@nuxt-customer-portal/core 0.8.8 → 0.9.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @nuxt-customer-portal/core
 
+## 0.9.1
+
+## 0.9.0
+
+### Patch Changes
+
+- Avoid generated API route type-inference limits when updating organizations.
+
+- 936f0a2: Add an authenticated store media library with Studio-style image editing, batch review, independent thumbnails, retained originals, and scoped API-key access using existing storage providers. Product images remain unchanged.
+
+  Support configurable store media variants with automatic generation, independent custom crops, and preset changes applied when each image is next saved. Existing thumbnails migrate as custom sources and product image policies remain unchanged.
+
+- 6696fd0: Add an opt-in unified sidebar with nested module navigation and keyboard-accessible collapsed flyouts. Include module subpages in global search, preserve standalone destinations, and place sidebar collapse controls in the footer. Enable the unified layout for SaaS Portal.
+
+## 0.8.9
+
+### Patch Changes
+
+- 6cfe8bc: Resolve login and signup provider visibility from the runtime server opt-in flags and credentials, including in prebuilt images, without requiring public Nuxt overrides.
+
 ## 0.8.8
 
 ## 0.8.7

package/app/composables/useOrganization.ts

@@ -39,7 +39,7 @@ export const useOrganization = () => {
     organizationId: string,
     data: { name: string; slug: string; officialCompanyName: string; logo: string; avatarLogo?: string }
   ) => {
-    return await $fetch<Organization>(`/api/admin/organizations/${organizationId}`, {
+    return await $fetch<Organization, string>(`/api/admin/organizations/${organizationId}`, {
       method: 'PATCH',
       body: data
     })

package/app/composables/useUserStore.ts

@@ -197,7 +197,7 @@ export const useUserStore = defineStore('user', () => {
 
     // console.log('Fetching user permissions from API for user:', currentUser.value.id)
     try {
-      const data = await $fetch<PermissionsResponse>('/api/auth/permissions')
+      const data = await $fetch<PermissionsResponse, string>('/api/auth/permissions')
       if (data) {
         permissions.value = data.permissions
         role.value = data.role

package/i18n/locales/en.json

@@ -49,7 +49,9 @@
     "settings": {
       "title": "Settings"
     },
-    "logout": "Log Out"
+    "logout": "Log Out",
+    "searchDescription": "Find a page in your workspace.",
+    "searchPages": "Search pages…"
   },
   "dashboard": {
     "title": "Dashboard",

package/i18n/locales/nl.json

@@ -49,7 +49,9 @@
     "settings": {
       "title": "Instellingen"
     },
-    "logout": "Uitloggen"
+    "logout": "Uitloggen",
+    "searchDescription": "Vind een pagina in uw werkruimte.",
+    "searchPages": "Zoek pagina’s…"
   },
   "dashboard": {
     "title": "Dashboard",

package/nuxt.config.ts

@@ -1,19 +1,10 @@
 import { fileURLToPath } from 'node:url'
-import { socialAuthProviderEnabled } from './shared/social-auth'
+import { socialAuthProviders } from './shared/social-auth'
 
 const registrationMode = ['open', 'invitation-only', 'disabled'].includes(process.env.PORTAL_REGISTRATION_MODE || '')
   ? (process.env.PORTAL_REGISTRATION_MODE as 'open' | 'invitation-only' | 'disabled')
   : 'open'
-const githubEnabled = socialAuthProviderEnabled(
-  process.env.PORTAL_GITHUB_ENABLED,
-  process.env.GITHUB_CLIENT_ID,
-  process.env.GITHUB_CLIENT_SECRET
-)
-const googleEnabled = socialAuthProviderEnabled(
-  process.env.PORTAL_GOOGLE_ENABLED,
-  process.env.GOOGLE_CLIENT_ID,
-  process.env.GOOGLE_CLIENT_SECRET
-)
+const { githubEnabled, googleEnabled } = socialAuthProviders(process.env)
 
 export default defineNuxtConfig({
   $meta: { name: 'nuxt-customer-portal-core' },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxt-customer-portal/core",
-  "version": "0.8.8",
+  "version": "0.9.1",
   "license": "MIT",
   "homepage": "https://nuxt-customer-portal.com",
   "repository": {

package/portal.manifest.mjs

@@ -1,6 +1,6 @@
 export default {
   id: 'core',
-  version: '0.8.8',
+  version: '0.9.1',
   source: '@nuxt-customer-portal/core',
   dependsOn: [],
   schema: './server/db/schema/index.ts',

