@innertia-solutions/innertia-nuxt 0.1.59 → 0.1.60

package/composables/useApi.js

@@ -42,6 +42,14 @@ export function useApi() {
     }
     run(headers, options)
 
+    // SSR: adjuntar el Bearer desde la sesión sellada del request activo
+    // (el BFF no interviene en llamadas server-side directas a Laravel).
+    if (import.meta.server) {
+      const event = useRequestEvent()
+      const token = event?.context?.authToken
+      if (token) headers['Authorization'] = `Bearer ${token}`
+    }
+
     const cleanPath = path.startsWith('/') ? path.slice(1) : path
     let url = `${baseUrl}/${cleanPath}`
 

package/composables/useAuth.js

@@ -14,9 +14,13 @@ export function useAuth() {
    */
   async function performLogin(context, email, password, remember = false) {
     authStore.rememberUser = remember
-    // Endpoint agnóstico de contexto: el contexto viaja en el payload (y luego en el JWT).
-    const data = await api.post('auth/login', { email, password, context })
-    authStore.saveToken(data.token ?? data.access_token)
+    // Sella la sesión en el server (Nitro). Devuelve user+contexts, SIN token.
+    const data = await $fetch('/_auth/login', {
+      method: 'POST',
+      body: { context, email, password, remember },
+    })
+    authStore.setAuthenticated(true)
+    if (data.user) authStore.saveUser(data.user)
     authStore.setCurrentContext(context)
     queryClient.clear()
     await fetchMe()
@@ -69,13 +73,9 @@ export function useAuth() {
    * Logout: best-effort POST to backend, then clear local state and redirect.
    */
   async function logout() {
-    try {
-      await api.post('auth/logout', {})
-    } catch {
-      // best-effort — ignore network failures
-    }
+    try { await $fetch('/_auth/logout', { method: 'POST' }) } catch { /* best-effort */ }
     queryClient.clear()
-    authStore.logout()
+    authStore.logout() // limpia el state en memoria
     organizationStore.reset()
     // En open, limpiar también el tenant seleccionado
     if (useInnertiaMode().isOpen()) useActiveTenantStore().reset()
@@ -87,10 +87,11 @@ export function useAuth() {
    * Returns the URL string from the backend.
    */
   async function getOauthRedirectUrl(context, provider) {
-    // Endpoint agnóstico: el contexto viaja como query param (el backend lo
-    // codifica en el state de OAuth y lo recupera en el callback).
-    const data = await api.get(`auth/${provider}/redirect`, { params: { context } })
-    return data.url
+    // Laravel arma la URL de Google, pero el redirect_uri debe volver a la ruta
+    // Nitro que sella la sesión: /_auth/{provider}/callback
+    const redirectUri = `${window.location.origin}/_auth/${provider}/callback?context=${context}`
+    const data = await api.get(`auth/${provider}/redirect`, { params: { context, redirect_uri: redirectUri } })
+    return data.url ?? data
   }
 
   return { performLogin, fetchMe, logout, getOauthRedirectUrl }

package/composables/useContext.ts

@@ -63,7 +63,12 @@ export function useContext() {
    * Updates store and reloads permissions via fetchMe.
    */
   async function confirmSwitch(targetContext: string) {
-    authStore.setCurrentContext(targetContext)
+    const context = targetContext
+    authStore.setCurrentContext(context)
+    // Sincronizar el contexto activo en la sesión sellada (para SSR).
+    if (import.meta.client) {
+      try { await $fetch('/_auth/context', { method: 'PUT', body: { context } }) } catch { /* best-effort */ }
+    }
     await fetchMe()
     return { success: true }
   }

