@lenne.tech/nuxt-extensions 1.15.1 → 1.17.0

package/dist/runtime/lib/auth-client.js

@@ -79,33 +79,95 @@ export function createLtAuthClient(config = {}) {
     plugins
   });
   return {
-    // Spread all base client properties and methods
-    ...baseClient,
-    // Explicitly pass through methods not captured by spread operator
     useSession: baseClient.useSession,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     passkey: baseClient.passkey,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    /**
+     * Better-Auth admin plugin, passed through UNWRAPPED — and therefore UNHASHED.
+     *
+     * `admin.createUser` (`password`) and `admin.setUserPassword` (`newPassword`) carry
+     * credentials that every other method in this file hashes. These two do not.
+     *
+     * Why that is deliberate rather than an oversight: `@lenne.tech/nest-server` does not
+     * register better-auth's `admin()` plugin and offers no option to — the two routes do
+     * not exist server-side, so a call 404s today. Hashing here would build a client
+     * expectation the server does not answer, and if the plugin were later enabled without
+     * normalising those routes, this wrapper would CREATE the credential-store desync it
+     * was meant to prevent.
+     *
+     * What that costs, stated plainly: `auth.enableAdmin` defaults to `true`, so the admin
+     * CLIENT plugin is registered in every consuming project. The trap is armed and waiting
+     * for a server that answers. Enabling `admin()` server-side is therefore a LOCKSTEP
+     * change — the routes join nest-server's password-normalisation table and these two
+     * methods get `ltSha256` wrappers here, in one release. Half of it produces accounts
+     * whose password nobody can log in with, and nothing warns.
+     */
     admin: baseClient.admin,
     $Infer: baseClient.$Infer,
     $fetch: baseClient.$fetch,
     $store: baseClient.$store,
+    /**
+     * Read the current session (`GET /get-session`).
+     *
+     * Carries no credential, so it is a bare passthrough.
+     */
+    getSession: baseClient.getSession,
+    /**
+     * Send (or re-send) an email-verification mail (`POST /send-verification-email`).
+     *
+     * A BARE passthrough, and it must stay one. `callbackURL` is the value Better Auth
+     * puts into the mail, and it MUST reach the server exactly as the caller wrote it:
+     * Better Auth resolves a relative value against the API origin, so `/auth/verify-email`
+     * lands on `api.<host>/auth/verify-email`, where the route does not exist. The mail
+     * still goes out, and the user follows a link to a 404 — the same silent failure
+     * `redirectTo` produces on the reset path.
+     *
+     * So do not normalise it here, do not supply a default, and do not resolve it against
+     * the client's `baseURL`. A library that quietly repairs the value hides the mistake
+     * until the next caller makes it somewhere we cannot see. Fixing it belongs to the
+     * caller (the lt starters use `appUrl()`, which throws rather than return something
+     * relative).
+     */
+    sendVerificationEmail: baseClient.sendVerificationEmail,
+    /**
+     * Verify an email address from a token (`POST /verify-email`).
+     *
+     * Carries no credential, so it is a bare passthrough. Note what the endpoint does with
+     * the query, because it decides the shape of the answer: WITH a `callbackURL` it
+     * answers `302` to that URL (carrying neither token nor status), WITHOUT one it answers
+     * `{ status: true }` as JSON. Callers that want the result rather than a redirect must
+     * therefore omit `callbackURL` here — which is not the same parameter as the one
+     * `sendVerificationEmail` puts into the mail, and confusing the two is easy.
+     */
+    verifyEmail: baseClient.verifyEmail,
+    // Deliberately a bare passthrough: it takes an email address, never a password, so
+    // there is nothing to hash — and passing it through untouched is what keeps
+    // `redirectTo` intact (see the note above `resetPassword`).
     requestPasswordReset: baseClient.requestPasswordReset,
     /**
-     * Change password for an authenticated user (both passwords are hashed)
+     * Change password for an authenticated user (both passwords are hashed).
+     *
+     * `revokeOtherSessions` is the option that made the whitelist bug matter — see the
+     * file header.
      */
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     changePassword: async (params, options) => {
       const [hashedCurrent, hashedNew] = await Promise.all([ltSha256(params.currentPassword), ltSha256(params.newPassword)]);
