@nuxtjs/better-auth 0.0.0 → 0.1.3

package/dist/runtime/server/utils/session.js

@@ -0,0 +1,280 @@
+import { matchesUser } from "../../utils/match-user.js";
+import { createAuthError, splitCookiesString } from "../internal/nitro-compat.js";
+import { serverAuth } from "./auth.js";
+const requestSessionLoadKey = Symbol.for("nuxt-better-auth.requestSessionLoad");
+const signingAlgorithm = { name: "HMAC", hash: "SHA-256" };
+const cookiePairSeparatorRE = /;\s*/;
+const fallbackRequestSessionContext = /* @__PURE__ */ new WeakMap();
+function getRequestSessionContext(event) {
+  const eventWithContext = event;
+  if (eventWithContext.context && typeof eventWithContext.context === "object")
+    return eventWithContext.context;
+  let context = fallbackRequestSessionContext.get(event);
+  if (!context) {
+    context = {};
+    fallbackRequestSessionContext.set(event, context);
+  }
+  return context;
+}
+function getIncomingRequestHeaders(event) {
+  const requestHeaders = event.req?.headers;
+  return requestHeaders instanceof Headers ? requestHeaders : event.headers;
+}
+function getRequestHeaders(event) {
+  return getRequestSessionContext(event).requestHeaders ?? getIncomingRequestHeaders(event);
+}
+function loadSession(event) {
+  const auth = serverAuth(event);
+  return auth.api.getSession({ headers: getRequestHeaders(event) });
+}
+function loadFreshSession(event) {
+  const auth = serverAuth(event);
+  return auth.api.getSession({
+    headers: getRequestHeaders(event),
+    query: { disableCookieCache: true },
+    returnHeaders: true
+  });
+}
+function getServerAuthContext(event) {
+  const auth = serverAuth(event);
+  return auth.$context;
+}
+function getCookieName(name, prefix) {
+  if (prefix === "secure")
+    return name.startsWith("__Secure-") ? name : `__Secure-${name}`;
+  if (prefix === "host")
+    return name.startsWith("__Host-") ? name : `__Host-${name}`;
+  if (prefix)
+    return void 0;
+  return name;
+}
+function serializeCookieHeader(name, value, attributes = {}, valueIsEncoded = false) {
+  const cookieName = getCookieName(name, attributes.prefix);
+  if (!cookieName)
+    throw new Error(`Unsupported cookie prefix: ${attributes.prefix}`);
+  const cookieValue = valueIsEncoded ? value : encodeURIComponent(value);
+  const cookie = [`${cookieName}=${cookieValue}`];
+  const options = { ...attributes };
+  if (cookieName.startsWith("__Secure-") && !options.secure)
+    options.secure = true;
+  if (cookieName.startsWith("__Host-")) {
+    options.secure = true;
+    options.path = "/";
+    delete options.domain;
+  }
+  if (typeof options.maxAge === "number" && options.maxAge >= 0)
+    cookie.push(`Max-Age=${Math.floor(options.maxAge)}`);
+  if (options.domain && options.prefix !== "host")
+    cookie.push(`Domain=${options.domain}`);
+  if (options.path)
+    cookie.push(`Path=${options.path}`);
+  if (options.expires)
+    cookie.push(`Expires=${options.expires.toUTCString()}`);
+  if (options.httpOnly)
+    cookie.push("HttpOnly");
+  if (options.partitioned)
+    options.secure = true;
+  if (options.secure)
+    cookie.push("Secure");
+  if (options.sameSite) {
+    const normalizedSameSite = options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1);
+    cookie.push(`SameSite=${normalizedSameSite}`);
+  }
+  if (options.partitioned)
+    cookie.push("Partitioned");
+  return cookie.join("; ");
+}
+function serializeCookie(name, value, attributes = {}) {
+  return serializeCookieHeader(name, value, attributes);
+}
