@lenne.tech/nuxt-extensions 1.15.0 → 1.16.0

package/CLAUDE.md

@@ -25,8 +25,8 @@ src/
 
 | Composable | Purpose |
 |-----------|---------|
-| `useLtAuth()` | Authentication state, login, logout, session management |
-| `useLtAuthClient()` | Raw Better Auth client access |
+| `useLtAuth()` | Authentication state, login, logout, session management, password change + reset |
+| `useLtAuthClient()` | Raw Better Auth client access (`twoFactor.*`, `admin.*`, `passkey`) |
 | `useSystemSetup()` | First-admin setup flow |
 | `useLtTusUpload()` | TUS resumable file uploads |
 | `useLtFile()` | File utilities (size formatting, URLs) |
@@ -179,6 +179,90 @@ export default defineNuxtRouteMiddleware((to) => {
 });
 ```
 
+## Password Handling: Reset, Change, and Client-Side Hashing
+
+**Every password leaves the browser SHA256-hashed.** `auth-client.ts` wraps each Better-Auth
+method that carries a credential and substitutes that one field with its digest;
+`@lenne.tech/nest-server` hashes the received value again on its side. The two ends agree only
+because both do this — which is why a hand-rolled call is not a style choice but a way to lock
+a user out of their own account.
+
+### Use the composable. Never hand-roll the flow.
+
+`useLtAuth()` exposes the whole set — `changePassword`, `requestPasswordReset`, `resetPassword`
+(since 1.16.0) — alongside `signIn` / `signUp`. Reach for `useLtAuthClient()` only for surfaces
+the composable does not carry (`twoFactor.*`, `admin.*`, `passkey`); that client hashes too.
+
+What went wrong when a project did otherwise: `useLtAuth()` offered `changePassword` but neither
+reset method, so a reset page was built directly against `$fetch`, the client-side hashing was
+forgotten, and the backend stored `scrypt(plaintext)` while sign-in verified
+`scrypt(sha256(plaintext))`. The password the user had just chosen did not work, and nothing in
+either log said why. The gap in this composable is what created that workaround.
+
+```typescript
+const { requestPasswordReset, resetPassword } = useLtAuth();
+
+// Step 1 — send the mail. `redirectTo` MUST be absolute (see below).
+await requestPasswordReset({
+  email,
+  redirectTo: new URL('/auth/reset-password', config.public.siteUrl).toString(),
+});
+
+// Step 2 — on the reset page, with the token from the query string.
+await resetPassword({ newPassword, token });
+```
+
+### `redirectTo` must be absolute, and must never come from user input
+
+Better Auth resolves it against the **API** origin (`new URL(callbackURL, ctx.baseURL)`). A
+relative value therefore lands on the API host, where the route does not exist: 403
+`INVALID_REDIRECT_URL`, no mail sent, nothing visible in the browser. It fails silently.
+
+**It also carries a live single-use reset token.** An attacker-chosen value is account takeover,
+not a phishing redirect — so never build it from `route.query`, a referrer, or a form field.
+The only thing holding it back is the server's `trustedOrigins` allowlist; a project that
+widens that (or sets a wildcard) removes the last barrier. In lt starter projects `appUrl()`
+(from the starter's `app/utils/app-origin.ts`, not from this package) builds one and throws
+rather than returning something relative; elsewhere use `new URL(path, siteUrl).toString()`.
+
+### Password length is enforced by YOUR form — the server cannot do it
+
+better-auth checks `minPasswordLength` against the value it **receives**
+(`api/routes/password.mjs`). Because this library hashes first, that value is always a 64-character
+hex string, so the check passes trivially on every path. nest-server 11.38.0 adds a raw-value
+length check for plaintext clients, and it deliberately skips anything matching `^[a-f0-9]{64}$`
+— i.e. skips us.
+
+This is a consequence of client-side hashing, not a bug in either backend, and there is nothing to
+"fix" server-side. **A minimum length must live in your form schema** (the starters use
+`v.minLength(8)` on register, setup and reset). If someone later removes that rule reasoning that
+"the server validates it", nothing will catch it.
+
+### `admin.*` is passed through UNHASHED — an armed trap, not a live one
+
+`admin.createUser` (`password`) and `admin.setUserPassword` (`newPassword`) are the only
+credential-carrying methods this library does **not** hash.
+
+Today that is harmless: `@lenne.tech/nest-server` does not register better-auth's `admin()`
+plugin and has no option to enable it, so those routes 404. But `auth.enableAdmin` defaults to
+`true`, meaning the admin *client* plugin is registered in every consuming project — the trap is
+armed and waiting for a server that answers.
+
+**Enabling `admin()` server-side is therefore a lock-step change across both repos in one
+release:** the two routes join nest-server's password-normalisation table, and these two methods
+get `ltSha256` wrappers here. Doing only the server half creates accounts whose password nobody
+can ever log in with, with no error anywhere. Hashing here pre-emptively is equally wrong — it
+would build a client expectation the server does not answer.
+
+### If you add a wrapper that hashes something
+
+Add it to both guards. `test/auth-client-hashing.test.ts` asserts the actual request payload;
+`test/auth-client-param-forwarding.test.ts` keeps the source-level half. A hashing wrapper
+replaces ONE field and forwards the rest — `{ ...params, password: hashed }`. Never
+`{ password: hashed }` (drops `revokeOtherSessions`, `redirectTo`, `method`, `issuer` — all
+shipped defects), and never `{ password: hashed, ...params }`, which looks almost identical and
+puts the **plaintext** back on the wire.
+
 ## Form Label Repair
 
 **The defect:** Nuxt UI's `FormField` derives the label's `for` and the control's `id` from one
@@ -257,7 +341,10 @@ fields at `app:beforeMount` and restores them at `app:mounted`, dispatching a sy
 ## Development Rules
 
 1. **ALWAYS read source code** in `dist/runtime/` to understand available composables and components
-2. **Use `useLtAuth()`** for authentication — never implement auth manually
+2. **Use `useLtAuth()`** for authentication — never implement auth manually. This includes the
+   password-reset flow: passwords are SHA256-hashed client-side, and a hand-rolled call that skips
+   that step desynchronises the two credential stores and locks the user out (see "Password
+   Handling" below).
 3. **Check existing composables** before creating new ones — this module may already provide what you need
 4. **Peer dependencies** (`better-auth`, `@better-auth/passkey`, `tus-js-client`) must be installed in the consuming project.
    `better-auth` and `@better-auth/passkey` are pinned to **`>=1.7.1 <1.8.0`** — deliberately not a caret.

package/README.md

@@ -363,6 +363,9 @@ const {
   authenticateWithPasskey,
   registerPasskey,
   twoFactor,
+  changePassword,
+  requestPasswordReset,
+  resetPassword,
 } = useLtAuth();
 
 // Login with email/password
@@ -426,6 +429,50 @@ const { hasRole, hasAnyRole } = useLtAuth();
 </template>
 ```
 
