@lenne.tech/nuxt-extensions 1.8.2 → 1.8.3

package/CLAUDE.md

@@ -133,6 +133,13 @@ The `useLtAuth()` composable manages the `lt-auth-state` cookie for authenticati
 3. If `useLtAuth()` can't find a valid user in the cookie on the server, it initializes with `{user: null}` — this is intentional and correct
 4. The `iam.session_token` httpOnly cookie (set by Better Auth) is the actual session identifier — `lt-auth-state` is a convenience cache for the client-side middleware
 
+### Session User Merge (nest-server-only fields):
+On session re-validation (`validateSession()` at app init / hard reload, and the passkey get-session fallback), `useLtAuth()` **merges** the Better-Auth session user onto the cached user of the SAME identity via the private `mergeSessionUser()`, instead of overwriting it. Consequences you must know:
+
+- **nest-server-only fields persist across reloads.** Better-Auth's get-session returns only Better-Auth-owned fields (id/email/name + registered additionalFields). Fields it does not own (e.g. custom preferences like `leadTableColumns`) previously vanished on every reload; they now survive. If you built a workaround that re-fetched such fields after each reload, you can retire it.
+- **Authorization fields are fail-closed.** `role`, `banned`, `banExpires`, `banReason`, `emailVerified`, `twoFactorEnabled` always reflect the session — any of these the session omits is dropped from the merge (never kept stale), so a backend downgrade is reflected client-side. If your project adds its OWN authorization-relevant user field, either register it as a Better-Auth additionalField (so get-session returns it) or add it to the `AUTHZ_KEYS` list in `use-lt-auth.ts` — otherwise it could persist stale in the client cache.
+- **Keep the cached user lean.** `lt-auth-state` is a non-httpOnly cookie sent on every same-site request and capped at ~4 KB by browsers. Because the merge keeps preference fields across reloads, large blobs on the user object can push the cookie over the limit — the browser then silently rejects the write and the next reload reads as a logout. `setUser` emits a dev-mode warning above ~3.5 KB; move large preference data off the user object and fetch it from an authenticated API.
+
 ### Custom Auth Middleware Pattern:
 ```typescript
 // CORRECT — read-only check, no cookie mutation

package/dist/runtime/composables/auth/use-lt-auth.js

@@ -58,7 +58,13 @@ export function useLtAuth() {
     if (import.meta.client) {
       const maxAge = 60 * 60 * 24 * 7;
       const secure = globalThis.location?.protocol === "https:" ? "; secure" : "";
-      document.cookie = `${stateCookieName}=${encodeURIComponent(JSON.stringify(newState))}; path=/; max-age=${maxAge}; samesite=lax${secure}`;
+      const encoded = encodeURIComponent(JSON.stringify(newState));
+      if (import.meta.dev && encoded.length > 3500) {
+        console.warn(
+          `[lt-auth] lt-auth-state cookie is ${encoded.length} bytes (encoded), approaching the ~4KB browser limit \u2014 an oversized cookie is dropped on write and reads as a logout on reload. Keep the cached user lean: move large preference data off the user object.`
+        );
+      }
+      document.cookie = `${stateCookieName}=${encoded}; path=/; max-age=${maxAge}; samesite=lax${secure}`;
     }
   }
   function clearUser() {
@@ -123,6 +129,20 @@ export function useLtAuth() {
     }
     return response;
   }
+  const AUTHZ_KEYS = ["banExpires", "banReason", "banned", "emailVerified", "role", "twoFactorEnabled"];
+  function mergeSessionUser(sessionUser) {
+    const cached = resolvedAuthState.value?.user;
+    if (!cached?.id || !sessionUser?.id || cached.id !== sessionUser.id) {
+      return sessionUser;
+    }
+    const merged = { ...cached, ...sessionUser };
+    for (const key of AUTHZ_KEYS) {
+      if (!(key in sessionUser)) {
+        delete merged[key];
+      }
+    }
+    return merged;
+  }
   async function validateSession() {
     try {
       const session = authClient.useSession();
@@ -141,7 +161,7 @@ export function useLtAuth() {
         });
       }
       if (session.value.data?.user) {
-        setUser(session.value.data.user, "cookie");
+        setUser(mergeSessionUser(session.value.data.user), "cookie");
         switchToJwtMode().catch(() => {
         });
         return true;
@@ -297,8 +317,9 @@ export function useLtAuth() {
           if (sessionResponse.ok) {
             const sessionData = await sessionResponse.json();
             if (sessionData?.user) {
-              result.user = sessionData.user;
-              setUser(sessionData.user, "cookie");
+              const mergedUser = mergeSessionUser(sessionData.user);
+              result.user = mergedUser;
+              setUser(mergedUser, "cookie");
               switchToJwtMode().catch(() => {
               });
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",