@meistrari/auth-nuxt 3.18.1 → 3.20.0

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@meistrari/auth-nuxt",
   "configKey": "telaAuth",
-  "version": "3.18.1",
+  "version": "3.20.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/composables/admin.d.ts

@@ -1,8 +1,9 @@
-import type { AdminApplicationRecord, AdminApplicationEntitlementRecord, AdminOrganization, AdminOrganizationTeamRecord, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, GetAdminOrganizationOptions, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminUsersOptions, ListAdminUsersResult, UpdateAdminOrganizationOptions } from '@meistrari/auth-core';
+import type { AdminApplicationRecord, AdminApplicationEntitlementRecord, AdminOrganization, AdminOrganizationTeamRecord, AdminUserAccess, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, GetAdminOrganizationOptions, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminUsersOptions, ListAdminUsersResult, AdminMember, RemoveAdminMemberOptions, ResendAdminInviteOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions } from '@meistrari/auth-core';
 export interface UseTelaAdminReturn {
     /**
-     * Lists users from the Better Auth `user` table as a global admin.
-     * @param options - Pagination, search, filter, and ordering options
+     * Lists users as a global admin, optionally with organization previews
+     * and totals when a preview size is requested.
+     * @param options - Pagination, ordering, search, and preview options
      * @returns The paginated user listing
      */
     listUsers: (options?: ListAdminUsersOptions) => Promise<ListAdminUsersResult>;
@@ -64,6 +65,14 @@ export interface UseTelaAdminReturn {
      * @returns The created organization team
      */
     createOrganizationTeam: (options: CreateAdminOrganizationTeamOptions) => Promise<AdminOrganizationTeamRecord>;
+    /**
+     * Fetches the per-organization access report for a single user as a global
+     * admin, including organization roles, teams, and entitled applications with
+     * the user's effective application role.
+     * @param userId - ID of the user to fetch access for
+     * @returns The user access report
+     */
+    getUserAccess: (userId: string) => Promise<AdminUserAccess>;
     /**
      * Creates an organization as a global admin without joining it.
      * @param options - Organization name and optional slug, logo, metadata, and settings
@@ -76,6 +85,62 @@ export interface UseTelaAdminReturn {
      * @returns The updated organization
      */
     updateOrganization: (options: UpdateAdminOrganizationOptions) => Promise<AdminOrganization>;
+    /**
+     * Updates an organization member's role as a global admin.
+     * @param options - Membership ID and the new role
+     * @returns The updated membership
+     */
+    updateMemberRole: (options: UpdateAdminMemberRoleOptions) => Promise<AdminMember>;
+    /**
+     * Removes an organization member as a global admin.
+     * @param options - Membership ID to remove
+     * @returns The removed membership
+     */
+    removeMember: (options: RemoveAdminMemberOptions) => Promise<AdminMember>;
+    /**
+     * Sets a user's effective application role within an organization as a
+     * global admin. A non-null role grants access, a null role denies access
+     * (leave application), and clear removes the user-specific override.
+     * @param options - User, organization, application, and the role or clear flag
+     */
+    setUserApplicationRole: (options: SetAdminUserApplicationRoleOptions) => Promise<void>;
+    /**
+     * Reconciles a user's team memberships within an organization to a given set
+     * as a global admin.
+     * @param options - User, organization, and the desired teams (empty to clear)
+     */
+    setUserTeam: (options: SetAdminUserTeamOptions) => Promise<void>;
+    /**
+     * Bans a user from the auth system and invalidates all their sessions.
+     * @param userId - ID of the user to ban
+     */
+    banUser: (userId: string) => Promise<void>;
+    /**
+     * Lifts a user's ban.
+     * @param userId - ID of the user to unban
+     */
+    unbanUser: (userId: string) => Promise<void>;
+    /**
+     * Permanently removes a user from the auth system.
+     * @param userId - ID of the user to remove
+     */
+    removeUser: (userId: string) => Promise<void>;
+    /**
+     * Cancels a pending invitation as a global admin.
+     * @param invitationId - ID of the invitation to cancel
+     */
+    cancelInvite: (invitationId: string) => Promise<void>;
+    /**
+     * Re-sends an organization invitation email as a global admin.
+     * @param options - Organization, email, role, and optional application
+     */
+    resendInvite: (options: ResendAdminInviteOptions) => Promise<void>;
+    /**
+     * Invites several users to an organization in one call, isolating failures
+     * per email in the results payload.
+     * @param options - Organization, emails, role, and optional teams/application
+     */
+    inviteOrganizationUsers: (options: InviteAdminOrganizationUsersOptions) => Promise<InviteAdminOrganizationUsersResult>;
 }
 /**
  * Composable for global admin operations.

