@authup/client-web-nuxt 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@authup/client-web-nuxt",
   "configKey": "authup",
-  "version": "1.0.0-beta.62",
+  "version": "1.0.0-beta.64",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -13,14 +13,7 @@ const module$1 = defineNuxtModule({
     const runtimeDir = fileURLToPath(new URL("./runtime", import.meta.url));
     nuxt.options.build.transpile.push(runtimeDir);
     const resolver = createResolver(import.meta.url);
-    const runtimeOptions = {
-      apiURL: options.apiURL,
-      apiURLRuntimeKey: options.apiURLRuntimeKey,
-      cookieDomain: options.cookieDomain,
-      cookieDomainRuntimeKey: options.cookieDomainRuntimeKey,
-      homeRoute: options.homeRoute,
-      loginRoute: options.loginRoute
-    };
+    const runtimeOptions = { ...options };
     nuxt.options.runtimeConfig.public = nuxt.options.runtimeConfig.public || {};
     if (nuxt.options.runtimeConfig.public.authup) {
       nuxt.options.runtimeConfig.public.authup = merge(

package/dist/runtime/helpers/routing-interceptor.d.ts

@@ -8,6 +8,27 @@ export declare class RoutingInterceptor {
     protected loginRoute: string;
     constructor(nuxtApp: NuxtApp);
     execute(to: RouteLocationNormalized, from: RouteLocationNormalized): Promise<RouteLocationAsPathGeneric | undefined>;
+    /**
+     * Resolve a post-login destination, or undefined when the value is not a
+     * site-relative path.
+     *
+     * The base is a fixed dummy origin, so a value that lands anywhere else
+     * declared an authority of its own and is refused. That covers the whole
+     * family in one comparison — `//host`, `https://host`, the `\`-for-`/`
+     * variants a prefix check misses, and non-special schemes, which resolve
+     * to the opaque `"null"` origin.
+     */
+    protected resolveDestination(value: string): URL | undefined;
+    protected withoutAuthorizationParams(route: RouteLocationNormalized): RouteLocationAsPathGeneric;
+    /**
+     * Return to a route the user already had.
+     *
+     * Passing `fullPath` as `path` looks equivalent and is not: vue-router
+     * runs it through `parseURL`, which keeps the path and silently discards
+     * the query and hash, so a bounce off `/users?page=2#row-7` used to land
+     * on a bare `/users`.
+     */
+    protected backTo(route: RouteLocationNormalized): RouteLocationAsPathGeneric;
     protected hasLoggedInCondition(route: RouteLocationNormalized): boolean;
     protected validateLoggedInCondition(route: RouteLocationNormalized): boolean;
     protected hasLoggedOutCondition(route: RouteLocationNormalized): boolean;

