@lupinum/better-convex-nuxt 0.8.0-beta.40

package/dist/runtime/plugin.server.js

@@ -0,0 +1,98 @@
+import { defineNuxtPlugin, useState, useRuntimeConfig, useRequestEvent } from "#app";
+import { ANONYMOUS_IDENTITY, toAuthenticatedIdentity } from "./auth/auth-identity.js";
+import { resolveServerAuthSnapshot } from "./server/utils/auth-snapshot.js";
+import { applyConvexAuthSsrHeaders } from "./server/utils/ssr-auth-headers.js";
+import { buildMissingSiteUrlMessage } from "./utils/auth-errors.js";
+import { useConvexIdentityState } from "./utils/auth-identity-state.js";
+import { createLogger, getLogLevel } from "./utils/logger.js";
+import { getConvexRuntimeConfig } from "./utils/runtime-config.js";
+import { filterBetterAuthCookies } from "./utils/shared-helpers.js";
+export default defineNuxtPlugin(async () => {
+  const config = useRuntimeConfig();
+  const convexConfig = getConvexRuntimeConfig();
+  const authConfig = convexConfig.auth;
+  const publicConvex = config.public.convex;
+  const logLevel = getLogLevel(publicConvex);
+  const logger = createLogger(logLevel);
+  const endInit = logger.time("plugin:init (server)");
+  if (authConfig === false) {
+    throw new Error("[better-convex-nuxt] auth server plugin loaded in a no-auth build");
+  }
+  const event = useRequestEvent();
+  if (!event) {
+    logger.auth({
+      phase: "init",
+      outcome: "error",
+      details: { code: "AUTH_REQUEST_EVENT_MISSING" }
+    });
+    return;
+  }
+  const requestMethod = event.method || "GET";
+  const requestId = crypto.randomUUID();
+  const traceEnabled = logLevel === "debug";
+  const convexIdentity = useConvexIdentityState();
+  const cookieHeader = event.headers.get("cookie");
+  const hasSupportedBetterAuthCookie = filterBetterAuthCookies(cookieHeader) !== null;
+  const siteUrl = convexConfig.siteUrl;
+  if (!siteUrl) {
+    applyConvexAuthSsrHeaders(event, {
+      hasBetterAuthCookie: hasSupportedBetterAuthCookie,
+      serializesToken: false
+    });
+    const message = buildMissingSiteUrlMessage();
+    const convexAuthError2 = useState("convex:authError", () => null);
+    convexAuthError2.value = message;
+    endInit();
+    logger.auth({
+      phase: "init",
+      outcome: "error",
+      details: { code: "AUTH_SITE_URL_MISSING" }
+    });
+    return;
+  }
+  const logAuth = (phase, outcome, details) => {
+    logger.auth({
+      phase,
+      outcome,
+      details: traceEnabled ? { requestId, method: requestMethod, ...details } : details
+    });
+  };
+  if (traceEnabled) {
+    logAuth("ssr.auth.started", "success", {
+      hasSupportedAuthCookie: hasSupportedBetterAuthCookie
+    });
+  }
+  const convexAuthError = useState("convex:authError", () => null);
+  const convexAuthWaterfall = useState("convex:authWaterfall", () => null);
+  const snapshotStartedAt = Date.now();
+  const snapshot = await resolveServerAuthSnapshot({
+    event,
+    siteUrl,
+    cookieHeader,
+    requestId,
+    trackWaterfall: import.meta.dev,
+    trustedClientIpHeader: authConfig.trustedClientIpHeader
+  });
+  convexIdentity.value = snapshot.token && snapshot.user ? toAuthenticatedIdentity(snapshot.token, snapshot.user) : ANONYMOUS_IDENTITY;
+  convexAuthError.value = snapshot.authError;
+  convexAuthWaterfall.value = snapshot.waterfall;
+  applyConvexAuthSsrHeaders(event, {
+    hasBetterAuthCookie: hasSupportedBetterAuthCookie,
+    serializesToken: snapshot.token !== null
+  });
+  endInit();
+  for (const logEvent of snapshot.logEvents) {
+    logAuth(logEvent.phase, logEvent.outcome, logEvent.details);
+  }
+  if (traceEnabled) {
+    logAuth(
+      "ssr.auth.completed",
+      snapshot.token ? "success" : snapshot.authError ? "error" : "miss",
+      {
+        durationMs: Date.now() - snapshotStartedAt,
+        identityHydrated: snapshot.user !== null,
+        tokenSerialized: snapshot.token !== null
+      }
+    );
+  }
+});

