@eaera-com/cms-sdk 0.1.101 → 0.1.102

package/dist/chunks/{_shared-Dyz_Ya9z.js → _shared-DWYblQqx.js}

@@ -1,4 +1,5 @@
 import { a as COOKIE_DEFAULTS } from './storage.constant-CVWam5ls.js';
+import { getRequestURL } from 'h3';
 import { useRuntimeConfig } from '#imports';
 
 const TOKEN_COOKIE_OPTIONS = {
@@ -8,6 +9,10 @@ const TOKEN_COOKIE_OPTIONS = {
   path: COOKIE_DEFAULTS.PATH,
   maxAge: COOKIE_DEFAULTS.MAX_AGE_SECONDS
 };
+function tokenCookieOptions(event) {
+  const secure = new URL(getRequestURL(event)).protocol === "https:";
+  return { ...TOKEN_COOKIE_OPTIONS, secure };
+}
 function readSdkConfig(event) {
   const config = useRuntimeConfig(event);
   const pub = config?.public ?? {};
@@ -22,4 +27,4 @@ function readSdkConfig(event) {
   };
 }
 
-export { TOKEN_COOKIE_OPTIONS as T, readSdkConfig as r };
+export { TOKEN_COOKIE_OPTIONS as T, readSdkConfig as r, tokenCookieOptions as t };

package/dist/chunks/_txn-DmQZNq48.js

@@ -0,0 +1,99 @@
+import { timingSafeEqual, randomBytes, createHash } from 'node:crypto';
+import { parseCookies, setCookie } from 'h3';
+
+const OAUTH_PROXY_PATH = {
+  /** GET — CMS code callback (state check + code exchange). Must match the
+   *  route the Nuxt module registers in `nuxt.ts` (SERVER_HANDLERS). */
+  CALLBACK: "/api/cms/oauth/callback"
+};
+const OAUTH_TXN_COOKIE = "cms_oauth_txn";
+const OAUTH_TXN_TTL_MS = 10 * 60 * 1e3;
+const OAUTH_TXN_MAX_ENTRIES = 1e3;
+const OAUTH_GRANT_AUTHORIZATION_CODE = "authorization_code";
+const OAUTH_PKCE_METHOD = "S256";
+
+const GLOBAL_KEY = "__cms_sdk_oauth_txns__";
+function store() {
+  const g = globalThis;
+  g[GLOBAL_KEY] ??= { txns: /* @__PURE__ */ new Map(), byState: /* @__PURE__ */ new Map() };
+  return g[GLOBAL_KEY];
+}
+function prune() {
+  const s = store();
+  const now = Date.now();
+  for (const [id, txn] of s.txns) {
+    if (now - txn.createdAt > OAUTH_TXN_TTL_MS) {
+      s.txns.delete(id);
+      s.byState.delete(txn.state);
+    }
+  }
+  while (s.txns.size > OAUTH_TXN_MAX_ENTRIES) {
+    const oldest = s.txns.keys().next().value;
+    if (!oldest) break;
+    const txn = s.txns.get(oldest);
+    s.txns.delete(oldest);
+    if (txn) s.byState.delete(txn.state);
+  }
+}
+function base64url(bytes) {
+  return bytes.toString("base64url");
+}
+function createPkce() {
+  return {
+    state: base64url(randomBytes(32)),
+    verifier: base64url(randomBytes(64)),
+    challenge: ""
+  };
+}
+function codeChallenge(verifier) {
+  return base64url(createHash("sha256").update(verifier).digest());
+}
+function saveTransaction(txn) {
+  prune();
+  const id = base64url(randomBytes(24));
+  const s = store();
+  s.txns.set(id, txn);
+  s.byState.set(txn.state, id);
+  return id;
+}
+function consumeTransaction(event, state) {
+  const s = store();
+  const id = s.byState.get(state);
+  if (!id) return null;
+  const cookie = parseCookies(event)[OAUTH_TXN_COOKIE];
+  if (!cookie || !safeEqual(cookie, id)) return null;
+  const txn = s.txns.get(id);
+  if (!txn) return null;
+  s.txns.delete(id);
+  s.byState.delete(state);
+  if (Date.now() - txn.createdAt > OAUTH_TXN_TTL_MS) return null;
+  return txn;
+}
+function clearTransactionCookie(event) {
+  setCookie(event, OAUTH_TXN_COOKIE, "", {
+    httpOnly: true,
+    sameSite: "lax",
+    path: "/",
+    maxAge: 0
+  });
+}
+function setTransactionCookie(event, txnId) {
+  setCookie(event, OAUTH_TXN_COOKIE, txnId, {
+    httpOnly: true,
+    sameSite: "lax",
+    path: "/",
+    maxAge: Math.floor(OAUTH_TXN_TTL_MS / 1e3)
+  });
+}
+const PKCE_METHOD = OAUTH_PKCE_METHOD;
+function safeEqual(a, b) {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+function safeReturnPath(value) {
+  return value && value.startsWith("/") && !value.startsWith("//") ? value : "/";
+}
+
+export { OAUTH_GRANT_AUTHORIZATION_CODE as O, PKCE_METHOD as P, clearTransactionCookie as a, createPkce as b, consumeTransaction as c, saveTransaction as d, setTransactionCookie as e, OAUTH_PROXY_PATH as f, codeChallenge as g, safeReturnPath as s };

