@drax/identity-vue 3.66.0 → 3.68.0

package/README.md

@@ -58,7 +58,7 @@ Integration contracts:
   null-to-null logout. Legacy stores without the field use the initial null epoch.
   Late returned refresh credentials are revoked best-effort.
 - Transient refresh/profile errors retain recoverable credentials; rejected
-  credentials (HTTP 401/403, including common-front wrapped errors) clear auth.
+  credentials (HTTP 401/403/498, including common-front wrapped errors) clear auth.
   Logout clears local state immediately, with best-effort server revocation even
   when the feature has subsequently been disabled. Offline revocation cannot be
   guaranteed; the backend expiration/revocation policy remains authoritative.
@@ -72,6 +72,197 @@ Focused tests:
 npm exec --workspace @drax/identity-vue -- vitest run test/auth-session.spec.ts test/auth-session.integration.spec.ts test/components/__tests__/IdentityLogin.spec.ts
 ```
 
+## Expired sessions and external login migration
+
+Session maintenance runs even with remember-me disabled or without a refresh token.
+Expired/malformed access tokens without renewal are cleared together with the profile,
+refresh credentials, persisted state and shared authorization headers. With remember-me
+disabled, a live access token remains usable, but legacy refresh credentials are discarded.
+`AuthStore.isAuth` checks local JWT validity, not mere token presence. This check is not
+signature verification: the backend remains authoritative.
+
+Store token/clear actions synchronize both shared clients. `syncAuthHeaders()` never
+installs an expired/malformed JWT; transient refresh errors preserve recoverable tokens
+in storage, remove expired authorization from the clients and reject the authenticated
+REST preflight before fetch. There is no navigation or automatic request replay.
+Removing a header directly is only a transport operation and intentionally does **not**
+clear the store: use session/store actions for credential changes. Direct `$patch` is
+not a session API; normal request maintenance re-reads persisted state.
+
+External providers must mark the credential exchange as independent using the existing
+HTTP option, even if the old Drax session is recoverable:
+
+```ts
+const response = await this.httpClient.post('/api/google/login', {credential}, {
+  timeout: 120000,
+  removeHeaders: ['Authorization'],
+})
+await loginWithToken(response.accessToken)
+```
+
+Do not remove/restore global headers or set the returned token manually before
+`loginWithToken`. The request option excludes Authorization case-insensitively and
+skips the session preflight without changing shared state. Its 401 is the external
+credential's rejection, not a reason to clear the existing Drax session. No global
+response interceptor performs logout. This does not disable browser CORS preflight.
+
+Consumer changes:
+
+- **GoogleProvider:** add `removeHeaders: ['Authorization']` to the login POST and
+  remove the redundant `setHttpClientToken(response.accessToken)` call; keep
+  `await loginWithToken(response.accessToken)` after a successful exchange. See
+  Zuite's `src/modules/base/providers/GoogleProvider.ts`.
+- **LoginPage:** delete the workaround that checks invalid access tokens and calls
+  `logout()`. Session cleanup belongs to maintenance, not a page (logout also navigates).
+- **Bootstrap:** retain `app.use(pinia); await setupAuthSession(); app.use(router)`;
+  install Pinia's persisted-state plugin before these calls. No extra cleanup needed.
+- **Router:** retain the existing `await refreshAuthSession()` plus catch and cancel
+  protected navigation while `!isAuthenticated() && isRememberMeEnabled() &&
+  authStore.refreshToken`. Do not convert transient failures into logout or redirects.
+- **Backend external route:** replace the Google-specific middleware wrapper with
+  the supported Fastify route option `{config: {identityJwt: 'ignore'}}` on the POST
+  route. Keep its external credential verifier and normal authorization checks.
+  A public route with optional JWT authentication still rejects a supplied invalid
+  Bearer; only this explicit option ignores it. See identity-back's
+  `docs/jwt-route-policy.md`.
+
+The two local workarounds can therefore be removed after upgrading compatible packages
+and declaring the external route policy. Google SDK/signature verification itself is
+consumer-owned; Drax tests use a deterministic external verifier, not Google's service.
+REST request-time maintenance requires the shared client's optional `setBeforeRequest`;
+GraphQL and custom clients without that hook do not get automatic preflight renewal.
