@habityzer/nuxt-symfony-kinde-layer 2.2.2 → 2.4.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [2.4.0](https://github.com/Habityzer/nuxt-symfony-kinde-layer/compare/v2.3.0...v2.4.0) (2026-03-16)
+
+
+### Features
+
+* Add support from native login ([5c40492](https://github.com/Habityzer/nuxt-symfony-kinde-layer/commit/5c4049205c7376c41d76ba14aeaf0d0362c5937e))
+
+# [2.3.0](https://github.com/Habityzer/nuxt-symfony-kinde-layer/compare/v2.2.2...v2.3.0) (2026-02-21)
+
+
+### Features
+
+* Enhance Kinde authentication middleware configuration ([f04dc26](https://github.com/Habityzer/nuxt-symfony-kinde-layer/commit/f04dc268b1ae0b4bfb096839bbc3673403fc7199))
+
 ## [2.2.2](https://github.com/Habityzer/nuxt-symfony-kinde-layer/compare/v2.2.1...v2.2.2) (2026-02-18)
 
 

package/app/plugins/auth-guard.client.ts

@@ -15,7 +15,9 @@ export default defineNuxtPlugin(() => {
   const idToken = useCookie<string | null>(`${cookiePrefix}${idTokenBaseName}`)
   const accessToken = useCookie<string | null>(`${cookiePrefix}${accessTokenBaseName}`)
   const e2eToken = useCookie<string | null>(`${cookiePrefix}${e2eTokenCookieName}`)
+  const mode = middlewareConfig.mode || 'privateByDefault'
   const publicRoutes: string[] = middlewareConfig.publicRoutes || ['/']
+  const protectedRoutes: string[] = middlewareConfig.protectedRoutes || []
   const loginPath = requireString(middlewareConfig.loginPath, 'kindeAuth.middleware.loginPath')
 
   router.beforeEach((to) => {
@@ -23,9 +25,11 @@ export default defineNuxtPlugin(() => {
       return true
     }
 
-    const isPublicRoute = publicRoutes.some(route => to.path === route || to.path.startsWith(`${route}/`))
-    logClient('route-check', { path: to.path, isPublicRoute })
-    if (isPublicRoute) {
+    const requiresAuth = mode === 'publicByDefault'
+      ? protectedRoutes.some(route => to.path === route || to.path.startsWith(`${route}/`))
+      : !publicRoutes.some(route => to.path === route || to.path.startsWith(`${route}/`))
+    logClient('route-check', { path: to.path, mode, requiresAuth })
+    if (!requiresAuth) {
       return true
     }
 

package/nuxt.config.ts

@@ -50,7 +50,9 @@ export default defineNuxtConfig({
           refreshTokenName: AUTH_REFRESH_TOKEN_NAME
         },
         middleware: {
-          publicRoutes: [], // Default, projects override this
+          mode: 'privateByDefault' as const,
+          publicRoutes: [],
+          protectedRoutes: [],
           loginPath: AUTH_LOGIN_PATH,
           clockSkewSeconds: AUTH_CLOCK_SKEW_SECONDS,
           appTokenPrefix: AUTH_APP_TOKEN_PREFIX,
@@ -78,6 +80,12 @@ export default defineNuxtConfig({
       if (!Array.isArray(runtimeMiddleware.publicRoutes) && Array.isArray(kindeModuleMiddleware.publicRoutes)) {
         runtimeMiddleware.publicRoutes = kindeModuleMiddleware.publicRoutes
       }
+      if (Array.isArray(kindeModuleMiddleware.protectedRoutes)) {
+        runtimeMiddleware.protectedRoutes = kindeModuleMiddleware.protectedRoutes
+      }
+      if (kindeModuleMiddleware.mode === 'publicByDefault' || kindeModuleMiddleware.mode === 'privateByDefault') {
+        runtimeMiddleware.mode = kindeModuleMiddleware.mode
+      }
 
