@merkaly/nuxt 0.10.1 → 0.10.3

package/README.md

@@ -35,6 +35,44 @@ On boot the module restores an existing session (user and token) and then runs t
 | store | optional | required | `merkaly:tenant` resolves the store from the host (public); a signed-in buyer is restored too; protected pages (account, checkout) ask for login. |
 | www | optional | not used | No hooks; anonymous or signed-in. |
 
+### Session lifetime and Auth0 setup for a new app
+
+The SPA keeps the session with **refresh tokens** (`useRefreshTokens`, cached in `localStorage`, login with `offline_access`). The access token for the API lasts **2 hours** (`token_lifetime_for_web` of `https://api.merkaly.io`); before each API call the module asks Auth0 for the current token, which is cached and renewed with the refresh token once it expires. When the refresh token is gone or expired, protected surfaces (`requiresAuth: true`) go back to login instead of calling the API without a token.
+
+Every new Nuxt app needs this in Auth0 (done for admin, dashboard, store and www on 2026-11-04):
+
+1. **Application** (type SPA): allowed callback (`/auth`), logout and web origin URLs for each environment.
+2. **Refresh Token Rotation: on**, **Refresh Token Expiration: on**, with idle lifetime `2592000` (30 days) and maximum lifetime `7776000` (90 days). Never non-rotating or non-expiring.
+3. **API `https://api.merkaly.io`**: "Allow Offline Access" stays **on**; without it Auth0 issues no refresh tokens and every session ends after 2 hours.
+4. **Organizations**: apps that work inside a store (admin) require an organization at login; staff-only apps are filtered by the "Enforce surface access" post-login Action (role `MK_*`).
+
+These settings can be read and changed through the Management API (`merkaly.us.auth0.com`, the canonical domain, never the custom `auth.merkaly.io`).
+
+## SEO: robots and sitemap
+
+Every app gets `@nuxtjs/robots`. Apps are **private by default**: in production
+`robots.txt` answers `Disallow: /` and pages carry the noindex meta and the
+`X-Robots-Tag` header (admin, dashboard). Outside production nothing is indexable.
+
+Public apps (www, store) opt in, and can also get `@nuxtjs/sitemap`, with
+`hreflang` built from `merkaly.i18n` when the strategy has a locale prefix:
+
+```ts
+export default defineNuxtConfig({
+  merkaly: {
+    seo: {
+      indexable: true,
+      url: 'https://www.merkaly.io',
+      disallow: ['/en/auth', '/es/auth', '/pt/auth'], // robots.txt
+      sitemap: { exclude: ['/en/auth', '/es/auth', '/pt/auth'] }, // or `true`
+    },
+  },
+});
+```
+
+The sitemap is only installed for indexable apps and is served at `/sitemap.xml`
+(linked from `robots.txt`).
+
 ## Money formatting
 
 Money in Merkaly is stored as **integer cents**. `MKFormatMoney`, `MKInputMoney`,

package/dist/module.d.mts

@@ -57,6 +57,18 @@ interface MerkalyModuleOptions {
         project: string;
         token: string;
     };
+    seo?: {
+        /** robots.txt paths to block, e.g. the Auth0 callback. */
+        disallow?: string[];
+        /** Private apps (admin, dashboard) stay false: robots.txt Disallow, noindex meta and X-Robots-Tag. */
+        indexable?: boolean;
+        /** Generate /sitemap.xml from the pages, with hreflang from the i18n locales. */
+        sitemap?: boolean | {
+            exclude?: string[];
+        };
+        /** Public site URL, used in robots.txt and the sitemap. */
+        url?: string;
+    };
 }
 declare const _default: _nuxt_schema.NuxtModule<MerkalyModuleOptions, MerkalyModuleOptions, false>;
 