package/dist/runtime/composables/admin.js

@@ -136,12 +136,45 @@ export function useTelaAdmin() {
   async function createOrganizationTeam(options) {
     return await authClient.admin.createOrganizationTeam(options);
   }
+  async function getUserAccess(userId) {
+    return await authClient.admin.getUserAccess(userId);
+  }
   async function createOrganization(options) {
     return await authClient.admin.createOrganization(options);
   }
   async function updateOrganization(options) {
     return await authClient.admin.updateOrganization(options);
   }
+  async function updateMemberRole(options) {
+    return await authClient.admin.updateMemberRole(options);
+  }
+  async function removeMember(options) {
+    return await authClient.admin.removeMember(options);
+  }
+  async function setUserApplicationRole(options) {
+    return await authClient.admin.setUserApplicationRole(options);
+  }
+  async function setUserTeam(options) {
+    return await authClient.admin.setUserTeam(options);
+  }
+  async function banUser(userId) {
+    return await authClient.admin.banUser(userId);
+  }
+  async function unbanUser(userId) {
+    return await authClient.admin.unbanUser(userId);
+  }
+  async function removeUser(userId) {
+    return await authClient.admin.removeUser(userId);
+  }
+  async function cancelInvite(invitationId) {
+    return await authClient.admin.cancelInvite(invitationId);
+  }
+  async function resendInvite(options) {
+    return await authClient.admin.resendInvite(options);
+  }
+  async function inviteOrganizationUsers(options) {
+    return await authClient.admin.inviteOrganizationUsers(options);
+  }
   return {
     listUsers,
     listApplications,
@@ -153,7 +186,18 @@ export function useTelaAdmin() {
     listOrganizationMembers,
     listOrganizationTeams,
     createOrganizationTeam,
+    getUserAccess,
     createOrganization,
-    updateOrganization
+    updateOrganization,
+    updateMemberRole,
+    removeMember,
+    setUserApplicationRole,
+    setUserTeam,
+    banUser,
+    unbanUser,
+    removeUser,
+    cancelInvite,
+    resendInvite,
+    inviteOrganizationUsers
   };
 }

package/dist/runtime/composables/application/organization.d.ts

@@ -1,4 +1,4 @@
-import type { CreateTeamPayload, FullOrganization, Invitation, InviteUserToOrganizationOptions, ListMembersOptions, Member, RemoveUserFromOrganizationOptions, Team, TeamMember, UpdateMemberRoleOptions, UpdateTeamPayload } from '@meistrari/auth-core';
+import type { AcceptInvitationResult, CreateTeamPayload, FullOrganization, Invitation, InviteUserToOrganizationOptions, ListMembersOptions, Member, RemoveUserFromOrganizationOptions, Team, TeamMember, UpdateMemberRoleOptions, UpdateTeamPayload } from '@meistrari/auth-core';
 import type { Ref } from 'vue';
 export interface UseTelaApplicationOrganizationReturn {
     /** Reactive reference to the active organization with members, invitations, and teams. */
@@ -84,11 +84,9 @@ export interface UseTelaApplicationOrganizationReturn {
      * afterwards.
      *
      * @param id - The invitation id to accept.
-     * @returns An object with `homeUrl`: the application's home URL, or `null`.
+     * @returns The accepted member and the application's home URL, or `null`.
      */
-    acceptInvitation: (id: string) => Promise<{
-        homeUrl: string | null;
-    }>;
+    acceptInvitation: (id: string) => Promise<AcceptInvitationResult>;
     /**
      * Cancels a pending invitation before it is accepted, revoking it so the link
      * can no longer be used, and removes it from `activeOrganization.invitations`

package/dist/runtime/composables/application/organization.js

@@ -49,7 +49,7 @@ export function useTelaOrganization() {
     return invitation;
   }
   async function acceptInvitation(id) {
-    const { homeUrl } = await authClient.organization.acceptInvitation(id);
+    const result = await authClient.organization.acceptInvitation(id);
     const members = await authClient.organization.listMembers();
     if (activeOrganization.value) {
       activeOrganization.value = {
@@ -57,7 +57,7 @@ export function useTelaOrganization() {
         members
       };
     }
-    return { homeUrl };
+    return result;
   }
   async function cancelInvitation(id) {
     await authClient.organization.cancelInvitation(id);