+### Password Change and Reset
+
+All three methods hash the password with SHA256 before it leaves the browser, because
+`@lenne.tech/nest-server` verifies that shape. **Use them rather than calling the endpoints
+yourself** — a hand-rolled reset that skips the hashing stores a credential the login can never
+match, and the user is locked out of the account they just set a password for. That is not
+hypothetical; it is why these two methods were added in 1.16.0.
+
+```vue
+<script setup lang="ts">
+const { changePassword, requestPasswordReset, resetPassword } = useLtAuth();
+const config = useRuntimeConfig();
+
+// Signed-in user changes their own password.
+// `revokeOtherSessions` ends every OTHER session — set it after a suspected compromise.
+await changePassword({ currentPassword, newPassword, revokeOtherSessions: true });
+
+// Step 1: send the reset mail.
+await requestPasswordReset({
+  email,
+  redirectTo: new URL('/auth/reset-password', config.public.siteUrl).toString(),
+});
+
+// Step 2: on the reset page, with the token from the query string.
+await resetPassword({ newPassword, token: route.query.token as string });
+</script>
+```
+
+**`redirectTo` must be an absolute URL.** Better Auth resolves it against the **API** origin, so
+a relative value lands on the API host where the route does not exist — a 403
+`INVALID_REDIRECT_URL`, no mail sent, and nothing visible in the browser. In an lt starter
+project the auto-imported `appUrl()` helper builds one and throws rather than returning something
+relative; that helper lives in the starter (`app/utils/app-origin.ts`), not in this package, so
+outside a starter use `new URL(path, siteUrl).toString()` as above.
+
+**Never build `redirectTo` from user input** (`route.query`, a referrer, a form field). The link
+carries a live single-use reset token, so an attacker-chosen destination is account takeover
+rather than a phishing redirect. The server's `trustedOrigins` allowlist is what stops it.
+
+**Enforce a minimum password length in your own form.** better-auth checks `minPasswordLength`
+against the value it receives, and because this library hashes first, that value is always a
+64-character hex string — the check passes on every path. The form is the only place the rule can
+live.
+
 ### Custom Better Auth Plugins
 
