@lenne.tech/nuxt-extensions 1.7.1 → 1.8.1

package/dist/module.mjs

@@ -73,6 +73,9 @@ const module$1 = defineNuxtModule({
     if (!rc.public.apiUrl) {
       rc.public.apiUrl = "";
     }
+    if (!rc.public.cookiePrefix) {
+      rc.public.cookiePrefix = "";
+    }
     nuxt.options.runtimeConfig.public.ltExtensions = {
       ai: {
         basePath: resolvedOptions.ai?.basePath || "/ai",

package/dist/runtime/composables/auth/use-lt-auth.js

@@ -1,6 +1,6 @@
-import { useNuxtApp, useCookie, useState, ref, computed, watch } from "#imports";
+import { useNuxtApp, useCookie, useState, useRequestHeaders, ref, computed, watch } from "#imports";
 import { ltArrayBufferToBase64Url, ltBase64UrlToUint8Array } from "../../utils/crypto.js";
-import { clearLtAuthCookies, getLtApiBase, getLtAuthCookieNames } from "../../lib/auth-state.js";
+import { clearLtAuthCookies, getLtApiBase, getLtAuthCookieNames, resolveLtAuthState } from "../../lib/auth-state.js";
 import { useLtAuthClient } from "../use-lt-auth-client.js";
 function useTranslation() {
   const nuxtApp = useNuxtApp();
@@ -23,32 +23,28 @@ export function useLtAuth() {
   });
   if (import.meta.client) {
     try {
-      const cookieStr = document.cookie.split("; ").find((row) => row.startsWith(`${stateCookieName}=`));
-      if (cookieStr) {
-        const parts = cookieStr.split("=");
-        const value = parts.length > 1 ? decodeURIComponent(parts.slice(1).join("=")) : "";
-        if (value) {
-          const parsed = JSON.parse(value);
-          if (parsed?.user && !authState.value?.user) {
-            authState.value = parsed;
-          }
-        }
+      const resolved = resolveLtAuthState(document.cookie, stateCookieName);
+      if (resolved?.user && !authState.value?.user) {
+        authState.value = resolved;
       }
     } catch {
     }
   }
-  if (import.meta.server && (authState.value === null || authState.value === void 0)) {
-    authState.value = { user: null, authMode: "cookie" };
-  }
+  const ssrCookieHeader = import.meta.server ? useRequestHeaders(["cookie"]).cookie || "" : "";
   const jwtToken = useCookie(tokenCookieName, {
     maxAge: 60 * 60 * 24 * 7,
     // 7 days
     sameSite: "lax"
   });
   const isLoading = ref(false);
-  const authMode = computed(() => authState.value?.authMode || "cookie");
+  const resolvedAuthState = computed(() => {
+    const refVal = authState.value;
+    const cookieString = import.meta.client ? document.cookie : ssrCookieHeader;
+    return resolveLtAuthState(cookieString, stateCookieName) ?? refVal ?? null;
+  });
+  const authMode = computed(() => resolvedAuthState.value?.authMode || "cookie");
   const isJwtMode = computed(() => authMode.value === "jwt");
-  const user = computed(() => authState.value?.user ?? null);
+  const user = computed(() => resolvedAuthState.value?.user ?? null);
   const isAuthenticated = computed(() => !!user.value);
   const isAdmin = computed(() => user.value?.role === "admin");
   const is2FAEnabled = computed(() => user.value?.twoFactorEnabled ?? false);
@@ -56,7 +52,9 @@ export function useLtAuth() {
   const featuresFetched = useState("lt-auth-features-fetched", () => false);
   function setUser(userData, mode = "cookie") {
     const newState = { user: userData, authMode: mode };
-    authState.value = newState;
+    if (import.meta.client || userData) {
+      authState.value = newState;
+    }
     if (import.meta.client) {
       const maxAge = 60 * 60 * 24 * 7;
       const secure = globalThis.location?.protocol === "https:" ? "; secure" : "";
@@ -64,10 +62,9 @@ export function useLtAuth() {
     }
   }
   function clearUser() {
-    const clearedState = { user: null, authMode: "cookie" };
-    authState.value = clearedState;
-    jwtToken.value = null;
     if (import.meta.client) {
+      authState.value = { user: null, authMode: "cookie" };
+      jwtToken.value = null;
       clearLtAuthCookies();
     }
   }

package/dist/runtime/lib/auth-state.d.ts

@@ -11,21 +11,85 @@
  *
  * The state is persisted in cookies for SSR compatibility.