+
+## Registro con creación de tenant (opcional, REST)
+
+En el **backend**:
+
+```dotenv
+DRAX_REGISTRATION_TENANT_ENABLED=true
+DRAX_DEFAULT_ROLE=Member
+```
+
+Cargá `LoadIdentityConfigFromEnv()`, registrá `UserRoutes` y creá previamente el rol
+configurado. Sin la flag, o con `false`, el registro no crea tenants. No se necesita
+una variable Vite: `IdentityRegistration`, usado por `RegistrationPage`, consulta
+`GET /api/auth/registration-options` → `{tenantRequired: boolean}`. Mientras no pueda
+cargar estas opciones, bloquea el envío y permite reintentar.
+
+Si está activo, el formulario exige un nombre de organización y envía
+`tenantName` en `POST /api/users/register`. El backend crea un tenant **nuevo** y
+asigna el usuario a ese tenant; rechaza nombres existentes con HTTP 422,
+`tenantName: validation.unique`. No vincula visitantes a tenants existentes. Los
+nombres se recortan y la unicidad es exacta y sensible a mayúsculas, igual que el
+índice MongoDB existente. SQLite también aplica un índice único, incluyendo bases
+ya creadas; si hay duplicados previos, hay que resolverlos manualmente antes de
+inicializar. No se borran ni renombran datos automáticamente.
+
+Para formularios propios, usá `useAuth().registrationOptions()` y
+`useAuth().register({...datos, tenantName})`. El rol y el ID de tenant los determina
+el servidor; enviar `role`, `tenant` o `active` no los sobreescribe. El usuario
+continúa inactivo hasta la verificación existente por email/teléfono; no hay
+login automático. Si falla la creación del usuario antes de persistir, se elimina
+el tenant recién creado; si ya se persistió o falla después el email, se conserva
+la asociación. No es una transacción distribuida entre bases/servicios.
+
+Desplegá backend y frontend compatibles: el formulario actualizado requiere el
+nuevo endpoint incluso cuando la flag está apagada. El registro GraphQL no está
+implementado; su provider devuelve `tenantRequired: false` para las opciones.
+
+## Verificación de email y reenvío (REST)
+
+`register(form)` conserva `{success, message}` y ahora devuelve el tipo público
+`IRegistrationResponse` de `@drax/identity-front`, con
+`verificationEmailSent?: boolean`. `true` indica aceptación por SMTP, **no entrega**;
+`false` indica que la cuenta se creó pero el correo quedó pendiente. La ausencia
+mantiene el comportamiento anterior. Un fallo SMTP ya no implica un error de
+registro ni habilita la cuenta: no hay login automático.
+
+`IdentityRegistration` muestra una advertencia si el valor es `false` y mantiene
+el mensaje de éxito existente para `true` o ausente. Ofrece un botón de acceso al
+reenvío (`auth.verificationResendTitle`), con el email prellenado, tanto desde el
+formulario como después del éxito/advertencia o de un error (duplicado o red).
+Al abrirlo, el reenvío **reemplaza** el formulario o el resultado del registro y
+oculta el botón de acceso. «Volver al registro» (`auth.backToRegistration`) restaura
+el estado anterior, conservando inputs, email, tenant y resultado de éxito/advertencia.
+No es necesario crear otra cuenta ni agregar rutas.
+
+El acceso al reenvío está **solo en registro**, separado del formulario principal
+con un margen superior. `IdentityLogin` conserva los enlaces de registro y de
+recuperación de contraseña según sus props, pero no muestra el acceso a verificación.
+El reenvío solicita email explícitamente. Hay un único formulario visible, sin
+formularios simultáneos ni anidados, y un único título de reenvío:
+`auth.verificationFormTitle` («Account verification» / «Verificación de cuenta»).
+
+El componente reutilizable está exportado:
+
+```vue
+<script setup lang="ts">
+import {IdentityVerificationResend} from '@drax/identity-vue'
+</script>
+
+<template>
+  <IdentityVerificationResend email="persona@example.com" />
+</template>
+```
+
+La prop `email` es opcional y editable. La prop opcional `backLabel?: string`
+muestra un botón de vuelta de tipo `button` que emite `back`; está deshabilitado
+mientras se procesa la solicitud. El componente padre decide qué restaurar al
+recibir ese evento. Sin `backLabel`, el uso standalone conserva un único botón de
+envío. El botón submit queda alineado a la derecha mediante un `v-spacer` anterior.