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=3.14.0"
   },
-  "version": "0.10.1",
+  "version": "0.10.3",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,4 +1,4 @@
-import { defineNuxtModule, useLogger, createResolver, addPlugin, addServerHandler, addRouteMiddleware, addImportsDir, addComponentsDir, addTypeTemplate, addTemplate } from '@nuxt/kit';
+import { defineNuxtModule, useLogger, createResolver, installModule, addPlugin, addServerHandler, addRouteMiddleware, addImportsDir, addComponentsDir, addTypeTemplate, addTemplate } from '@nuxt/kit';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { defu } from 'defu';
@@ -42,6 +42,13 @@ const defaultOptions = {
     dsn: "",
     project: "",
     token: ""
+  },
+  seo: {
+    disallow: [],
+    indexable: false,
+    // private unless the app opts in
+    sitemap: false,
+    url: ""
   }
 };
 function hasI18nConfig(options) {
@@ -76,6 +83,10 @@ function buildModuleDependencies(nuxt, options) {
   if (hasPlausibleConfig(options)) {
     dependencies["@nuxtjs/plausible"] = {};
   }
+  configureSite(nuxt, options);
+  dependencies["@nuxtjs/robots"] = {
+    overrides: { disallow: options.seo?.disallow ?? [] }
+  };
   const logger = useLogger(MODULE_NAME);
   Object.keys(dependencies).forEach((dependency) => {
     logger.info(`Loaded ${dependency} module`);
@@ -126,6 +137,33 @@ function configureI18n(nuxt, options) {
     vueI18n
   };
 }
+function configureSite(nuxt, options) {
+  nuxt.options.site = defu({
+    indexable: Boolean(options.seo?.indexable),
+    url: options.seo?.url || void 0
+  }, nuxt.options.site || {});
+}
+function configureSitemap(options) {
+  const exclude = typeof options.seo?.sitemap === "object" ? options.seo.sitemap.exclude ?? [] : [];
+  const prefixed = hasI18nConfig(options) && options.i18n.strategy && options.i18n.strategy !== "no_prefix";
+  if (!prefixed) {
+    return { exclude };
+  }
+  return {
+    autoI18n: {
+      // locales are registered through a hook, so the sitemap module can't read them on its own
+      defaultLocale: options.i18n.defaultLocale,
+      locales: options.i18n.locales.map((locale) => ({
+        _hreflang: locale.language,
+        _sitemap: locale.language,
+        code: locale.code,
+        language: locale.language
+      })),
+      strategy: options.i18n.strategy
+    },
+    exclude
+  };
+}
 function configureRuntimeConfig(nuxt, options) {
   nuxt.options.runtimeConfig.merkaly = defu({
     sentry: {
@@ -278,6 +316,10 @@ const module$1 = defineNuxtModule({
     const resolver = createResolver(import.meta.url);
     configureNuxtOptions(nuxt, options);
     await configureExternalIntegrations(nuxt, logger);
+    if (options.seo?.indexable && options.seo.sitemap) {
+      await installModule("@nuxtjs/sitemap", configureSitemap(options));
+      logger.info("Loaded @nuxtjs/sitemap module");
+    }
     registerRuntimeFeatures(options, resolver);
   }
 });

package/dist/runtime/plugins/api.global.js

@@ -1,4 +1,4 @@
-import { defineNuxtPlugin, useRequestURL, useRuntimeConfig } from "#app";
+import { defineNuxtPlugin, useNuxtApp, useRequestURL, useRuntimeConfig } from "#app";
 import { useAuth, useTenant } from "#imports";
 const GLOBAL_API_HEADER = "x-merkaly-global";
 function serverBaseURL(api, global) {
@@ -10,8 +10,10 @@ export default defineNuxtPlugin(({ provide }) => {
   if (import.meta.server && import.meta.dev && new URL(useRuntimeConfig().public.merkaly.api.url).hostname.endsWith(".test")) {
     process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
   }
+  const nuxtApp = useNuxtApp();
   provide("api", async (url, options = {}) => {
     const { token } = useAuth();
+    if (import.meta.client && token.value) await nuxtApp.$auth0?.getTokenSilently();
     const { tenant } = useTenant();
     const { public: { merkaly } } = useRuntimeConfig();
     const requiresTenant = options.requiresTenant ?? merkaly.auth0.requiresTenant;

package/dist/runtime/plugins/auth0.client.js

@@ -43,6 +43,9 @@ export default defineNuxtPlugin(async ({ callHook, hook }) => {
     if (user.value && !token.value && tokenError) {
       user.value = void 0;
       await self0.logout({ openUrl: false });
+      if ($config.merkaly.auth0.requiresAuth) {
+        return auth0.loginWithRedirect({ appState: { target: location.pathname + location.search } });
+      }
     }
     return initTenantContext();
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merkaly/nuxt",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/merkaly-io/nuxt.git"
@@ -38,6 +38,8 @@
     "@nuxt/kit": "^4.6.0",
     "@nuxtjs/i18n": "^10.6.0",
     "@nuxtjs/plausible": "^4.0.0",
+    "@nuxtjs/robots": "^7.0.2",
+    "@nuxtjs/sitemap": "^9.1.0",
     "@sentry/nuxt": "^11.10.0",
     "@types/node": "latest",
     "@types/vue-select": "^3.16.8",