@lenne.tech/nuxt-extensions 1.8.3 → 1.8.4

package/dist/runtime/plugins/auth-interceptor.client.d.ts

@@ -2,10 +2,17 @@
  * Auth Interceptor Plugin
  *
  * This plugin intercepts all API responses and handles session expiration.
- * When a 401 (Unauthorized) response is received, it automatically:
+ * When a 401 (Unauthorized) response is received, it verifies against the
+ * session endpoint that the session is genuinely dead and then automatically:
  * 1. Clears the user session state
  * 2. Redirects to the login page
  *
+ * The verification step exists because a 401 from a domain endpoint is not
+ * proof of an expired session: backends may mislabel permission errors
+ * (authenticated user, missing rights — semantically 403) as 401. Logging out
+ * on those would kick a logged-in user out of the app for a mere missing
+ * right. Only a dead session may clear state.
+ *
  * Note: This is a client-only plugin (.client.ts) since auth state
  * management only makes sense in the browser context.
  */

package/dist/runtime/plugins/auth-interceptor.client.js

@@ -1,4 +1,5 @@
 import { useLtAuth } from "../composables/auth/use-lt-auth.js";
+import { getLtApiBase } from "../lib/auth-state.js";
 export default (nuxtApp) => {
   if (import.meta.server) return;
   let _authInstance = null;
@@ -42,6 +43,19 @@ export default (nuxtApp) => {
     ];
     return authEndpoints.some((endpoint) => url.includes(endpoint));
   }
+  async function isSessionStillAlive() {
+    try {
+      const { fetchWithAuth } = getAuth();
+      const response = await fetchWithAuth(`${getLtApiBase()}/get-session`, { method: "GET" });
+      if (!response.ok) {
+        return false;
+      }
+      const data = await response.json().catch(() => null);
+      return Boolean(data && (data.user || data.session));
+    } catch {
+      return null;
+    }
+  }
   async function handleUnauthorized(requestUrl) {
     if (isHandling401) {
       return;
@@ -56,6 +70,13 @@ export default (nuxtApp) => {
     try {
       const { clearUser, isAuthenticated } = getAuth();
       if (isAuthenticated.value) {
+        const sessionAlive = await isSessionStillAlive();
+        if (sessionAlive !== false) {
+          console.debug(
+            sessionAlive ? `[LtAuth Interceptor] 401 from ${requestUrl ?? "unknown URL"} but session is still valid \u2014 treating it as a permission error, not logging out` : "[LtAuth Interceptor] 401 received but session state could not be verified \u2014 not logging out"
+          );
+          return;
+        }
         console.debug("[LtAuth Interceptor] Session expired, logging out...");
         clearUser();
         const router = nuxtApp.$router;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",