@lenne.tech/nuxt-extensions 1.3.0 → 1.5.0

package/README.md

@@ -42,6 +42,58 @@ npm install tus-js-client
 - **i18n Support** - English and German translations (works without i18n too)
 - **Auto-imports** - All composables and components are auto-imported
 
+## Environment Variables
+
+| Variable | Context | Description |
+|----------|---------|-------------|
+| `NUXT_PUBLIC_API_URL` | Client + Server | Public API URL. Primary way to configure the API endpoint. Used for client-side requests and as SSR fallback. |
+| `NUXT_API_URL` | Server only | Internal API URL for SSR requests. Use when the backend has a private network address that should not be exposed to the client. |
+| `NUXT_PUBLIC_API_PROXY` | Client | Set to `true` to enable the Vite dev proxy. Routes client requests through `/api/` for same-origin cookies. **Only for local development.** |
+
+### How URL Resolution Works
+
+All environment variables are resolved **at runtime** (not build time). This means you can build a Docker image once and deploy it to different environments by changing env vars — no rebuild needed.
+
+**SSR fallback chain:**
+`NUXT_API_URL` → `NUXT_PUBLIC_API_URL` → `auth.baseURL` (from nuxt.config.ts) → `http://localhost:3000`
+
+**Client fallback chain (no proxy):**
+`NUXT_PUBLIC_API_URL` → `auth.baseURL` (from nuxt.config.ts) → `http://localhost:3000`
+
+**Client with proxy (`NUXT_PUBLIC_API_PROXY=true`):**
+All requests go to `/api/{path}` — the Vite dev proxy forwards them to the backend.
+
+> **Security:** `NUXT_API_URL` is never exposed to the client bundle. It stays in `runtimeConfig.apiUrl` (server only). This is important when using internal network addresses like `http://api.svc.cluster.local`.
+
+### Deployment Scenarios
+
+**Local development** — Frontend and backend on different ports, proxy ensures same-origin cookies:
+```bash
+NUXT_PUBLIC_API_URL=http://localhost:3000
+NUXT_PUBLIC_API_PROXY=true
+```
+
+**Production (simple)** — Backend reachable via public URL from both SSR and client:
+```bash
+NUXT_PUBLIC_API_URL=https://api.example.com
+```
+
+**Production (internal network)** — SSR uses fast internal route, client uses public URL:
+```bash
+NUXT_PUBLIC_API_URL=https://api.example.com
+NUXT_API_URL=http://api-internal:3000
+```
+
+**Legacy (nuxt.config.ts only)** — Works but env vars are preferred for runtime flexibility:
+```typescript
+// nuxt.config.ts
+ltExtensions: {
+  auth: {
+    baseURL: 'https://api.example.com',
+  },
+}
+```
+
 ## Configuration
 
 ```typescript
@@ -53,7 +105,7 @@ export default defineNuxtConfig({
     // Auth configuration
     auth: {
       enabled: true,                // Enable auth features
-      baseURL: '',                  // API base URL (empty = use Nuxt proxy)
+      baseURL: '',                  // API base URL (empty = use env vars)
       basePath: '/iam',             // Better-Auth endpoint prefix
       loginPath: '/auth/login',     // Login redirect path
       twoFactorRedirectPath: '/auth/2fa',  // 2FA redirect path
@@ -68,6 +120,18 @@ export default defineNuxtConfig({
         enabled: true,              // 401 auto-handler
         publicPaths: ['/auth/login', '/auth/register'],
       },
+
+      // System setup (first admin user creation)
+      systemSetup: {
+        enabled: false,             // Enable setup flow
+        setupPath: '/auth/setup',   // Setup page path
+      },
+    },
+
+    // Error translation configuration
+    errorTranslation: {
+      enabled: true,                // Translate backend error codes
+      defaultLocale: 'de',          // Fallback locale
     },
 
     // TUS upload configuration
@@ -298,9 +362,12 @@ The package works **with or without** `@nuxtjs/i18n`:
 | Composable | Description |
 |------------|-------------|
 | `useLtAuth()` | Better-Auth integration with session, passkey, 2FA |
+| `useLtAuthClient()` | Direct access to the Better-Auth client singleton |
+| `useLtErrorTranslation()` | Translate backend error codes to user-friendly messages |
 | `useLtTusUpload()` | TUS protocol file uploads with pause/resume |