+async function signCookieValue(value, secret) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    signingAlgorithm,
+    false,
+    ["sign", "verify"]
+  );
+  const signature = await crypto.subtle.sign(
+    signingAlgorithm.name,
+    key,
+    new TextEncoder().encode(value)
+  );
+  return encodeURIComponent(`${value}.${btoa(String.fromCharCode(...new Uint8Array(signature)))}`);
+}
+async function serializeSignedCookie(name, value, secret, attributes = {}) {
+  return serializeCookieHeader(name, await signCookieValue(value, secret), attributes, true);
+}
+function appendCookieHeader(event, header) {
+  const nodeResponse = event.node?.res;
+  if (nodeResponse?.setHeader) {
+    const current = nodeResponse.getHeader?.("set-cookie");
+    if (Array.isArray(current))
+      nodeResponse.setHeader("set-cookie", [...current, header]);
+    else if (typeof current === "string")
+      nodeResponse.setHeader("set-cookie", [current, header]);
+    else
+      nodeResponse.setHeader("set-cookie", [header]);
+    return;
+  }
+  const eventWithResponse = event;
+  const responseHeaders = eventWithResponse.res?.headers ?? eventWithResponse.response?.headers;
+  responseHeaders?.append("set-cookie", header);
+}
+function getSetCookieHeaders(headers) {
+  const getSetCookie = headers.getSetCookie;
+  const cookies = getSetCookie?.call(headers);
+  if (cookies?.length)
+    return cookies.flatMap((cookie) => splitCookiesString(cookie));
+  const header = headers.get("set-cookie");
+  return header ? splitCookiesString(header) : [];
+}
+function appendSetCookieHeaders(event, headers) {
+  for (const header of getSetCookieHeaders(headers))
+    appendCookieHeader(event, header);
+}
+function parseRequestCookies(cookieHeader) {
+  const cookies = /* @__PURE__ */ new Map();
+  if (!cookieHeader)
+    return cookies;
+  for (const pair of cookieHeader.split(cookiePairSeparatorRE)) {
+    if (!pair)
+      continue;
+    const separatorIndex = pair.indexOf("=");
+    if (separatorIndex < 0)
+      continue;
+    cookies.set(pair.slice(0, separatorIndex), pair.slice(separatorIndex + 1));
+  }
+  return cookies;
+}
+function serializeRequestCookies(cookies) {
+  if (!cookies.size)
+    return null;
+  return Array.from(cookies.entries()).map(([name, value]) => `${name}=${value}`).join("; ");
+}
+function extractResponseCookieValue(header) {
+  const separatorIndex = header.indexOf(";");
+  const cookiePair = separatorIndex >= 0 ? header.slice(0, separatorIndex) : header;
+  return cookiePair.slice(cookiePair.indexOf("=") + 1);
+}
+function getChunkedCookieNames(event, cookieName) {
+  const cookieNames = /* @__PURE__ */ new Set([cookieName]);
+  for (const name of parseRequestCookies(getIncomingRequestHeaders(event).get("cookie")).keys()) {
+    if (name.startsWith(`${cookieName}.`))
+      cookieNames.add(name);
+  }
+  return Array.from(cookieNames);
+}
+function expireCookie(event, cookieName, attributes) {
+  appendCookieHeader(event, serializeCookie(cookieName, "", {
+    ...attributes,
+    expires: /* @__PURE__ */ new Date(0),
+    maxAge: 0
+  }));
+}
+function expireCookies(event, cookie) {
+  for (const cookieName of getChunkedCookieNames(event, cookie.name))
+    expireCookie(event, cookieName, cookie.attributes);
+}
+function updateRequestHeaders(event, sessionCookie, clearedCookieNames) {
+  const requestContext = getRequestSessionContext(event);
+  const incomingHeaders = getIncomingRequestHeaders(event);
+  const requestHeaders = new Headers(incomingHeaders);
+  const cookies = parseRequestCookies(incomingHeaders.get("cookie"));
