@innertia-solutions/innertia-nuxt 0.1.65 → 0.1.67

package/build/__tests__/version.test.ts

@@ -0,0 +1,45 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { collectBuildVersion, readPackageVersions } from '../version'
+
+let root: string
+
+function pkg(dir: string, json: Record<string, unknown>) {
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(join(dir, 'package.json'), JSON.stringify(json))
+}
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'innertia-version-'))
+  pkg(root, { name: 'acme-front', version: '1.2.3' })
+  pkg(join(root, 'node_modules', 'nuxt'), { name: 'nuxt', version: '4.4.6' })
+  pkg(join(root, 'node_modules', 'vue'), { name: 'vue', version: '3.5.34' })
+  pkg(join(root, 'node_modules', '@innertia-solutions', 'innertia-nuxt'), { name: '@innertia-solutions/innertia-nuxt', version: '0.1.66' })
+})
+afterEach(() => rmSync(root, { recursive: true, force: true }))
+
+describe('readPackageVersions', () => {
+  it('lee versiones instaladas y omite las ausentes', () => {
+    expect(readPackageVersions(root, ['nuxt', 'vue', '@innertia-solutions/innertia-nuxt', 'no-existe']))
+      .toEqual({ nuxt: '4.4.6', vue: '3.5.34', '@innertia-solutions/innertia-nuxt': '0.1.66' })
+  })
+})
+
+describe('collectBuildVersion', () => {
+  it('usa APP_COMMIT/APP_BUILD_DATE/APP_VERSION del entorno de build', () => {
+    const v = collectBuildVersion(root, {
+      APP_COMMIT: 'abcdef1234567890', APP_BUILD_DATE: '2026-11-04T10:00:00Z', APP_VERSION: '9.9.9',
+    }, { git: false })
+    expect(v).toMatchObject({ app: 'acme-front', version: '9.9.9', commit: 'abcdef1234567890', buildDate: '2026-11-04T10:00:00Z' })
+    expect(v.packages.nuxt).toBe('4.4.6')
+  })
+
+  it('cae al package.json del producto y a la fecha actual', () => {
+    const v = collectBuildVersion(root, {}, { git: false })
+    expect(v.version).toBe('1.2.3')
+    expect(v.commit).toBe('')
+    expect(Number.isNaN(Date.parse(v.buildDate))).toBe(false)
+  })
+})

package/build/version.ts

@@ -0,0 +1,75 @@
+// Build-time (Node): recolecta la info de versión del PRODUCTO al correr `nuxi build`.
+// La usa el módulo inline del nuxt.config de la capa para llenar
+// runtimeConfig.innertiaVersion (PRIVADO: nunca llega al payload del browser).
+import { readFileSync, existsSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { join } from 'node:path'
+
+export const DEFAULT_FRONT_PACKAGES = [
+  'nuxt',
+  'vue',
+  '@innertia-solutions/innertia-nuxt',
+  'pinia',
+  '@pinia/nuxt',
+  '@tanstack/vue-query',
+  'tailwindcss',
+  'pusher-js',
+]
+
+export interface BuildVersion {
+  app: string
+  version: string
+  commit: string
+  buildDate: string
+  packages: Record<string, string>
+}
+
+function readJson(path: string): Record<string, any> | null {
+  try {
+    return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : null
+  } catch {
+    return null
+  }
+}
+
+/** Versiones instaladas (node_modules del producto). Las ausentes se omiten. */
+export function readPackageVersions(rootDir: string, names: string[]): Record<string, string> {
+  const out: Record<string, string> = {}
+  for (const name of names) {
+    const v = readJson(join(rootDir, 'node_modules', name, 'package.json'))?.version
+    if (typeof v === 'string' && v) out[name] = v
+  }
+  return out
+}
+
+function gitCommit(rootDir: string): string {
+  try {
+    return execFileSync('git', ['rev-parse', 'HEAD'], { cwd: rootDir, stdio: ['ignore', 'pipe', 'ignore'], timeout: 2000 })
+      .toString().trim()
+  } catch {
+    return ''
+  }
+}
+
+/**
+ * Prioridad por campo: env de build (APP_COMMIT / APP_BUILD_DATE / APP_VERSION)
+ * → build-info.json en rootDir (lo escribe el Dockerfile) → fallback
+ * (git rev-parse en dev, package.json del producto, fecha actual).
+ */
+export function collectBuildVersion(
+  rootDir: string,
+  env: Record<string, string | undefined> = process.env,
+  opts: { git?: boolean, packages?: string[] } = {},
+): BuildVersion {
+  const product = readJson(join(rootDir, 'package.json')) ?? {}
+  const info = readJson(join(rootDir, 'build-info.json')) ?? {}
+  const str = (v: unknown) => (typeof v === 'string' ? v.trim() : '')
+
+  return {
+    app: str(product.name),
+    version: str(env.APP_VERSION) || str(info.version) || str(product.version),
+    commit: str(env.APP_COMMIT) || str(info.commit) || (opts.git === false ? '' : gitCommit(rootDir)),
+    buildDate: str(env.APP_BUILD_DATE) || str(info.build_date) || new Date().toISOString(),
+    packages: readPackageVersions(rootDir, opts.packages ?? DEFAULT_FRONT_PACKAGES),
+  }
+}

