@nuxtjs/better-auth 0.3.3 → 0.3.5

package/dist/module.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxtjs/better-auth",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "configKey": "auth",
   "compatibility": {
     "nuxt": ">=4.0.0"

package/dist/module.mjs

@@ -10,9 +10,10 @@ import { defu } from 'defu';
 import { toRouteMatcher, createRouter } from 'radix3';
 import { randomBytes } from 'node:crypto';
 import { isCI, isTest } from 'std-env';
+import { isInternalAssetPath } from '../dist/runtime/internal/auth-route-rules.js';
 export { defineClientAuth, defineServerAuth } from '../dist/runtime/config.js';
 
-const version = "0.3.3";
+const version = "0.3.5";
 
 const CONFIG_EXTENSIONS = [".ts", ".js", ".mts", ".cts", ".mjs", ".cjs"];
 const CONFIG_EXTENSION_RE = /\.[cm]?[jt]s$/;
@@ -742,7 +743,8 @@ function setupRuntimeConfig(input) {
       login: options.redirects?.login ?? "/login",
       guest: options.redirects?.guest ?? "/",
       authenticated: options.redirects?.authenticated,
-      logout: options.redirects?.logout
+      logout: options.redirects?.logout,
+      sessionExpired: options.redirects?.sessionExpired
     },
     preserveRedirect: options.preserveRedirect ?? true,
     redirectQueryKey: options.redirectQueryKey ?? "redirect",
@@ -990,6 +992,8 @@ function assertSafeAuthRouteRules(routeRules) {
   for (const path of collectRouteRulePaths(patterns, ""))
     paths.add(path);
   const conflicts = [...paths].flatMap((path) => {
+    if (isInternalAssetPath(path))
+      return [];
     const matches = matcher.matchAll(path);
     const effectiveRule = defu({}, ...matches.reverse());
     if (effectiveRule.auth === void 0 || effectiveRule.auth === false)

package/dist/runtime/app/composables/useUserSession.js

@@ -37,6 +37,7 @@ export function useUserSession() {
   const authReady = useState("auth:ready", () => false);
   const prerenderReadyResetQueued = useState("auth:prerender-ready-reset-queued", () => false);
   const hydrationReconcileQueued = useState("auth:hydration-reconcile-queued", () => false);
+  const signOutInProgress = useState("auth:sign-out-in-progress", () => false);
   const ready = computed(() => authReady.value);
   const loggedIn = computed(() => Boolean(session.value && user.value));
   const isPrerenderedPayload = computed(() => Boolean(nuxtApp.payload.prerenderedAt || nuxtApp.payload.isCached));
@@ -94,13 +95,30 @@ export function useUserSession() {
     }
   }
   let mountedReconciliationStarted = false;
+  let sessionExpiredRedirecting = false;
+  function getSessionExpiredRedirect() {
+    return runtimeConfig.public.auth?.redirects?.sessionExpired;
+  }
+  function scheduleSessionExpiredRedirect() {
+    const sessionExpiredRedirect = getSessionExpiredRedirect();
+    if (!sessionExpiredRedirect || signOutInProgress.value || sessionExpiredRedirecting)
+      return;
+    sessionExpiredRedirecting = true;
+    void nextTick().then(() => {
+      if (sessionExpiredRedirecting)
+        void navigateTo(sessionExpiredRedirect);
+    });
+  }
   function queueHydrationReconciliation() {
     if (hydrationReconcileQueued.value)
       return;
     hydrationReconcileQueued.value = true;
     const reconcile = async () => {
+      const sessionWasActive = loggedIn.value;
       try {
         await fetchSession({ force: true });
+        if (sessionWasActive && !loggedIn.value)
+          scheduleSessionExpiredRedirect();
       } catch (error) {
         console.error("[nuxt-better-auth] Failed to fetch session during hydration reconciliation:", error);
       } finally {
@@ -119,16 +137,19 @@ export function useUserSession() {
   if (runtimeFlags.client && rawClient && !_sessionSyncApps.has(nuxtApp)) {
     const clientSession = rawClient.useSession();
     const initialClientSession = clientSession.value;
+    let hydrationSessionWasActive = nuxtApp.isHydrating && nuxtApp.payload.serverRendered && Boolean(session.value && user.value) && !initialClientSession?.data?.session && !initialClientSession?.data?.user;
     const shouldReconcileInitialHydration = nuxtApp.isHydrating && nuxtApp.payload.serverRendered && Boolean(session.value && user.value) && !initialClientSession?.data?.session && !initialClientSession?.data?.user && !initialClientSession?.isPending && !initialClientSession?.isRefetching;
     if (shouldReconcileInitialHydration)
       queueHydrationReconciliation();
     watch(
       () => clientSession.value,
-      (newSession) => {
+      (newSession, previousSession) => {
         const shouldWaitForPrerenderResolution = isPrerenderHydrationEmptySnapshot.value && !newSession?.data?.session && !newSession?.data?.user;
         if (shouldWaitForPrerenderResolution)
           return;
         if (newSession?.data?.session && newSession?.data?.user) {
+          sessionExpiredRedirecting = false;
+          hydrationSessionWasActive = false;
           session.value = stripToken(newSession.data.session);
           user.value = newSession.data.user;
         } else if (!newSession?.isPending && !newSession?.isRefetching) {
@@ -137,8 +158,14 @@ export function useUserSession() {
             queueHydrationReconciliation();
             return;
           }
-          if (!newSession?.error || isExpectedSignedOutSessionError(newSession.error))
+          const sessionWasActive = hydrationSessionWasActive || Boolean(previousSession?.data?.session && previousSession?.data?.user);
+          const sessionWasInvalidated = !newSession?.error || isExpectedSignedOutSessionError(newSession.error);
+          if (sessionWasInvalidated) {
+            hydrationSessionWasActive = false;
             clearSession();
+          }
+          if (sessionWasActive && sessionWasInvalidated)
+            scheduleSessionExpiredRedirect();
         }
         if (!authReady.value && !newSession?.isPending && !newSession?.isRefetching)
           authReady.value = true;
@@ -172,19 +199,24 @@ export function useUserSession() {
       return;
     }
     _signOutPromise = (async () => {
-      const result = await rawClient.signOut();
-      if (isRecord(result) && result.error)
-        throw new Error(normalizeAuthActionError(result.error).message);
-      clearSession();
-      if (options?.onSuccess) {
-        await options.onSuccess();
-        return;
-      }
-      const authConfig = runtimeConfig.public.auth;
-      const logoutRedirect = authConfig?.redirects?.logout;
-      if (logoutRedirect) {
-        await nextTick();
-        await navigateTo(logoutRedirect);
+      signOutInProgress.value = true;
+      try {
+        const result = await rawClient.signOut();
+        if (isRecord(result) && result.error)
+          throw new Error(normalizeAuthActionError(result.error).message);
+        clearSession();
+        if (options?.onSuccess) {
+          await options.onSuccess();
+          return;
+        }
+        const authConfig = runtimeConfig.public.auth;
+        const logoutRedirect = authConfig?.redirects?.logout;
+        if (logoutRedirect) {
+          await nextTick();
+          await navigateTo(logoutRedirect);
+        }
+      } finally {
+        signOutInProgress.value = false;
       }
     })().finally(() => {
       _signOutPromise = null;