+  for (const name of clearedCookieNames)
+    cookies.delete(name);
+  const sessionTokenName = sessionCookie.slice(0, sessionCookie.indexOf("="));
+  cookies.set(sessionTokenName, extractResponseCookieValue(sessionCookie));
+  const nextCookieHeader = serializeRequestCookies(cookies);
+  if (nextCookieHeader)
+    requestHeaders.set("cookie", nextCookieHeader);
+  else
+    requestHeaders.delete("cookie");
+  requestContext.requestHeaders = requestHeaders;
+}
+export async function getRequestSession(event) {
+  const context = getRequestSessionContext(event);
+  if (context.requestSession !== void 0)
+    return context.requestSession;
+  const inFlight = context[requestSessionLoadKey];
+  if (inFlight)
+    return inFlight;
+  const load = loadSession(event);
+  context[requestSessionLoadKey] = load;
+  try {
+    const session = await load;
+    context.requestSession = session;
+    return session;
+  } finally {
+    delete context[requestSessionLoadKey];
+  }
+}
+export async function getUserSession(event) {
+  const context = getRequestSessionContext(event);
+  if (context.requestSession !== void 0)
+    return context.requestSession;
+  const inFlight = context[requestSessionLoadKey];
+  if (inFlight)
+    return inFlight;
+  return loadSession(event);
+}
+export async function refreshSessionCookieCache(event) {
+  const context = getRequestSessionContext(event);
+  const inFlight = context[requestSessionLoadKey];
+  if (inFlight)
+    await inFlight.catch(() => void 0);
+  delete context.requestSession;
+  const load = loadFreshSession(event).then(({ headers, response }) => {
+    appendSetCookieHeaders(event, headers);
+    context.requestSession = response;
+    return response;
+  });
+  context[requestSessionLoadKey] = load;
+  try {
+    return await load;
+  } finally {
+    if (context[requestSessionLoadKey] === load)
+      delete context[requestSessionLoadKey];
+  }
+}
+export async function setSessionCookie(event, token) {
+  const context = await getServerAuthContext(event);
+  const sessionCookie = await serializeSignedCookie(
+    context.authCookies.sessionToken.name,
+    token,
+    context.secret,
+    {
+      ...context.authCookies.sessionToken.attributes,
+      maxAge: context.sessionConfig.expiresIn
+    }
+  );
+  appendCookieHeader(event, sessionCookie);
+  expireCookies(event, context.authCookies.sessionData);
+  expireCookies(event, context.authCookies.dontRememberToken);
+  const requestContext = getRequestSessionContext(event);
+  delete requestContext.requestSession;
+  delete requestContext[requestSessionLoadKey];
+  updateRequestHeaders(event, sessionCookie, [
+    ...getChunkedCookieNames(event, context.authCookies.sessionData.name),
+    ...getChunkedCookieNames(event, context.authCookies.dontRememberToken.name)
+  ]);
+}
+export async function createSession(event, userId) {
+  const context = await getServerAuthContext(event);
+  return context.internalAdapter.createSession?.(userId, false);
+}
+export async function requireUserSession(event, options) {
+  const session = await getRequestSession(event);
+  if (!session)
+    throw createAuthError(401, "Authentication required");
+  if (options?.user) {
+    if (!matchesUser(session.user, options.user))
+      throw createAuthError(403, "Access denied");
+  }
+  if (options?.rule) {
+    const allowed = await options.rule({ user: session.user, session: session.session });
+    if (!allowed)
+      throw createAuthError(403, "Access denied");
+  }
+  return session;
+}