  */
-import type { LtAuthMode } from '../types/index.js';
+import type { LtAuthMode, LtAuthState } from '../types/index.js';
 /** Default name of the auth-state cookie. Used when the module config has not been resolved yet. */
 export declare const LT_AUTH_STATE_COOKIE_DEFAULT = "lt-auth-state";
 /** Default name of the JWT-token cookie. Used when the module config has not been resolved yet. */
 export declare const LT_JWT_TOKEN_COOKIE_DEFAULT = "lt-jwt-token";
+/**
+ * Resolve the cookie prefix that drives the auth cookie names.
+ *
+ * A single, dedicated, OPT-IN knob with a safe default:
+ *   - **`cookiePrefix`** (`NUXT_PUBLIC_COOKIE_PREFIX` →
+ *     `runtimeConfig.public.cookiePrefix`) → `<prefix>-auth-state` /
+ *     `<prefix>-jwt-token`. Lets a project run with its own cookie namespace —
+ *     e.g. several lenne.tech apps on a shared host during development, where
+ *     cookies collide by host (not port) and would otherwise read each other's
+ *     `lt-auth-state` (a "ghost" user from the other project).
+ *   - otherwise `''` → the default `lt-auth-state` / `lt-jwt-token`.
+ *
+ * `storagePrefix` deliberately does NOT influence the cookie name. It is a
+ * localStorage-namespacing convention; coupling it to cookies would silently
+ * rename auth cookies on a mere upgrade (logging every user out, bouncing valid
+ * sessions in custom middleware that reads `lt-auth-state` directly) and force
+ * frontend/backend to be deployed in lockstep. Cookie naming is therefore
+ * controlled ONLY by this explicit, opt-in knob → fully backward compatible.
+ *
+ * IMPORTANT: when you set `cookiePrefix`, mirror it on the backend
+ * (`COOKIE_PREFIX` env — see nest-server `resolveBetterAuthCookiePrefix`) so
+ * both sides always agree on the cookie name.
+ */
+export declare function resolveLtCookiePrefix(pub: null | Record<string, any> | undefined): string;
 /**
  * Resolve the configured auth cookie names from runtime config.
  *
- * Falls back to the defaults (`lt-auth-state`, `lt-jwt-token`) so callers
- * keep working even outside a Nuxt context (tests, edge SSR boots).
+ * **Per-project isolation (collision avoidance).** Cookies are scoped by
+ * host+path, NOT by port. Two lenne.tech apps sharing a host during development
+ * (e.g. both on `localhost`) would otherwise read each other's `lt-auth-state`
+ * cookie — surfacing a "ghost" user from the other project. The cookie name is
+ * therefore derived from a per-project prefix (see {@link resolveLtCookiePrefix}).
+ *
+ * Resolution order:
+ *   1. an explicitly configured `cookieNames.state/token` (exact name) always wins;
+ *   2. otherwise `<prefix>-auth-state` / `<prefix>-jwt-token` where `prefix`
+ *      comes from {@link resolveLtCookiePrefix} (the opt-in `cookiePrefix`);
+ *   3. otherwise fall back to the legacy `lt-auth-state` / `lt-jwt-token`
+ *      (backward compatible — no behaviour change for apps without a prefix).