-      return baseClient.changePassword?.({ currentPassword: hashedCurrent, newPassword: hashedNew }, options);
+      if (!baseClient.changePassword) {
+        throw new Error("[lt-auth] changePassword is unavailable on the Better-Auth client \u2014 the password was NOT changed.");
+      }
+      return baseClient.changePassword({ ...params, currentPassword: hashedCurrent, newPassword: hashedNew }, options);
     },
     /**
-     * Reset password with token (new password is hashed before sending)
+     * Reset password with token (new password is hashed before sending).
+     *
+     * Spread first, then overwrite the one field this wrapper exists for — see the file
+     * header for why the order is not a style question.
      */
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     resetPassword: async (params, options) => {
       const hashedPassword = await ltSha256(params.newPassword);
-      return baseClient.resetPassword?.({ newPassword: hashedPassword, token: params.token }, options);
+      if (!baseClient.resetPassword) {
+        throw new Error("[lt-auth] resetPassword is unavailable on the Better-Auth client \u2014 the password was NOT changed.");
+      }
+      return baseClient.resetPassword({ ...params, newPassword: hashedPassword }, options);
     },
     // Override signIn to hash password (keep passkey method from plugin)
     signIn: {
@@ -113,7 +175,6 @@ export function createLtAuthClient(config = {}) {
       /**
        * Sign in with email and password (password is hashed before sending)
        */
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       email: async (params, options) => {
         const hashedPassword = await ltSha256(params.password);
         return baseClient.signIn.email({ ...params, password: hashedPassword }, options);
@@ -122,7 +183,6 @@ export function createLtAuthClient(config = {}) {
        * Sign in with passkey (pass through to base client - provided by passkeyClient plugin)
        * @see https://www.better-auth.com/docs/plugins/passkey
        */
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       passkey: baseClient.signIn.passkey
     },
     // Explicitly pass through signOut (not captured by spread operator)
@@ -133,7 +193,6 @@ export function createLtAuthClient(config = {}) {
       /**
        * Sign up with email and password (password is hashed before sending)
        */
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       email: async (params, options) => {
         const hashedPassword = await ltSha256(params.password);
         return baseClient.signUp.email({ ...params, password: hashedPassword }, options);
@@ -141,41 +200,35 @@ export function createLtAuthClient(config = {}) {
     },
     // Override twoFactor to hash passwords (provided by twoFactorClient plugin)
     twoFactor: {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       ...baseClient.twoFactor,
       /**
        * Disable 2FA (password is hashed before sending)
        */
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       disable: async (params, options) => {
         const hashedPassword = await ltSha256(params.password);
-        return baseClient.twoFactor.disable({ password: hashedPassword }, options);
+        return baseClient.twoFactor.disable({ ...params, password: hashedPassword }, options);
       },
       /**
        * Enable 2FA (password is hashed before sending)
        */
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       enable: async (params, options) => {
         const hashedPassword = await ltSha256(params.password);
-        return baseClient.twoFactor.enable({ password: hashedPassword }, options);
+        return baseClient.twoFactor.enable({ ...params, password: hashedPassword }, options);
       },
       /**
        * Generate backup codes (password is hashed before sending)
        */
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       generateBackupCodes: async (params, options) => {
         const hashedPassword = await ltSha256(params.password);
-        return baseClient.twoFactor.generateBackupCodes({ password: hashedPassword }, options);
+        return baseClient.twoFactor.generateBackupCodes({ ...params, password: hashedPassword }, options);
       },
       /**
        * Verify TOTP code (pass through to base client)
        */
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       verifyTotp: baseClient.twoFactor.verifyTotp,
       /**
        * Verify backup code (pass through to base client)
        */
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       verifyBackupCode: baseClient.twoFactor.verifyBackupCode
     }
   };

