@meistrari/auth-nuxt 3.0.0 → 3.0.1

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@meistrari/auth-nuxt",
   "configKey": "telaAuth",
-  "version": "2.1.3",
+  "version": "3.0.1",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/composables/application-auth.js

@@ -33,6 +33,11 @@ export function useTelaApplicationAuth() {
       throw new AuthorizationFlowError("The login function can only be called on the client side.");
     }
     const { state: stateKey, challenge: codeChallenge } = await $fetch("/auth/login", { method: "POST" });
+    const returnTo = new URL(window.location.href).searchParams.get("returnTo");
+    if (returnTo && returnTo.startsWith("/") && !returnTo.startsWith("//")) {
+      const returnUrlCookie = useCookie("tela-return-url", { sameSite: "lax", path: "/" });
+      returnUrlCookie.value = returnTo;
+    }
     const url = new URL("/applications/login", appConfig.application?.dashboardUrl);
     url.searchParams.set("application_id", applicationId);
     url.searchParams.set("code_challenge", codeChallenge);

package/dist/runtime/plugins/application-token-refresh.js

@@ -43,13 +43,14 @@ export default defineNuxtPlugin({
           refreshTokenCookie.value = refreshToken2;
           state.user.value = user2;
           state.activeOrganization.value = organization2;
-          return;
+          return true;
         }
         const { user, organization } = await $fetch("/auth/refresh", {
           method: "POST"
         });
         state.user.value = user;
         state.activeOrganization.value = organization;
+        return true;
       } catch {
         await sdkLogout();
         if (import.meta.client) {
@@ -69,11 +70,11 @@ export default defineNuxtPlugin({
         clearTimeout(tokenRefreshInterval);
         tokenRefreshInterval = null;
       }
-      if (!accessTokenCookie.value) {
-        return;
-      }
-      if (isTokenExpired(accessTokenCookie.value, TWO_MINUTES)) {
-        await refreshToken();
+      if (!accessTokenCookie.value || isTokenExpired(accessTokenCookie.value, TWO_MINUTES)) {
+        const result = await refreshToken();
+        if (!result) {
+          return;
+        }
       }
       const expiry = parseTokenExpiry(accessTokenCookie.value);
       if (!expiry) {

package/dist/runtime/plugins/auth-guard.js

@@ -5,35 +5,38 @@ export default defineNuxtPlugin(() => {
   const authConfig = config.public.telaAuth;
   const loginPath = authConfig.application?.loginPath ?? "/login";
   const unauthorizedPath = authConfig.application?.unauthorizedPath ?? "/unauthorized";
+  const exemptPaths = [loginPath, unauthorizedPath];
   addRouteMiddleware("auth-guard", async (to) => {
     const authMeta = to.meta?.auth;
-    if (!authMeta || authMeta.required !== true) {
+    const path = decodeURI(to.path);
+    if (authMeta === false || exemptPaths.includes(path)) {
       return;
     }
     const token = useCookie("tela-access-token");
     if (!token.value) {
       return await navigateTo({
         path: loginPath,
-        query: { redirect: to.fullPath }
+        query: { returnTo: to.fullPath }
       });
     }
-    if (authMeta.roles && authMeta.roles.length > 0) {
-      try {
-        const payload = decodeJwt(token.value);
-        const userRole = payload.user?.role;
-        if (!userRole || !authMeta.roles.includes(userRole)) {
-          return await navigateTo({
-            path: unauthorizedPath,
-            query: { redirect: to.fullPath }
-          });
-        }
-      } catch (error) {
-        console.error("Failed to decode token:", error);
+    if (!authMeta?.roles?.length) {
+      return;
+    }
+    try {
+      const payload = decodeJwt(token.value);
+      const userRole = payload.user?.role;
+      if (!userRole || !authMeta.roles.includes(userRole)) {
         return await navigateTo({
-          path: loginPath,
-          query: { redirect: to.fullPath }
+          path: unauthorizedPath,
+          query: { returnTo: to.fullPath }
         });
       }
+    } catch (error) {
+      console.error("Failed to decode token:", error);
+      return await navigateTo({
+        path: loginPath,
+        query: { returnTo: to.fullPath }
+      });
     }
   }, { global: true });
 });

package/dist/runtime/server/routes/auth/callback.js

@@ -40,6 +40,13 @@ export default defineEventHandler(async (event) => {
       path: "/"
     });
     deleteCookie(event, `tela-verifier-${state}`, { path: "/" });
+    const returnUrlCookie = getCookie(event, "tela-return-url");
+    if (returnUrlCookie) {
+      deleteCookie(event, "tela-return-url", { path: "/" });
+      if (returnUrlCookie.startsWith("/") && !returnUrlCookie.startsWith("//")) {
+        return await sendRedirect(event, returnUrlCookie);
+      }
+    }
     return await sendRedirect(event, "/");
   } catch (error) {
     console.error("[Auth Callback] OAuth flow error:", error);

package/dist/runtime/server/utils/require-auth.js

@@ -3,10 +3,6 @@ import { createRemoteJWKSet, jwtVerify } from "jose";
 import { useRuntimeConfig } from "nitropack/runtime";
 export function requireAuth(handler, options) {
   return defineEventHandler(async (event) => {
-    const moduleOptions = useRuntimeConfig(event).public.telaAuth;
-    if (!moduleOptions.skipServerMiddleware && !options?.roles && import.meta.dev) {
-      console.warn("You have enabled the global server middleware, meaning you only need to use requireAuth() on routes that require specific roles.", `Triggered at ${event.path}`);
-    }
     if (event.context.auth?.user && event.context.auth?.token) {
       if (import.meta.dev) {
         console.debug("Using existing auth context from global server middleware");

package/dist/runtime/types/page-meta.d.ts

@@ -1,10 +1,7 @@
 declare type Roles = 'meistrari:admin' | (string & {})
 declare module '#app' {
     interface PageMeta {
-        auth?: {
-            required: false
-        } | {
-            required: true
+        auth?: false | {
             roles?: Roles[]
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-nuxt",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "type": "module",
   "exports": {
     ".": {