+ *
+ * Falls back to the defaults so callers keep working even outside a Nuxt
+ * context (tests, edge SSR boots).
  */
 export declare function getLtAuthCookieNames(): {
     state: string;
     token: string;
 };
+/**
+ * Resolve the authoritative auth state from a raw `Cookie` header /
+ * `document.cookie` string, tolerating **multiple** auth-state cookies with the
+ * same name.
+ *
+ * A deployed setup can end up with TWO auth-state cookies in parallel — a
+ * host-only one (written by `useCookie` / `setUser`) and a domain-scoped one
+ * (e.g. set by a backend SAML callback with `Domain=<appHost>` so it is
+ * readable across `app` and `api.app`). They can disagree: one carries the
+ * signed-in user, the other a stale `{ user: null }` left behind by a partial
+ * clear. A naive single-value read (`useCookie`, or `document.cookie.find`)
+ * may pick the stale twin and wrongly report the user as logged out — which
+ * makes SSR auth guards bounce a perfectly valid session to the login page.
+ *
+ * This scans ALL matching entries and prefers the one that actually carries a
+ * `user`; only when none do does it return the (user-less) fallback state.
+ *
+ * SECURITY NOTE: preferring the user-bearing twin is intentional and required —
+ * preferring the `{ user: null }` twin is exactly what caused the random logout.
+ * `lt-auth-state` is a NON-authoritative client convenience cache for the app
+ * shell, NOT the session identifier (that is the httpOnly session cookie, e.g.
+ * `iam.session_token`). A forged/injected user-bearing cookie therefore yields
+ * at most UI spoofing ("looks logged in") — every real API/server call still
+ * authenticates against the httpOnly session and 401s. This trust boundary is
+ * unchanged by the duplicate-tolerant read; it only decides which twin wins.
+ */
+export declare function resolveLtAuthState(cookieString: string, stateCookieName?: string): LtAuthState | null;
 /**
  * Determines if HTTP requests should use the Nuxt Vite dev proxy.
  *

package/dist/runtime/lib/auth-state.js

@@ -1,18 +1,47 @@
 import { useRuntimeConfig } from "#imports";
 export const LT_AUTH_STATE_COOKIE_DEFAULT = "lt-auth-state";
 export const LT_JWT_TOKEN_COOKIE_DEFAULT = "lt-jwt-token";
+function sanitizeCookiePrefix(raw) {
+  if (typeof raw !== "string") {
+    return "";
+  }
+  return raw.trim().replace(/[^A-Za-z0-9._-]/g, "");
+}
+export function resolveLtCookiePrefix(pub) {
+  return sanitizeCookiePrefix(pub?.cookiePrefix);
+}
 export function getLtAuthCookieNames() {
   try {
     const runtimeConfig = useRuntimeConfig();
-    const configured = runtimeConfig.public?.ltExtensions?.auth?.cookieNames;
-    return {
-      state: configured?.state || LT_AUTH_STATE_COOKIE_DEFAULT,
-      token: configured?.token || LT_JWT_TOKEN_COOKIE_DEFAULT
-    };
+    const pub = runtimeConfig.public;
+    const configured = pub?.ltExtensions?.auth?.cookieNames;
+    const prefix = resolveLtCookiePrefix(pub);
+    const state = configured?.state && configured.state !== LT_AUTH_STATE_COOKIE_DEFAULT ? configured.state : prefix ? `${prefix}-auth-state` : LT_AUTH_STATE_COOKIE_DEFAULT;
+    const token = configured?.token && configured.token !== LT_JWT_TOKEN_COOKIE_DEFAULT ? configured.token : prefix ? `${prefix}-jwt-token` : LT_JWT_TOKEN_COOKIE_DEFAULT;
+    return { state, token };
   } catch {
     return { state: LT_AUTH_STATE_COOKIE_DEFAULT, token: LT_JWT_TOKEN_COOKIE_DEFAULT };