package/components/App/Versions.vue

@@ -0,0 +1,115 @@
+<script setup>
+/**
+ * <AppVersions /> — tarjeta "Versiones" para la consola /platform.
+ * Consume /_version/details (ruta Nitro de la capa), que autoriza contra el backend
+ * (GET platform/version → solo platform admin) y adjunta el detalle del front.
+ *
+ * ```vue
+ * <AppVersions />
+ * <AppVersions endpoint="/_version/details" title="Versiones" />
+ * ```
+ */
+import { IconVersions, IconRefresh } from '@tabler/icons-vue'
+
+const props = defineProps({
+  endpoint: { type: String, default: '/_version/details' },
+  title:    { type: String, default: 'Versiones' },
+})
+
+const { data, error, pending, refresh } = useFetch(props.endpoint, { server: false, key: `innertia-versions:${props.endpoint}` })
+
+function fmtDate(iso) {
+  if (!iso) return '—'
+  const d = new Date(iso)
+  return Number.isNaN(d.getTime()) ? iso : d.toLocaleString()
+}
+
+const sides = computed(() => {
+  if (!data.value) return []
+  const { frontend: f, backend: b } = data.value
+  return [
+    {
+      key: 'frontend',
+      label: 'Frontend',
+      info: f,
+      runtime: [['Node', f?.runtime?.node]],
+      packages: Object.entries(f?.packages ?? {}).map(([name, version]) => ({ name, version })),
+    },
+    {
+      key: 'backend',
+      label: 'Backend',
+      info: b,
+      runtime: [
+        ['PHP', b?.runtime?.php],
+        ['Laravel', b?.runtime?.laravel],
+        [b?.runtime?.database?.driver ? `BD (${b.runtime.database.driver})` : 'BD', b?.runtime?.database?.version],
+      ],
+      packages: Object.entries(b?.packages ?? {}).map(([name, p]) => ({ name, version: p?.version, reference: p?.reference })),
+    },
+  ]
+})
+</script>
+
+<template>
+  <section class="rounded-card border border-card-line bg-card">
+    <header class="flex items-center justify-between gap-3 border-b border-card-line px-4 py-3">
+      <div class="flex items-center gap-2">
+        <IconVersions class="size-5 text-muted-foreground" />
+        <h2 class="text-sm font-semibold text-foreground">{{ title }}</h2>
+      </div>
+      <button
+        type="button"
+        class="inline-flex items-center gap-1 rounded-control px-2 py-1 text-xs text-muted-foreground hover:bg-muted hover:text-foreground disabled:opacity-50"
+        :disabled="pending"
+        @click="refresh()"
+      >
+        <IconRefresh class="size-3.5" :class="{ 'animate-spin': pending }" /> Actualizar
+      </button>
+    </header>
+
+    <div v-if="pending && !data" class="p-4 text-sm text-muted-foreground">Cargando…</div>