package/dist/chunks/{connection--KUpmDbP.js → connection-DprBIh4D.js}

@@ -27,11 +27,6 @@ const setQwenpawSessionCookies = (event, connection) => {
     path: "/",
     maxAge: QWENPAW_COOKIE_MAX_AGE
   };
-  console.log("[qwenpaw] exchange saved connection →", {
-    agentId: connection.agentId,
-    agentIdIsConstant: connection.agentId === QWENPAW_DEFAULT_AGENT_ID,
-    baseUrl: connection.baseUrl
-  });
   setCookie(event, QWENPAW_COOKIE_BASE_URL, connection.baseUrl, common);
 };
 const readCookieValue = (event, name) => {
@@ -44,11 +39,6 @@ const resolveQwenpawConnection = (event, overrides = {}) => {
     baseUrl: overrides.baseUrl || readCookieValue(event, QWENPAW_COOKIE_BASE_URL) || config.baseUrl,
     agentId: QWENPAW_DEFAULT_AGENT_ID
   };
-  console.log("[qwenpaw] resolveQwenpawConnection →", {
-    agentId: resolved.agentId,
-    source: overrides.baseUrl ? "override" : readCookieValue(event, QWENPAW_COOKIE_BASE_URL) ? "cookie" : "runtimeConfig",
-    baseUrl: resolved.baseUrl
-  });
   return resolved;
 };
 const hasQwenpawConnection = (event) => Boolean(resolveQwenpawConnection(event).baseUrl);

package/dist/common/constants/oauth.constant.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Central-login OAuth constants (FEAT-014 portal integration contract).
+ *
+ * The portal BFF owns state + PKCE; the browser only ever sees the
+ * authorize redirect and the code/state echo on the callback. Secrets and
+ * verifiers stay server-side.
+ */
+export declare const OAUTH_PROXY_PATH: {
+    /** GET — starts the flow (302 to the CMS authorize URL). Must match the
+     *  route the Nuxt module registers in `nuxt.ts` (SERVER_HANDLERS). */
+    readonly START: "/api/cms/oauth/start";
+    /** GET — CMS code callback (state check + code exchange). Must match the
+     *  route the Nuxt module registers in `nuxt.ts` (SERVER_HANDLERS). */
+    readonly CALLBACK: "/api/cms/oauth/callback";
+};
+/** Browser-correlation cookie holding the local transaction id. */
+export declare const OAUTH_TXN_COOKIE = "cms_oauth_txn";
+/** Transaction TTL — must cover the whole login round-trip. */
+export declare const OAUTH_TXN_TTL_MS: number;
+/** Prune threshold — keep the in-memory map bounded. */
+export declare const OAUTH_TXN_MAX_ENTRIES = 1000;
+/** Token endpoint grant used for the code exchange. */
+export declare const OAUTH_GRANT_AUTHORIZATION_CODE = "authorization_code";
+/** PKCE method required by the CMS (S256, 43-char challenge, no padding). */
+export declare const OAUTH_PKCE_METHOD = "S256";
+//# sourceMappingURL=oauth.constant.d.ts.map