 You can extend the auth client with additional [Better Auth plugins](https://www.better-auth.com/docs/plugins):
@@ -655,8 +702,8 @@ The package works **with or without** `@nuxtjs/i18n`:
 
 | Composable | Description |
 |------------|-------------|
-| `useLtAuth()` | Better-Auth integration with session, passkey, 2FA |
-| `useLtAuthClient()` | Direct access to the Better-Auth client singleton |
+| `useLtAuth()` | Better-Auth integration with session, passkey, 2FA, password change + reset |
+| `useLtAuthClient()` | Direct access to the Better-Auth client singleton (`twoFactor.*`, `admin.*`, `passkey`) |
 | `useLtErrorTranslation()` | Translate backend error codes to user-friendly messages |
 | `useLtTusUpload()` | TUS protocol file uploads with pause/resume |
 | `useLtFile()` | File utilities (size formatting, URLs) |

package/dist/module.d.mts

@@ -3,7 +3,7 @@ import { LtExtensionsModuleOptions } from '../dist/runtime/types/index.js';
 export * from '../dist/runtime/types/index.js';
 
 declare const name = "@lenne.tech/nuxt-extensions";
-declare const version = "1.15.0";
+declare const version = "1.16.0";
 declare const configKey = "ltExtensions";
 declare const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 declare const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "configKey": "ltExtensions",
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -2,7 +2,7 @@ import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComp
 import { pathToFileURL } from 'node:url';
 
 const name = "@lenne.tech/nuxt-extensions";
-const version = "1.15.0";
+const version = "1.16.0";
 const configKey = "ltExtensions";
 const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/runtime/composables/auth/use-lt-auth.js

@@ -201,7 +201,6 @@ export function useLtAuth() {
   }
   const signIn = {
     ...authClient.signIn,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     email: async (params, options) => {
       isLoading.value = true;
       try {
@@ -227,7 +226,6 @@ export function useLtAuth() {
   };
   const signUp = {
     ...authClient.signUp,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     email: async (params, options) => {
       isLoading.value = true;
       try {
@@ -382,7 +380,6 @@ export function useLtAuth() {
           timeout: options.timeout,
           attestation: options.attestation,
           authenticatorSelection: options.authenticatorSelection,
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
           excludeCredentials: (options.excludeCredentials || []).map((cred) => ({
             ...cred,
             id: ltBase64UrlToUint8Array(cred.id).buffer
@@ -479,6 +476,21 @@ export function useLtAuth() {
     changePassword: authClient.changePassword,
     clearUser,
     registerPasskey,
+    // The reset pair, exposed so no project has to reach for `useLtAuthClient()` or hand-roll
+    // the flow — the one that did forgot the client-side hashing and desynchronised the two
+    // credential stores. The full contract, including why `redirectTo` must be absolute and
+    // must never come from user input, lives on `UseLtAuthReturn` in `runtime/types/auth.ts`:
+    // that is the surface consumers read, and one copy cannot drift from itself.
+    //
+    // `params` is forwarded WHOLE and stays fully type-checked. Only `options` is cast, and
+    // only because `UseLtAuthReturn` declares it `unknown` while Better-Auth wants its own
+    // `ClientFetchOption`. Casting the METHOD instead — which is what this used to do — would
+    // throw away the checking on `params` as collateral, on the one argument that carries a
+    // credential. The `Parameters<>` here reads the client's option type INSIDE the
+    // implementation; it never reaches the published declarations, so it does not recreate
+    // the better-auth coupling that 1.15.1 had to revert.
+    requestPasswordReset: (params, options) => authClient.requestPasswordReset(params, options),
+    resetPassword: (params, options) => authClient.resetPassword(params, options),
     setUser,
     signIn,
     signOut,