 | `useLtFile()` | File utilities (size formatting, URLs) |
 | `useLtShare()` | Web Share API with clipboard fallback |
+| `useSystemSetup()` | System setup flow for initial admin user creation |
 
 ### Components
 

package/dist/module.d.mts

@@ -6,7 +6,7 @@ export { LtAuthModuleOptions, LtErrorTranslationModuleOptions, LtExtensionsModul
 export { LtErrorTranslationResponse, LtParsedError, UseLtErrorTranslationReturn } from '../dist/runtime/types/error.js';
 
 declare const name = "@lenne.tech/nuxt-extensions";
-declare const version = "1.3.0";
+declare const version = "1.4.0";
 declare const configKey = "ltExtensions";
 declare const _default: _nuxt_schema.NuxtModule<LtExtensionsModuleOptions, LtExtensionsModuleOptions, false>;
 

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "configKey": "ltExtensions",
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,7 +1,7 @@
 import { defineNuxtModule, createResolver, addImports, addComponent, addPlugin, addRouteMiddleware } from '@nuxt/kit';
 
 const name = "@lenne.tech/nuxt-extensions";
-const version = "1.3.0";
+const version = "1.4.0";
 const configKey = "ltExtensions";
 const defaultOptions = {
   auth: {
@@ -54,6 +54,13 @@ const module$1 = defineNuxtModule({
       i18n: { ...defaultOptions.i18n, ...options.i18n },
       tus: { ...defaultOptions.tus, ...options.tus }
     };
+    const rc = nuxt.options.runtimeConfig;
+    if (!rc.apiUrl) {
+      rc.apiUrl = "";
+    }
+    if (!rc.public.apiUrl) {
+      rc.public.apiUrl = "";
+    }
     nuxt.options.runtimeConfig.public.ltExtensions = {
       auth: {
         basePath: resolvedOptions.auth?.basePath || "/iam",

package/dist/runtime/composables/auth/use-lt-auth.js

@@ -61,7 +61,8 @@ export function useLtAuth() {
     authState.value = newState;
     if (import.meta.client) {
       const maxAge = 60 * 60 * 24 * 7;
-      document.cookie = `lt-auth-state=${encodeURIComponent(JSON.stringify(newState))}; path=/; max-age=${maxAge}; samesite=lax`;
+      const secure = globalThis.location?.protocol === "https:" ? "; secure" : "";
+      document.cookie = `lt-auth-state=${encodeURIComponent(JSON.stringify(newState))}; path=/; max-age=${maxAge}; samesite=lax${secure}`;
     }
   }
   function clearUser() {
@@ -70,7 +71,8 @@ export function useLtAuth() {
     jwtToken.value = null;
     if (import.meta.client) {
       const maxAge = 60 * 60 * 24 * 7;
-      document.cookie = `lt-auth-state=${encodeURIComponent(JSON.stringify(clearedState))}; path=/; max-age=${maxAge}; samesite=lax`;
+      const secure = globalThis.location?.protocol === "https:" ? "; secure" : "";
+      document.cookie = `lt-auth-state=${encodeURIComponent(JSON.stringify(clearedState))}; path=/; max-age=${maxAge}; samesite=lax${secure}`;
       document.cookie = `lt-jwt-token=; path=/; max-age=0`;
       const sessionCookieNames = [
         "better-auth.session_token",

package/dist/runtime/composables/use-lt-auth-client.d.ts

@@ -27,10 +27,17 @@ export declare function resetLtAuthClient(): void;
  * The client is created once and reused across all calls.
  * Configuration is read from RuntimeConfig on first call.
  *
- * IMPORTANT: When the API proxy is enabled (NUXT_PUBLIC_API_PROXY=true),
- * the basePath is automatically prefixed with '/api' so the Vite dev proxy
- * can forward requests to the backend. This is required for same-origin
- * cookies and WebAuthn/Passkey to work correctly.
+ * ## baseURL resolution
+ * Prefers `runtimeConfig.public.apiUrl` (set at runtime via `NUXT_PUBLIC_API_URL`)
+ * over `ltExtensions.auth.baseURL` (baked at build time from nuxt.config.ts).
+ * This ensures Docker containers can be reconfigured without rebuilding.
+ * Trailing slashes are automatically stripped.
+ *
+ * ## Proxy mode (`NUXT_PUBLIC_API_PROXY=true`)
+ * When enabled, `baseURL` is set to `""` (same-origin) and `basePath` is
+ * prefixed with `/api` (e.g., `/api/iam`). The Vite dev proxy forwards
+ * these requests to the backend. This is required for same-origin cookies
+ * and WebAuthn/Passkey to work in local development.