package/nuxt.config.ts

@@ -22,6 +22,10 @@ export default defineNuxtConfig({
     ],
   },
   runtimeConfig: {
+    // Privado (solo server). Llenado desde NUXT_SESSION_PASSWORD (≥32 chars).
+    session: {
+      password: '',
+    },
     public: {
       loginPath: '/backoffice/login',
       homePath: '/backoffice',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@innertia-solutions/innertia-nuxt",
-  "version": "0.1.59",
+  "version": "0.1.60",
   "description": "Innertia Solutions — Nuxt layer unificada: core, auth, multitenancy, theme y app contexts",
   "keywords": [
     "nuxt",
@@ -56,11 +56,15 @@
     "vanilla-calendar-pro": "^3.1.0",
     "vue3-apexcharts": "^1.11.1"
   },
+  "scripts": {
+    "test": "vitest run"
+  },
   "devDependencies": {
     "@pinia/nuxt": "^0.11.3",
     "nuxt": "^4.4.2",
     "pinia": "^3.0.4",
     "pinia-plugin-persistedstate": "^4.7.1",
+    "vitest": "^2",
     "vue": "^3.5.0"
   }
 }

package/plugins/api-auth.ts

@@ -1,12 +1,9 @@
-// Registers the Authorization header interceptor into the shared registry.
-// Universal: useCookie reads request cookies in SSR and document.cookie on client.
 export default defineNuxtPlugin(() => {
   const { add } = useRequestInterceptors()
-
   add((headers: Record<string, string>, options: Record<string, unknown>) => {
-    if (options.useToken !== false) {
-      const token = useAuthStore().getToken()
-      if (token) headers['Authorization'] = `Bearer ${token}`
-    }
+    // Authorization lo inyecta el BFF (server) desde la sesión sellada.
+    // Aquí quedan solo headers no-sensibles (p. ej. multitenancy) si aplica.
+    void options
+    void headers
   })
 })

package/plugins/auth-init.ts

@@ -1,34 +1,23 @@
-// Universal plugin: runs on both server (SSR) and client.
-// On SSR: token is read from cookie → fetches user from API → pinia state is serialized
-// into the Nuxt payload and transferred to the client → no hydration mismatch.
-// Avoids useQueryClient() because vue-query.ts runs after this plugin alphabetically.
-// Universal plugin: runs on both server (SSR) and client.
-// On SSR: token is read from cookie → fetches user from API → pinia state is serialized
-// into the Nuxt payload and transferred to the client → no hydration mismatch.
-// Avoids useQueryClient() because vue-query.ts runs after this plugin alphabetically.
+// Universal (server+client). Rehidrata la sesión sin tocar el token (vive en la
+// cookie sellada, solo accesible por el BFF).
 export default defineNuxtPlugin(async () => {
   const authStore = useAuthStore()
-
-  // Use getToken() not authStore.token — pinia-plugin-persistedstate may not have
-  // hydrated the store yet in SSR, but getToken() reads useCookie() directly.
-  if (!authStore.getToken()) return
-
-  if (!authStore.isAuthenticated()) {
-    authStore.logout()
-    return
-  }
-
-  if (!authStore.user) {
-    try {
-      const api = useApi()
-      const data = await api.get('auth/me')
-      if (data) {
-        authStore.saveUser(data.user ?? data)
-        authStore.savePermissions(data.permissions ?? [])
-        authStore.availableContexts = data.availableContexts ?? []
+  const api = useApi()
+  const requestFetch = useRequestFetch()
+  try {
+    const session = await requestFetch('/_auth/session')
+    if (!session?.authenticated) { authStore.setAuthenticated(false); return }
+    authStore.setAuthenticated(true)
+    if (session.currentContext) authStore.currentContext = session.currentContext
+    if (!authStore.user) {
+      const me = await api.get('auth/me')
+      if (me) {
+        authStore.saveUser(me.user ?? me)
+        authStore.savePermissions(me.permissions ?? [])
+        authStore.availableContexts = me.availableContexts ?? me.contexts ?? []
       }
-    } catch {
-      if (import.meta.client) authStore.logout()
     }
+  } catch {
+    authStore.setAuthenticated(false)
   }
 })

