?: boolean;
+        };
+    };
+    /** OAuth2 scopes to request */
+    scopes?: string[];
+    /** Secret for signing session JWTs (use ASGARDEO_SESSION_SECRET env var) */
+    sessionSecret?: string;
     /**
-     * Asgardeo Application Client Secret. (Server-side only)
-     * @default process.env.ASGARDEO_CLIENT_SECRET
+     * Optional override for the redirect-based sign-in URL. Reserved for
+     * parity with the React/Next.js SDKs; not currently used by the redirect
+     * flow (which goes through `/api/auth/signin`).
      */
-    clientSecret?: string;
+    signInUrl?: string;
     /**
-     * Authentication scopes to request from Asgardeo.
-     * @default ['openid', 'profile']
+     * Optional override for the redirect-based sign-up URL. When set,
+     * `<AsgardeoSignUpButton>` and `useAsgardeo().signUp()` (no-arg) navigate
+     * here instead of deriving the URL from `baseUrl`/`clientId`.
      */
-    scope?: string[];
-    /**
-     * The absolute redirect URI where Asgardeo should redirect after sign-in.
-     * Must match the URI configured in your Asgardeo app.
-     * @default process.env.ASGARDEO_SIGN_IN_REDIRECT_URL
-     */
-    signInRedirectURL: string;
+    signUpUrl?: string;
+}
+/**
+ * Payload stored in the session JWT cookie.
+ */
+export interface AsgardeoSessionPayload extends JWTPayload {
+    accessToken: string;
+    /** Unix timestamp (seconds) when the access token expires. Used for proactive refresh. */
+    accessTokenExpiresAt?: number;
+    exp: number;
+    iat: number;
+    /** Raw ID token string (for userinfo derivation without in-memory store). */
+    idToken?: string;
+    organizationId?: string;
+    /** Refresh token for obtaining new access tokens without re-authentication. */
+    refreshToken?: string;
+    scopes: string;
+    sessionId: string;
+    sub: string;
+}
+/**
+ * Payload stored in the temporary session JWT cookie (during OAuth flow).
+ */
+export interface AsgardeoTempSessionPayload extends JWTPayload {
+    /** URL to redirect to after successful sign-in */
+    returnTo?: string;
+    sessionId: string;
+    type: 'temp';
+}
+/**
+ * Full SSR payload resolved by the Nitro plugin on each page request.
+ * Written to `event.context.asgardeo.ssr` and subsequently seeded into
+ * hydrated `useState` keys so the client never re-fetches on first render.
+ */
+export interface AsgardeoSSRData {
+    /** Branding preference fetched from Asgardeo (null when `preferences.theme.inheritFromBranding` is false). */
+    brandingPreference: BrandingPreference | null;
+    /** The organisation the user is currently acting within (null when not in an org). */
+    currentOrganization: Organization | null;
+    isSignedIn: boolean;
+    /** All organisations the user is a member of (empty array when `preferences.user.fetchOrganizations` is false). */
+    myOrganizations: Organization[];
     /**
-     * The absolute URI to redirect to after sign-out completes.
-     * @default process.env.ASGARDEO_SIGN_OUT_REDIRECT_URL
+     * The base URL actually used for this request.
+     * Equals `${baseUrl}/o` when the user is acting within an organisation
+     * (derived from the `user_org` claim in the ID token), otherwise equals
+     * the configured `baseUrl`.
      */
-    signOutRedirectURL: string;
+    resolvedBaseUrl: string | null;
+    session: AsgardeoSessionPayload | null;
+    user: User | null;
+    /** Flattened SCIM2 profile + raw profile + schemas (null when `preferences.user.fetchUserProfile` is false). */
+    userProfile: UserProfile | null;
 }
-export interface AuthInterface {
-    getAccessToken: () => Promise<string | null>;
-    getBasicUserInfo: () => Promise<BasicUserInfo | null>;
-    getDataLayer: () => Promise<DataLayer<any> | null>;
-    getDecodedIDToken: () => Promise<IdTokenPayload | null>;
-    getIdToken: () => Promise<string | null>;
-    getOIDCServiceEndpoints: () => Promise<OIDCEndpoints | null>;
-    isAuthenticated: () => Promise<boolean>;
-    revokeAccessToken: () => Promise<void>;
-    signIn: (callbackUrl?: string) => Promise<void>;
-    signOut: () => Promise<void>;
+/**
+ * Auth state hydrated from server to client via useState.
+ */
+export interface AsgardeoAuthState {
+    isLoading: boolean;
+    isSignedIn: boolean;
+    user: User | null;
 }
-export type SessionLastRefreshedAt = Date | undefined;
-export type SessionStatus = 'authenticated' | 'unauthenticated' | 'loading';
-export type { BasicUserInfo };

package/dist/runtime/utils/createRouteMatcher.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Create a route matcher function from an array of glob-like patterns.
+ *
+ * Patterns support:
+ * - Literal paths: `/dashboard`
+ * - Wildcard segments: `/admin/*` matches `/admin/users` but not `/admin/users/1`
+ * - Deep wildcards: `/admin/**` matches `/admin/users` and `/admin/users/1`
+ * - Explicit regex groups: `/api/(users|posts)` stays as-is
+ *
+ * @example
+ * ```ts
+ * const isProtectedRoute = createRouteMatcher(['/dashboard/**', '/admin/**']);
+ * const isPublicRoute = createRouteMatcher(['/', '/about', '/sign-in']);
+ *
+ * // In a global middleware:
+ * export default defineNuxtRouteMiddleware((to) => {
+ *   if (isProtectedRoute(to.path) && !authState.value?.isSignedIn) {
+ *     return navigateTo('/api/auth/signin', { external: true });
+ *   }
+ * });
+ * ```
+ */
+export declare function createRouteMatcher(patterns: string[]): (path: string) => boolean;

package/dist/runtime/utils/createRouteMatcher.js

@@ -0,0 +1,7 @@
+export function createRouteMatcher(patterns) {
+  const regexes = patterns.map((pattern) => {
+    const regexStr = pattern.replace(/[.+^${}|[\]\\]/g, "\\$&").replace(/\*\*/g, "___DOUBLE_STAR___").replace(/\*/g, "[^/]*").replace(/___DOUBLE_STAR___/g, ".*");
+    return new RegExp(`^${regexStr}$`);
+  });
+  return (path) => regexes.some((regex) => regex.test(path));
+}

package/dist/runtime/utils/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * @asgardeo/nuxt/utils
+ *
+ * Public utilities barrel. Import from this subpath to access
+ * utilities such as createRouteMatcher without polluting the
+ * global auto-import namespace.
+ *
+ * @example
+ * ```ts
+ * import { createRouteMatcher } from '@asgardeo/nuxt/utils';
+ * ```
+ */
+export { createRouteMatcher } from './createRouteMatcher.js';

package/dist/runtime/utils/index.js

@@ -0,0 +1 @@
+export { createRouteMatcher } from "./createRouteMatcher.js";