package/dist/runtime/plugins/auth-interceptor.client.js

@@ -133,7 +133,6 @@ export default (nuxtApp) => {
     globalThis.$fetch = ((url, options) => {
       return originalFetch(url, {
         ...options,
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         onResponseError: (context) => {
           if (options?.onResponseError) {
             options.onResponseError(context);

package/dist/runtime/types/auth.d.ts

@@ -102,6 +102,31 @@ export interface LtPasskeyRegisterResult {
 /**
  * Return type for useLtAuth composable
  */
+/**
+ * Accepts any caller-supplied shape while refusing a stray plaintext credential field.
+ *
+ * WHY A GENERIC AND NOT `& Record<string, unknown>`
+ *
+ * TypeScript gives a `type` alias an implicit index signature and an `interface` deliberately none
+ * (declaration merging could add anything later). So an intersection with `Record<string, unknown>`
+ * REJECTS an interface-typed variable — and `app/interfaces/*.interface.ts` plus `Ref<Form>.value`
+ * are the dominant shapes in this stack. That is how 1.15.0 broke consuming projects; the same
+ * mistake in a different costume is not worth repeating.
+ *
+ * A generic parameter carries every shape and keeps the excess-property check, which matters:
+ * widening these signatures to forward caller options also removed the compiler's objection to
+ * `changePassword({ …, password: plaintext })` — a plaintext credential that would land in the
+ * request body and from there in proxy logs, APM body capture and error reporters. Naming the
+ * foreign credential keys `never` puts that objection back without closing the passthrough.
+ *
+ * @typeParam T - whatever the caller actually passes
+ * @typeParam Own - the credential keys this method legitimately carries
+ */
+type NoStrayCredential<T, Own extends string> = Omit<{
+    currentPassword?: never;
+    newPassword?: never;
+    password?: never;
+}, Own> & T;
 export interface UseLtAuthReturn {
     authMode: ComputedRef<LtAuthMode>;
     isAuthenticated: ComputedRef<boolean>;
@@ -157,33 +182,95 @@ export interface UseLtAuthReturn {
     features: ComputedRef<Record<string, boolean | number | string[]>>;
     fetchFeatures: () => Promise<Record<string, boolean | number | string[]>>;
     authenticateWithPasskey: () => Promise<LtPasskeyAuthResult>;
-    changePassword: (params: {
+    /**
+     * Change the password of the signed-in user. Both passwords are hashed client-side.
+     *
+     * Pass `revokeOtherSessions: true` after a suspected compromise — Better Auth reads it on the
+     * `update-user` route and ends every other session. Until 1.16.0 the wrapper silently dropped
+     * it, so a caller believed foreign sessions were ended when they were not.
+     */
+    changePassword: <T extends {
         currentPassword: string;
         newPassword: string;
-    }, options?: unknown) => Promise<unknown>;
+    }>(params: NoStrayCredential<T, 'currentPassword' | 'newPassword'>, options?: unknown) => Promise<unknown>;
     clearUser: () => void;
     fetchWithAuth: (url: string, options?: RequestInit) => Promise<Response>;
     refreshJwtToken: () => Promise<boolean>;
     registerPasskey: (name?: string) => Promise<LtPasskeyRegisterResult>;
+    /**
+     * Ask for a password-reset mail.
+     *
+     * `redirectTo` MUST be an absolute app URL — Better Auth resolves it against the API
+     * origin, so a relative value lands on the API host, the route does not exist, and the
+     * answer is a 403 with no mail sent. In an lt starter project `appUrl()` builds one; elsewhere
+     * construct it yourself, e.g. `new URL('/auth/reset-password', config.public.siteUrl).toString()`.
+     *
+     * **SECURITY: never build `redirectTo` from `route.query`, a referrer, or a form field.** The
+     * reset redirect carries a live single-use token, so an attacker-controlled value is account
+     * takeover rather than phishing. What holds it back is `trustedOrigins` rejecting foreign
+     * origins — a project that widens that removes the last barrier.
+     *
+     * From `@lenne.tech/nest-server` 11.38.0 the reset mail links straight to the app, so
+     * `redirectTo` is no longer consulted on the default path. It stays load-bearing where a project
+     * sets `betterAuth.emailVerification.passwordResetLink: false` to keep Better Auth's own link.
+     *
+     * Generic rather than a closed shape: this is a passthrough, and a closed shape would push
+     * callers back to the raw client for any option the library has not enumerated yet — which is
+     * how hand-rolled reset flows start.
+     *
+     * @example
+     * const { requestPasswordReset } = useLtAuth();
+     * await requestPasswordReset({
+     *   email,
+     *   redirectTo: new URL('/auth/reset-password', config.public.siteUrl).toString(),
+     * });
+     * @see {@link UseLtAuthReturn.resetPassword} — step two, with the token from the query string.
+     */
+    requestPasswordReset: <T extends {
+        email: string;
+    }>(params: NoStrayCredential<T, never>, options?: unknown) => Promise<unknown>;
+    /**
+     * Set a new password from a reset token. The password is hashed client-side.
+     *
+     * **The minimum-length rule has to live in your form.** Better Auth checks `minPasswordLength`
+     * against the value it RECEIVES, and this client hashes first — so the server sees 64 characters
+     * whatever the user typed, on every version. That is a consequence of client-side hashing, not
+     * of any particular server release. The lt starter's `reset-password.vue`, `register.vue` and
+     * `setup.vue` declare `v.minLength(8)`; a project using this package without those forms has to
+     * add it.
+     *
+     * Takes `{ newPassword, token }` and nothing else — better-auth's `/reset-password` body schema
+     * carries no `redirectTo`, so the absolute-URL trap applies one step earlier, on
+     * {@link UseLtAuthReturn.requestPasswordReset}.
+     *
+     * @example
+     * const { resetPassword } = useLtAuth();
+     * await resetPassword({ newPassword, token: route.query.token as string });
+     */
+    resetPassword: <T extends {
+        newPassword: string;
+        token: string;
+    }>(params: NoStrayCredential<T, 'newPassword'>, options?: unknown) => Promise<unknown>;
     setUser: (userData: LtUser | null, mode?: LtAuthMode) => void;
     signIn: {
-        email: (params: {
+        email: <T extends {
             email: string;
             password: string;
             rememberMe?: boolean;
-        }, options?: unknown) => Promise<unknown>;
+        }>(params: NoStrayCredential<T, 'password'>, options?: unknown) => Promise<unknown>;
         passkey?: (options?: unknown) => Promise<unknown>;
     };
     signOut: (options?: unknown) => Promise<unknown>;
     signUp: {
-        email: (params: {
+        email: <T extends {
             email: string;
             name: string;
             password: string;
-        } & Record<string, unknown>, options?: unknown) => Promise<unknown>;
+        }>(params: NoStrayCredential<T, 'password'>, options?: unknown) => Promise<unknown>;
     };
     switchToJwtMode: () => Promise<boolean>;
     validateSession: () => Promise<boolean>;
     passkey?: unknown;
     twoFactor?: unknown;
 }
+export {};

