@lenne.tech/nuxt-extensions 1.8.2 → 1.8.4

package/CLAUDE.md

@@ -133,6 +133,13 @@ The `useLtAuth()` composable manages the `lt-auth-state` cookie for authenticati
 3. If `useLtAuth()` can't find a valid user in the cookie on the server, it initializes with `{user: null}` — this is intentional and correct
 4. The `iam.session_token` httpOnly cookie (set by Better Auth) is the actual session identifier — `lt-auth-state` is a convenience cache for the client-side middleware
 
+### Session User Merge (nest-server-only fields):
+On session re-validation (`validateSession()` at app init / hard reload, and the passkey get-session fallback), `useLtAuth()` **merges** the Better-Auth session user onto the cached user of the SAME identity via the private `mergeSessionUser()`, instead of overwriting it. Consequences you must know:
+
+- **nest-server-only fields persist across reloads.** Better-Auth's get-session returns only Better-Auth-owned fields (id/email/name + registered additionalFields). Fields it does not own (e.g. custom preferences like `leadTableColumns`) previously vanished on every reload; they now survive. If you built a workaround that re-fetched such fields after each reload, you can retire it.
+- **Authorization fields are fail-closed.** `role`, `banned`, `banExpires`, `banReason`, `emailVerified`, `twoFactorEnabled` always reflect the session — any of these the session omits is dropped from the merge (never kept stale), so a backend downgrade is reflected client-side. If your project adds its OWN authorization-relevant user field, either register it as a Better-Auth additionalField (so get-session returns it) or add it to the `AUTHZ_KEYS` list in `use-lt-auth.ts` — otherwise it could persist stale in the client cache.
+- **Keep the cached user lean.** `lt-auth-state` is a non-httpOnly cookie sent on every same-site request and capped at ~4 KB by browsers. Because the merge keeps preference fields across reloads, large blobs on the user object can push the cookie over the limit — the browser then silently rejects the write and the next reload reads as a logout. `setUser` emits a dev-mode warning above ~3.5 KB; move large preference data off the user object and fetch it from an authenticated API.
+
 ### Custom Auth Middleware Pattern:
 ```typescript
 // CORRECT — read-only check, no cookie mutation

package/dist/runtime/composables/auth/use-lt-auth.js

@@ -58,7 +58,13 @@ export function useLtAuth() {
     if (import.meta.client) {
       const maxAge = 60 * 60 * 24 * 7;
       const secure = globalThis.location?.protocol === "https:" ? "; secure" : "";
-      document.cookie = `${stateCookieName}=${encodeURIComponent(JSON.stringify(newState))}; path=/; max-age=${maxAge}; samesite=lax${secure}`;
+      const encoded = encodeURIComponent(JSON.stringify(newState));
+      if (import.meta.dev && encoded.length > 3500) {
+        console.warn(
+          `[lt-auth] lt-auth-state cookie is ${encoded.length} bytes (encoded), approaching the ~4KB browser limit \u2014 an oversized cookie is dropped on write and reads as a logout on reload. Keep the cached user lean: move large preference data off the user object.`
+        );
+      }
+      document.cookie = `${stateCookieName}=${encoded}; path=/; max-age=${maxAge}; samesite=lax${secure}`;
     }
   }
   function clearUser() {
@@ -123,6 +129,20 @@ export function useLtAuth() {
     }
     return response;
   }
+  const AUTHZ_KEYS = ["banExpires", "banReason", "banned", "emailVerified", "role", "twoFactorEnabled"];
+  function mergeSessionUser(sessionUser) {
+    const cached = resolvedAuthState.value?.user;
+    if (!cached?.id || !sessionUser?.id || cached.id !== sessionUser.id) {
+      return sessionUser;
+    }
+    const merged = { ...cached, ...sessionUser };
+    for (const key of AUTHZ_KEYS) {
+      if (!(key in sessionUser)) {
+        delete merged[key];
+      }
+    }
+    return merged;
+  }
   async function validateSession() {
     try {
       const session = authClient.useSession();
@@ -141,7 +161,7 @@ export function useLtAuth() {
         });
       }
       if (session.value.data?.user) {
-        setUser(session.value.data.user, "cookie");
+        setUser(mergeSessionUser(session.value.data.user), "cookie");
         switchToJwtMode().catch(() => {
         });
         return true;
@@ -297,8 +317,9 @@ export function useLtAuth() {
           if (sessionResponse.ok) {
             const sessionData = await sessionResponse.json();
             if (sessionData?.user) {
-              result.user = sessionData.user;
-              setUser(sessionData.user, "cookie");
+              const mergedUser = mergeSessionUser(sessionData.user);
+              result.user = mergedUser;
+              setUser(mergedUser, "cookie");
               switchToJwtMode().catch(() => {
               });
             }

package/dist/runtime/plugins/auth-interceptor.client.d.ts

@@ -2,10 +2,17 @@
  * Auth Interceptor Plugin
  *
  * This plugin intercepts all API responses and handles session expiration.
- * When a 401 (Unauthorized) response is received, it automatically:
+ * When a 401 (Unauthorized) response is received, it verifies against the
+ * session endpoint that the session is genuinely dead and then automatically:
  * 1. Clears the user session state
  * 2. Redirects to the login page
  *
+ * The verification step exists because a 401 from a domain endpoint is not
+ * proof of an expired session: backends may mislabel permission errors
+ * (authenticated user, missing rights — semantically 403) as 401. Logging out
+ * on those would kick a logged-in user out of the app for a mere missing
+ * right. Only a dead session may clear state.
+ *
  * Note: This is a client-only plugin (.client.ts) since auth state
  * management only makes sense in the browser context.
  */

package/dist/runtime/plugins/auth-interceptor.client.js

@@ -1,4 +1,5 @@
 import { useLtAuth } from "../composables/auth/use-lt-auth.js";
+import { getLtApiBase } from "../lib/auth-state.js";
 export default (nuxtApp) => {
   if (import.meta.server) return;
   let _authInstance = null;
@@ -42,6 +43,19 @@ export default (nuxtApp) => {
     ];
     return authEndpoints.some((endpoint) => url.includes(endpoint));
   }
+  async function isSessionStillAlive() {
+    try {
+      const { fetchWithAuth } = getAuth();
+      const response = await fetchWithAuth(`${getLtApiBase()}/get-session`, { method: "GET" });
+      if (!response.ok) {
+        return false;
+      }
+      const data = await response.json().catch(() => null);
+      return Boolean(data && (data.user || data.session));
+    } catch {
+      return null;
+    }
+  }
   async function handleUnauthorized(requestUrl) {
     if (isHandling401) {
       return;
@@ -56,6 +70,13 @@ export default (nuxtApp) => {
     try {
       const { clearUser, isAuthenticated } = getAuth();
       if (isAuthenticated.value) {
+        const sessionAlive = await isSessionStillAlive();
+        if (sessionAlive !== false) {
+          console.debug(
+            sessionAlive ? `[LtAuth Interceptor] 401 from ${requestUrl ?? "unknown URL"} but session is still valid \u2014 treating it as a permission error, not logging out` : "[LtAuth Interceptor] 401 received but session state could not be verified \u2014 not logging out"
+          );
+          return;
+        }
         console.debug("[LtAuth Interceptor] Session expired, logging out...");
         clearUser();
         const router = nuxtApp.$router;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.8.2",
+  "version": "1.8.4",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",