@meistrari/auth-nuxt 3.29.3 → 3.31.0

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@meistrari/auth-nuxt",
   "configKey": "telaAuth",
-  "version": "3.29.3",
+  "version": "3.31.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/composables/admin.d.ts

@@ -1,4 +1,4 @@
-import type { AdminApplicationRecord, AdminApplicationRole, AdminApplicationEntitlementRecord, AdminApplicationSecret, AdminEntitlementWithRules, AdminOrganization, AdminOrganizationSummary, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreatedAdminApplicationSecret, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminUsersOptions, ListAdminUsersResult, AdminMember, RemoveAdminMemberOptions, ResendAdminInviteOptions, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, UpdateAdminEntitlementOptions, UpdateAdminApplicationRoleOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions } from '@meistrari/auth-core';
+import type { AdminApplicationRecord, AdminApplicationRole, AdminApplicationEntitlementRecord, AdminApplicationSecret, AdminEntitlementWithRules, AdminOrganization, AdminOrganizationSummary, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreatedAdminApplicationSecret, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminUsersOptions, ListAdminUsersResult, AdminMember, DeleteAdminOrganizationTeamOptions, RemoveAdminMemberOptions, ResendAdminInviteOptions, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, UpdateAdminEntitlementOptions, UpdateAdminApplicationRoleOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions } from '@meistrari/auth-core';
 export interface UseTelaAdminReturn {
     /**
      * Lists users, optionally with organization previews and totals when a
@@ -143,6 +143,20 @@ export interface UseTelaAdminReturn {
      * @returns The created organization team
      */
     createOrganizationTeam: (options: CreateAdminOrganizationTeamOptions) => Promise<AdminOrganizationTeamRecord>;
+    /**
+     * Updates a team for a single organization. Global admins may update any
+     * organization; an organization admin only their own.
+     * @param options - Organization ID, team ID, new name, and optional replacement member IDs
+     * @returns The updated organization team
+     */
+    updateOrganizationTeam: (options: UpdateAdminOrganizationTeamOptions) => Promise<AdminOrganizationTeamRecord>;
+    /**
+     * Deletes a team for a single organization, detaching its members with it.
+     * Global admins may delete from any organization; an organization admin
+     * only from their own.
+     * @param options - Organization ID and team ID
+     */
+    deleteOrganizationTeam: (options: DeleteAdminOrganizationTeamOptions) => Promise<void>;
     /**
      * Fetches the per-organization access report for a single user as a global
      * admin, including organization roles, teams, and entitled applications with

package/dist/runtime/composables/admin.js

@@ -63,6 +63,12 @@ export function useTelaAdmin() {
   async function createOrganizationTeam(options) {
     return await authClient.admin.createOrganizationTeam(options);
   }
+  async function updateOrganizationTeam(options) {
+    return await authClient.admin.updateOrganizationTeam(options);
+  }
+  async function deleteOrganizationTeam(options) {
+    return await authClient.admin.deleteOrganizationTeam(options);
+  }
   async function getUserAccess(userId) {
     return await authClient.admin.getUserAccess(userId);
   }
@@ -139,6 +145,8 @@ export function useTelaAdmin() {
     listOrganizationMembers,
     listOrganizationTeams,
     createOrganizationTeam,
+    updateOrganizationTeam,
+    deleteOrganizationTeam,
     getUserAccess,
     createOrganization,
     updateOrganization,

package/dist/runtime/composables/session.js

@@ -24,12 +24,14 @@ export function useTelaSession() {
   async function signInWithSocialProvider({
     provider,
     callbackURL,
-    errorCallbackURL
+    errorCallbackURL,
+    loginHint
   }) {
     await authClient.session.signInWithSocialProvider({
       provider,
       callbackURL,
-      errorCallbackURL
+      errorCallbackURL,
+      loginHint
     });
   }
   async function signInWithSaml({

package/dist/runtime/plugins/application-token-refresh.js

@@ -53,7 +53,7 @@ export default defineNuxtPlugin({
         }
         console.error("[Tela Auth SDK] Transient token refresh failure during SSR, leaving session for client recovery:", error?.message);
       };
-      const authClient = createNuxtAuthClient(appConfig.apiUrl, () => null, () => refreshTokenCookie.value ?? null);
+      const authClient = createNuxtAuthClient(appConfig.apiUrl, () => null);
       async function refreshOnServer() {
         const { accessToken, refreshToken, user, organization, assurance } = await authClient.application.refreshAccessToken(refreshTokenCookie.value ?? "");
         accessTokenCookie.value = accessToken;