+Formularios propios pueden usar `useAuth().resendVerificationEmail(email)` o
+`AuthSystem.resendVerificationEmail(email)`.
+REST hace `POST /api/users/verification/resend` con `{email}`. Tanto este endpoint
+como el registro son anónimos: no envían `Authorization`, no disparan el preflight
+de refresh y no borran las cabeceras del cliente compartido.
+
+El resultado de reenvío es siempre neutral para cuentas inexistentes, verificadas,
+limitadas o con fallo SMTP: `{success: true, message: 'If an account is pending
+verification, activation instructions will be sent.'}`. La UI usa traducciones
+es/en neutrales, sin confirmar existencia de la cuenta ni envío o entrega del
+correo. Valida el email, muestra errores de red/`ClientError` y bloquea el envío
+durante la solicitud. No impone una cuenta regresiva fija: el cooldown lo decide
+el servidor (60 segundos por defecto, configurable). GraphQL rechaza esta operación
+explícitamente como no implementada; no se crea una query ni mutación ficticia.
+Los providers personalizados anteriores pueden omitir el método opcional de
+`IAuthProvider`; sus APIs previas siguen funcionando y `AuthSystem` rechaza el
+reenvío con un error explícito si el provider no lo soporta.
+
+### Backend: vencimiento, límites y recuperación de cuentas anteriores
+
+Configuración opcional, cargada con `LoadIdentityConfigFromEnv()`:
+
+```dotenv
+DRAX_EMAIL_VERIFICATION_TTL_SECONDS=86400
+DRAX_EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS=60
+```
+
+Ambos valores deben ser segundos enteros positivos. El código es de un solo uso y
+vence a las 24 horas por defecto. Reenviar reutiliza un código vigente sin extender
+su vencimiento; rota el código únicamente si venció o si el registro anterior no
+tenía vencimiento. Los enlaces antiguos sin vencimiento ya no activan cuentas:
+para recuperarlas, solicitá un reenvío con el email original desde login/registro.
+No hace falta borrar ni volver a crear usuario o tenant. Solo son elegibles cuentas
+con `origin: 'Registry'` y email sin verificar; el reenvío no altera sus datos ni
+reactiva cuentas verificadas que hayan sido desactivadas administrativamente.
+
+El cooldown por email se reclama atómicamente en la base de datos, también cuando
+SMTP falla. Se admiten 10 intentos de reenvío por IP cada 15 minutos por proceso,
+con memoria acotada; incluso los emails inexistentes consumen ese límite. En un
+despliegue multiinstancia, agregá un rate limiter compartido/gateway y configurá
+correctamente la IP de cliente detrás del proxy. No hay cola ni reintentos
+automáticos de correo: el usuario solicita el reenvío. La persistencia SQLite se
+actualiza de forma aditiva al inicializar el repositorio; no se borran registros.
+
+Actualizá backend, `identity-share`, `identity-front` e `identity-vue` de forma
+coherente y desplegá backend antes de la UI nueva. En el monorepo compilá primero
+`identity-share` para que los tipos utilizados por los demás paquetes estén al día.
+
+Pruebas enfocadas: `test/verification-resend.spec.ts`, `test/registration.spec.ts`,
+`test/components/__tests__/IdentityLogin.spec.ts`,
+`test/auth-session.integration.spec.ts` y
+`../identity-front/test/verification-resend.test.ts`.
+
 ## Recommended IDE Setup
 
 [VSCode](https://code.visualstudio.com/) + [Volar](https://marketplace.visualstudio.com/items?itemName=Vue.volar) (and disable Vetur).