package/dist/runtime/helpers/routing-interceptor.js

@@ -8,6 +8,7 @@ import {
 import { hasOwnProperty, omitRecord } from "@authup/kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { RouteMetaKey } from "../constants.js";
+const DESTINATION_BASE = "http://localhost";
 export class RoutingInterceptor {
   store;
   storeRefs;
@@ -27,6 +28,8 @@ export class RoutingInterceptor {
         return void 0;
       }
       const request = loadAuthorizationRequest();
+      const { redirect } = to.query;
+      const destination = typeof redirect === "string" ? this.resolveDestination(redirect) : void 0;
       try {
         if (request) {
           const state = typeof to.query.state === "string" ? to.query.state : void 0;
@@ -43,26 +46,22 @@ export class RoutingInterceptor {
           await this.store.exchangeAuthorizationCode(code);
         }
         clearAuthorizationRequest();
-        if (request?.target) {
-          const url = new URL(request.target, "http://localhost");
+        if (destination) {
+          const query = {};
+          for (const key of new Set(destination.searchParams.keys())) {
+            const values = destination.searchParams.getAll(key);
+            query[key] = values.length > 1 ? values : values[0];
+          }
           return {
-            path: url.pathname,
-            query: Object.fromEntries(url.searchParams.entries()),
-            hash: url.hash
+            path: destination.pathname,
+            query,
+            hash: destination.hash
           };
         }
-        return {
-          path: to.path,
-          query: omitRecord(to.query, ["code", "state"]),
-          hash: to.hash
-        };
+        return this.withoutAuthorizationParams(to);
       } catch {
         clearAuthorizationRequest();
-        return {
-          path: to.path,
-          query: omitRecord(to.query, ["code", "state"]),
-          hash: to.hash
-        };
+        return this.withoutAuthorizationParams(to);
       }
     }
     try {
@@ -101,12 +100,59 @@ export class RoutingInterceptor {
       }
       if (this.hasLoggedOutCondition(from)) {
         await this.store.logout();
-        return { path: from.fullPath };
+        return this.backTo(from);
+      }
+      if (typeof from.query.code === "string") {
+        return { path: this.homeRoute };
       }
-      return { path: from.fullPath };
+      return this.backTo(from);
     }
     return void 0;
   }
+  /**
+   * Resolve a post-login destination, or undefined when the value is not a
+   * site-relative path.
+   *
+   * The base is a fixed dummy origin, so a value that lands anywhere else
+   * declared an authority of its own and is refused. That covers the whole
+   * family in one comparison — `//host`, `https://host`, the `\`-for-`/`
+   * variants a prefix check misses, and non-special schemes, which resolve
+   * to the opaque `"null"` origin.
+   */
+  resolveDestination(value) {
+    if (!value) {
+      return void 0;
+    }
+    let url;
+    try {
+      url = new URL(value, DESTINATION_BASE);
+    } catch {
+      return void 0;
+    }
+    return url.origin === DESTINATION_BASE ? url : void 0;
+  }
+  withoutAuthorizationParams(route) {
+    return {
+      path: route.path,
+      query: omitRecord(route.query, ["code", "state", "redirect"]),
+      hash: route.hash
+    };
+  }
+  /**
+   * Return to a route the user already had.
+   *
+   * Passing `fullPath` as `path` looks equivalent and is not: vue-router
+   * runs it through `parseURL`, which keeps the path and silently discards
+   * the query and hash, so a bounce off `/users?page=2#row-7` used to land
+   * on a bare `/users`.
+   */
+  backTo(route) {
+    return {
+      path: route.path,
+      query: route.query,
+      hash: route.hash
+    };
+  }
   hasLoggedInCondition(route) {
     return route.matched.some(
       (matched) => !!matched.meta[RouteMetaKey.REQUIRE_LOGGED_IN]

package/dist/runtime/plugins/kit.js

@@ -28,6 +28,13 @@ function buildCookieOptions(runtimeConfig) {
   }
   return cookieOptions;
 }
+function buildCookieName(runtimeConfig) {
+  const options = runtimeConfig.public.authup;
+  if (!options.cookiePrefix) {
+    return (key) => key;
+  }
+  return (key) => `${options.cookiePrefix}${key}`;
+}
 function buildApiUrl(runtimeConfig) {
   const options = runtimeConfig.public.authup;
   let url;
@@ -62,13 +69,14 @@ export default defineNuxtPlugin({
     const runtimeConfig = useRuntimeConfig();
     const baseURL = buildApiUrl(runtimeConfig);
     const cookieOptions = buildCookieOptions(runtimeConfig);
+    const cookieName = buildCookieName(runtimeConfig);
     install(ctx.vueApp, {
       pinia: ctx.$pinia,
       baseURL,
       cookieSet: (key, value, options) => {
         const app = tryUseNuxtApp();
         if (app) {
-          const cookie = useCookie(key, {
+          const cookie = useCookie(cookieName(key), {
             ...cookieOptions,
             ...options || {}
           });
@@ -78,7 +86,7 @@ export default defineNuxtPlugin({
       cookieUnset: (key, options) => {
         const app = tryUseNuxtApp();
         if (app) {
-          const cookie = useCookie(key, {
+          const cookie = useCookie(cookieName(key), {
             ...cookieOptions,
             ...options || {}
           });
@@ -88,7 +96,7 @@ export default defineNuxtPlugin({
       cookieGet: (key) => {
         const app = tryUseNuxtApp();
         if (app) {
-          const cookie = useCookie(key);
+          const cookie = useCookie(cookieName(key));
           return cookie.value;
         }
         return null;