package/dist/runtime/server/virtual-modules.d.ts

@@ -0,0 +1,27 @@
+declare module '#auth/database' {
+  export const db: any
+  export function createDatabase(...args: any[]): any
+}
+
+declare module '#imports' {
+  export function getRouteRules(event: any): any
+  export function useRuntimeConfig(): any
+}
+
+declare module '#auth/secondary-storage' {
+  export function createSecondaryStorage(...args: any[]): any
+}
+
+declare module '#auth/schema' {
+  export const schema: any
+}
+
+declare module '#auth/server' {
+  const createServerAuth: any
+  export default createServerAuth
+}
+
+declare module '@nuxthub/db' {
+  export const db: any
+  export const schema: any
+}

package/dist/runtime/types/augment.d.ts

@@ -0,0 +1,56 @@
+import type { ComputedRef, Ref } from 'vue';
+export interface AuthUser {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    name: string;
+    image?: string | null;
+}
+export interface AuthSession {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    userId: string;
+    expiresAt: Date;
+    token: string;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+}
+export interface ServerAuthContext {
+    runtimeConfig: Record<string, unknown>;
+    db: unknown;
+    requestOrigin?: string;
+}
+export interface AuthSocialProviderRegistry {
+}
+export interface UserSessionComposable {
+    user: Ref<AuthUser | null>;
+    session: Ref<AuthSession | null>;
+    loggedIn: ComputedRef<boolean>;
+    ready: ComputedRef<boolean>;
+    fetchSession: (options?: {
+        headers?: HeadersInit;
+        force?: boolean;
+    }) => Promise<void>;
+    waitForSession: () => Promise<void>;
+    signOut: (options?: {
+        onSuccess?: () => void | Promise<void>;
+    }) => Promise<void>;
+    updateUser: (updates: Partial<AuthUser>) => Promise<void>;
+}
+export type UserMatch<T> = {
+    [K in keyof T]?: T[K] | T[K][];
+};
+export interface AppSession {
+    user: AuthUser;
+    session: AuthSession;
+}
+export interface RequireSessionOptions {
+    user?: UserMatch<AuthUser>;
+    rule?: (ctx: {
+        user: AuthUser;
+        session: AuthSession;
+    }) => boolean | Promise<boolean>;
+}

package/dist/runtime/types.d.ts

@@ -0,0 +1,21 @@
+import type { AuthSocialProviderRegistry, AuthUser, UserMatch } from '#nuxt-better-auth';
+export type { AppSession, AuthSession, AuthSocialProviderRegistry, AuthUser, RequireSessionOptions, ServerAuthContext, UserMatch, UserSessionComposable } from './types/augment.js';
+export type AuthSocialProviderId = AuthSocialProviderRegistry extends {
+    ids: infer T;
+} ? Extract<T, string> : never;
+export type { Auth, InferPluginTypes, InferSessionFromClient as InferSession, InferUserFromClient as InferUser } from 'better-auth';
+export interface AuthActionError {
+    message: string;
+    code?: string;
+    status?: number;
+    raw: unknown;
+}
+export type AuthMode = 'guest' | 'user';
+export type AuthMeta = false | AuthMode | {
+    only?: AuthMode;
+    redirectTo?: string;
+    user?: UserMatch<AuthUser>;
+};
+export type AuthRouteRules = Record<string, unknown> & {
+    auth?: AuthMeta;
+};

package/dist/runtime/utils/match-user.d.ts

@@ -0,0 +1,2 @@
+import type { UserMatch } from '../types.js';
+export declare function matchesUser<T extends object>(user: T, match: UserMatch<T>): boolean;

package/dist/runtime/utils/match-user.js

@@ -0,0 +1,13 @@
+export function matchesUser(user, match) {
+  for (const [key, expected] of Object.entries(match)) {
+    const actual = user[key];
+    if (Array.isArray(expected)) {
+      if (!expected.includes(actual))
+        return false;
+    } else {
+      if (actual !== expected)
+        return false;
+    }
+  }
+  return true;
+}

package/dist/types.d.mts

@@ -0,0 +1,11 @@
+import type { NuxtModule } from '@nuxt/schema'
+
+import type { default as Module } from './module.mjs'
+
+export type ModuleOptions = typeof Module extends NuxtModule<infer O> ? Partial<O> : Record<string, any>
+
+export { type BetterAuthModuleOptions, type defineClientAuth, type defineServerAuth } from '../dist/runtime/config.js'
+
+export { type AppSession, type Auth, type AuthActionError, type AuthMeta, type AuthMode, type AuthRouteRules, type AuthSession, type AuthSocialProviderId, type AuthUser, type InferSession, type InferUser, type RequireSessionOptions, type ServerAuthContext, type UserMatch } from '../dist/runtime/types.js'
+
+export { default } from './module.mjs'