package/dist/runtime/composables/organization.d.ts

@@ -1,4 +1,4 @@
-import type { CreateTeamPayload, FullOrganization, Invitation, InviteUserToOrganizationOptions, ListMembersOptions, Member, RemoveUserFromOrganizationOptions, Team, TeamMember, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload } from '@meistrari/auth-core';
+import type { AcceptInvitationResult, CreateTeamPayload, FullOrganization, Invitation, InviteUserToOrganizationOptions, ListMembersOptions, Member, RemoveUserFromOrganizationOptions, Team, TeamMember, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload } from '@meistrari/auth-core';
 import type { Ref } from 'vue';
 export interface UseTelaOrganizationReturn {
     /** Reactive reference to the active organization with members, invitations, and teams. */
@@ -46,12 +46,10 @@ export interface UseTelaOrganizationReturn {
     /**
      * Accepts an organization invitation and updates the active organization state.
      * @param id - The invitation ID to accept
-     * @returns Object containing the application's `homeUrl` when the invitation is
-     *   scoped to an application that defines one; otherwise `null`.
+     * @returns The accepted member and the application's `homeUrl` when the invitation
+     *   is scoped to an application that defines one; otherwise `null`.
      */
-    acceptInvitation: (id: string) => Promise<{
-        homeUrl: string | null;
-    }>;
+    acceptInvitation: (id: string) => Promise<AcceptInvitationResult>;
     /**
      * Cancels a pending organization invitation and updates the active organization state.
      * @param id - The invitation ID to cancel

package/dist/runtime/composables/organization.js

@@ -58,7 +58,7 @@ export function useTelaOrganization() {
     return invitation;
   }
   async function acceptInvitation(id) {
-    const { homeUrl } = await authClient.organization.acceptInvitation(id);
+    const result = await authClient.organization.acceptInvitation(id);
     const members = await authClient.organization.listMembers();
     if (activeOrganization.value) {
       activeOrganization.value = {
@@ -66,7 +66,7 @@ export function useTelaOrganization() {
         members
       };
     }
-    return { homeUrl };
+    return result;
   }
   async function cancelInvitation(id) {
     await authClient.organization.cancelInvitation(id);