+    <div v-else-if="error" class="p-4 text-sm text-red-600 dark:text-red-400">
+      No se pudieron cargar las versiones ({{ error.statusCode ?? 'error' }}).
+    </div>
+
+    <div v-else class="grid divide-y divide-card-line md:grid-cols-2 md:divide-x md:divide-y-0">
+      <div v-for="side in sides" :key="side.key" class="space-y-4 p-4">
+        <div>
+          <p class="text-xs font-medium uppercase tracking-wide text-muted-foreground">{{ side.label }}</p>
+          <p class="mt-1 text-lg font-semibold text-foreground">
+            {{ side.info?.app || '—' }}
+            <span class="text-sm font-normal text-muted-foreground">{{ side.info?.version || '' }}</span>
+          </p>
+        </div>
+
+        <dl class="grid grid-cols-[auto_1fr] gap-x-4 gap-y-1.5 text-sm">
+          <dt class="text-muted-foreground">Commit</dt>
+          <dd class="flex items-center gap-1 font-mono text-foreground">
+            {{ side.info?.commit || '—' }}
+            <CopyButton v-if="side.info?.commit" :value="side.info.commit" size="xs" />
+          </dd>
+          <dt class="text-muted-foreground">Build</dt>
+          <dd class="text-foreground">{{ fmtDate(side.info?.build_date) }}</dd>
+          <dt class="text-muted-foreground">Entorno</dt>
+          <dd class="text-foreground">{{ side.info?.environment || '—' }}</dd>
+          <template v-for="[label, value] in side.runtime" :key="label">
+            <dt class="text-muted-foreground">{{ label }}</dt>
+            <dd class="font-mono text-foreground">{{ value || '—' }}</dd>
+          </template>
+        </dl>
+
+        <div v-if="side.packages.length">
+          <p class="mb-1.5 text-xs font-medium text-muted-foreground">Paquetes</p>
+          <ul class="divide-y divide-card-line rounded-control border border-card-line text-sm">
+            <li v-for="p in side.packages" :key="p.name" class="flex items-center justify-between gap-3 px-3 py-1.5">
+              <span class="truncate text-foreground">{{ p.name }}</span>
+              <span class="shrink-0 font-mono text-xs text-muted-foreground">
+                {{ p.version || '—' }}<template v-if="p.reference && String(p.version).startsWith('dev-')"> · {{ p.reference }}</template>
+              </span>
+            </li>
+          </ul>
+        </div>
+      </div>
+    </div>
+  </section>
+</template>

package/nuxt.config.ts

@@ -1,4 +1,5 @@
 import tailwindcss from '@tailwindcss/vite'
+import { collectBuildVersion } from './build/version'
 