  */
 export declare function useLtAuthClient(): LtAuthClient;
 export declare const ltAuthClient: {

package/dist/runtime/composables/use-lt-auth-client.js

@@ -1,4 +1,4 @@
-import { useNuxtApp } from "#imports";
+import { useRuntimeConfig } from "#imports";
 import {
   getOrCreateLtAuthClient,
   resetLtAuthClientSingleton
@@ -9,15 +9,17 @@ export function resetLtAuthClient() {
 }
 export function useLtAuthClient() {
   try {
-    const nuxtApp = useNuxtApp();
-    const config = nuxtApp.$config?.public?.ltExtensions?.auth || {};
+    const runtimeConfig = useRuntimeConfig();
+    const config = runtimeConfig.public?.ltExtensions?.auth || {};
+    const publicApiUrl = String(runtimeConfig.public?.apiUrl || "");
     const useProxy = isLocalDevApiProxy();
     let basePath = config.basePath || "/iam";
     if (useProxy && basePath && !basePath.startsWith("/api")) {
       basePath = `/api${basePath}`;
     }
+    const authBaseURL = (publicApiUrl || config.baseURL || "").replace(/\/+$/, "");
     return getOrCreateLtAuthClient({
-      baseURL: useProxy ? "" : config.baseURL,
+      baseURL: useProxy ? "" : authBaseURL,
       basePath,
       twoFactorRedirectPath: config.twoFactorRedirectPath,
       enableAdmin: config.enableAdmin,

package/dist/runtime/lib/auth-client.d.ts

@@ -136,7 +136,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         }>>;
         <F extends (...args: any) => any>(useFetch: F): Promise<{
             data: import("vue").Ref<{
-                user: {
+                user: import("better-auth").StripEmptyObjects<{
                     id: string;
                     createdAt: Date;
                     updatedAt: Date;
@@ -144,8 +144,8 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                     emailVerified: boolean;
                     name: string;
                     image?: string | null | undefined;
-                };
-                session: {
+                }>;
+                session: import("better-auth").StripEmptyObjects<{
                     id: string;
                     createdAt: Date;
                     updatedAt: Date;
@@ -154,9 +154,9 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                     token: string;
                     ipAddress?: string | null | undefined;
                     userAgent?: string | null | undefined;
-                };
+                }>;
             } | null, {
-                user: {
+                user: import("better-auth").StripEmptyObjects<{
                     id: string;
                     createdAt: Date;
                     updatedAt: Date;
@@ -164,8 +164,8 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                     emailVerified: boolean;
                     name: string;
                     image?: string | null | undefined;
-                };
-                session: {
+                }>;
+                session: import("better-auth").StripEmptyObjects<{
                     id: string;
                     createdAt: Date;
                     updatedAt: Date;
@@ -174,7 +174,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                     token: string;
                     ipAddress?: string | null | undefined;
                     userAgent?: string | null | undefined;
-                };
+                }>;
             } | null>;
             isPending: false;
             error: import("vue").Ref<{
@@ -188,7 +188,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
     admin: any;
     $Infer: {
         Session: {
-            user: {
+            user: import("better-auth").StripEmptyObjects<{
                 id: string;
                 createdAt: Date;
                 updatedAt: Date;
@@ -196,8 +196,8 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 emailVerified: boolean;
                 name: string;
                 image?: string | null | undefined;
-            };
-            session: {
+            }>;
+            session: import("better-auth").StripEmptyObjects<{
                 id: string;
                 createdAt: Date;
                 updatedAt: Date;
@@ -206,7 +206,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 token: string;
                 ipAddress?: string | null | undefined;
                 userAgent?: string | null | undefined;
-            };
+            }>;
         };
     };
     $fetch: import("better-auth/client").BetterFetch<{
@@ -227,22 +227,22 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             };
         })[];
         cache?: RequestCache | undefined;
-        method: string;
-        window?: null | undefined;
+        priority?: RequestPriority | undefined;
+        credentials?: RequestCredentials;
         headers?: (HeadersInit & (HeadersInit | {
             accept: "application/json" | "text/plain" | "application/octet-stream";
             "content-type": "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data" | "application/octet-stream";
             authorization: "Bearer" | "Basic";
         })) | undefined;
-        redirect?: RequestRedirect | undefined;
-        credentials?: RequestCredentials;
         integrity?: string | undefined;
         keepalive?: boolean | undefined;
+        method: string;
         mode?: RequestMode | undefined;
-        priority?: RequestPriority | undefined;
+        redirect?: RequestRedirect | undefined;
         referrer?: string | undefined;
         referrerPolicy?: ReferrerPolicy | undefined;
         signal?: (AbortSignal | null) | undefined;
+        window?: null | undefined;
         onRetry?: ((response: import("better-auth/client").ResponseContext) => Promise<void> | void) | undefined;
         hookOptions?: {