package/dist/common/constants/oauth.constant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.constant.d.ts","sourceRoot":"","sources":["../../../src/common/constants/oauth.constant.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;IAC3B;0EACsE;;IAEtE;0EACsE;;CAE9D,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAE/C,wDAAwD;AACxD,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,uDAAuD;AACvD,eAAO,MAAM,8BAA8B,uBAAuB,CAAC;AAEnE,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,SAAS,CAAC"}

package/dist/nuxt.d.ts

@@ -7,6 +7,11 @@ export interface IModuleOptions {
      */
     endpoints?: Record<string, string>;
     clientId?: string;
+    /**
+     * OAuth scope requested by the central-login flow
+     * (`/api/cms/oauth/start`). Default 'read'.
+     */
+    oauthScope?: string;
     /** Storage backend name. Default 'cookie'. */
     storage?: StorageName;
     /** Use fake data until the backend is ready. Default false. */

package/dist/nuxt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nuxt.d.ts","sourceRoot":"","sources":["../src/nuxt.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kFAAkF;IAClF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA6BD;;;;;;;;;;;;;GAaG;;AACH,wBAqCG"}
+{"version":3,"file":"nuxt.d.ts","sourceRoot":"","sources":["../src/nuxt.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kFAAkF;IAClF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA+BD;;;;;;;;;;;;;GAaG;;AACH,wBA4CG"}

package/dist/nuxt.js

@@ -6,6 +6,8 @@ const SERVER_HANDLERS = [
   ["/api/cms/login", "server/auth/login.post.js"],
   ["/api/cms/logout", "server/auth/logout.post.js"],
   ["/api/cms/refresh", "server/auth/refresh.post.js"],
+  ["/api/cms/oauth/start", "server/oauth/start.get.js"],
+  ["/api/cms/oauth/callback", "server/oauth/callback.get.js"],
   ["/api/cms/cbs-start", "server/auth/cbs-start.post.js"],
   ["/api/cms/cbs-callback", "server/auth/cbs-callback.post.js"],
   ["/api/cms/idp-login", "server/auth/idp-login.get.js"],
@@ -35,6 +37,7 @@ const nuxt = defineNuxtModule({
   defaults: {
     endpoints: { cms: "cmsUrl", report: "reportUrl", poolTrading: "poolTradingUrl" },
     clientId: "clientId",
+    oauthScope: "read",
     storage: "cookie",
     mock: false,
     wsTopics: [],
@@ -45,6 +48,7 @@ const nuxt = defineNuxtModule({
     const { resolve } = createResolver(import.meta.url);
     nuxt.options.runtimeConfig.public ??= {};
     nuxt.options.runtimeConfig.public.cmsSdkOptions = options;
+    nuxt.options.runtimeConfig.cmsClientSecret ??= "";
     for (const [route, file] of SERVER_HANDLERS) {
       addServerHandler({ route, handler: resolve(file) });
     }

package/dist/runtime/plugin.js

@@ -2,6 +2,7 @@ import { createCmsSDK, createPersistPlugin, TOKEN_STORAGE_KEY, useAuthStore, use
 import { $fetch } from 'ofetch';
 import { watch } from 'vue';
 import { defineNuxtPlugin, useRuntimeConfig, useCookie } from '#app';
+import { getRequestURL } from 'h3';
 
 function buildOpts(httpOnly) {
   return httpOnly ? { httpOnly: true, secure: true, sameSite: "lax", path: "/" } : { secure: true, sameSite: "lax", path: "/" };
@@ -27,6 +28,10 @@ const TOKEN_COOKIE_OPTIONS = {
   path: "/",
   maxAge: 60 * 60 * 24 * 30
 };
+function tokenCookieOptions(event) {
+  const secure = new URL(getRequestURL(event)).protocol === "https:";
+  return { ...TOKEN_COOKIE_OPTIONS, secure };
+}
 