package/dist/runtime/plugins/handshake.js

@@ -2,7 +2,15 @@ import { defineNuxtPlugin, useCookie, useRequestURL, useRuntimeConfig } from "#a
 import { navigateTo, useRoute } from "#imports";
 import { watch } from "vue";
 import { useTelaSession } from "../composables/session.js";
+import { useOrganizationState } from "../composables/state.js";
+import { readClientCookie } from "../helpers/client-cookies.js";
+import { createRefreshOrchestrator } from "../helpers/refresh-orchestrator.js";
+import { DEFAULT_REFRESH_POLICY } from "../helpers/refresh-policy.js";
+import { createRefreshScheduler } from "../helpers/refresh-scheduler.js";
+import { parseTokenExpiry } from "../helpers/token.js";
+import { createWorkerTimer } from "../helpers/worker-timer.js";
 import { createNuxtAuthClient } from "../shared.js";
+const TOKEN_FETCH_TIMEOUT_MS = 15e3;
 export default defineNuxtPlugin({
   name: "tela-auth-handshake",
   enforce: "pre",
@@ -11,13 +19,23 @@ export default defineNuxtPlugin({
   },
   async setup() {
     const authConfig = useRuntimeConfig().public.telaAuth;
-    const { session, user, getToken } = useTelaSession();
+    const { session, user, signOut } = useTelaSession();
     const tokenCookie = useCookie(authConfig.jwtCookieName);
     tokenCookie.value = null;
     const authClient = createNuxtAuthClient(authConfig.apiUrl, () => tokenCookie.value ?? null);
     const query = useRoute().query;
     const nonce = query.nonce;
     const origin = useRequestURL();
+    async function initializeSession() {
+      if (session.value && user.value)
+        return;
+      const sessionData = await authClient.session.getSession();
+      if (!sessionData) {
+        return;
+      }
+      user.value = sessionData.user;
+      session.value = sessionData.session;
+    }
     if (import.meta.server) {
       if (nonce && typeof nonce === "string") {
         if (nonce !== "null") {
@@ -39,43 +57,97 @@ export default defineNuxtPlugin({
         });
         return;
       }
-    } else if (import.meta.client && !session.value) {
-      const token = await getToken();
-      if (token) {
-        tokenCookie.value = token;
+      if (tokenCookie.value) {
+        await initializeSession();
       }
-    }
-    async function initializeSession() {
-      if (session.value && user.value)
-        return;
-      const sessionData = await authClient.session.getSession();
-      if (!sessionData) {
-        return;
-      }
-      user.value = sessionData.user;
-      session.value = sessionData.session;
-    }
-    if (tokenCookie.value) {
-      await initializeSession();
+      return;
     }
     if (import.meta.client) {
-      let tokenRefreshInterval = null;
-      watch(session, async (newVal) => {
-        if (tokenRefreshInterval) {
-          clearTimeout(tokenRefreshInterval);
-          tokenRefreshInterval = null;
+      const readAccessToken = () => readClientCookie(authConfig.jwtCookieName) ?? tokenCookie.value ?? null;
+      async function signOutSafely() {
+        try {
+          await signOut();
+        } catch {
+          const { activeOrganization, activeMember } = useOrganizationState();
+          tokenCookie.value = null;
+          user.value = null;
+          session.value = null;
+          activeOrganization.value = null;
+          activeMember.value = null;
+        }
+      }
+      async function fetchToken() {
+        let timeoutId;
+        const timeout = new Promise((_, reject) => {
+          timeoutId = setTimeout(() => reject(new Error("Token fetch timed out")), TOKEN_FETCH_TIMEOUT_MS);
+        });
+        try {
+          const { token } = await Promise.race([authClient.session.getToken(), timeout]);
+          return token;
+        } finally {
+          clearTimeout(timeoutId);
+        }
+      }
+      const orchestrator = createRefreshOrchestrator({
+        performRefresh: async () => {
+          tokenCookie.value = await fetchToken();
+        },
+        readAccessToken,
+        parseTokenExpiry,
+        policy: DEFAULT_REFRESH_POLICY,
+        lockName: "tela-auth-handshake-token-refresh"
+      });
+      let startupRefreshFailed = false;
+      if (!session.value) {
+        const outcome = await orchestrator.ensureFreshToken({ force: true });
+        if (outcome.status === "auth-failed") {
+          await signOutSafely();
+        }
+        startupRefreshFailed = outcome.status === "transient-failed" || outcome.status === "skipped-offline";
+      }
+      if (tokenCookie.value) {
+        await initializeSession();
+      }
+      const scheduler = createRefreshScheduler({
+        ensureFreshToken: orchestrator.ensureFreshToken,
+        readAccessToken,
+        parseTokenExpiry,
+        policy: DEFAULT_REFRESH_POLICY,
+        timer: createWorkerTimer(),
+        // Reachable only from a definitive 401/404 — every other
+        // failure keeps the session and reschedules. Middleware
+        // handles the redirect to the login page after sign-out.
+        onAuthFailure: async () => {
+          await signOutSafely();
         }
+      });
+      watch(session, (newVal) => {
         if (newVal) {
-          async function createTokenRefreshInterval() {
-            const token = await getToken();
-            if (token) {
-              tokenCookie.value = token;
-            }
-            tokenRefreshInterval = window.setTimeout(() => void createTokenRefreshInterval(), 6e4);
-          }
-          await createTokenRefreshInterval();
+          scheduler.start();
+        } else {
+          scheduler.stop();
         }
       }, { immediate: true });
+      if (startupRefreshFailed) {
+        const stopTokenWatch = watch(tokenCookie, async (token) => {
+          if (!token || session.value) {
+            return;
+          }
+          try {
+            await initializeSession();
+            stopTokenWatch();
+          } catch {
+          }
+        });
+        scheduler.start();
+      }
+      document.addEventListener("visibilitychange", () => {
+        if (document.visibilityState === "visible") {
+          scheduler.kick();
+        }
+      });
+      window.addEventListener("online", () => scheduler.kick());
+      window.addEventListener("focus", () => scheduler.kick());
     }
   },
   hooks: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-nuxt",
-  "version": "3.18.1",
+  "version": "3.20.0",
   "type": "module",
   "exports": {
     ".": {
@@ -36,7 +36,7 @@
     "docs": "nuxt-module-build prepare && typedoc"
   },
   "dependencies": {
-    "@meistrari/auth-core": "1.28.1",
+    "@meistrari/auth-core": "1.30.0",
     "jose": "6.1.3"
   },
   "peerDependencies": {