             cloneResponse?: boolean;
@@ -301,7 +301,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
     changePassword: (params: {
         currentPassword: string;
         newPassword: string;
-    }, options?: any) => Promise<{
+    }, options?: any) => Promise<(Omit<{
         token: string | null;
         user: {
             id: string;
@@ -311,9 +311,27 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             emailVerified: boolean;
             name: string;
             image?: string | null | undefined;
-        } & Record<string, any>;
-    } | {
-        data: {
+        } & Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        };
+    }, "user"> & {
+        user: import("better-auth").StripEmptyObjects<{
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        }>;
+    }) | {
+        data: Omit<{
             token: string | null;
             user: {
                 id: string;
@@ -323,7 +341,25 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 emailVerified: boolean;
                 name: string;
                 image?: string | null | undefined;
-            } & Record<string, any>;
+            } & Record<string, any> & {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            };
+        }, "user"> & {
+            user: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            }>;
         };
         error: null;
     } | {
@@ -365,7 +401,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             email: string;
             password: string;
             rememberMe?: boolean;
-        }, options?: any) => Promise<{
+        }, options?: any) => Promise<(Omit<{
             redirect: boolean;
             token: string;
             url?: string | undefined;
@@ -378,8 +414,18 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 name: string;
                 image?: string | null | undefined | undefined;
             };
-        } | {
-            data: {
+        }, "user"> & {
+            user: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            }>;
+        }) | {
+            data: Omit<{
                 redirect: boolean;
                 token: string;
                 url?: string | undefined;
@@ -392,6 +438,16 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                     name: string;
                     image?: string | null | undefined | undefined;
                 };
+            }, "user"> & {
+                user: import("better-auth").StripEmptyObjects<{
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                }>;
             };
             error: null;
         } | {
@@ -409,7 +465,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
          */
         passkey: any;
         social: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<{
-            provider: (string & {}) | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "vercel";
+            provider: (string & {}) | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel";
             callbackURL?: string | undefined;
             newUserCallbackURL?: string | undefined;
             errorCallbackURL?: string | undefined;
@@ -420,13 +476,20 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 accessToken?: string | undefined;
                 refreshToken?: string | undefined;
                 expiresAt?: number | undefined;
+                user?: {
+                    name?: {
+                        firstName?: string | undefined;
+                        lastName?: string | undefined;
+                    } | undefined;
+                    email?: string | undefined;
+                } | undefined;
             } | undefined;
             scopes?: string[] | undefined;
             requestSignUp?: boolean | undefined;
             loginHint?: string | undefined;
             additionalData?: Record<string, any> | undefined;
         }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
-            provider: (string & {}) | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "vercel";
+            provider: (string & {}) | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel";
             callbackURL?: string | undefined;
             newUserCallbackURL?: string | undefined;
             errorCallbackURL?: string | undefined;
@@ -437,6 +500,13 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 accessToken?: string | undefined;
                 refreshToken?: string | undefined;
                 expiresAt?: number | undefined;
+                user?: {
+                    name?: {
+                        firstName?: string | undefined;
+                        lastName?: string | undefined;
+                    } | undefined;
+                    email?: string | undefined;
+                } | undefined;
             } | undefined;
             scopes?: string[] | undefined;
             requestSignUp?: boolean | undefined;
@@ -444,10 +514,10 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             additionalData?: Record<string, any> | undefined;
         } & {
             fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<NonNullable<{
+        }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
             redirect: boolean;
             url: string;
-        } | {
+        } | (Omit<{
             redirect: boolean;
             token: string;
             url: undefined;
@@ -460,7 +530,17 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 name: string;
                 image?: string | null | undefined | undefined;
             };
-        }>, {
+        }, "user"> & {
+            user: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            }>;
+        }), {