 const STORE_ATTACHMENTS = [
   { name: "auth", get: useAuthStore },
@@ -81,7 +86,7 @@ const plugin = defineNuxtPlugin(async (nuxtApp) => {
     if (import.meta.server) {
       const { setCookie, deleteCookie } = await import('h3');
       const event = nuxtApp.ssrContext?.event;
-      if (token) setCookie(event, TOKEN_STORAGE_KEY, token, TOKEN_COOKIE_OPTIONS);
+      if (token) setCookie(event, TOKEN_STORAGE_KEY, token, tokenCookieOptions(event));
       else deleteCookie(event, TOKEN_STORAGE_KEY, { path: TOKEN_COOKIE_OPTIONS.path });
     } else if (token) {
       await $fetch("/api/cms/set-token", { method: "POST", body: { token } });

package/dist/server/ai/qwenpaw/chat/stop.post.js

@@ -1,7 +1,7 @@
 import { defineEventHandler, readBody, createError } from 'h3';
 import { c as qwenpawStop, p as postConsoleChatError } from '../../../../chunks/client-Ac6qgpZ8.js';
 import { c as QWENPAW_MAX_SESSION_ID_LENGTH } from '../../../../chunks/qwenpaw.constant-DHSj9A-0.js';
-import { r as requireCmsSession, a as resolveFreshQwenpawConnection, b as resolveQwenpawServerConfig } from '../../../../chunks/connection--KUpmDbP.js';
+import { r as requireCmsSession, a as resolveFreshQwenpawConnection, b as resolveQwenpawServerConfig } from '../../../../chunks/connection-DprBIh4D.js';
 
 const stop_post = defineEventHandler(async (event) => {
   requireCmsSession(event);

package/dist/server/ai/qwenpaw/chat.post.js

@@ -2,7 +2,7 @@ import { Readable } from 'node:stream';
 import { defineEventHandler, readBody, createError, setResponseStatus, setResponseHeader, sendStream } from 'h3';
 import { q as qwenpawChat, p as postConsoleChatError } from '../../../chunks/client-Ac6qgpZ8.js';
 import { Q as QWENPAW_MAX_MESSAGE_LENGTH, a as QWENPAW_MAX_FILES, b as QWENPAW_MAX_FILE_NAME_LENGTH, c as QWENPAW_MAX_SESSION_ID_LENGTH } from '../../../chunks/qwenpaw.constant-DHSj9A-0.js';
-import { r as requireCmsSession, a as resolveFreshQwenpawConnection, b as resolveQwenpawServerConfig } from '../../../chunks/connection--KUpmDbP.js';
+import { r as requireCmsSession, a as resolveFreshQwenpawConnection, b as resolveQwenpawServerConfig } from '../../../chunks/connection-DprBIh4D.js';
 
 const chat_post = defineEventHandler(async (event) => {
   requireCmsSession(event);

package/dist/server/ai/qwenpaw/chats-id.delete.js

@@ -1,6 +1,6 @@
 import { defineEventHandler, getRouterParam, createError } from 'h3';
 import { d as deleteQwenpawChat } from '../../../chunks/chats-BjSS83OW.js';
-import { r as requireCmsSession, a as resolveFreshQwenpawConnection } from '../../../chunks/connection--KUpmDbP.js';
+import { r as requireCmsSession, a as resolveFreshQwenpawConnection } from '../../../chunks/connection-DprBIh4D.js';
 
 const chatsId_delete = defineEventHandler(async (event) => {
   requireCmsSession(event);

package/dist/server/ai/qwenpaw/chats.get.js

@@ -1,7 +1,7 @@
 import { defineEventHandler } from 'h3';
 import { l as listQwenpawChats, a as listQwenpawGroups } from '../../../chunks/chats-BjSS83OW.js';
 import { d as QWENPAW_DEFAULT_AGENT_ID } from '../../../chunks/qwenpaw.constant-DHSj9A-0.js';
-import { r as requireCmsSession, a as resolveFreshQwenpawConnection } from '../../../chunks/connection--KUpmDbP.js';
+import { r as requireCmsSession, a as resolveFreshQwenpawConnection } from '../../../chunks/connection-DprBIh4D.js';
 