package/dist/runtime/lib/auth-client.d.ts

@@ -6,6 +6,34 @@
  *
  * SECURITY: Passwords are hashed with SHA256 client-side to prevent
  * plain text password transmission over the network.
+ *
+ * ---
+ *
+ * A HASHING WRAPPER REPLACES ONE FIELD — IT IS NEVER A WHITELIST.
+ *
+ * This is the invariant every wrapper below shares, and it has been broken twice, so it
+ * lives here rather than beside one method that a refactor could delete.
+ *
+ * Each wrapper exists to substitute ONE field with its SHA256 digest. It must forward
+ * everything else the caller passed, untouched:
+ *
+ *     { ...params, password: hashedPassword }   // correct
+ *     { password: hashedPassword }              // WRONG — drops every other option
+ *     { password: hashedPassword, ...params }   // WRONG — puts the PLAINTEXT back
+ *
+ * The first mistake is silent data loss: `changePassword` dropped `revokeOtherSessions`,
+ * so callers who set it after a suspected compromise got a successful password change and
+ * every other session left open. `twoFactor.enable` dropped `method` and `issuer`, so
+ * `method: 'otp'` quietly enabled TOTP instead.
+ *
+ * The second is worse and looks almost identical: `params` still carries the raw value, so
+ * a trailing spread overwrites the digest and the plaintext password goes on the wire.
+ * Trailing-spread is the more common JS idiom, which is exactly why this warning is here.
+ *
+ * Both are pinned by tests: `test/auth-client-hashing.test.ts` asserts the real request
+ * payload (it catches both mistakes), `test/auth-client-param-forwarding.test.ts` keeps the
+ * source-level half so a whitelist rebuild is visible in review. If you add a wrapper that
+ * hashes something, add it to both.
  */
 import type { LtAuthClientConfig } from '../types/index.js';
 /**
@@ -184,8 +212,28 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             }>;
         }>;
     };
-    passkey: Record<string, unknown> | undefined;
-    admin: Record<string, unknown> | undefined;
+    passkey: any;
+    /**
+     * Better-Auth admin plugin, passed through UNWRAPPED — and therefore UNHASHED.
+     *
+     * `admin.createUser` (`password`) and `admin.setUserPassword` (`newPassword`) carry
+     * credentials that every other method in this file hashes. These two do not.
+     *
+     * Why that is deliberate rather than an oversight: `@lenne.tech/nest-server` does not
+     * register better-auth's `admin()` plugin and offers no option to — the two routes do
+     * not exist server-side, so a call 404s today. Hashing here would build a client
+     * expectation the server does not answer, and if the plugin were later enabled without
+     * normalising those routes, this wrapper would CREATE the credential-store desync it
+     * was meant to prevent.
+     *
+     * What that costs, stated plainly: `auth.enableAdmin` defaults to `true`, so the admin
+     * CLIENT plugin is registered in every consuming project. The trap is armed and waiting
+     * for a server that answers. Enabling `admin()` server-side is therefore a LOCKSTEP
+     * change — the routes join nest-server's password-normalisation table and these two
+     * methods get `ltSha256` wrappers here, in one release. Half of it produces accounts
+     * whose password nobody can log in with, and nothing warns.
+     */
+    admin: any;
     $Infer: {
         Session: {
             user: import("better-auth").StripEmptyObjects<{
@@ -297,12 +345,44 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
     /**
-     * Change password for an authenticated user (both passwords are hashed)
+     * Change password for an authenticated user (both passwords are hashed).
+     *
+     * `revokeOtherSessions` is the option that made the whitelist bug matter — see the
+     * file header.
      */
-    changePassword: (params: {
+    changePassword: <T extends {
         currentPassword: string;
         newPassword: string;
-    }, options?: unknown) => Promise<{
+    }>(params: T, options?: any) => Promise<(Omit<{
+        token: string | null;
+        user: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        } & Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        };
+    }, "user"> & {
+        user: import("better-auth").StripEmptyObjects<{
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        }>;
+    }) | {
         data: Omit<{
             token: string | null;