package/dist/runtime/types.d.ts

@@ -22,6 +22,21 @@ export type RuntimeOptions = {
      * (client-side & server-side)
      */
     cookieDomainRuntimeKey?: string;
+    /**
+     * Prefix prepended to every session cookie name
+     * (client-side & server-side)
+     *
+     * The session cookies are written under fixed names (`access_token`,
+     * `refresh_token`, ...). Widening `cookieDomain` delivers those names to
+     * every host under that domain, so any other authup client there writes
+     * the same names and the browser ends up holding two records under one.
+     * A prefix keeps them apart.
+     *
+     * Prepended verbatim, so `flame_` writes `flame_access_token`. Use cookie
+     * name characters only: letters, digits, `_`, `-`, `.`, never `:` or a
+     * space.
+     */
+    cookiePrefix?: string;
     /**
      * Path of the home route
      * Default: /

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/client-web-nuxt",
     "type": "module",
-    "version": "1.0.0-beta.62",
+    "version": "1.0.0-beta.64",
     "description": "Nuxt module for the authup ecosystem",
     "license": "Apache-2.0",
     "repository": {
@@ -24,16 +24,18 @@
         "build": "nuxt-module-build prepare && nuxt-module-build build",
         "prepack": "nuxt-module-build prepare && nuxt-module-build build",
         "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground",
-        "lint": "eslint ."
+        "check:types": "nuxt-module-build prepare && vue-tsc -p tsconfig.test.json",
+        "lint": "eslint .",
+        "test": "nuxt-module-build prepare && cross-env NODE_ENV=test vitest run --config test/vitest.config.ts"
     },
     "engines": {
         "node": "^22.13.0 || ^23.5.0 || >=24.0.0"
     },
     "dependencies": {
-        "@authup/access": "^1.0.0-beta.62",
-        "@authup/client-web-kit": "^1.0.0-beta.62",
-        "@authup/core-http-kit": "^1.0.0-beta.62",
-        "@authup/kit": "^1.0.0-beta.62",
+        "@authup/access": "^1.0.0-beta.64",
+        "@authup/client-web-kit": "^1.0.0-beta.64",
+        "@authup/core-http-kit": "^1.0.0-beta.64",
+        "@authup/kit": "^1.0.0-beta.64",
         "@nuxt/kit": "^4.0.0",
         "pathtrace": "^2.2.0",
         "smob": "^1.6.1"
@@ -41,18 +43,21 @@
     "devDependencies": {
         "@nuxt/module-builder": "^1.0.3",
         "@nuxt/schema": "^4.0.0",
-        "@pinia/nuxt": "^1.0.1",
+        "@pinia/nuxt": "^1.0.2",
+        "cross-env": "^10.1.0",
         "fix-dts-default-cjs-exports": "^1.0.1",
         "mkdist": "^2.3.0",
         "nuxt": "^4.5.2",
-        "pinia": "^4.0.2",
+        "pinia": "^4.0.3",
         "rollup-plugin-dts": "^6.5.1",
-        "strip-literal": "^3.1.0",
-        "vue-router": "^5.0.7"
+        "strip-literal": "^4.0.0",
+        "vitest": "^4.0.14",
+        "vue": "^3.5.42",
+        "vue-router": "^5.3.0"
     },
     "peerDependencies": {
         "@pinia/nuxt": "*",
-        "pinia": "^4.0.2"
+        "pinia": "^4.0.3"
     },
     "keywords": [
         "auth",