 // @innertia-solutions/innertia-nuxt — capa Nuxt unificada de Innertia Solutions.
 // Provee: utilidades base + auth + multitenancy + design system + app contexts.
@@ -7,6 +8,21 @@ export default defineNuxtConfig({
     '@nuxtjs/seo',
     '@pinia/nuxt',
     'pinia-plugin-persistedstate/nuxt', // requerido para persistir auth, dockedPreviews, etc.
+    // Versiones: en build llena runtimeConfig.innertiaVersion (PRIVADO) con app/version/
+    // commit/fecha del producto + versiones de nuxt/vue/innertia-nuxt de su node_modules.
+    // Lo sirven /_version (público, sin deps) y /_version/details (vía backend platform).
+    (_opts: unknown, nuxt: any) => {
+      const current = nuxt.options.runtimeConfig.innertiaVersion ?? {}
+      const built = collectBuildVersion(nuxt.options.rootDir)
+      nuxt.options.runtimeConfig.innertiaVersion = {
+        ...current,
+        app: current.app || nuxt.options.runtimeConfig.public?.appName || built.app,
+        version: current.version || built.version,
+        commit: current.commit || built.commit,
+        buildDate: current.buildDate || built.buildDate,
+        packages: { ...built.packages, ...(current.packages ?? {}) },
+      }
+    },
   ],
   css: ['@innertia-solutions/innertia-nuxt/theme.css'],
   components: [
@@ -26,6 +42,16 @@ export default defineNuxtConfig({
     session: {
       password: '',
     },
+    // Privado. Lo llena el módulo inline de arriba en build; override runtime con
+    // NUXT_INNERTIA_VERSION_COMMIT / _BUILD_DATE / _VERSION / _DETAILS_PATH.
+    innertiaVersion: {
+      app: '',
+      version: '',
+      commit: '',
+      buildDate: '',
+      packages: {},
+      detailsPath: 'platform/version',
+    },
     public: {
       loginPath: '/backoffice/login',
       homePath: '/backoffice',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@innertia-solutions/innertia-nuxt",
-  "version": "0.1.65",
+  "version": "0.1.67",
   "description": "Innertia Solutions — Nuxt layer unificada: core, auth, multitenancy, theme y app contexts",
   "keywords": [
     "nuxt",

package/server/routes/_auth/[provider]/callback.get.ts

@@ -1,6 +1,7 @@
-import { defineEventHandler, getRouterParam, getQuery, sendRedirect, createError } from 'h3'
+import { defineEventHandler, getRouterParam, getQuery, sendRedirect, createError, getRequestHeader } from 'h3'
 import { writeSession } from '../../../utils/session'
 import { normalizeLoginResponse } from '../../../utils/login'
+import { forwardClientHeaders } from '../../../utils/bff'
 
 // Recibe el callback de OAuth, intercambia contra Laravel, sella la sesión y
 // redirige a la app. El token nunca llega al browser.
@@ -12,7 +13,7 @@ export default defineEventHandler(async (event) => {
   let data: any
   try {
     data = await $fetch(`${config.apiInternalUrl}/auth/${provider}/callback`, {
-      method: 'GET', query, headers: { Accept: 'application/json' },
+      method: 'GET', query, headers: { Accept: 'application/json', ...forwardClientHeaders(n => getRequestHeader(event, n)) },
     })
   } catch (err: any) {
     const msg = err?.data?.message ?? 'oauth_failed'

package/server/routes/_auth/login.post.ts

@@ -1,5 +1,6 @@
-import { defineEventHandler, readBody, createError } from 'h3'
+import { defineEventHandler, readBody, createError, getRequestHeader } from 'h3'
 import { writeSession } from '../../utils/session'
+import { forwardClientHeaders } from '../../utils/bff'
 import { normalizeLoginResponse } from '../../utils/login'
 
 // Llama a Laravel /auth/login server-to-server; en éxito sella el JWT en la
@@ -13,7 +14,7 @@ export default defineEventHandler(async (event) => {
     data = await $fetch(`${config.apiInternalUrl}/auth/login`, {
       method: 'POST',
       body: { context, email, password, remember },
-      headers: { Accept: 'application/json' },
+      headers: { Accept: 'application/json', ...forwardClientHeaders(n => getRequestHeader(event, n)) },
     })
   } catch (err: any) {
     const status = err?.response?.status ?? err?.statusCode ?? 500

package/server/routes/_auth/platform/login.post.ts

@@ -1,5 +1,6 @@
-import { defineEventHandler, readBody, createError } from 'h3'
+import { defineEventHandler, readBody, createError, getRequestHeader } from 'h3'
 import { writeSession } from '../../../utils/session'
+import { forwardClientHeaders } from '../../../utils/bff'
 import { normalizeLoginResponse } from '../../../utils/login'
 