   }
 }
+export function resolveLtAuthState(cookieString, stateCookieName) {
+  const name = stateCookieName || getLtAuthCookieNames().state;
+  const prefix = `${name}=`;
+  let fallback = null;
+  for (const entry of (cookieString || "").split("; ")) {
+    if (!entry.startsWith(prefix)) continue;
+    try {
+      const state = JSON.parse(decodeURIComponent(entry.slice(prefix.length)));
+      if (state?.user) {
+        return state;
+      }
+      if (state) {
+        fallback = state;
+      }
+    } catch {
+    }
+  }
+  return fallback;
+}
 let _proxyFallbackWarned = false;
 export function isLocalDevApiProxy() {
   if (import.meta.server) {
@@ -65,31 +94,20 @@ export function buildLtApiUrl(path) {
 }
 export function getLtAuthMode() {
   if (import.meta.server) return "cookie";
-  try {
-    const { state: stateCookieName } = getLtAuthCookieNames();
-    const cookie = document.cookie.split("; ").find((row) => row.startsWith(`${stateCookieName}=`));
-    if (cookie) {
-      const parts = cookie.split("=");
-      const value = parts.length > 1 ? decodeURIComponent(parts.slice(1).join("=")) : "";
-      const state = JSON.parse(value);
-      return state?.authMode || "cookie";
-    }
-  } catch {
-  }
-  return "cookie";
+  return resolveLtAuthState(document.cookie)?.authMode || "cookie";
 }
 export function getLtJwtToken() {
   if (import.meta.server) return null;
   try {
     const { token: tokenCookieName } = getLtAuthCookieNames();
-    const cookie = document.cookie.split("; ").find((row) => row.startsWith(`${tokenCookieName}=`));
-    if (cookie) {
-      const parts = cookie.split("=");
-      const value = parts.length > 1 ? decodeURIComponent(parts.slice(1).join("=")) : "";
-      if (value.startsWith('"') && value.endsWith('"')) {
-        return JSON.parse(value);
+    const cookiePrefix = `${tokenCookieName}=`;
+    for (const row of document.cookie.split("; ")) {
+      if (!row.startsWith(cookiePrefix)) continue;
+      const raw = decodeURIComponent(row.slice(cookiePrefix.length));
+      const value = raw.startsWith('"') && raw.endsWith('"') ? JSON.parse(raw) : raw;
+      if (value) {
+        return value;
       }
-      return value || null;
     }
   } catch {
   }
@@ -110,27 +128,32 @@ export function clearLtAuthCookies() {
   if (import.meta.server) return;
   const { state: stateCookieName, token: tokenCookieName } = getLtAuthCookieNames();
   const secure = globalThis.location?.protocol === "https:" ? "; secure" : "";
+  const host = globalThis.location?.hostname;
+  const domainAttr = host ? `; domain=${host}` : "";
   document.cookie = `${stateCookieName}=; path=/; max-age=0; samesite=lax${secure}`;
+  if (domainAttr) {
+    document.cookie = `${stateCookieName}=; path=/; max-age=0; samesite=lax${secure}${domainAttr}`;
+  }
   document.cookie = `${tokenCookieName}=; path=/; max-age=0; samesite=lax${secure}`;
+  if (domainAttr) {
+    document.cookie = `${tokenCookieName}=; path=/; max-age=0; samesite=lax${secure}${domainAttr}`;
+  }
   const sessionCookieNames = ["better-auth.session_token", "better-auth.session", "__Secure-better-auth.session_token", "session_token", "session"];
   for (const name of sessionCookieNames) {
-    document.cookie = `${name}=; path=/; max-age=0`;
-    document.cookie = `${name}=; path=/api; max-age=0`;
-    document.cookie = `${name}=; path=/api/iam; max-age=0`;