             user: {
@@ -344,12 +424,17 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         };
     }>;
     /**
-     * Reset password with token (new password is hashed before sending)
+     * Reset password with token (new password is hashed before sending).
+     *
+     * Spread first, then overwrite the one field this wrapper exists for — see the file
+     * header for why the order is not a style question.
      */
-    resetPassword: (params: {
+    resetPassword: <T extends {
         newPassword: string;
         token: string;
-    }, options?: unknown) => Promise<{
+    }>(params: T, options?: any) => Promise<{
+        status: boolean;
+    } | {
         data: {
             status: boolean;
         };
@@ -367,11 +452,34 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         /**
          * Sign in with email and password (password is hashed before sending)
          */
-        email: (params: {
+        email: <T extends {
             email: string;
             password: string;
             rememberMe?: boolean;
-        }, options?: unknown) => Promise<{
+        }>(params: T, options?: any) => Promise<(Omit<{
+            redirect: boolean;
+            token: string;
+            url?: string | undefined;
+            user: {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined | undefined;
+            };
+        }, "user"> & {
+            user: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            }>;
+        }) | {
             data: Omit<{
                 redirect: boolean;
                 token: string;
@@ -410,7 +518,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
          * Sign in with passkey (pass through to base client - provided by passkeyClient plugin)
          * @see https://www.better-auth.com/docs/plugins/passkey
          */
-        passkey: ((...args: unknown[]) => Promise<unknown>) | undefined;
+        passkey: any;
         social: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<{
             provider: (string & {}) | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
             callbackURL?: string | undefined;
@@ -519,11 +627,53 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         /**
          * Sign up with email and password (password is hashed before sending)
          */
-        email: (params: {
+        email: <T extends {
             email: string;
             name: string;
             password: string;
-        } & Record<string, unknown>, options?: unknown) => Promise<{
+        }>(params: T, options?: any) => Promise<(Omit<{
+            token: null;
+            user: {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined | undefined;
+            };
+        }, "user"> & {
+            user: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            }>;
+        }) | (Omit<{
+            token: string;
+            user: {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined | undefined;
+            };
+        }, "user"> & {
+            user: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            }>;
+        }) | {
             data: (Omit<{
                 token: null;
                 user: {
@@ -578,34 +728,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             };
         }>;
     };
-    twoFactor: {
-        /**
-         * Disable 2FA (password is hashed before sending)
-         */
-        disable: (params: {
-            password: string;
-        }, options?: unknown) => Promise<unknown>;
-        /**
-         * Enable 2FA (password is hashed before sending)
-         */
-        enable: (params: {
-            password: string;
-        }, options?: unknown) => Promise<unknown>;
-        /**
-         * Generate backup codes (password is hashed before sending)
-         */
-        generateBackupCodes: (params: {
-            password: string;
-        }, options?: unknown) => Promise<unknown>;
-        /**
-         * Verify TOTP code (pass through to base client)
-         */
-        verifyTotp: ((...args: unknown[]) => Promise<unknown>) | undefined;
-        /**
-         * Verify backup code (pass through to base client)
-         */
-        verifyBackupCode: ((...args: unknown[]) => Promise<unknown>) | undefined;
-    };
+    twoFactor: any;
     verifyEmail: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<{
         token: string;
         callbackURL?: string | undefined;