package/dist/runtime/types/error.d.ts

@@ -31,7 +31,32 @@ export interface LtErrorTranslationModuleOptions {
  * Return type for useLtErrorTranslation composable
  */
 export interface UseLtErrorTranslationReturn {
-    /** Translate an error message or code to user-friendly message */
+    /**
+     * Translate an error message or code to a user-friendly message.
+     *
+     * ALWAYS returns a usable string, which has two consequences worth knowing before you
+     * write the call.
+     *
+     * **`translateError(x) || 'Fallback'` never reaches the fallback.** When the message
+     * carries no `#CODE:` marker, the original message is returned unchanged — non-empty,
+     * therefore truthy. Only an error with no message at all can produce `''`. The `||`
+     * reads like a safety net, catches nothing, and hides that the untranslated English text
+     * is what the user actually sees. Six pages in one starter had it before anyone noticed.
+     * If you want a fallback, decide on {@link LtParsedError.code} being `null`.
+     *
+     * **Branch on the code, not on the message.** Backends give one message per situation
+     * but not one situation per status: Better Auth answers `POST /reset-password` with five
+     * different errors under the same `400`. Only the code separates them, and only codes
+     * the backend has mapped arrive with a `#LTNS_` marker at all — anything unmapped falls
+     * through as raw English, by design rather than by omission.
+     *
+     * **A raw `$fetch` error can be passed straight in.** ofetch's `FetchError` keeps the
+     * transport line in `message` (`[POST] "/iam/reset-password": 400 Bad Request`) and the
+     * parsed response body in `data`; extraction reads `data.message` first, so the
+     * backend's own message is what gets translated. Unwrapping it at the call site
+     * (`err.data?.message ?? err`) is therefore no longer necessary — it stays harmless, but
+     * a helper built for it can go.
+     */
     translateError: (errorOrMessage: unknown) => string;
     /** Parse a backend error to extract code and messages */
     parseError: (errorOrMessage: unknown) => LtParsedError;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.15.1",
+  "version": "1.17.0",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -51,9 +51,9 @@
     "prepack": "node scripts/sync-module-version.mjs && nuxt-module-build build",
     "c": "pnpm run check",
     "check": "node scripts/check.mjs",
-    "check:raw": "pnpm install --frozen-lockfile && pnpm audit && pnpm run format:check && pnpm run lint && pnpm run version:check && pnpm run dev:prepare && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
-    "check:fix": "pnpm install && pnpm audit --fix && pnpm run format && pnpm run lint:fix && pnpm run version:sync && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
-    "check:naf": "pnpm install && pnpm run format && pnpm run lint:fix && pnpm run version:sync && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
+    "check:raw": "pnpm install --frozen-lockfile && pnpm audit && pnpm peers check && pnpm run format:check && pnpm run lint && pnpm run version:check && pnpm run dev:prepare && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
+    "check:fix": "pnpm install && pnpm audit --fix && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run version:sync && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
+    "check:naf": "pnpm install && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run version:sync && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
     "cf": "pnpm run check:fix",
     "cnaf": "pnpm run check:naf",
     "dev": "pnpm dev:prepare && nuxt dev playground",