       runtimeKindeAuth.cookie = runtimeCookie
       runtimeKindeAuth.middleware = runtimeMiddleware
@@ -89,7 +97,7 @@ export default defineNuxtConfig({
       assertRequiredString(kindeModuleCookie.prefix, 'kindeAuth.cookie.prefix')
       assertRequiredString(kindeModuleConfig.authDomain, 'kindeAuth.authDomain')
       assertRequiredString(kindeModuleConfig.clientId, 'kindeAuth.clientId')
-      assertRequiredString(kindeModuleConfig.clientSecret, 'kindeAuth.clientSecret')
+      // clientSecret is optional for Frontend/PKCE apps
       assertRequiredString(kindeModuleConfig.redirectURL, 'kindeAuth.redirectURL')
       assertRequiredString(kindeModuleConfig.logoutRedirectURL, 'kindeAuth.logoutRedirectURL')
     }
@@ -124,7 +132,9 @@ export default defineNuxtConfig({
     middleware: {
       enabled: false, // Disabled - using custom middleware from layer
       global: false,
-      publicRoutes: [] // Projects can override
+      mode: 'privateByDefault',
+      publicRoutes: [],
+      protectedRoutes: [] // Projects can override
     },
     debug: {
       enabled: process.env.NODE_ENV !== 'production'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@habityzer/nuxt-symfony-kinde-layer",
-  "version": "2.2.2",
+  "version": "2.4.0",
   "description": "Shared Nuxt layer for Symfony + Kinde authentication integration",
   "type": "module",
   "main": "./nuxt.config.ts",

package/server/middleware/auth-guard.ts

@@ -12,17 +12,21 @@ export default defineEventHandler((event) => {
   const kindeConfig = config.public.kindeAuth || {}
   const middlewareConfig = kindeConfig.middleware || {}
   const cookieConfig = kindeConfig.cookie || {}
+  const mode = middlewareConfig.mode || 'privateByDefault'
   const publicRoutes: string[] = middlewareConfig.publicRoutes || ['/']
+  const protectedRoutes: string[] = middlewareConfig.protectedRoutes || []
   const loginPath = requireString(middlewareConfig.loginPath, 'kindeAuth.middleware.loginPath')
   const appTokenPrefix = requireString(middlewareConfig.appTokenPrefix, 'kindeAuth.middleware.appTokenPrefix')
   const e2eTokenCookieName = requireString(middlewareConfig.e2eTokenCookieName, 'kindeAuth.middleware.e2eTokenCookieName')
   const clockSkewSeconds = requireNonNegativeNumber(middlewareConfig.clockSkewSeconds, 'kindeAuth.middleware.clockSkewSeconds')
   const idTokenBaseName = requireString(cookieConfig.idTokenName, 'kindeAuth.cookie.idTokenName')
   const accessTokenBaseName = requireString(cookieConfig.accessTokenName, 'kindeAuth.cookie.accessTokenName')
-  const isPublicRoute = publicRoutes.some(route => path === route || path.startsWith(`${route}/`))
+  const requiresAuth = mode === 'publicByDefault'
+    ? protectedRoutes.some(route => path === route || path.startsWith(`${route}/`))
+    : !publicRoutes.some(route => path === route || path.startsWith(`${route}/`))
 
-  logServer('route-check', { path, isPublicRoute })
-  if (isPublicRoute) {
+  logServer('route-check', { path, mode, requiresAuth })
+  if (!requiresAuth) {
     return
   }
 

package/types/kinde-auth.d.ts

@@ -13,7 +13,10 @@ declare module '@habityzer/nuxt-kinde-auth' {
     middleware?: {
       enabled?: boolean
       global?: boolean
+      /** 'privateByDefault' = protect all except publicRoutes; 'publicByDefault' = protect only protectedRoutes */
+      mode?: 'privateByDefault' | 'publicByDefault'
       publicRoutes?: string[]
+      protectedRoutes?: string[]
       publicApiRoutes?: string[]
       e2eTokenCookieName?: string
       appTokenPrefix?: string
@@ -37,7 +40,9 @@ export interface KindeAuthRuntimeConfig {
   middleware?: {
     enabled?: boolean
     global?: boolean
+    mode?: 'privateByDefault' | 'publicByDefault'
     publicRoutes?: string[]
+    protectedRoutes?: string[]
     publicApiRoutes?: string[]
     e2eTokenCookieName?: string
     appTokenPrefix?: string