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "3.66.0",
+  "version": "3.68.0",
   "type": "module",
   "main": "./src/index.ts",
   "module": "./src/index.ts",
@@ -18,13 +18,13 @@
     "format": "prettier --write src/"
   },
   "dependencies": {
-    "@drax/common-front": "^3.65.0",
-    "@drax/common-vue": "^3.65.0",
+    "@drax/common-front": "^3.68.0",
+    "@drax/common-vue": "^3.68.0",
     "@drax/crud-front": "^3.58.0",
     "@drax/crud-share": "^3.65.0",
-    "@drax/crud-vue": "^3.66.0",
-    "@drax/identity-front": "^3.65.0",
-    "@drax/identity-share": "^3.65.0"
+    "@drax/crud-vue": "^3.68.0",
+    "@drax/identity-front": "^3.68.0",
+    "@drax/identity-share": "^3.67.0"
   },
   "peerDependencies": {
     "pinia": "^3.0.4",
@@ -49,5 +49,5 @@
     "vue-tsc": "^3.2.4",
     "vuetify": "^3.11.8"
   },
-  "gitHead": "904410e22198dc6f96d64db10ba96a3ffd6ec777"
+  "gitHead": "c8300dd678d4048416da13f9065d6749e715c3bf"
 }

package/src/components/IdentityLogin/IdentityLogin.vue

@@ -4,6 +4,7 @@ import {useAuth} from '../../composables/useAuth.js'
 import IdentityProfileView from "../IdentityProfileView/IdentityProfileView.vue";
 import {useI18n} from "vue-i18n";
 import IdentityRememberMe from '../IdentityRememberMe.vue'
+
 import {isRememberMeEnabled} from '../../composables/setupAuthSession'
 const {t, te} = useI18n()
 
@@ -22,6 +23,7 @@ const authError = ref('')
 const loading = ref(false)
 const rememberMe = ref(false)
 
+
 const isFormValid = computed(() => username.value.trim() !== '' && password.value.trim() !== '')
 
 const emit = defineEmits(['loginSuccess'])
@@ -60,6 +62,7 @@ function togglePasswordVisibility() {
         </v-card>
   </template>
 
+
   <template v-else>
 
         <v-form @submit.prevent="submitLogin">
@@ -124,6 +127,7 @@ function togglePasswordVisibility() {
           </v-card>
         </v-form>
 
+
   </template>
 </template>
 

package/src/components/IdentityRegistration/IdentityRegistration.vue

@@ -1,18 +1,42 @@
 <script setup lang="ts">
-import {ref} from 'vue'
+import {onMounted, ref} from 'vue'
+import type {IRegistrationOptions} from '@drax/identity-front'
 import {useAuth} from "../../composables/useAuth.js";
 import {ClientError} from "@drax/common-front";
 import type {IClientInputError} from "@drax/common-front";
 import {useI18nValidation} from "@drax/common-vue";
 import {useI18n} from "vue-i18n";
 import {useRouter} from "vue-router"
+import IdentityVerificationResend from '../IdentityVerificationResend/IdentityVerificationResend.vue'
 
 const {t,te} = useI18n()
 const {$ta} = useI18nValidation()
 
 const router = useRouter()
 
-const {register} = useAuth()
+const {register, registrationOptions} = useAuth()
+const options = ref<IRegistrationOptions | null>(null)
+const optionsLoading = ref(true)
+const optionsError = ref(false)
+const tenantName = ref('')
+const rform = ref<{validate: () => Promise<{valid: boolean}>} | null>(null)
+
+async function loadRegistrationOptions() {
+  optionsLoading.value = true
+  optionsError.value = false
+  options.value = null
+  try {
+    const result = await registrationOptions()
+    if (typeof result?.tenantRequired !== 'boolean') throw new Error('Invalid registration options')
+    options.value = result
+  } catch {
+    optionsError.value = true
+  } finally {
+    optionsLoading.value = false
+  }
+}
+
+onMounted(loadRegistrationOptions)
 
 const variant = ref<"outlined" | "plain" | "filled" | "underlined" | "solo" | "solo-inverted" | "solo-filled" | undefined>('filled')
 
@@ -29,6 +53,8 @@ const inputErrors = ref<IClientInputError|undefined>({currentPassword: [], newPa
 const errorMsg = ref('')
 const loading = ref(false)
 const success = ref(false)
+const verificationEmailSent = ref<boolean>()
+const showVerificationResend = ref(false)
 
 let passwordVisibility = ref(false)
 let confirmPasswordVisibility = ref(false)
@@ -39,10 +65,23 @@ function confirmPasswordRule(value: string) {
 }
 
 async function submitRegistration() {
+  if (!options.value || optionsLoading.value || loading.value) return