             code?: string | undefined;
             message?: string | undefined;
         }, FetchOptions["throw"] extends true ? true : false>>;
@@ -482,7 +562,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             email: string;
             name: string;
             password: string;
-        } & Record<string, unknown>, options?: any) => Promise<NonNullable<{
+        } & Record<string, unknown>, options?: any) => Promise<(Omit<{
             token: null;
             user: {
                 id: string;
@@ -493,7 +573,17 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 name: string;
                 image?: string | null | undefined | undefined;
             };
-        } | {
+        }, "user"> & {
+            user: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            }>;
+        }) | (Omit<{
             token: string;
             user: {
                 id: string;
@@ -504,8 +594,18 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 name: string;
                 image?: string | null | undefined | undefined;
             };
-        }> | {
-            data: NonNullable<{
+        }, "user"> & {
+            user: import("better-auth").StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            }>;
+        }) | {
+            data: (Omit<{
                 token: null;
                 user: {
                     id: string;
@@ -516,7 +616,17 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                     name: string;
                     image?: string | null | undefined | undefined;
                 };
-            } | {
+            }, "user"> & {
+                user: import("better-auth").StripEmptyObjects<{
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                }>;
+            }) | (Omit<{
                 token: string;
                 user: {
                     id: string;
@@ -527,7 +637,17 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                     name: string;
                     image?: string | null | undefined | undefined;
                 };
-            }>;
+            }, "user"> & {
+                user: import("better-auth").StripEmptyObjects<{
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                }>;
+            });
             error: null;
         } | {
             data: null;
@@ -583,14 +703,34 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         code?: string | undefined;
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
+    updateSession: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<Partial<{}>> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<Partial<{}> & {
+        fetchOptions?: FetchOptions | undefined;
+    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
+        session: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+        };
+    }, {
+        code?: string | undefined;
+        message?: string | undefined;
+    }, FetchOptions["throw"] extends true ? true : false>>;
     updateUser: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<Partial<{}> & {
         name?: string | undefined;
         image?: string | undefined | null;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<{
-        image?: (string | null) | undefined;
-        name?: string | undefined;
-        fetchOptions?: FetchOptions | undefined;
-    } & Partial<{}>> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<import("better-auth/client").InferUserUpdateCtx<{
+        basePath: string;
+        baseURL: any;
+        fetchOptions: {
+            customFetchImpl: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+        };
+        plugins: any[];
+    }, FetchOptions>> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
         status: boolean;
     }, {
         code?: string | undefined;
@@ -756,9 +896,9 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         fetchOptions?: FetchOptions | undefined;
     }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
         accessToken: string | undefined;
-        refreshToken: string | undefined;
+        refreshToken: string;
         accessTokenExpiresAt: Date | undefined;
-        refreshTokenExpiresAt: Date | undefined;
+        refreshTokenExpiresAt: Date | null | undefined;
         scope: string | null | undefined;
         idToken: string | null | undefined;
         providerId: string;
@@ -810,7 +950,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         } | undefined;
         fetchOptions?: FetchOptions | undefined;
     }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
-        user: {
+        user: import("better-auth").StripEmptyObjects<{
             id: string;
             createdAt: Date;
             updatedAt: Date;
@@ -818,8 +958,8 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             emailVerified: boolean;
             name: string;
             image?: string | null | undefined;
-        };
-        session: {
+        }>;
+        session: import("better-auth").StripEmptyObjects<{
             id: string;
             createdAt: Date;
             updatedAt: Date;
@@ -828,55 +968,204 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             token: string;
             ipAddress?: string | null | undefined;
             userAgent?: string | null | undefined;
-        };
+        }>;
     } | null, {
         code?: string | undefined;
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
     $ERROR_CODES: {
-        readonly USER_NOT_FOUND: "User not found";
-        readonly FAILED_TO_CREATE_USER: "Failed to create user";
-        readonly FAILED_TO_CREATE_SESSION: "Failed to create session";
-        readonly FAILED_TO_UPDATE_USER: "Failed to update user";