package/server/middleware/auth-session.ts

@@ -0,0 +1,13 @@
+import { readSession } from '../utils/session'
+
+// Lee la sesión sellada una vez por request y deja el token en event.context
+// para que useApi (SSR) adjunte el Bearer en llamadas directas a Laravel.
+// Defensivo: si no hay secret/sesión, sigue sin token (no revienta el request).
+export default defineEventHandler(async (event) => {
+  try {
+    const { token } = await readSession(event)
+    if (token) event.context.authToken = token
+  } catch {
+    // sin NUXT_SESSION_PASSWORD o sin sesión válida → seguir sin token
+  }
+})

package/server/routes/_auth/[provider]/callback.get.ts

@@ -0,0 +1,25 @@
+import { defineEventHandler, getRouterParam, getQuery, sendRedirect, createError } from 'h3'
+import { writeSession } from '../../../utils/session'
+import { normalizeLoginResponse } from '../../../utils/login'
+
+// Recibe el callback de OAuth, intercambia contra Laravel, sella la sesión y
+// redirige a la app. El token nunca llega al browser.
+export default defineEventHandler(async (event) => {
+  const provider = getRouterParam(event, 'provider')
+  const query = getQuery(event)
+  const config = useRuntimeConfig(event)
+  const context = (query.context as string) || 'backoffice'
+  let data: any
+  try {
+    data = await $fetch(`${config.apiInternalUrl}/api/auth/${provider}/callback`, {
+      method: 'GET', query, headers: { Accept: 'application/json' },
+    })
+  } catch (err: any) {
+    const msg = err?.data?.message ?? 'oauth_failed'
+    return sendRedirect(event, `${config.public.loginPath}?social_error=${encodeURIComponent(msg)}`)
+  }
+  const { token } = normalizeLoginResponse(data)
+  if (!token) throw createError({ statusCode: 502, statusMessage: 'oauth_no_token' })
+  await writeSession(event, { token, currentContext: context })
+  return sendRedirect(event, config.public.homePath)
+})

package/server/routes/_auth/context.put.ts

@@ -0,0 +1,11 @@
+import { defineEventHandler, readBody, createError } from 'h3'
+import { readSession, writeSession } from '../../utils/session'
+
+// Cambia el contexto activo en la sesión (el modal "¿seguro?" es UX de front).
+export default defineEventHandler(async (event) => {
+  const { context } = await readBody(event)
+  const current = await readSession(event)
+  if (!current.token) throw createError({ statusCode: 401, statusMessage: 'no_session' })
+  await writeSession(event, { ...current, currentContext: context })
+  return { ok: true, currentContext: context }
+})

package/server/routes/_auth/login.post.ts

@@ -0,0 +1,25 @@
+import { defineEventHandler, readBody, createError } from 'h3'
+import { writeSession } from '../../utils/session'
+import { normalizeLoginResponse } from '../../utils/login'
+
+// Llama a Laravel /auth/login server-to-server; en éxito sella el JWT en la
+// sesión y devuelve el body SIN token. Propaga el status de Laravel (403 = el
+// usuario no posee ese contexto → el probing del cliente prueba el siguiente).
+export default defineEventHandler(async (event) => {
+  const { context, email, password, remember } = await readBody(event)
+  const config = useRuntimeConfig(event)
+  let data: any
+  try {
+    data = await $fetch(`${config.apiInternalUrl}/api/auth/login`, {
+      method: 'POST',
+      body: { context, email, password, remember },
+      headers: { Accept: 'application/json' },
+    })
+  } catch (err: any) {
+    const status = err?.response?.status ?? err?.statusCode ?? 500
+    throw createError({ statusCode: status, data: err?.data ?? null, statusMessage: 'login_failed' })
+  }
+  const { token, body } = normalizeLoginResponse(data)
+  await writeSession(event, { token, currentContext: context })
+  return body
+})