+  loading.value = true
+  errorMsg.value = ''
+  inputErrors.value = undefined
   try {
-    loading.value = true
-    const result = await register(form.value)
+    if (options.value.tenantRequired && !tenantName.value.trim()) {
+      inputErrors.value = {tenantName: ['validation.required']}
+      return
+    }
+    if (!(await rform.value?.validate())?.valid) return
+    const payload = {
+      ...form.value,
+      ...(options.value.tenantRequired ? {tenantName: tenantName.value.trim()} : {})
+    }
+    const result = await register(payload)
     success.value = result.success
+    verificationEmailSent.value = result.verificationEmailSent
   } catch (err) {
     if (err instanceof ClientError) {
       inputErrors.value = err.inputErrors
@@ -61,12 +100,18 @@ async function submitRegistration() {
 
 <template>
   <v-sheet>
+    <identity-verification-resend
+        v-if="showVerificationResend"
+        :email="form.email"
+        :back-label="t('auth.backToRegistration')"
+        @back="showVerificationResend = false"
+    />
 
-    <template v-if="success">
+    <template v-else-if="success">
       <v-card>
         <v-card-text>
-          <v-alert type="success">
-            {{ t('user.events.registrationComplete') }}
+          <v-alert :type="verificationEmailSent === false ? 'warning' : 'success'">
+            {{ verificationEmailSent === false ? t('auth.registrationVerificationPending') : t('user.events.registrationComplete') }}
           </v-alert>
         </v-card-text>
         <v-card-text class="text-center">
@@ -81,12 +126,29 @@ async function submitRegistration() {
           <v-form ref="rform" @submit.prevent="submitRegistration">
             <v-card variant="elevated">
               <v-card-title class="pa-4">{{ t('user.action.register') }}</v-card-title>
+              <v-card-text v-if="optionsLoading">
+                <v-alert type="info">{{ t('auth.registrationOptionsLoading') }}</v-alert>
+              </v-card-text>
+              <v-card-text v-if="optionsError">
+                <v-alert type="error">{{ t('auth.registrationOptionsError') }}</v-alert>
+                <v-btn @click="loadRegistrationOptions">{{ t('auth.registrationOptionsRetry') }}</v-btn>
+              </v-card-text>
               <v-card-text v-if="errorMsg">
                 <v-alert type="error">
                   {{ te(errorMsg) ?t(errorMsg) : errorMsg }}
                 </v-alert>
               </v-card-text>
               <v-card-text>
+                <v-text-field
+                    v-if="options?.tenantRequired"
+                    id="tenant-name-input"
+                    v-model="tenantName"
+                    :label="t('auth.registrationTenantName')"
+                    :variant="variant"
+                    required
+                    :rules="[(v: string) => !!v?.trim() || t('validation.required')]"
+                    :error-messages="$ta(inputErrors?.tenantName)"
+                ></v-text-field>
                 <v-text-field
                     id="name-input"
                     :label="t('user.field.name')"
@@ -167,7 +229,7 @@ async function submitRegistration() {
                     color="grey"
                     variant="text"
                     id="submit-button"
-                    type="submit"
+                    type="button"
                     href="/login"
                 >
                   {{ t('auth.login') }}
@@ -179,6 +241,7 @@ async function submitRegistration() {
                     id="submit-button"
                     type="submit"
                     :loading="loading"
+                    :disabled="!options || optionsLoading || loading"
                 >
                   {{ t('action.sent') }}
                 </v-btn>
@@ -186,7 +249,20 @@ async function submitRegistration() {
             </v-card>
           </v-form>
     </template>
+
+    
   </v-sheet>
+
+  <div v-if="!showVerificationResend" class="mt-2 text-center">
+    <v-btn
+        type="button"
+        variant="text"
+        color="secondary"
