@merkaly/nuxt 0.13.3 → 0.13.5

package/README.md

@@ -169,6 +169,10 @@ To open the Auth0 signup screen instead of the login one, use `useAuth().signup(
 
 The SPA keeps the session with **refresh tokens**: the client uses `useRefreshTokens` with `localStorage` cache and logs in with `audience` and `scope: openid profile email offline_access`. Before each API call the module asks Auth0 for the current access token, which is cached and renewed with the refresh token once it expires (2 hours for `https://api.merkaly.io`). When the refresh token is gone or expired, protected surfaces (`requiresAuth: true`) go back to login instead of calling the API without a token. Account linking (`linkWithConnection(connection)`) uses a separate Auth0 client, the `auth.merkaly.io` SPA client in Auth0, with an in-memory cache, created only on the first call (no extra `checkSession` on page load). It opens a login popup for that connection and sends the popup's raw ID token to `POST /auth/identities` as `{ idToken }`; the api verifies the token (signature, issuer, audience = the account linking client, expiry) and links the identity from its `sub` into the logged-in user. Requires an api with that contract (older clients that sent `{ provider, userId }` get `400`).
 
+### Calling app header
+
+Every API request carries the app's Auth0 client id (`merkaly.auth0.client`) in the `x-merkaly-client` header: the `$api` plugin adds it to server-side calls and the `/api` proxy sets it on every forwarded request (overwriting whatever the browser sent). The api checks it against its list of Auth0 applications and, on authenticated requests, against the token `azp` (api doc: [`docs/conventions/surface-clients.md`](https://github.com/merkaly-io/api.merkaly.io/blob/master/docs/conventions/surface-clients.md)). An app without `merkaly.auth0.client` sends no header.
+
 The Auth0 side (tenant, API, app settings, refresh token rotation and lifetimes, organizations, and the checklist for a new app) is documented in the auth.merkaly.io repo: [`docs/tenant-setup.md`](https://github.com/merkaly-io/auth.merkaly.io/blob/master/docs/tenant-setup.md).
 
 ## SEO: robots and sitemap

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=3.14.0"
   },
-  "version": "0.13.3",
+  "version": "0.13.5",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/composables/useApi.js

@@ -1,7 +1,7 @@
 import { getCurrentInstance, onServerPrefetch, reactive, ref, useNuxtApp, useState } from "#imports";
 function useApi(callback) {
   const { $api } = useNuxtApp();
-  const controller = new AbortController();
+  let controller = new AbortController();
   const params = reactive({});
   const getOptions = (currentParams) => {
     const options = callback(currentParams);
@@ -23,6 +23,8 @@ function useApi(callback) {
       params[key2] = args[key2];
     });
     const currentOptions = getOptions(params);
+    controller = new AbortController();
+    loading.value = true;
     await $api(currentOptions.uri, {
       ...currentOptions,
       controller,
@@ -32,10 +34,7 @@ function useApi(callback) {
       loading,
       meta,
       params
-    }).catch((reason) => {
-      loading.value = false;
-      throw reason;
-    });
+    }).finally(() => loading.value = false);
   };
   if (initialOptions.immediate) {
     const instance = getCurrentInstance();

package/dist/runtime/plugins/api.global.js

@@ -1,6 +1,7 @@
 import { defineNuxtPlugin, useNuxtApp, useRequestURL, useRuntimeConfig } from "#app";
 import { useAuth, useOrganization } from "#imports";
 const GLOBAL_API_HEADER = "x-merkaly-global";
+const CLIENT_HEADER = "x-merkaly-client";
 function serverBaseURL(api, global) {
   const prefix = global ? "" : (api.prefix ?? "").replace(/^\/+|\/+$/g, "");
   return prefix ? `${api.url.replace(/\/+$/, "")}/${prefix}` : api.url;
@@ -35,6 +36,7 @@ This surface has requiresTenant: true. Possible causes:
         [GLOBAL_API_HEADER]: options.global ? "true" : "",
         ...requestHost ? { "x-merkaly-host": requestHost } : {},
         // tenant host, as the proxy sends it
+        ...merkaly.auth0.client ? { [CLIENT_HEADER]: merkaly.auth0.client } : {},
         ...options?.headers
       },
       method: options?.method,

package/dist/runtime/server/middleware/proxy.js

@@ -2,6 +2,7 @@ import { defineEventHandler, getRequestURL, proxyRequest } from "h3";
 import { useRuntimeConfig } from "#imports";
 const GLOBAL_API_HEADER = "x-merkaly-global";
 const TENANT_HOST_HEADER = "x-merkaly-host";
+const CLIENT_HEADER = "x-merkaly-client";
 const API_PREFIX_PATTERN = /^\/api\/?/;
 const API_ROUTE_PATTERN = /^\/api(?:\/|$)/;
 const EDGE_SLASH_PATTERN = /^\/|\/$/g;
@@ -33,6 +34,8 @@ export default defineEventHandler((event) => {
   const path = resolveProxyPath(prefix, url.pathname, url.search);
   event.node.req.headers["x-forwarded-host"] = url.host;
   event.node.req.headers[TENANT_HOST_HEADER] = url.host;
+  if ($config.merkaly.auth0.client) event.node.req.headers[CLIENT_HEADER] = $config.merkaly.auth0.client;
+  else Reflect.deleteProperty(event.node.req.headers, CLIENT_HEADER);
   stripEdgeHeaders(event.node.req.headers);
   if (import.meta.dev && targetOrigin.hostname.endsWith(".test")) {
     process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merkaly/nuxt",
-  "version": "0.13.3",
+  "version": "0.13.5",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/merkaly-io/nuxt.git"