 // Login de plataforma (identidad separada, sin contexto de tenant). Llama a
@@ -15,7 +16,7 @@ export default defineEventHandler(async (event) => {
     data = await $fetch(`${config.apiInternalUrl}/platform/auth/login`, {
       method: 'POST',
       body: { email, password },
-      headers: { Accept: 'application/json' },
+      headers: { Accept: 'application/json', ...forwardClientHeaders(n => getRequestHeader(event, n)) },
     })
   } catch (err: any) {
     const status = err?.response?.status ?? err?.statusCode ?? 500

package/server/routes/_version/details.get.ts

@@ -0,0 +1,39 @@
+import { defineEventHandler, setResponseHeader, setResponseStatus } from 'h3'
+import { readSession } from '../../utils/session'
+import { resolveApiTarget, buildAuthHeaders } from '../../utils/bff'
+import { frontendDetails } from '../../utils/version'
+
+// Detalle (front + back). Nitro no sabe quién es platform admin: delega la
+// autorización al backend llamando su endpoint protegido con el Bearer de la sesión.
+// ≠2xx → mismo status, sin datos del front. 2xx → { frontend, backend }.
+export default defineEventHandler(async (event) => {
+  setResponseHeader(event, 'cache-control', 'no-store')
+  const config = useRuntimeConfig(event)
+  const cfg = config.innertiaVersion ?? {}
+  const { token } = await readSession(event)
+
+  if (!token) {
+    setResponseStatus(event, 401)
+    return { message: 'No autenticado.' }
+  }
+
+  const target = resolveApiTarget(config.apiInternalUrl, cfg.detailsPath || 'platform/version', '')
+  const res = await $fetch.raw(target, {
+    headers: { ...buildAuthHeaders(token), accept: 'application/json' },
+    ignoreResponseError: true,
+  }).catch(() => null)
+
+  if (!res) {
+    setResponseStatus(event, 502)
+    return { message: 'Backend no disponible.' }
+  }
+  if (res.status < 200 || res.status >= 300) {
+    setResponseStatus(event, res.status)
+    return { message: (res._data as any)?.message ?? 'No autorizado.' }
+  }
+
+  return {
+    frontend: frontendDetails(cfg, process.env, process.version),
+    backend: res._data,
+  }
+})

package/server/routes/_version/index.get.ts

@@ -0,0 +1,8 @@
+import { defineEventHandler, setResponseHeader } from 'h3'
+import { publicVersion } from '../../utils/version'
+
+// Público: qué build del front está desplegado. Sin dependencias.
+export default defineEventHandler((event) => {
+  setResponseHeader(event, 'cache-control', 'no-store')
+  return publicVersion(useRuntimeConfig(event).innertiaVersion ?? {}, process.env)
+})

package/server/utils/__tests__/bff.test.ts

@@ -20,3 +20,21 @@ describe('buildAuthHeaders', () => {
     expect(buildAuthHeaders(undefined)).toEqual({ cookie: '' })
   })
 })
+
+describe('forwardClientHeaders', () => {
+  it('reenvía solo IP y user-agent del cliente, omitiendo los ausentes', async () => {
+    const { forwardClientHeaders } = await import('../bff')
+    const headers: Record<string, string> = {
+      'x-forwarded-for': '200.1.2.3, 172.68.0.1',
+      'cf-connecting-ip': '200.1.2.3',
+      'user-agent': 'Mozilla/5.0',
+      cookie: 'innertia_session=secret',
+      authorization: 'Bearer x',
+    }
+    expect(forwardClientHeaders(n => headers[n])).toEqual({
+      'x-forwarded-for': '200.1.2.3, 172.68.0.1',
+      'cf-connecting-ip': '200.1.2.3',
+      'user-agent': 'Mozilla/5.0',
+    })
+  })
+})