package/server/routes/_auth/logout.post.ts

@@ -0,0 +1,18 @@
+import { defineEventHandler } from 'h3'
+import { readSession, clearSession } from '../../utils/session'
+import { buildAuthHeaders } from '../../utils/bff'
+
+// Best-effort: avisa a Laravel con el Bearer de la sesión, luego limpia la sesión.
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig(event)
+  const { token } = await readSession(event)
+  if (token) {
+    try {
+      await $fetch(`${config.apiInternalUrl}/api/auth/logout`, {
+        method: 'POST', headers: { ...buildAuthHeaders(token), Accept: 'application/json' },
+      })
+    } catch { /* best-effort */ }
+  }
+  await clearSession(event)
+  return { ok: true }
+})

package/server/routes/_auth/session.get.ts

@@ -0,0 +1,8 @@
+import { defineEventHandler } from 'h3'
+import { readSession } from '../../utils/session'
+
+// Para SSR/middlewares: ¿hay sesión? ¿cuál es el contexto activo? Sin exponer el token.
+export default defineEventHandler(async (event) => {
+  const { token, currentContext } = await readSession(event)
+  return { authenticated: !!token, currentContext: currentContext ?? null }
+})

package/server/routes/api/[...path].ts

@@ -0,0 +1,15 @@
+import { defineEventHandler, proxyRequest, getRequestURL } from 'h3'
+import { readSession } from '../../utils/session'
+import { resolveApiTarget, buildAuthHeaders } from '../../utils/bff'
+
+// BFF: reenvía /api/** a Laravel inyectando el Bearer desde la sesión sellada.
+// proxyRequest hace passthrough de método/body/headers y STREAMEA la respuesta
+// (crítico para el SSE del asistente). No se reenvía la cookie de sesión.
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig(event)
+  const { token } = await readSession(event)
+  const path = (event.context.params?.path ?? '') as string
+  const search = getRequestURL(event).search
+  const target = resolveApiTarget(config.apiInternalUrl, path, search)
+  return proxyRequest(event, target, { headers: buildAuthHeaders(token) })
+})

package/server/utils/__tests__/bff.test.ts

@@ -0,0 +1,22 @@
+import { describe, it, expect } from 'vitest'
+import { resolveApiTarget, buildAuthHeaders } from '../bff'
+
+describe('resolveApiTarget', () => {
+  it('arma base + /api/ + path + querystring', () => {
+    expect(resolveApiTarget('http://api:80', 'auth/me', '')).toBe('http://api:80/api/auth/me')
+    expect(resolveApiTarget('http://api:80', 'question-bank', '?perPage=1'))
+      .toBe('http://api:80/api/question-bank?perPage=1')
+  })
+  it('normaliza slashes duplicados en la base', () => {
+    expect(resolveApiTarget('http://api:80/', 'auth/me', '')).toBe('http://api:80/api/auth/me')
+  })
+})
+
+describe('buildAuthHeaders', () => {
+  it('con token inyecta Authorization y vacía la cookie', () => {
+    expect(buildAuthHeaders('jwt123')).toEqual({ authorization: 'Bearer jwt123', cookie: '' })
+  })
+  it('sin token solo vacía la cookie (no manda Authorization)', () => {
+    expect(buildAuthHeaders(undefined)).toEqual({ cookie: '' })
+  })
+})

package/server/utils/__tests__/login.test.ts

@@ -0,0 +1,16 @@
+import { describe, it, expect } from 'vitest'
+import { normalizeLoginResponse } from '../login'
+
+describe('normalizeLoginResponse', () => {
+  it('separa el token del resto', () => {
+    const r = normalizeLoginResponse({
+      token: 'jwt', user: { id: '1' }, contexts: ['backoffice'], requires_password_change: false,
+    })
+    expect(r.token).toBe('jwt')
+    expect(r.body).toEqual({ user: { id: '1' }, contexts: ['backoffice'], requires_password_change: false })
+    expect((r.body as any).token).toBeUndefined()
+  })
+  it('acepta access_token como alias', () => {
+    expect(normalizeLoginResponse({ access_token: 'jwt2' }).token).toBe('jwt2')
+  })
+})