 const chats_get = defineEventHandler(async (event) => {
   requireCmsSession(event);

package/dist/server/ai/qwenpaw/history.get.js

@@ -1,6 +1,6 @@
 import { defineEventHandler, getQuery, createError } from 'h3';
 import { f as fetchChatHistory } from '../../../chunks/chats-BjSS83OW.js';
-import { r as requireCmsSession, a as resolveFreshQwenpawConnection } from '../../../chunks/connection--KUpmDbP.js';
+import { r as requireCmsSession, a as resolveFreshQwenpawConnection } from '../../../chunks/connection-DprBIh4D.js';
 
 const history_get = defineEventHandler(async (event) => {
   requireCmsSession(event);

package/dist/server/ai/qwenpaw/session.get.js

@@ -1,5 +1,5 @@
 import { defineEventHandler } from 'h3';
-import { r as requireCmsSession, c as resolveQwenpawConnection, h as hasQwenpawConnection } from '../../../chunks/connection--KUpmDbP.js';
+import { r as requireCmsSession, c as resolveQwenpawConnection, h as hasQwenpawConnection } from '../../../chunks/connection-DprBIh4D.js';
 
 const session_get = defineEventHandler((event) => {
   requireCmsSession(event);

package/dist/server/ai/qwenpaw/session.post.js

@@ -1,5 +1,5 @@
 import { defineEventHandler } from 'h3';
-import { r as requireCmsSession, e as exchangeQwenpawSession, d as handleExchangeError } from '../../../chunks/connection--KUpmDbP.js';
+import { r as requireCmsSession, e as exchangeQwenpawSession, d as handleExchangeError } from '../../../chunks/connection-DprBIh4D.js';
 
 const session_post = defineEventHandler(async (event) => {
   requireCmsSession(event);

package/dist/server/ai/qwenpaw/upload.post.js

@@ -1,7 +1,7 @@
 import { defineEventHandler, readMultipartFormData, createError } from 'h3';
 import { d as qwenpawUpload, p as postConsoleChatError } from '../../../chunks/client-Ac6qgpZ8.js';
 import { g as QWENPAW_MAX_UPLOAD_BYTES } from '../../../chunks/qwenpaw.constant-DHSj9A-0.js';
-import { r as requireCmsSession, a as resolveFreshQwenpawConnection, b as resolveQwenpawServerConfig } from '../../../chunks/connection--KUpmDbP.js';
+import { r as requireCmsSession, a as resolveFreshQwenpawConnection, b as resolveQwenpawServerConfig } from '../../../chunks/connection-DprBIh4D.js';
 
 const upload_post = defineEventHandler(async (event) => {
   requireCmsSession(event);

package/dist/server/auth/cbs-callback.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, readBody, parseCookies, getRequestHead
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig, t as tokenCookieOptions } from '../../chunks/_shared-DWYblQqx.js';
 import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const cbsCallback_post = defineEventHandler(async (event) => {
@@ -26,9 +26,9 @@ const cbsCallback_post = defineEventHandler(async (event) => {
     const data = response._data ?? {};
     const token = data.accessToken ?? data.access_token ?? "";
     const refreshToken = data.refreshToken ?? data.refresh_token ?? "";
-    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, TOKEN_COOKIE_OPTIONS);
+    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, tokenCookieOptions(event));
     if (refreshToken)
-      setCookie(event, REFRESH_TOKEN_STORAGE_KEY, refreshToken, TOKEN_COOKIE_OPTIONS);
+      setCookie(event, REFRESH_TOKEN_STORAGE_KEY, refreshToken, tokenCookieOptions(event));
     return { ...data, token };
   } catch (err) {
     throw createError({

package/dist/server/auth/cbs-start.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, parseCookies, getRequestHeader } from
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig } from '../../chunks/_shared-DWYblQqx.js';
 
 const cbsStart_post = defineEventHandler(async (event) => {
   const { cmsUrl, clientId } = readSdkConfig(event);