-        readonly FAILED_TO_GET_SESSION: "Failed to get session";
-        readonly INVALID_PASSWORD: "Invalid password";
-        readonly INVALID_EMAIL: "Invalid email";
-        readonly INVALID_EMAIL_OR_PASSWORD: "Invalid email or password";
-        readonly SOCIAL_ACCOUNT_ALREADY_LINKED: "Social account already linked";
-        readonly PROVIDER_NOT_FOUND: "Provider not found";
-        readonly INVALID_TOKEN: "Invalid token";
-        readonly ID_TOKEN_NOT_SUPPORTED: "id_token not supported";
-        readonly FAILED_TO_GET_USER_INFO: "Failed to get user info";
-        readonly USER_EMAIL_NOT_FOUND: "User email not found";
-        readonly EMAIL_NOT_VERIFIED: "Email not verified";
-        readonly PASSWORD_TOO_SHORT: "Password too short";
-        readonly PASSWORD_TOO_LONG: "Password too long";
-        readonly USER_ALREADY_EXISTS: "User already exists.";
-        readonly USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "User already exists. Use another email.";
-        readonly EMAIL_CAN_NOT_BE_UPDATED: "Email can not be updated";
-        readonly CREDENTIAL_ACCOUNT_NOT_FOUND: "Credential account not found";
-        readonly SESSION_EXPIRED: "Session expired. Re-authenticate to perform this action.";
-        readonly FAILED_TO_UNLINK_LAST_ACCOUNT: "You can't unlink your last account";
-        readonly ACCOUNT_NOT_FOUND: "Account not found";
-        readonly USER_ALREADY_HAS_PASSWORD: "User already has a password. Provide that to delete the account.";
-        readonly CROSS_SITE_NAVIGATION_LOGIN_BLOCKED: "Cross-site navigation login blocked. This request appears to be a CSRF attack.";
-        readonly VERIFICATION_EMAIL_NOT_ENABLED: "Verification email isn't enabled";
-        readonly EMAIL_ALREADY_VERIFIED: "Email is already verified";
-        readonly EMAIL_MISMATCH: "Email mismatch";
-        readonly SESSION_NOT_FRESH: "Session is not fresh";
-        readonly LINKED_ACCOUNT_ALREADY_EXISTS: "Linked account already exists";
-        readonly INVALID_ORIGIN: "Invalid origin";
-        readonly INVALID_CALLBACK_URL: "Invalid callbackURL";
-        readonly INVALID_REDIRECT_URL: "Invalid redirectURL";
-        readonly INVALID_ERROR_CALLBACK_URL: "Invalid errorCallbackURL";
-        readonly INVALID_NEW_USER_CALLBACK_URL: "Invalid newUserCallbackURL";
-        readonly MISSING_OR_NULL_ORIGIN: "Missing or null Origin";
-        readonly CALLBACK_URL_REQUIRED: "callbackURL is required";
-        readonly FAILED_TO_CREATE_VERIFICATION: "Unable to create verification";
-        readonly FIELD_NOT_ALLOWED: "Field not allowed to be set";
-        readonly ASYNC_VALIDATION_NOT_SUPPORTED: "Async validation is not supported";
-        readonly VALIDATION_ERROR: "Validation Error";
-        readonly MISSING_FIELD: "Field is required";
+        USER_NOT_FOUND: {
+            readonly code: "USER_NOT_FOUND";
+            message: string;
+        };
+        FAILED_TO_CREATE_USER: {
+            readonly code: "FAILED_TO_CREATE_USER";
+            message: string;
+        };
+        FAILED_TO_CREATE_SESSION: {
+            readonly code: "FAILED_TO_CREATE_SESSION";
+            message: string;
+        };
+        FAILED_TO_UPDATE_USER: {
+            readonly code: "FAILED_TO_UPDATE_USER";
+            message: string;
+        };
+        FAILED_TO_GET_SESSION: {
+            readonly code: "FAILED_TO_GET_SESSION";
+            message: string;
+        };
+        INVALID_PASSWORD: {
+            readonly code: "INVALID_PASSWORD";
+            message: string;
+        };
+        INVALID_EMAIL: {
+            readonly code: "INVALID_EMAIL";
+            message: string;
+        };
+        INVALID_EMAIL_OR_PASSWORD: {
+            readonly code: "INVALID_EMAIL_OR_PASSWORD";
+            message: string;
+        };
+        INVALID_USER: {
+            readonly code: "INVALID_USER";
+            message: string;
+        };
+        SOCIAL_ACCOUNT_ALREADY_LINKED: {
+            readonly code: "SOCIAL_ACCOUNT_ALREADY_LINKED";
+            message: string;
+        };
+        PROVIDER_NOT_FOUND: {
+            readonly code: "PROVIDER_NOT_FOUND";
+            message: string;
+        };
+        INVALID_TOKEN: {
+            readonly code: "INVALID_TOKEN";
+            message: string;
+        };
+        TOKEN_EXPIRED: {
+            readonly code: "TOKEN_EXPIRED";
+            message: string;
+        };
+        ID_TOKEN_NOT_SUPPORTED: {
+            readonly code: "ID_TOKEN_NOT_SUPPORTED";
+            message: string;
+        };
+        FAILED_TO_GET_USER_INFO: {
+            readonly code: "FAILED_TO_GET_USER_INFO";
+            message: string;
+        };
+        USER_EMAIL_NOT_FOUND: {
+            readonly code: "USER_EMAIL_NOT_FOUND";
+            message: string;
+        };
+        EMAIL_NOT_VERIFIED: {
+            readonly code: "EMAIL_NOT_VERIFIED";
+            message: string;
+        };
+        PASSWORD_TOO_SHORT: {
+            readonly code: "PASSWORD_TOO_SHORT";
+            message: string;
+        };
+        PASSWORD_TOO_LONG: {
+            readonly code: "PASSWORD_TOO_LONG";
+            message: string;
+        };
+        USER_ALREADY_EXISTS: {
+            readonly code: "USER_ALREADY_EXISTS";
+            message: string;
+        };
+        USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: {
+            readonly code: "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL";
+            message: string;
+        };
+        EMAIL_CAN_NOT_BE_UPDATED: {
+            readonly code: "EMAIL_CAN_NOT_BE_UPDATED";
+            message: string;
+        };
+        CREDENTIAL_ACCOUNT_NOT_FOUND: {
+            readonly code: "CREDENTIAL_ACCOUNT_NOT_FOUND";