package/dist/runtime/lib/auth-client.js

@@ -78,32 +78,65 @@ export function createLtAuthClient(config = {}) {
     },
     plugins
   });
-  const withPlugins = baseClient;
-  const signInWithPlugins = baseClient.signIn;
   return {
     // Spread all base client properties and methods
     ...baseClient,
     // Explicitly pass through methods not captured by spread operator
     useSession: baseClient.useSession,
-    passkey: withPlugins.passkey,
-    admin: withPlugins.admin,
+    passkey: baseClient.passkey,
+    /**
+     * Better-Auth admin plugin, passed through UNWRAPPED — and therefore UNHASHED.
+     *
+     * `admin.createUser` (`password`) and `admin.setUserPassword` (`newPassword`) carry
+     * credentials that every other method in this file hashes. These two do not.
+     *
+     * Why that is deliberate rather than an oversight: `@lenne.tech/nest-server` does not
+     * register better-auth's `admin()` plugin and offers no option to — the two routes do
+     * not exist server-side, so a call 404s today. Hashing here would build a client
+     * expectation the server does not answer, and if the plugin were later enabled without
+     * normalising those routes, this wrapper would CREATE the credential-store desync it
+     * was meant to prevent.
+     *
+     * What that costs, stated plainly: `auth.enableAdmin` defaults to `true`, so the admin
+     * CLIENT plugin is registered in every consuming project. The trap is armed and waiting
+     * for a server that answers. Enabling `admin()` server-side is therefore a LOCKSTEP
+     * change — the routes join nest-server's password-normalisation table and these two
+     * methods get `ltSha256` wrappers here, in one release. Half of it produces accounts
+     * whose password nobody can log in with, and nothing warns.
+     */
+    admin: baseClient.admin,
     $Infer: baseClient.$Infer,
     $fetch: baseClient.$fetch,
     $store: baseClient.$store,
+    // Deliberately a bare passthrough: it takes an email address, never a password, so
+    // there is nothing to hash — and passing it through untouched is what keeps
+    // `redirectTo` intact (see the note above `resetPassword`).
     requestPasswordReset: baseClient.requestPasswordReset,
     /**
-     * Change password for an authenticated user (both passwords are hashed)
+     * Change password for an authenticated user (both passwords are hashed).
+     *
+     * `revokeOtherSessions` is the option that made the whitelist bug matter — see the
+     * file header.
      */
     changePassword: async (params, options) => {
       const [hashedCurrent, hashedNew] = await Promise.all([ltSha256(params.currentPassword), ltSha256(params.newPassword)]);
-      return baseClient.changePassword?.({ currentPassword: hashedCurrent, newPassword: hashedNew }, options);
+      if (!baseClient.changePassword) {
+        throw new Error("[lt-auth] changePassword is unavailable on the Better-Auth client \u2014 the password was NOT changed.");
+      }
+      return baseClient.changePassword({ ...params, currentPassword: hashedCurrent, newPassword: hashedNew }, options);
     },
     /**
-     * Reset password with token (new password is hashed before sending)
+     * Reset password with token (new password is hashed before sending).
+     *
+     * Spread first, then overwrite the one field this wrapper exists for — see the file
+     * header for why the order is not a style question.
      */
     resetPassword: async (params, options) => {
       const hashedPassword = await ltSha256(params.newPassword);
-      return baseClient.resetPassword?.({ newPassword: hashedPassword, token: params.token }, options);
+      if (!baseClient.resetPassword) {
+        throw new Error("[lt-auth] resetPassword is unavailable on the Better-Auth client \u2014 the password was NOT changed.");
+      }
+      return baseClient.resetPassword({ ...params, newPassword: hashedPassword }, options);
     },
     // Override signIn to hash password (keep passkey method from plugin)
     signIn: {
@@ -119,7 +152,7 @@ export function createLtAuthClient(config = {}) {
        * Sign in with passkey (pass through to base client - provided by passkeyClient plugin)
        * @see https://www.better-auth.com/docs/plugins/passkey
        */
-      passkey: signInWithPlugins.passkey
+      passkey: baseClient.signIn.passkey
     },
     // Explicitly pass through signOut (not captured by spread operator)
     signOut: baseClient.signOut,
@@ -136,36 +169,36 @@ export function createLtAuthClient(config = {}) {
     },
     // Override twoFactor to hash passwords (provided by twoFactorClient plugin)
     twoFactor: {
-      ...withPlugins.twoFactor,
+      ...baseClient.twoFactor,
       /**
        * Disable 2FA (password is hashed before sending)
        */
       disable: async (params, options) => {
         const hashedPassword = await ltSha256(params.password);
-        return withPlugins.twoFactor?.disable({ password: hashedPassword }, options);
+        return baseClient.twoFactor.disable({ ...params, password: hashedPassword }, options);
       },
       /**
        * Enable 2FA (password is hashed before sending)
        */
       enable: async (params, options) => {
         const hashedPassword = await ltSha256(params.password);
-        return withPlugins.twoFactor?.enable({ password: hashedPassword }, options);
+        return baseClient.twoFactor.enable({ ...params, password: hashedPassword }, options);
       },
       /**
        * Generate backup codes (password is hashed before sending)
        */
       generateBackupCodes: async (params, options) => {
         const hashedPassword = await ltSha256(params.password);
-        return withPlugins.twoFactor?.generateBackupCodes({ password: hashedPassword }, options);
+        return baseClient.twoFactor.generateBackupCodes({ ...params, password: hashedPassword }, options);
       },
       /**
        * Verify TOTP code (pass through to base client)
        */
-      verifyTotp: withPlugins.twoFactor?.verifyTotp,
+      verifyTotp: baseClient.twoFactor.verifyTotp,
       /**
        * Verify backup code (pass through to base client)
        */
-      verifyBackupCode: withPlugins.twoFactor?.verifyBackupCode
+      verifyBackupCode: baseClient.twoFactor.verifyBackupCode
     }
   };
 }