package/dist/server/auth/idp-callback.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, getQuery, parseCookies, getRequestHead
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig, t as tokenCookieOptions } from '../../chunks/_shared-DWYblQqx.js';
 import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpCallback_get = defineEventHandler(async (event) => {
@@ -33,9 +33,9 @@ const idpCallback_get = defineEventHandler(async (event) => {
     });
     const token = data.accessToken ?? data.access_token ?? "";
     const refreshToken = data.refreshToken ?? data.refresh_token ?? "";
-    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, TOKEN_COOKIE_OPTIONS);
+    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, tokenCookieOptions(event));
     if (refreshToken)
-      setCookie(event, REFRESH_TOKEN_STORAGE_KEY, refreshToken, TOKEN_COOKIE_OPTIONS);
+      setCookie(event, REFRESH_TOKEN_STORAGE_KEY, refreshToken, tokenCookieOptions(event));
     return { ...data, token };
   } catch (err) {
     const beData = err?.data ?? {};

package/dist/server/auth/idp-link-callback.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, getQuery, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig } from '../../chunks/_shared-DWYblQqx.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpLinkCallback_get = defineEventHandler(async (event) => {

package/dist/server/auth/idp-link-start.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, getQuery, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig } from '../../chunks/_shared-DWYblQqx.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpLinkStart_get = defineEventHandler(async (event) => {

package/dist/server/auth/idp-link.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, readBody, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig } from '../../chunks/_shared-DWYblQqx.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpLink_post = defineEventHandler(async (event) => {

package/dist/server/auth/idp-login.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, getQuery, parseCookies, getRequestHead
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig } from '../../chunks/_shared-DWYblQqx.js';
 
 const idpLogin_get = defineEventHandler(async (event) => {
   const { cmsUrl, clientId } = readSdkConfig(event);

package/dist/server/auth/idp-me.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig } from '../../chunks/_shared-DWYblQqx.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpMe_get = defineEventHandler(async (event) => {

package/dist/server/auth/idp-unlink.delete.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, getQuery, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig } from '../../chunks/_shared-DWYblQqx.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const idpUnlink_delete = defineEventHandler(async (event) => {

package/dist/server/auth/login.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, readBody, parseCookies, getRequestHead
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig, t as tokenCookieOptions } from '../../chunks/_shared-DWYblQqx.js';
 import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const login_post = defineEventHandler(async (event) => {
@@ -29,9 +29,9 @@ const login_post = defineEventHandler(async (event) => {
     const data = response._data ?? {};
     const token = data.accessToken ?? data.access_token ?? "";
     const refreshToken = data.refreshToken ?? data.refresh_token ?? "";
-    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, TOKEN_COOKIE_OPTIONS);
+    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, tokenCookieOptions(event));
     if (refreshToken)
-      setCookie(event, REFRESH_TOKEN_STORAGE_KEY, refreshToken, TOKEN_COOKIE_OPTIONS);
+      setCookie(event, REFRESH_TOKEN_STORAGE_KEY, refreshToken, tokenCookieOptions(event));
     return { ...data, token };
   } catch (err) {
     throw createError({

package/dist/server/auth/logout.post.js

@@ -2,7 +2,7 @@ import { defineEventHandler, parseCookies, deleteCookie } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-DWYblQqx.js';
 import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const logout_post = defineEventHandler(async (event) => {