+            message: string;
+        };
+        ACCOUNT_NOT_FOUND: {
+            readonly code: "ACCOUNT_NOT_FOUND";
+            message: string;
+        };
+        SESSION_EXPIRED: {
+            readonly code: "SESSION_EXPIRED";
+            message: string;
+        };
+        FAILED_TO_UNLINK_LAST_ACCOUNT: {
+            readonly code: "FAILED_TO_UNLINK_LAST_ACCOUNT";
+            message: string;
+        };
+        USER_ALREADY_HAS_PASSWORD: {
+            readonly code: "USER_ALREADY_HAS_PASSWORD";
+            message: string;
+        };
+        CROSS_SITE_NAVIGATION_LOGIN_BLOCKED: {
+            readonly code: "CROSS_SITE_NAVIGATION_LOGIN_BLOCKED";
+            message: string;
+        };
+        VERIFICATION_EMAIL_NOT_ENABLED: {
+            readonly code: "VERIFICATION_EMAIL_NOT_ENABLED";
+            message: string;
+        };
+        EMAIL_ALREADY_VERIFIED: {
+            readonly code: "EMAIL_ALREADY_VERIFIED";
+            message: string;
+        };
+        EMAIL_MISMATCH: {
+            readonly code: "EMAIL_MISMATCH";
+            message: string;
+        };
+        SESSION_NOT_FRESH: {
+            readonly code: "SESSION_NOT_FRESH";
+            message: string;
+        };
+        LINKED_ACCOUNT_ALREADY_EXISTS: {
+            readonly code: "LINKED_ACCOUNT_ALREADY_EXISTS";
+            message: string;
+        };
+        INVALID_ORIGIN: {
+            readonly code: "INVALID_ORIGIN";
+            message: string;
+        };
+        INVALID_CALLBACK_URL: {
+            readonly code: "INVALID_CALLBACK_URL";
+            message: string;
+        };
+        INVALID_REDIRECT_URL: {
+            readonly code: "INVALID_REDIRECT_URL";
+            message: string;
+        };
+        INVALID_ERROR_CALLBACK_URL: {
+            readonly code: "INVALID_ERROR_CALLBACK_URL";
+            message: string;
+        };
+        INVALID_NEW_USER_CALLBACK_URL: {
+            readonly code: "INVALID_NEW_USER_CALLBACK_URL";
+            message: string;
+        };
+        MISSING_OR_NULL_ORIGIN: {
+            readonly code: "MISSING_OR_NULL_ORIGIN";
+            message: string;
+        };
+        CALLBACK_URL_REQUIRED: {
+            readonly code: "CALLBACK_URL_REQUIRED";
+            message: string;
+        };
+        FAILED_TO_CREATE_VERIFICATION: {
+            readonly code: "FAILED_TO_CREATE_VERIFICATION";
+            message: string;
+        };
+        FIELD_NOT_ALLOWED: {
+            readonly code: "FIELD_NOT_ALLOWED";
+            message: string;
+        };
+        ASYNC_VALIDATION_NOT_SUPPORTED: {
+            readonly code: "ASYNC_VALIDATION_NOT_SUPPORTED";
+            message: string;
+        };
+        VALIDATION_ERROR: {
+            readonly code: "VALIDATION_ERROR";
+            message: string;
+        };
+        MISSING_FIELD: {
+            readonly code: "MISSING_FIELD";
+            message: string;
+        };
+        METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED: {
+            readonly code: "METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED";
+            message: string;
+        };
+        BODY_MUST_BE_AN_OBJECT: {
+            readonly code: "BODY_MUST_BE_AN_OBJECT";
+            message: string;
+        };
+        PASSWORD_ALREADY_SET: {
+            readonly code: "PASSWORD_ALREADY_SET";
+            message: string;
+        };
     };
 };
 export type LtAuthClient = ReturnType<typeof createLtAuthClient>;

package/dist/runtime/lib/auth-state.d.ts

@@ -49,9 +49,35 @@ export declare function isLocalDevApiProxy(): boolean;
 /**
  * Build a full API URL for a given path, handling SSR, proxy, and direct modes.
  *
- * - **SSR**: `runtimeConfig.apiUrl` + path (direct backend call)
- * - **Client + Proxy** (`NUXT_PUBLIC_API_PROXY=true`): `/api` + path (Vite proxy)
- * - **Client direct**: `runtimeConfig.public.apiUrl` + path
+ * ## Resolution Strategy
+ *
+ * All environment variables are resolved **at runtime** by Nuxt's built-in
+ * `NUXT_*` → `runtimeConfig` mapping. The module only declares empty default
+ * keys at build time so Nuxt knows which keys to override.
+ *
+ * ### SSR (Server-Side Rendering)
+ * Fallback chain: `NUXT_API_URL` → `NUXT_PUBLIC_API_URL` → `auth.baseURL` → `localhost:3000`
+ *
+ * `NUXT_API_URL` allows using an internal network address (e.g., `http://api.svc.cluster.local`)
+ * that is never exposed to the client bundle. If not set, the public URL is used.
+ *
+ * ### Client + Proxy (`NUXT_PUBLIC_API_PROXY=true`)
+ * Returns `/api{path}` — the Vite dev proxy forwards to the backend and strips `/api`.
+ * This ensures same-origin requests for cookies/WebAuthn. **Only for local development.**
+ *
+ * ### Client direct (deployed instances)
+ * Fallback chain: `NUXT_PUBLIC_API_URL` → `auth.baseURL` → `localhost:3000`
+ *
+ * ## Deployment Scenarios
+ *
+ * | Scenario                 | Env Vars                                      | SSR Result              | Client Result           |
+ * |--------------------------|-----------------------------------------------|-------------------------|-------------------------|
+ * | Local dev + proxy        | `PUBLIC_API_URL=localhost:3000, API_PROXY=true`| `localhost:3000{path}`  | `/api{path}` (proxy)    |
+ * | Production (simple)      | `PUBLIC_API_URL=api.example.com`               | `api.example.com{path}` | `api.example.com{path}` |
+ * | Production (internal)    | `PUBLIC_API_URL=..., API_URL=api-internal:3000`| `api-internal:3000{path}` | `api.example.com{path}` |
+ * | Legacy (nuxt.config only)| `auth.baseURL` in config                       | `{baseURL}{path}`       | `{baseURL}{path}`       |
+ *
+ * Trailing slashes on the base URL are automatically stripped.