package/dist/runtime/plugins/auth-interceptor.client.js

@@ -133,7 +133,6 @@ export default (nuxtApp) => {
     globalThis.$fetch = ((url, options) => {
       return originalFetch(url, {
         ...options,
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         onResponseError: (context) => {
           if (options?.onResponseError) {
             options.onResponseError(context);

package/dist/runtime/types/auth.d.ts

@@ -102,6 +102,31 @@ export interface LtPasskeyRegisterResult {
 /**
  * Return type for useLtAuth composable
  */
+/**
+ * Accepts any caller-supplied shape while refusing a stray plaintext credential field.
+ *
+ * WHY A GENERIC AND NOT `& Record<string, unknown>`
+ *
+ * TypeScript gives a `type` alias an implicit index signature and an `interface` deliberately none
+ * (declaration merging could add anything later). So an intersection with `Record<string, unknown>`
+ * REJECTS an interface-typed variable — and `app/interfaces/*.interface.ts` plus `Ref<Form>.value`
+ * are the dominant shapes in this stack. That is how 1.15.0 broke consuming projects; the same
+ * mistake in a different costume is not worth repeating.
+ *
+ * A generic parameter carries every shape and keeps the excess-property check, which matters:
+ * widening these signatures to forward caller options also removed the compiler's objection to
+ * `changePassword({ …, password: plaintext })` — a plaintext credential that would land in the
+ * request body and from there in proxy logs, APM body capture and error reporters. Naming the
+ * foreign credential keys `never` puts that objection back without closing the passthrough.
+ *
+ * @typeParam T - whatever the caller actually passes
+ * @typeParam Own - the credential keys this method legitimately carries
+ */
+type NoStrayCredential<T, Own extends string> = Omit<{
+    currentPassword?: never;
+    newPassword?: never;
+    password?: never;
+}, Own> & T;
 export interface UseLtAuthReturn {
     authMode: ComputedRef<LtAuthMode>;
     isAuthenticated: ComputedRef<boolean>;
@@ -157,33 +182,95 @@ export interface UseLtAuthReturn {
     features: ComputedRef<Record<string, boolean | number | string[]>>;
     fetchFeatures: () => Promise<Record<string, boolean | number | string[]>>;
     authenticateWithPasskey: () => Promise<LtPasskeyAuthResult>;
-    changePassword: (params: {
+    /**
+     * Change the password of the signed-in user. Both passwords are hashed client-side.
+     *
+     * Pass `revokeOtherSessions: true` after a suspected compromise — Better Auth reads it on the
+     * `update-user` route and ends every other session. Until 1.16.0 the wrapper silently dropped
+     * it, so a caller believed foreign sessions were ended when they were not.
+     */
+    changePassword: <T extends {
         currentPassword: string;
         newPassword: string;
-    }, options?: unknown) => Promise<unknown>;
+    }>(params: NoStrayCredential<T, 'currentPassword' | 'newPassword'>, options?: unknown) => Promise<unknown>;
     clearUser: () => void;
     fetchWithAuth: (url: string, options?: RequestInit) => Promise<Response>;
     refreshJwtToken: () => Promise<boolean>;
     registerPasskey: (name?: string) => Promise<LtPasskeyRegisterResult>;
+    /**
+     * Ask for a password-reset mail.
+     *
+     * `redirectTo` MUST be an absolute app URL — Better Auth resolves it against the API
+     * origin, so a relative value lands on the API host, the route does not exist, and the
+     * answer is a 403 with no mail sent. In an lt starter project `appUrl()` builds one; elsewhere
+     * construct it yourself, e.g. `new URL('/auth/reset-password', config.public.siteUrl).toString()`.