package/server/utils/__tests__/session.test.ts

@@ -0,0 +1,17 @@
+import { describe, it, expect } from 'vitest'
+import { sessionOptions, SESSION_COOKIE } from '../session'
+
+describe('sessionOptions', () => {
+  it('sella con el password dado y cookie httpOnly/lax/secure/maxAge', () => {
+    const o = sessionOptions('x'.repeat(32))
+    expect(o.password).toBe('x'.repeat(32))
+    expect(o.name).toBe(SESSION_COOKIE)
+    expect(o.cookie).toMatchObject({ httpOnly: true, sameSite: 'lax', secure: true, path: '/', maxAge: 60 * 60 * 24 * 7 })
+  })
+  it('permite secure:false (dev http)', () => {
+    expect(sessionOptions('x'.repeat(32), { secure: false }).cookie.secure).toBe(false)
+  })
+  it('lanza si el password es muy corto (<32)', () => {
+    expect(() => sessionOptions('corto')).toThrow(/32/)
+  })
+})

package/server/utils/__tests__/smoke.test.ts

@@ -0,0 +1,5 @@
+import { describe, it, expect } from 'vitest'
+
+describe('vitest', () => {
+  it('runs', () => { expect(1 + 1).toBe(2) })
+})

package/server/utils/bff.ts

@@ -0,0 +1,16 @@
+// Lógica pura del BFF. Sin dependencias de h3 para poder testear aislado.
+
+/** Construye la URL destino en Laravel: base + /api/ + path + query. */
+export function resolveApiTarget(base: string, path: string, search: string): string {
+  const cleanBase = base.replace(/\/+$/, '')
+  return `${cleanBase}/api/${path}${search}`
+}
+
+/**
+ * Headers a inyectar al reenviar a Laravel:
+ * - Authorization Bearer si hay token de sesión.
+ * - cookie vacía: NO reenviar la cookie de sesión de Nitro al backend.
+ */
+export function buildAuthHeaders(token?: string): Record<string, string> {
+  return token ? { authorization: `Bearer ${token}`, cookie: '' } : { cookie: '' }
+}

package/server/utils/login.ts

@@ -0,0 +1,21 @@
+export interface LaravelLoginResponse {
+  token?: string
+  access_token?: string
+  user?: unknown
+  contexts?: string[]
+  requires_password_change?: boolean
+  [k: string]: unknown
+}
+
+/** Separa el token (va a la sesión) del body que vuelve al cliente (sin token). */
+export function normalizeLoginResponse(data: LaravelLoginResponse) {
+  const token = data.token ?? data.access_token
+  return {
+    token,
+    body: {
+      user: data.user ?? null,
+      contexts: data.contexts ?? [],
+      requires_password_change: data.requires_password_change ?? false,
+    },
+  }
+}

package/server/utils/session.ts

@@ -0,0 +1,53 @@
+import { useSession } from 'h3'
+import type { H3Event } from 'h3'
+
+export const SESSION_COOKIE = 'innertia_session'
+
+export interface SessionData {
+  token?: string
+  currentContext?: string
+}
+
+/** Opciones de la sesión sellada. Pura y testeable. */
+export function sessionOptions(password: string, opts: { secure?: boolean } = {}) {
+  if (!password || password.length < 32) {
+    throw new Error('[innertia-auth] NUXT_SESSION_PASSWORD debe tener ≥32 caracteres')
+  }
+  return {
+    password,
+    name: SESSION_COOKIE,
+    cookie: {
+      httpOnly: true,
+      sameSite: 'lax' as const,
+      secure: opts.secure ?? true,
+      path: '/',
+      maxAge: 60 * 60 * 24 * 7, // 7 días
+    },
+  }
+}
+
+// Secure cookie en qa/prod (HTTPS); en dev local (http) debe ir sin Secure o el
+// browser la descarta silenciosamente → logout loop.
+function secureCookie(): boolean {
+  return process.env.NODE_ENV !== 'development'
+}
+
+function password(event: H3Event): string {
+  // runtimeConfig.session.password (privado), llenado desde NUXT_SESSION_PASSWORD.
+  return useRuntimeConfig(event).session.password
+}
+
+export async function readSession(event: H3Event): Promise<SessionData> {
+  const s = await useSession<SessionData>(event, sessionOptions(password(event), { secure: secureCookie() }))
+  return s.data
+}
+
+export async function writeSession(event: H3Event, data: SessionData): Promise<void> {
+  const s = await useSession<SessionData>(event, sessionOptions(password(event), { secure: secureCookie() }))
+  await s.update(data)
+}
+
+export async function clearSession(event: H3Event): Promise<void> {
+  const s = await useSession<SessionData>(event, sessionOptions(password(event), { secure: secureCookie() }))
+  await s.clear()
+}