  *
  * @param path - The API path (e.g., `/system-setup/status`, `/i18n/errors/de`)
  */

package/dist/runtime/lib/auth-state.js

@@ -28,15 +28,17 @@ export function isLocalDevApiProxy() {
 export function buildLtApiUrl(path) {
   try {
     const runtimeConfig = useRuntimeConfig();
+    const publicUrl = runtimeConfig.public.apiUrl || "";
+    const authBaseURL = runtimeConfig.public?.ltExtensions?.auth?.baseURL || "";
     if (import.meta.server) {
-      const apiUrl2 = runtimeConfig.apiUrl || "http://localhost:3000";
-      return `${apiUrl2}${path}`;
+      const apiUrl2 = runtimeConfig.apiUrl || publicUrl || authBaseURL || "http://localhost:3000";
+      return `${apiUrl2.replace(/\/+$/, "")}${path}`;
     }
     if (isLocalDevApiProxy()) {
       return `/api${path}`;
     }
-    const apiUrl = runtimeConfig.public.apiUrl || runtimeConfig.public?.ltExtensions?.auth?.baseURL || "http://localhost:3000";
-    return `${apiUrl}${path}`;
+    const apiUrl = publicUrl || authBaseURL || "http://localhost:3000";
+    return `${apiUrl.replace(/\/+$/, "")}${path}`;
   } catch {
     return `http://localhost:3000${path}`;
   }
@@ -74,8 +76,9 @@ export function getLtJwtToken() {
 export function setLtJwtToken(token) {
   if (import.meta.server) return;
   const maxAge = 60 * 60 * 24 * 7;
+  const secure = globalThis.location?.protocol === "https:" ? "; secure" : "";
   if (token) {
-    document.cookie = `lt-jwt-token=${encodeURIComponent(JSON.stringify(token))}; path=/; max-age=${maxAge}; samesite=lax`;
+    document.cookie = `lt-jwt-token=${encodeURIComponent(JSON.stringify(token))}; path=/; max-age=${maxAge}; samesite=lax${secure}`;
   } else {
     document.cookie = `lt-jwt-token=; path=/; max-age=0`;
   }
@@ -91,7 +94,8 @@ export function setLtAuthMode(mode) {
       state = { ...JSON.parse(value), authMode: mode };
     }
     const maxAge = 60 * 60 * 24 * 7;
-    document.cookie = `lt-auth-state=${encodeURIComponent(JSON.stringify(state))}; path=/; max-age=${maxAge}; samesite=lax`;
+    const secure = globalThis.location?.protocol === "https:" ? "; secure" : "";
+    document.cookie = `lt-auth-state=${encodeURIComponent(JSON.stringify(state))}; path=/; max-age=${maxAge}; samesite=lax${secure}`;
   } catch {
   }
 }

package/dist/runtime/types/module.d.ts

@@ -1,5 +1,22 @@
 /**
- * Auth module configuration options
+ * System setup module configuration options
+ *
+ * When enabled, a global middleware redirects to the setup page if no admin user exists.
+ *
+ * @example
+ * ```typescript
+ * // nuxt.config.ts
+ * export default defineNuxtConfig({
+ *   ltExtensions: {
+ *     auth: {
+ *       systemSetup: {
+ *         enabled: true,
+ *         setupPath: '/auth/setup',
+ *       },
+ *     },
+ *   },
+ * });
+ * ```
  */
 export interface LtSystemSetupModuleOptions {
     /** Enable system setup flow (default: false) */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -12,7 +12,7 @@
   },
   "author": "lenne.Tech <info@lenne.tech> (https://lenne.tech)",
   "license": "MIT",
-  "packageManager": "pnpm@10.29.2",
+  "packageManager": "pnpm@10.32.1",
   "type": "module",
   "exports": {
     ".": {
@@ -69,7 +69,7 @@
     "release": "pnpm format:check && pnpm lint && pnpm test:types && pnpm test && pnpm prepack"
   },
   "dependencies": {
-    "@nuxt/kit": "4.3.0"
+    "@nuxt/kit": "4.4.2"
   },
   "peerDependencies": {
     "@better-auth/passkey": ">=1.0.0",
@@ -93,30 +93,37 @@
     }
   },
   "devDependencies": {
-    "@better-auth/passkey": "1.4.18",
-    "@nuxt/devtools": "3.1.1",
-    "@playwright/test": "1.58.1",
+    "@better-auth/passkey": "1.5.5",
+    "@nuxt/devtools": "3.2.3",
     "@nuxt/module-builder": "1.0.2",
-    "@nuxt/schema": "4.3.0",
-    "@nuxt/test-utils": "3.23.0",
-    "@types/node": "25.2.0",
-    "@vitest/coverage-v8": "4.0.18",
-    "@vue/test-utils": "2.4.6",
-    "better-auth": "1.4.18",
-    "happy-dom": "20.5.0",
-    "nuxt": "4.3.0",
-    "oxfmt": "0.28.0",
-    "oxlint": "1.43.0",
+    "@nuxt/schema": "4.4.2",
+    "@playwright/test": "1.58.2",
+    "@types/node": "25.5.0",
+    "@vitest/coverage-v8": "4.1.0",
+    "better-auth": "1.5.5",
+    "happy-dom": "20.8.4",
+    "nuxt": "4.4.2",
+    "oxfmt": "0.40.0",
+    "oxlint": "1.55.0",
     "tus-js-client": "4.3.1",
     "typescript": "5.9.3",
-    "vitest": "4.0.18",
-    "vue-tsc": "3.2.4"
+    "vitest": "4.1.0",
+    "vue-tsc": "3.2.5"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
       "@parcel/watcher",
       "esbuild"
-    ]
+    ],
+    "overrides": {
+      "minimatch@>=5.0.0 <5.1.8": "5.1.8",
+      "minimatch@>=9.0.0 <9.0.7": "9.0.7",
+      "minimatch@>=10.0.0 <10.2.3": "10.2.3",
+      "rollup@>=4.0.0 <4.59.0": ">=4.59.0",
+      "serialize-javascript@<=7.0.2": ">=7.0.3",
+      "svgo@=4.0.0": ">=4.0.1",
+      "tar@<7.5.11": "7.5.11"
+    }
   },
   "keywords": [
     "nuxt",