package/dist/runtime/server/routes/auth/callback.js

@@ -18,11 +18,7 @@ export default defineEventHandler(async (event) => {
     return await sendRedirect(event, `${loginPath}?error=verifier_missing`);
   }
   try {
-    const authClient = createNuxtAuthClient(
-      authConfig.apiUrl,
-      () => null,
-      () => null
-    );
+    const authClient = createNuxtAuthClient(authConfig.apiUrl, () => null);
     const { accessToken, refreshToken } = await authClient.application.completeAuthorizationFlow(code, codeVerifier);
     setCookie(event, "tela-access-token", accessToken, {
       secure: !import.meta.dev,

package/dist/runtime/server/routes/auth/refresh.js

@@ -14,11 +14,7 @@ export default defineEventHandler(async (event) => {
       message: "No refresh token found"
     });
   }
-  const authClient = createNuxtAuthClient(
-    authConfig.apiUrl,
-    () => null,
-    () => refreshToken
-  );
+  const authClient = createNuxtAuthClient(authConfig.apiUrl, () => null);
   let accessToken;
   let newRefreshToken;
   let user;

package/dist/runtime/server/routes/auth/whoami.js

@@ -4,7 +4,7 @@ import { createNuxtAuthClient } from "../../../shared.js";
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig();
   const authConfig = config.public.telaAuth;
-  const authClient = createNuxtAuthClient(authConfig.apiUrl, () => null, () => null);
+  const authClient = createNuxtAuthClient(authConfig.apiUrl, () => null);
   const accessToken = getCookie(event, "tela-access-token");
   if (!accessToken) {
     throw createError({

package/dist/runtime/shared.d.ts

@@ -3,11 +3,15 @@ import { AuthClient } from '@meistrari/auth-core';
  * Creates an {@link AuthClient} instance configured for use within a Nuxt application.
  *
  * Automatically sets the `X-User-Agent` header with SDK version and service name,
- * and attaches authorization and refresh token headers to outgoing requests.
+ * and attaches the authorization header to outgoing requests.
+ *
+ * Application tokens travel as `x-tela-access-token` / `x-tela-refresh-token`
+ * headers (set by the core client). They must never be sent as cookies: any
+ * `Cookie` header makes Better Auth's origin check demand a matching `Origin`,
+ * which server-to-server calls cannot provide.
  *
  * @param apiUrl - The base URL of the authentication API
  * @param getAuthToken - Function that returns the current JWT access token, or `null` if not available
- * @param getRefreshToken - Function that returns the current refresh token, or `null` if not available
  * @returns A configured {@link AuthClient} instance
  */
-export declare function createNuxtAuthClient(apiUrl: string, getAuthToken: () => string | null, getRefreshToken?: () => string | null): AuthClient;
+export declare function createNuxtAuthClient(apiUrl: string, getAuthToken: () => string | null): AuthClient;

package/dist/runtime/shared.js

@@ -1,6 +1,6 @@
 import { AuthClient } from "@meistrari/auth-core";
 import { version } from "../../package.json";
-export function createNuxtAuthClient(apiUrl, getAuthToken, getRefreshToken = () => null) {
+export function createNuxtAuthClient(apiUrl, getAuthToken) {
   const serviceName = typeof process !== "undefined" ? process.env.SERVICE_NAME : "";
   const userAgent = `auth-sdk:nuxt:${version}${serviceName ? `@${serviceName}` : ""}`;
   return new AuthClient(apiUrl, {
@@ -14,15 +14,6 @@ export function createNuxtAuthClient(apiUrl, getAuthToken, getRefreshToken = ()
       if (token && !isTokenRequest) {
         context.headers.set("Authorization", `Bearer ${token}`);
       }
-      const isRefreshTokenRequest = requestUrl.pathname.endsWith("/api/auth/applications/token/refresh");
-      if (isRefreshTokenRequest) {
-        const refreshToken = getRefreshToken();
-        if (refreshToken) {
-          const cookie = context.headers.get("Cookie");
-          const newCookie = cookie ? `${cookie}; tela-refresh-token=${refreshToken}` : `tela-refresh-token=${refreshToken}`;
-          context.headers.set("Cookie", newCookie);
-        }
-      }
     }
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-nuxt",
-  "version": "3.29.3",
+  "version": "3.31.0",
   "type": "module",
   "exports": {
     ".": {
@@ -36,7 +36,7 @@
     "docs": "nuxt-module-build prepare && typedoc"
   },
   "dependencies": {
-    "@meistrari/auth-core": "1.39.3",
+    "@meistrari/auth-core": "1.41.1",
     "jose": "6.1.3"
   },
   "peerDependencies": {