package/dist/runtime/plugins/convex-call-error-payload.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Universal Nuxt payload plugin for {@link ConvexCallError} (internal
+ *). Registered with `mode: 'all'` and an explicit negative `order` (-50) by
+ * `src/module.ts`, so the reviver exists before Nuxt parses the SSR payload.
+ *
+ * The framework-free `/errors` entry stays unaware of Nuxt; this Nuxt-aware
+ * plugin is the only place the two meet. The reducer emits the public
+ * `toJSON()` shape (never `cause`); the reviver reconstructs a real
+ * `ConvexCallError` — instance identity survives hydration — WITHOUT a `cause`,
+ * and only after strict structural validation, so an arbitrary object carrying
+ * `name: 'ConvexCallError'` is never revived.
+ */
+declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+export default _default;

package/dist/runtime/plugins/convex-call-error-payload.js

@@ -0,0 +1,12 @@
+import { definePayloadPlugin, definePayloadReducer, definePayloadReviver } from "#app";
+import { ConvexCallError, isSerializedConvexCallError } from "../errors/index.js";
+export default definePayloadPlugin(() => {
+  definePayloadReducer("ConvexCallError", (value) => {
+    if (!(value instanceof ConvexCallError)) return;
+    return value.toJSON();
+  });
+  definePayloadReviver("ConvexCallError", (value) => {
+    if (!isSerializedConvexCallError(value)) return;
+    return new ConvexCallError(value);
+  });
+});

package/dist/runtime/runtime-context.d.ts

@@ -0,0 +1,26 @@
+import type { BetterConvexAttachment } from '@lupinum/better-convex-vue/embedded';
+import type { ComputedRef } from 'vue';
+import type { DevtoolsSink } from './devtools/sink.js';
+import type { ConvexAuthStatus } from './utils/auth-status.js';
+import type { Logger } from './utils/logger.js';
+/** Nuxt-owned Better Auth presentation; it never controls a Convex client. */
+export interface NuxtConvexAuthController {
+    readonly isPending: ComputedRef<boolean>;
+    readonly client: object;
+    ready(options?: {
+        timeoutMs?: number;
+    }): Promise<ConvexAuthStatus>;
+    dispose(): void;
+}
+/** Nuxt adapters around the one Vue-owned browser runtime. */
+export interface ConvexRuntimeContext {
+    readonly attachment: BetterConvexAttachment;
+    readonly logger: Logger;
+    getAuthController(): NuxtConvexAuthController | null;
+    attachAuthController(controller: NuxtConvexAuthController): void;
+    getDevtoolsSink(): DevtoolsSink | null;
+    attachDevtoolsSink(sink: DevtoolsSink): (() => void) | null;
+    dispose(): void;
+}
+export declare function readConvexRuntimeContext(nuxtApp: unknown): ConvexRuntimeContext | undefined;
+export declare function createConvexRuntimeContext(attachment: BetterConvexAttachment, logger: Logger): ConvexRuntimeContext;

package/dist/runtime/runtime-context.js

@@ -0,0 +1,48 @@
+export function readConvexRuntimeContext(nuxtApp) {
+  if (typeof nuxtApp !== "object" && typeof nuxtApp !== "function" || nuxtApp === null) {
+    return void 0;
+  }
+  return nuxtApp.$convexRuntime;
+}
+export function createConvexRuntimeContext(attachment, logger) {
+  let authController = null;
+  let devtoolsSink = null;
+  let disposed = false;
+  const stopIdentityObservation = attachment.identity.subscribe(() => {
+    devtoolsSink?.clearIdentityOwned();
+  });
+  const context = {
+    attachment,
+    logger,
+    getAuthController: () => authController,
+    attachAuthController(controller) {
+      if (authController && authController !== controller) {
+        throw new Error("[convex-runtime] auth controller is already attached");
+      }
+      authController = controller;
+    },
+    getDevtoolsSink: () => devtoolsSink,
+    attachDevtoolsSink(sink) {
+      if (disposed) {
+        sink.dispose();
+        return null;
+      }
+      devtoolsSink?.dispose();
+      devtoolsSink = sink;
+      return () => {
+        if (devtoolsSink !== sink) return;
+        devtoolsSink = null;
+        sink.dispose();
+      };
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      stopIdentityObservation();
+      authController?.dispose();
+      devtoolsSink?.dispose();
+      devtoolsSink = null;
+    }
+  };
+  return Object.freeze(context);
+}

package/dist/runtime/server/api/auth/[...].d.ts

@@ -0,0 +1,10 @@
+export interface AuthProxyHandlerOptions {
+    allowedMethods?: readonly string[];
+    /** Fixed issuer-relative path for a standards-defined public alias. */
+    fixedAuthPath?: string;
+    /** Expose a standards-defined, credential-free metadata document to browsers. */
+    publicMetadataCors?: boolean;
+}
+export declare function createAuthProxyHandler(options?: AuthProxyHandlerOptions): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;