package/stores/auth.js

@@ -18,19 +18,6 @@ function _setCookie(name, value, maxAgeSeconds) {
   }
 }
 
-function _getCookie(name) {
-  try {
-    const cookie = useCookie(name)
-    return cookie.value ?? null
-  } catch {
-    if (import.meta.client) {
-      const match = document.cookie.match(new RegExp('(?:^|; )' + name + '=([^;]*)'))
-      return match ? decodeURIComponent(match[1]) : null
-    }
-    return null
-  }
-}
-
 function _deleteCookie(name) {
   try {
     const cookie = useCookie(name)
@@ -42,20 +29,10 @@ function _deleteCookie(name) {
   }
 }
 
-// ─── JWT decode (no lib) ───────────────────────────────────────────────────
-function _decodeJwtExpiry(token) {
-  try {
-    const payload = JSON.parse(atob(token.split('.')[1]))
-    return payload.exp ?? null
-  } catch {
-    return null
-  }
-}
-
 // ─── store ─────────────────────────────────────────────────────────────────
 export const useAuthStore = defineStore('auth', {
   state: () => ({
-    token: null,
+    authenticated: false,
     user: null,
     currentContext: null,
     availableContexts: [],
@@ -64,13 +41,6 @@ export const useAuthStore = defineStore('auth', {
   }),
 
   persist: [
-    {
-      // Token en cookie con key propio para que SSR lo lea en middlewares (guest/auth).
-      // Key separado para evitar que la segunda config sobreescriba el token.
-      key: 'auth_token',
-      pick: ['token'],
-      storage: piniaPluginPersistedstate.cookies,
-    },
     {
       // currentContext y availableContexts en localStorage.
       // user NO se persiste: auth-init.client.ts lo recarga desde API en cada boot,
@@ -82,22 +52,13 @@ export const useAuthStore = defineStore('auth', {
   ],
 
   actions: {
-    // ── token ──────────────────────────────────────────────────────────────
-    saveToken(token) {
-      this.token = token
-      _setCookie('auth_token', token, 60 * 60 * 24 * 7) // 7 days
-    },
-
-    getToken() {
-      return this.token ?? _getCookie('auth_token')
+    // ── auth flag ──────────────────────────────────────────────────────────
+    // El token ya no vive en el cliente. isAuthenticated se resuelve por /_auth/session.
+    setAuthenticated(value) {
+      this.authenticated = !!value
     },
-
     isAuthenticated() {
-      const token = this.getToken()
-      if (!token) return false
-      const exp = _decodeJwtExpiry(token)
-      if (exp === null) return true // non-JWT or no expiry claim → treat as valid
-      return Date.now() / 1000 < exp
+      return this.authenticated === true
     },
 
     // ── user ───────────────────────────────────────────────────────────────
@@ -118,12 +79,11 @@ export const useAuthStore = defineStore('auth', {
 
     // ── logout ─────────────────────────────────────────────────────────────
     logout() {
-      this.token = null
+      this.authenticated = false
       this.user = null
       this.currentContext = null
       this.availableContexts = []
       this.permissions = []
-      _deleteCookie('auth_token')
       _deleteCookie('auth_user')
     },
   },

package/vitest.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  test: {
+    include: ['**/__tests__/**/*.test.ts', '**/*.test.ts'],
+    environment: 'node',
+  },
+})