+        @click="showVerificationResend = true"
+    >
+      {{ t('auth.verificationResendTitle') }}
+    </v-btn>
+  </div>
 </template>
 
 <style scoped lang="sass">

package/src/components/IdentityVerificationResend/IdentityVerificationResend.vue

@@ -0,0 +1,87 @@
+<script setup lang="ts">
+import {ref, watch} from 'vue'
+import {ClientError} from '@drax/common-front'
+import type {IClientInputError} from '@drax/common-front'
+import {useI18nValidation} from '@drax/common-vue'
+import {useI18n} from 'vue-i18n'
+import {useAuth} from '../../composables/useAuth.js'
+
+const props = withDefaults(defineProps<{email?: string, backLabel?: string}>(), {email: ''})
+const emit = defineEmits<{back: []}>()
+const {t, te} = useI18n()
+const {$ta} = useI18nValidation()
+const {resendVerificationEmail} = useAuth()
+const email = ref(props.email)
+const loading = ref(false)
+const success = ref(false)
+const errorMsg = ref('')
+const inputErrors = ref<IClientInputError>()
+
+watch(() => props.email, value => { email.value = value })
+watch(email, () => {
+  success.value = false
+  errorMsg.value = ''
+  inputErrors.value = undefined
+})
+
+async function submitResend() {
+  if (loading.value) return
+  success.value = false
+  errorMsg.value = ''
+  inputErrors.value = undefined
+  const address = email.value.trim()
+  if (!address || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(address)) {
+    inputErrors.value = {email: [address ? 'auth.verificationEmailInvalid' : 'validation.required']}
+    return
+  }
+  loading.value = true
+  try {
+    const result = await resendVerificationEmail(address)
+    if (!result.success) throw new Error('auth.verificationResendError')
+    // A neutral response does not confirm an account exists or that mail was sent.
+    success.value = true
+  } catch (error) {
+    if (error instanceof ClientError) inputErrors.value = error.inputErrors
+    errorMsg.value = error instanceof Error ? error.message : 'auth.verificationResendError'
+  } finally {
+    loading.value = false
+  }
+}
+</script>
+
+<template>
+  <v-form @submit.prevent="submitResend" novalidate>
+    <v-card variant="flat">
+      <v-card-title>{{ t('auth.verificationFormTitle') }}</v-card-title>
+      <v-card-text>
+        <v-alert v-if="success" type="success" role="status" class="mb-4">
+          {{ t('auth.verificationResendNeutral') }}
+        </v-alert>
+        <v-alert v-if="errorMsg" type="error" role="alert" class="mb-4">
+          {{ te(errorMsg) ? t(errorMsg) : errorMsg }}
+        </v-alert>
+        <v-text-field
+            v-model="email"
+            name="verification-email"
+            type="email"
+            autocomplete="email"
+            :label="t('user.field.email')"
+            prepend-inner-icon="mdi-email"
+            variant="outlined"
+            required
+            :disabled="loading"
+            :error-messages="$ta(inputErrors?.email)"
+        />
+      </v-card-text>
+      <v-card-actions>
+        <v-btn v-if="backLabel" type="button" variant="text" :disabled="loading" @click="emit('back')">
+          {{ backLabel }}
+        </v-btn>
+        <v-spacer />
+        <v-btn type="submit" color="primary" variant="tonal" :loading="loading" :disabled="loading">
+          {{ t('auth.verificationResend') }}
+        </v-btn>
+      </v-card-actions>
+    </v-card>
+  </v-form>
+</template>

package/src/components/SwitchTenant/SwitchTenant.vue

@@ -6,7 +6,7 @@ import {useAuthStore} from "../../stores/AuthStore"
 import {useI18n} from "vue-i18n"
 
 const authStore = useAuthStore()
-const {switchTenant, hasPermission} = useAuth()
+const {switchTenant, hasPermission, isAuthenticated} = useAuth()
 
 const {t} = useI18n()
 const tenant = ref();
@@ -19,7 +19,7 @@ async function changeTenant() {
 </script>
 
 <template>
-  <v-toolbar v-if="hasPermission('user:switchTenant')">
+  <v-toolbar v-if="isAuthenticated() && hasPermission('user:switchTenant')">
     <v-toolbar-title>
       <b>{{t('tenant.current')}}:</b> {{authStore.authUser?.tenant ? authStore.authUser?.tenant?.name : '-'}}