-    document.cookie = `${name}=; path=/iam; max-age=0`;
+    for (const path of ["/", "/api", "/api/iam", "/iam"]) {
+      document.cookie = `${name}=; path=${path}; max-age=0`;
+      if (domainAttr) {
+        document.cookie = `${name}=; path=${path}; max-age=0${domainAttr}`;
+      }
+    }
   }
 }
 export function setLtAuthMode(mode) {
   if (import.meta.server) return;
   try {
     const { state: stateCookieName } = getLtAuthCookieNames();
-    const cookie = document.cookie.split("; ").find((row) => row.startsWith(`${stateCookieName}=`));
-    let state = { user: null, authMode: mode };
-    if (cookie) {
-      const parts = cookie.split("=");
-      const value = parts.length > 1 ? decodeURIComponent(parts.slice(1).join("=")) : "";
-      state = { ...JSON.parse(value), authMode: mode };
-    }
+    const existing = resolveLtAuthState(document.cookie, stateCookieName);
+    const state = { ...existing ?? { user: null }, authMode: mode };
     const maxAge = 60 * 60 * 24 * 7;
     const secure = globalThis.location?.protocol === "https:" ? "; secure" : "";
     document.cookie = `${stateCookieName}=${encodeURIComponent(JSON.stringify(state))}; path=/; max-age=${maxAge}; samesite=lax${secure}`;
@@ -170,18 +193,7 @@ export async function attemptLtJwtSwitch(basePath = "/iam") {
 }
 export function isLtAuthenticated() {
   if (import.meta.server) return false;
-  try {
-    const { state: stateCookieName } = getLtAuthCookieNames();
-    const cookie = document.cookie.split("; ").find((row) => row.startsWith(`${stateCookieName}=`));
-    if (cookie) {
-      const parts = cookie.split("=");
-      const value = parts.length > 1 ? decodeURIComponent(parts.slice(1).join("=")) : "";
-      const state = JSON.parse(value);
-      return !!state?.user;
-    }
-  } catch {
-  }
-  return false;
+  return !!resolveLtAuthState(document.cookie)?.user;
 }
 export function createLtAuthFetch(basePath = "/iam") {
   return async function ltAuthFetch2(input, init) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.7.1",
+  "version": "1.8.1",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -51,7 +51,8 @@
     "prepare": "git config core.hooksPath .githooks",
     "prepack": "node scripts/sync-module-version.mjs && nuxt-module-build build",
     "c": "pnpm run check",
-    "check": "pnpm audit && pnpm run format:check && pnpm run lint && pnpm run dev:prepare && pnpm test:types && pnpm test && pnpm run build",
+    "check": "node scripts/check.mjs",
+    "check:raw": "pnpm audit && pnpm run format:check && pnpm run lint && pnpm run dev:prepare && pnpm test:types && pnpm test && pnpm run build",
     "check:fix": "pnpm install && pnpm audit --fix && pnpm run format && pnpm run lint:fix && pnpm test:types && pnpm test && pnpm run build",
     "check:naf": "pnpm install && pnpm run format && pnpm run lint:fix && pnpm test:types && pnpm test && pnpm run build",
     "cf": "pnpm run check:fix",
@@ -121,7 +122,14 @@
       "brace-expansion@>=5.0.0 <5.0.6": "5.0.6",
       "devalue@>=5.6.3 <=5.8.0": "5.8.1",
       "kysely@>=0.26.0 <0.28.17": "0.28.17",
-      "ws@>=8.0.0 <8.20.1": "8.21.0"
+      "ws@>=8.0.0 <8.20.1": "8.21.0",
+      "shell-quote@<1.8.4": "1.8.4",
+      "nuxt@<4.4.7": "4.4.7",
+      "vite@>=7.0.0 <7.3.5": "7.3.5",
+      "tar@<7.5.16": "7.5.16",
+      "launch-editor@<2.14.1": "2.14.1",
+      "esbuild@<0.28.1": "0.28.1",
+      "@babel/core@<7.29.6": "7.29.6"
     }
   },
   "keywords": [