package/dist/server/auth/refresh.post.js

@@ -1,8 +1,9 @@
 import { defineEventHandler, createError, parseCookies, setCookie } from 'h3';
+import { useRuntimeConfig } from '#imports';
 import { $fetch } from 'ofetch';
 import { a as AUTH_ENDPOINT } from '../../chunks/auth.constant-CnGo0q42.js';
 import { b as HTTP_HEADER, R as RESPONSE_CASING_VALUE } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig, T as TOKEN_COOKIE_OPTIONS } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig, t as tokenCookieOptions } from '../../chunks/_shared-DWYblQqx.js';
 import { R as REFRESH_TOKEN_STORAGE_KEY, T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const refresh_post = defineEventHandler(async (event) => {
@@ -14,7 +15,20 @@ const refresh_post = defineEventHandler(async (event) => {
     throw createError({ statusCode: 401, message: "No refresh token" });
   }
   const snake = requestCasing === RESPONSE_CASING_VALUE.SNAKE;
+  const config = useRuntimeConfig(event);
+  const clientSecret = config?.cmsClientSecret ?? "";
   const body = snake ? { grant_type: "refresh_token", refresh_token: refreshToken } : { grantType: "refresh_token", refreshToken };
+  if (clientSecret) {
+    body.client_id = clientId;
+    body.client_secret = clientSecret;
+    if (!snake) {
+      body.grant_type = body.grantType;
+      body.refresh_token = body.refreshToken;
+    } else {
+      body.grantType = body.grant_type;
+      body.refreshToken = body.refresh_token;
+    }
+  }
   const headers = {
     [HTTP_HEADER.CLIENT_ID]: clientId || ""
   };
@@ -31,8 +45,9 @@ const refresh_post = defineEventHandler(async (event) => {
     });
     const token = data.accessToken ?? data.access_token ?? "";
     const newRefresh = data.refreshToken ?? data.refresh_token ?? "";
-    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, TOKEN_COOKIE_OPTIONS);
-    if (newRefresh) setCookie(event, REFRESH_TOKEN_STORAGE_KEY, newRefresh, TOKEN_COOKIE_OPTIONS);
+    if (token) setCookie(event, TOKEN_STORAGE_KEY, token, tokenCookieOptions(event));
+    if (newRefresh)
+      setCookie(event, REFRESH_TOKEN_STORAGE_KEY, newRefresh, tokenCookieOptions(event));
     return { ...data, token };
   } catch (err) {
     throw createError({

package/dist/server/authz/portal-access.get.js

@@ -2,7 +2,7 @@ import { defineEventHandler, createError, parseCookies } from 'h3';
 import { $fetch } from 'ofetch';
 import { a as AUTHZ_ENDPOINT } from '../../chunks/authz.constant-BqX8Nzw6.js';
 import { b as HTTP_HEADER } from '../../chunks/http.constant-BzH5tJTG.js';
-import { r as readSdkConfig } from '../../chunks/_shared-Dyz_Ya9z.js';
+import { r as readSdkConfig } from '../../chunks/_shared-DWYblQqx.js';
 import { T as TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
 
 const portalAccess_get = defineEventHandler(async (event) => {

package/dist/server/oauth/callback.get.js

@@ -0,0 +1,53 @@
+import { $fetch } from 'ofetch';
+import { defineEventHandler, getQuery, createError, setCookie, sendRedirect } from 'h3';
+import { useRuntimeConfig } from '#imports';
+import { c as consumeTransaction, a as clearTransactionCookie, O as OAUTH_GRANT_AUTHORIZATION_CODE, s as safeReturnPath } from '../../chunks/_txn-DmQZNq48.js';
+import { T as TOKEN_STORAGE_KEY, R as REFRESH_TOKEN_STORAGE_KEY } from '../../chunks/storage.constant-CVWam5ls.js';
+import { r as readSdkConfig, t as tokenCookieOptions } from '../../chunks/_shared-DWYblQqx.js';
+
+const callback_get = defineEventHandler(async (event) => {
+  const query = getQuery(event);
+  const code = typeof query.code === "string" ? query.code : "";
+  const state = typeof query.state === "string" ? query.state : "";
+  const oauthError = typeof query.error === "string" ? query.error : "";
+  const fail = async (reason) => {
+    clearTransactionCookie(event);
+    await sendRedirect(event, `/login?auth_error=${encodeURIComponent(reason)}`, 302);
+  };
+  if (oauthError) return await fail(oauthError);
+  if (!code || !state) return await fail("missing_code_or_state");
+  const txn = consumeTransaction(event, state);
+  if (!txn) return await fail("invalid_state");
+  clearTransactionCookie(event);
+  const { cmsUrl, clientId } = readSdkConfig(event);
+  if (!cmsUrl) throw createError({ statusCode: 500, message: "CMS URL not configured" });
+  const secret = useRuntimeConfig(event).cmsClientSecret;
+  if (!secret) throw createError({ statusCode: 500, message: "cmsClientSecret not configured" });
+  let tokenResponse;
+  try {
+    tokenResponse = await $fetch("/api/oauth/token", {
+      baseURL: cmsUrl,
+      method: "POST",
+      body: {
+        grant_type: OAUTH_GRANT_AUTHORIZATION_CODE,
+        code,
+        client_id: clientId,
+        client_secret: secret,
+        redirect_uri: txn.redirectUri,
+        code_verifier: txn.codeVerifier
+      }
+    });
+  } catch {
+    return await fail("token_exchange_failed");
+  }
+  const accessToken = tokenResponse.accessToken ?? tokenResponse.access_token ?? "";
+  const refreshToken = tokenResponse.refreshToken ?? tokenResponse.refresh_token ?? "";
+  if (!accessToken) return await fail("token_exchange_failed");
+  setCookie(event, TOKEN_STORAGE_KEY, accessToken, tokenCookieOptions(event));
+  if (refreshToken) {
+    setCookie(event, REFRESH_TOKEN_STORAGE_KEY, refreshToken, tokenCookieOptions(event));
+  }
+  await sendRedirect(event, safeReturnPath(txn.returnTo), 302);
+});
+
+export { callback_get as default };