package/package.json

@@ -1,14 +1,115 @@
 {
   "name": "@nuxtjs/better-auth",
-  "version": "0.0.0",
-  "description": "Placeholder for @nuxtjs/better-auth",
-  "main": "index.js",
-  "scripts": {},
-  "keywords": [],
-  "author": "danielroe (https://www.npmjs.com/~danielroe)",
-  "license": "UNLICENSED",
-  "private": false,
-  "publishConfig": {
-    "access": "public"
+  "type": "module",
+  "version": "0.1.3",
+  "description": "Nuxt module for Better Auth integration with NuxtHub, route protection, session management, and role-based access",
+  "author": "onmax",
+  "license": "MIT",
+  "homepage": "https://better-auth.nuxt.dev",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/nuxt-modules/better-auth"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/types.d.mts",
+      "import": "./dist/module.mjs"
+    },
+    "./composables": {
+      "types": "./dist/runtime/composables.d.ts",
+      "import": "./dist/runtime/composables.js"
+    },
+    "./config": {
+      "types": "./dist/runtime/config.d.ts",
+      "import": "./dist/runtime/config.js"
+    }
+  },
+  "main": "./dist/module.mjs",
+  "typesVersions": {
+    "*": {
+      ".": [
+        "./dist/types.d.mts"
+      ],
+      "composables": [
+        "./dist/runtime/composables.d.ts"
+      ],
+      "config": [
+        "./dist/runtime/config.d.ts"
+      ]
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "peerDependencies": {
+    "@nuxthub/core": ">=0.10.5",
+    "better-auth": ">=1.7.0-rc.5 <2"
+  },
+  "peerDependenciesMeta": {
+    "@nuxthub/core": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@nuxt/kit": "^4.3.1",
+    "auth": "1.7.0-rc.5",
+    "defu": "^6.1.4",
+    "h3": "^1.15.11",
+    "jiti": "^2.6.1",
+    "pathe": "^2.0.3",
+    "radix3": "^1.1.2",
+    "std-env": "^4.0.0",
+    "ufo": "^1.6.4"
+  },
+  "devDependencies": {
+    "@antfu/eslint-config": "^9.0.0",
+    "@libsql/client": "^0.17.3",
+    "@libsql/linux-x64-gnu": "0.5.29",
+    "@nuxt/devtools": "^3.2.3",
+    "@nuxt/devtools-kit": "^3.2.4",
+    "@nuxt/module-builder": "^1.0.2",
+    "@nuxt/schema": "^4.3.1",
+    "@nuxt/test-utils": "^4.0.0",
+    "@nuxthub/core": "^0.10.6",
+    "@pinia/nuxt": "^0.11.3",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "latest",
+    "better-auth": "1.7.0-rc.5",
+    "better-call": "1.4.0",
+    "better-sqlite3": "^12.6.2",
+    "consola": "^3.4.2",
+    "drizzle-kit": "^0.31.10",
+    "drizzle-orm": "^0.45.1",
+    "eslint": "^10.0.3",
+    "nitropack": "2.13.1",
+    "nuxt": "^4.3.1",
+    "pinia": "^3.0.4",
+    "pkg-pr-new": "0.0.87",
+    "postgres": "^3.4.9",
+    "tinyexec": "^1.1.1",
+    "typescript": "~5.9.3",
+    "unstorage": "^1.17.5",
+    "vitest": "^4.0.18",
+    "vitest-package-exports": "^1.2.0",
+    "vue": "3.5.29",
+    "vue-tsc": "^3.2.7",
+    "wrangler": "4.72.0",
+    "yaml": "^2.8.3"
+  },
+  "scripts": {
+    "build": "pnpm build:docs",
+    "dev": "pnpm dev:prepare && nuxi dev playground",
+    "dev:build": "nuxi build playground",
+    "dev:prepare": "nuxt-module-build build --stub && nuxi prepare playground",
+    "dev:docs": "nuxi dev docs",
+    "build:docs": "nuxi build docs",
+    "deploy": "wrangler deploy",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "typecheck": "vue-tsc --noEmit",
+    "typecheck:runtime-server": "cd test/cases/plugins-type-inference && nuxi prepare && vue-tsc --noEmit --pretty false -p .nuxt/tsconfig.server.json",
+    "typecheck:playground": "pnpm -C playground exec nuxi prepare && pnpm -C playground exec vue-tsc --noEmit -p .nuxt/tsconfig.app.json",
+    "test": "vitest run",
+    "test:watch": "vitest watch"
   }
 }

package/index.js

@@ -1 +0,0 @@
-// Placeholder