     </v-toolbar-title>

package/src/composables/setupAuthSession.ts

@@ -1,5 +1,5 @@
-import {HttpClientFactory, HttpRestClientFactory} from '@drax/common-front'
-import {AuthSystemFactory} from '@drax/identity-front'
+import {HttpRestClientFactory} from '@drax/common-front'
+import {AuthHelper, AuthSystemFactory} from '@drax/identity-front'
 import {useAuthStore} from '../stores/AuthStore'
 
 export const isRememberMeEnabled = () => import.meta.env.VITE_DRAX_REMEMBER_ME_ENABLED === 'true'
@@ -12,11 +12,7 @@ const revisions = new WeakMap<AuthStore, number>()
 export const authSessionRevision = (store = useAuthStore()) => revisions.get(store) ?? 0
 
 export function syncAuthHeaders(store = useAuthStore()) {
-    const clients = new Set([HttpClientFactory.getInstance(), HttpRestClientFactory.getInstance()])
-    for (const client of clients) {
-        if (store.accessToken) client.addHeader('Authorization', `Bearer ${store.accessToken}`)
-        else client.removeHeader('Authorization')
-    }
+    store.syncAuthHeaders()
 }
 
 export function clearAuthSession(store = useAuthStore()) {
@@ -28,7 +24,7 @@ export function clearAuthSession(store = useAuthStore()) {
 export function isRejectedCredential(error: unknown): boolean {
     const e = error as {statusCode?: number, status?: number, response?: {status?: number}, cause?: unknown, error?: unknown}
     const status = e?.statusCode ?? e?.status ?? e?.response?.status
-    return status === 401 || status === 403 ||
+    return status === 401 || status === 403 || status === 498 ||
         (!!e?.error && e.error !== error && isRejectedCredential(e.error)) ||
         (!!e?.cause && e.cause !== error && isRejectedCredential(e.cause))
 }
@@ -76,11 +72,7 @@ export function isCurrentAuthSession(store: AuthStore, token: string | null, ver
 }
 
 function needsRefresh(token: string | null) {
-    try {
-        const payload = (token?.split('.')[1] ?? '').replace(/-/g, '+').replace(/_/g, '/')
-        const {exp} = JSON.parse(atob(payload))
-        return typeof exp !== 'number' || exp * 1000 <= Date.now() + 30_000
-    } catch { return true }
+    return !AuthHelper.isJWTValid(token ?? '', 30)
 }
 
 async function withSessionLock(action: () => Promise<void>) {
@@ -115,12 +107,25 @@ async function fetchSessionUser(store: AuthStore) {
 }
 
 export function refreshAuthSession(store = useAuthStore()): Promise<void> {
-    if (!isRememberMeEnabled()) return Promise.resolve()
+
     const running = flights.get(store)
     if (running) return running
     const flight = withSessionLock(async () => {
         rereadSession(store)
-        if (!store.refreshToken) return
+        const valid = AuthHelper.isJWTValid(store.accessToken ?? '')
+        if (!isRememberMeEnabled() || !store.refreshToken) {
+            if (!valid) {
+                if (store.accessToken || store.refreshToken || store.refreshExpiresAt || store.authUser) clearAuthSession(store)
+                else syncAuthHeaders(store)
+            } else {
+                // Disabling remember-me must not invalidate an otherwise live ordinary JWT.
+                if (!isRememberMeEnabled() && (store.refreshToken || store.refreshExpiresAt)) {
+                    store.setAccessToken(store.accessToken!)
+                }
+                syncAuthHeaders(store)
+            }
+            return
+        }
         if (!needsRefresh(store.accessToken)) {
             if (!store.authUser) await fetchSessionUser(store)
             return
@@ -162,7 +167,8 @@ export async function setupAuthSession(): Promise<void> {
     }
     syncAuthHeaders(store)
     client.setBeforeRequest?.(async (url) => {
-        if (/\/api\/auth\/(login|refresh|logout)\/?(?:[?#]|$)/.test(url)) return
+        if (/\/api\/auth\/(login|refresh|logout|registration-options)\/?(?:[?#]|$)/.test(url)) return
+        if (/\/api\/users\/(register|verification\/resend)\/?(?:[?#]|$)/.test(url)) return
         // The profile fetch uses the fresh JWT and must not await its own refresh promise.