package/dist/server/oauth/start.get.js

@@ -0,0 +1,46 @@
+import { defineEventHandler, createError, getQuery, getRequestURL, sendRedirect } from 'h3';
+import { useRuntimeConfig } from '#imports';
+import { s as safeReturnPath, b as createPkce, d as saveTransaction, e as setTransactionCookie, f as OAUTH_PROXY_PATH, g as codeChallenge, P as PKCE_METHOD } from '../../chunks/_txn-DmQZNq48.js';
+import { r as readSdkConfig } from '../../chunks/_shared-DWYblQqx.js';
+
+const start_get = defineEventHandler(async (event) => {
+  const config = useRuntimeConfig(event);
+  const centralAuthUrl = config?.public?.centralAuthUrl ?? "";
+  if (!centralAuthUrl) {
+    throw createError({ statusCode: 500, message: "centralAuthUrl not configured" });
+  }
+  const { clientId } = readSdkConfig(event);
+  if (!clientId) {
+    throw createError({ statusCode: 500, message: "clientId not configured" });
+  }
+  const query = getQuery(event);
+  const returnTo = safeReturnPath(typeof query.redirect === "string" ? query.redirect : void 0);
+  const origin = new URL(getRequestURL(event)).origin;
+  const redirectUri = `${origin}${OAUTH_PROXY_PATH.CALLBACK}`;
+  const pkce = createPkce();
+  const txnId = saveTransaction({
+    state: pkce.state,
+    codeVerifier: pkce.verifier,
+    redirectUri,
+    returnTo,
+    createdAt: Date.now()
+  });
+  setTransactionCookie(event, txnId);
+  const authorize = new URL(centralAuthUrl);
+  authorize.searchParams.set("response_type", "code");
+  authorize.searchParams.set("client_id", clientId);
+  authorize.searchParams.set("redirect_uri", redirectUri);
+  authorize.searchParams.set("scope", readOAuthScope(event));
+  authorize.searchParams.set("state", pkce.state);
+  authorize.searchParams.set("code_challenge", codeChallenge(pkce.verifier));
+  authorize.searchParams.set("code_challenge_method", PKCE_METHOD);
+  authorize.searchParams.set("prompt", "login");
+  return await sendRedirect(event, authorize.toString(), 302);
+});
+function readOAuthScope(event) {
+  const config = useRuntimeConfig(event);
+  const opts = config?.public?.cmsSdkOptions ?? {};
+  return opts.oauthScope || "read";
+}
+
+export { start_get as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eaera-com/cms-sdk",
-  "version": "0.1.101",
+  "version": "0.1.102",
   "description": "EAERA CMS SDK — data access layer for Nuxt 3 apps (ofetch + Pinia + typed services)",
   "type": "module",
   "main": "./dist/index.js",