+     *
+     * **SECURITY: never build `redirectTo` from `route.query`, a referrer, or a form field.** The
+     * reset redirect carries a live single-use token, so an attacker-controlled value is account
+     * takeover rather than phishing. What holds it back is `trustedOrigins` rejecting foreign
+     * origins — a project that widens that removes the last barrier.
+     *
+     * From `@lenne.tech/nest-server` 11.38.0 the reset mail links straight to the app, so
+     * `redirectTo` is no longer consulted on the default path. It stays load-bearing where a project
+     * sets `betterAuth.emailVerification.passwordResetLink: false` to keep Better Auth's own link.
+     *
+     * Generic rather than a closed shape: this is a passthrough, and a closed shape would push
+     * callers back to the raw client for any option the library has not enumerated yet — which is
+     * how hand-rolled reset flows start.
+     *
+     * @example
+     * const { requestPasswordReset } = useLtAuth();
+     * await requestPasswordReset({
+     *   email,
+     *   redirectTo: new URL('/auth/reset-password', config.public.siteUrl).toString(),
+     * });
+     * @see {@link UseLtAuthReturn.resetPassword} — step two, with the token from the query string.
+     */
+    requestPasswordReset: <T extends {
+        email: string;
+    }>(params: NoStrayCredential<T, never>, options?: unknown) => Promise<unknown>;
+    /**
+     * Set a new password from a reset token. The password is hashed client-side.
+     *
+     * **The minimum-length rule has to live in your form.** Better Auth checks `minPasswordLength`
+     * against the value it RECEIVES, and this client hashes first — so the server sees 64 characters
+     * whatever the user typed, on every version. That is a consequence of client-side hashing, not
+     * of any particular server release. The lt starter's `reset-password.vue`, `register.vue` and
+     * `setup.vue` declare `v.minLength(8)`; a project using this package without those forms has to
+     * add it.
+     *
+     * Takes `{ newPassword, token }` and nothing else — better-auth's `/reset-password` body schema
+     * carries no `redirectTo`, so the absolute-URL trap applies one step earlier, on
+     * {@link UseLtAuthReturn.requestPasswordReset}.
+     *
+     * @example
+     * const { resetPassword } = useLtAuth();
+     * await resetPassword({ newPassword, token: route.query.token as string });
+     */
+    resetPassword: <T extends {
+        newPassword: string;
+        token: string;
+    }>(params: NoStrayCredential<T, 'newPassword'>, options?: unknown) => Promise<unknown>;
     setUser: (userData: LtUser | null, mode?: LtAuthMode) => void;
     signIn: {
-        email: (params: {
+        email: <T extends {
             email: string;
             password: string;
             rememberMe?: boolean;
-        }, options?: unknown) => Promise<unknown>;
+        }>(params: NoStrayCredential<T, 'password'>, options?: unknown) => Promise<unknown>;
         passkey?: (options?: unknown) => Promise<unknown>;
     };
     signOut: (options?: unknown) => Promise<unknown>;
     signUp: {
-        email: (params: {
+        email: <T extends {
             email: string;
             name: string;
             password: string;
-        } & Record<string, unknown>, options?: unknown) => Promise<unknown>;
+        }>(params: NoStrayCredential<T, 'password'>, options?: unknown) => Promise<unknown>;
     };
     switchToJwtMode: () => Promise<boolean>;
     validateSession: () => Promise<boolean>;
     passkey?: unknown;
     twoFactor?: unknown;
 }
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",