         if (fetchingUser.has(store) && /\/api\/auth\/me\/?(?:[?#]|$)/.test(url)) return
         await refreshAuthSession(store)

package/src/composables/useAuth.ts

@@ -81,6 +81,14 @@ export function useAuth() {
         return await authSystem.recoveryPasswordComplete(recoveryCode, newPassword)
     }
 
+    const registrationOptions = async () => {
+        return await authSystem.registrationOptions()
+    }
+
+    const resendVerificationEmail = async (email: string) => {
+        return await authSystem.resendVerificationEmail(email)
+    }
+
     const register = async (form: any) => {
         return await authSystem.register(form)
     }
@@ -147,7 +155,7 @@ export function useAuth() {
         isAuthenticated, fetchAuthUser,
         changeOwnPassword, changeAvatar, passwordPolicy,
         recoveryPasswordRequest, recoveryPasswordComplete,
-        register, switchTenant
+        register, registrationOptions, resendVerificationEmail, switchTenant
     }
 
 }

package/src/index.ts

@@ -1,5 +1,6 @@
 export {setupAuthSession, refreshAuthSession, isRememberMeEnabled} from './composables/setupAuthSession'
 export {default as IdentityRememberMe} from './components/IdentityRememberMe.vue'
+export {default as IdentityVerificationResend} from './components/IdentityVerificationResend/IdentityVerificationResend.vue'
 
 import IdentityLogin from "./components/IdentityLogin/IdentityLogin.vue";
 import IdentityProfileAvatar from "./components/IdentityProfileAvatar/IdentityProfileAvatar.vue";

package/src/stores/AuthStore.ts

@@ -4,6 +4,7 @@ import type {IAuthFullUser} from "@drax/identity-front";
 //@ts-ignore
 import type from 'pinia-plugin-persistedstate'
 import {AuthHelper} from "@drax/identity-front";
+import {HttpClientFactory, HttpRestClientFactory} from '@drax/common-front'
 
 export const useAuthStore = defineStore('AuthStore', {
   state: () => ({
@@ -15,8 +16,7 @@ export const useAuthStore = defineStore('AuthStore', {
   }),
   getters:{
     isAuth: (state): boolean => {
-      //TODO verify token
-      return !!state.accessToken
+      return !!state.accessToken && AuthHelper.isJWTValid(state.accessToken)
     },
     hasPermission: (state) => (permission:string) => {
       return state.authUser && state.authUser.role && state.authUser.role.permissions ? state.authUser.role.permissions.includes(permission) : false
@@ -26,6 +26,16 @@ export const useAuthStore = defineStore('AuthStore', {
     },
   },
   actions:{
+    syncAuthHeaders(){
+      const clients = new Set([HttpClientFactory.getInstance(), HttpRestClientFactory.getInstance()])
+      for (const client of clients) {
+        for (const header of Object.keys(client.baseHeaders ?? {})) {
+          if (header.toLowerCase() === 'authorization' && header !== 'Authorization') client.removeHeader(header)
+        }
+        if (this.accessToken && AuthHelper.isJWTValid(this.accessToken)) client.addHeader('Authorization', `Bearer ${this.accessToken}`)
+        else client.removeHeader('Authorization')
+      }
+    },
     persistSession(){
       // Persist synchronously so another tab holding the refresh lock sees rotation immediately.
       try {
@@ -35,6 +45,7 @@ export const useAuthStore = defineStore('AuthStore', {
     setAccessToken(accessToken:string){
       this.$patch({accessToken, refreshToken: null, refreshExpiresAt: null})
       this.persistSession()
+      this.syncAuthHeaders()
     },
     setSession(session: {accessToken: string, refreshToken?: string, refreshExpiresAt?: string}){
       this.$patch({
@@ -43,6 +54,7 @@ export const useAuthStore = defineStore('AuthStore', {
         refreshExpiresAt: session.refreshExpiresAt ?? null,
       })
       this.persistSession()
+      this.syncAuthHeaders()
     },
     setAuthUser(authUser:IAuthFullUser){
       this.authUser = authUser
@@ -55,6 +67,7 @@ export const useAuthStore = defineStore('AuthStore', {
         sessionVersion: globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`,
       })
       this.persistSession()
+      this.syncAuthHeaders()
     }
   },