package/server/middleware/auth.ts

@@ -1,6 +1,6 @@
 import { defineEventHandler, type H3Event, createError } from 'h3'
 import { auth } from '../utils/auth'
-import { isPublicStoreRoute } from '../utils/public-api-route'
+import { isMediaLibraryRoute, isPublicStoreRoute } from '../utils/public-api-route'
 import { isPublicInvitationRoute } from '../utils/public-invitation-route'
 
 async function isAuthenticated(event: H3Event): Promise<boolean> {
@@ -21,7 +21,7 @@ export default defineEventHandler(async (event) => {
   }
   // Products routes implement their own catalog-key, signature, or public-entry checks.
   const pathname = new URL(url, 'http://localhost').pathname
-  if (isPublicStoreRoute(event.method, pathname)) {
+  if (isPublicStoreRoute(event.method, pathname) || isMediaLibraryRoute(event.method, pathname)) {
     return
   }
   if (isPublicInvitationRoute(event.method, pathname)) {

package/server/middleware/social-auth-config.ts

@@ -0,0 +1,8 @@
+import { defineEventHandler } from 'h3'
+import { socialAuthProviders } from '../../shared/social-auth'
+
+export default defineEventHandler((event) => {
+  // Nitro gives each request its own runtime config. Replace build-time defaults
+  // and public overrides with the same availability checks used by Better Auth.
+  Object.assign(useRuntimeConfig(event).public.portalAuth, socialAuthProviders(process.env))
+})

package/server/utils/auth.ts

@@ -34,7 +34,7 @@ import {
 import { canViewOrganizationDirectory } from '../../shared/feature-registry'
 import { isSystemAdminEmail, parseSystemAdminEmails } from './admin-email-allowlist'
 import { runUserIdentityChangedHooks } from './business-hooks'
-import { socialAuthProviderEnabled } from '../../shared/social-auth'
+import { socialAuthProviders } from '../../shared/social-auth'
 
 /**
  * Generate an ID in the same format as better-auth uses (nanoid)
@@ -48,16 +48,7 @@ const portalAuthConfig = useRuntimeConfig().portalAuth
 const registrationMode = ['open', 'invitation-only', 'disabled'].includes(process.env.PORTAL_REGISTRATION_MODE || '')
   ? process.env.PORTAL_REGISTRATION_MODE
   : portalAuthConfig.registrationMode
-const githubEnabled = socialAuthProviderEnabled(
-  process.env.PORTAL_GITHUB_ENABLED,
-  process.env.GITHUB_CLIENT_ID,
-  process.env.GITHUB_CLIENT_SECRET
-)
-const googleEnabled = socialAuthProviderEnabled(
-  process.env.PORTAL_GOOGLE_ENABLED,
-  process.env.GOOGLE_CLIENT_ID,
-  process.env.GOOGLE_CLIENT_SECRET
-)
+const { githubEnabled, googleEnabled } = socialAuthProviders(process.env)
 const systemAdminEmails = isPortalDemo() ? new Set<string>() : parseSystemAdminEmails(process.env.ADMIN_EMAILS)
 
 export const auth = betterAuth({

package/server/utils/public-api-route.ts

@@ -19,3 +19,11 @@ export function isPublicStoreRoute(method: string, pathname: string) {
     (method === 'DELETE' && pathname === '/api/store/planning/hold')
   )
 }
+
+// Media endpoints authenticate administrator sessions or scoped API keys themselves.
+export function isMediaLibraryRoute(method: string, pathname: string) {
+  if (!['GET', 'POST', 'PUT', 'DELETE'].includes(method)) {
+    return false
+  }
+  return pathname === '/api/products/media' || pathname.startsWith('/api/products/media/')
+}

package/shared/social-auth.ts

@@ -3,3 +3,8 @@ export const socialAuthProviderEnabled = (
   clientId: string | undefined,
   clientSecret: string | undefined
 ) => enabled === 'true' && Boolean(clientId?.trim()) && Boolean(clientSecret?.trim())
+
+export const socialAuthProviders = (env: Record<string, string | undefined>) => ({
+  googleEnabled: socialAuthProviderEnabled(env.PORTAL_GOOGLE_ENABLED, env.GOOGLE_CLIENT_ID, env.GOOGLE_CLIENT_SECRET),
+  githubEnabled: socialAuthProviderEnabled(env.PORTAL_GITHUB_ENABLED, env.GITHUB_CLIENT_ID, env.GITHUB_CLIENT_SECRET)
+})