package/server/utils/__tests__/version.test.ts

@@ -0,0 +1,31 @@
+import { describe, it, expect } from 'vitest'
+import { publicVersion, frontendDetails } from '../version'
+
+const cfg = {
+  app: 'acme-front', version: '1.2.3', commit: '0123456789abcdef', buildDate: '2026-11-04T10:00:00Z',
+  packages: { nuxt: '4.4.6', vue: '3.5.34' }, detailsPath: 'platform/version',
+}
+
+describe('publicVersion', () => {
+  it('expone solo los 5 campos, commit corto, sin dependencias', () => {
+    const v = publicVersion(cfg, { APP_ENV: 'staging' })
+    expect(Object.keys(v)).toEqual(['app', 'version', 'commit', 'build_date', 'environment'])
+    expect(v).toEqual({ app: 'acme-front', version: '1.2.3', commit: '0123456', build_date: '2026-11-04T10:00:00Z', environment: 'staging' })
+    expect(JSON.stringify(v)).not.toContain('4.4.6')
+  })
+
+  it('commit vacío → null; environment cae a NODE_ENV', () => {
+    const v = publicVersion({ ...cfg, commit: '' }, { NODE_ENV: 'production' })
+    expect(v.commit).toBeNull()
+    expect(v.environment).toBe('production')
+  })
+})
+
+describe('frontendDetails', () => {
+  it('agrega runtime node y paquetes', () => {
+    const d = frontendDetails(cfg, { APP_ENV: 'local' }, 'v22.12.0')
+    expect(d.runtime).toEqual({ node: 'v22.12.0' })
+    expect(d.packages).toEqual({ nuxt: '4.4.6', vue: '3.5.34' })
+    expect(d.commit).toBe('0123456')
+  })
+})

package/server/utils/bff.ts

@@ -18,3 +18,22 @@ export function resolveApiTarget(base: string, path: string, search: string): st
 export function buildAuthHeaders(token?: string): Record<string, string> {
   return token ? { authorization: `Bearer ${token}`, cookie: '' } : { cookie: '' }
 }
+
+/** Headers del cliente que Laravel necesita para conocer su IP real y dispositivo. */
+const CLIENT_HEADERS = ['x-forwarded-for', 'x-real-ip', 'cf-connecting-ip', 'user-agent'] as const
+
+/**
+ * Headers del cliente original a reenviar en las llamadas server-to-server
+ * (login, login de plataforma, callback OAuth, logout). Sin esto Laravel ve a
+ * TODOS los usuarios con la IP del contenedor Nuxt: el throttle de login queda
+ * compartido entre todos (un atacante bloquea el login de todos) y las
+ * sesiones quedan sin IP ni dispositivo. Recibe un getter para no depender de h3.
+ */
+export function forwardClientHeaders(get: (name: string) => string | undefined | null): Record<string, string> {
+  const out: Record<string, string> = {}
+  for (const name of CLIENT_HEADERS) {
+    const value = get(name)
+    if (value) out[name] = value
+  }
+  return out
+}

package/server/utils/version.ts

@@ -0,0 +1,41 @@
+// Lógica pura del endpoint de versiones (sin h3, testeable aislada).
+
+export interface VersionConfig {
+  app?: string
+  version?: string
+  commit?: string
+  buildDate?: string
+  packages?: Record<string, string>
+  detailsPath?: string
+}
+
+export interface PublicVersion {
+  app: string | null
+  version: string | null
+  commit: string | null
+  build_date: string | null
+  environment: string
+}
+
+const orNull = (v?: string) => (v && v.trim() ? v.trim() : null)
+
+/** Público: SOLO estos 5 campos. Nunca dependencias ni runtime (fingerprinting/CVE). */
+export function publicVersion(cfg: VersionConfig, env: Record<string, string | undefined>): PublicVersion {
+  const commit = orNull(cfg.commit)
+  return {
+    app: orNull(cfg.app),
+    version: orNull(cfg.version),
+    commit: commit ? commit.slice(0, 7) : null,
+    build_date: orNull(cfg.buildDate),
+    environment: env.APP_ENV || env.NODE_ENV || 'production',
+  }
+}
+
+/** Detalle del front: público + runtime + paquetes. Solo tras autorizar contra el backend. */
+export function frontendDetails(cfg: VersionConfig, env: Record<string, string | undefined>, node: string) {
+  return {
+    ...publicVersion(cfg, env),
+    runtime: { node },
+    packages: { ...(cfg.packages ?? {}) },
+  }
+}