package/dist/runtime/config.d.ts

@@ -58,6 +58,8 @@ export interface BetterAuthModuleOptions {
         authenticated?: string;
         /** Where to navigate after logout. Default: no automatic navigation */
         logout?: string;
+        /** Where to navigate when a previously authenticated session expires or is revoked. Default: no automatic navigation */
+        sessionExpired?: string;
     };
     /**
      * When redirecting unauthenticated users to the login route, append a query param
@@ -95,6 +97,7 @@ export interface AuthRuntimeConfig {
         guest: string;
         authenticated?: string;
         logout?: string;
+        sessionExpired?: string;
     };
     preserveRedirect: boolean;
     redirectQueryKey: string;

package/dist/runtime/internal/auth-route-rules.d.ts

@@ -1,4 +1,5 @@
 import type { AuthRouteRules } from '../types.js';
+export declare function isInternalAssetPath(path: string): boolean;
 export declare function normalizeAuthRoutePath(path: string, baseURL?: string): string;
 export declare function normalizeAuthRouteRule(rule: unknown): AuthRouteRules['auth'];
 export declare function shouldSkipAuthRouteRules(path: string): boolean;

package/dist/runtime/internal/auth-route-rules.js

@@ -1,22 +1,21 @@
 import { withoutBase } from "ufo";
+const internalAssetPaths = ["/_fonts", "/_ipx", "/_nuxt", "/api/_nuxt_icon"];
+export function isInternalAssetPath(path) {
+  const pathname = path.split(/[?#]/, 1)[0] || "/";
+  return internalAssetPaths.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
 const internalRouteRuleAuthPaths = /* @__PURE__ */ new Set([
-  "/_ipx",
-  "/_nuxt",
   "/__better-auth-devtools",
   "/__nuxt_devtools__",
   "/__nuxt_error",
   "/__nuxt_vite_node__",
   "/api/_better-auth",
-  "/api/_nuxt_icon",
   "/api/auth"
 ]);
 const internalRouteRuleAuthPrefixes = [
-  "/_ipx/",
-  "/_nuxt/",
   "/__nuxt_devtools__/",
   "/__nuxt_vite_node__/",
   "/api/_better-auth/",
-  "/api/_nuxt_icon/",
   "/api/auth/"
 ];
 export function normalizeAuthRoutePath(path, baseURL = "/") {
@@ -30,5 +29,5 @@ export function normalizeAuthRouteRule(rule) {
 }
 export function shouldSkipAuthRouteRules(path) {
   const pathname = path.split(/[?#]/, 1)[0] || "/";
-  return internalRouteRuleAuthPaths.has(pathname) || internalRouteRuleAuthPrefixes.some((prefix) => pathname.startsWith(prefix));
+  return isInternalAssetPath(pathname) || internalRouteRuleAuthPaths.has(pathname) || internalRouteRuleAuthPrefixes.some((prefix) => pathname.startsWith(prefix));
 }

package/dist/runtime/server/api/_better-auth/config.get.js

@@ -21,7 +21,8 @@ export default defineEventHandler(async (event) => {
             login: publicAuth?.redirects?.login ?? "/login",
             guest: publicAuth?.redirects?.guest ?? "/",
             authenticated: publicAuth?.redirects?.authenticated,
-            logout: publicAuth?.redirects?.logout
+            logout: publicAuth?.redirects?.logout,
+            sessionExpired: publicAuth?.redirects?.sessionExpired
           },
           preserveRedirect: publicAuth?.preserveRedirect ?? true,
           redirectQueryKey: publicAuth?.redirectQueryKey ?? "redirect",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nuxtjs/better-auth",
   "type": "module",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Nuxt module for Better Auth integration with NuxtHub, route protection, session management, and role-based access",
   "author": "onmax",
   "license": "MIT",
@@ -94,6 +94,7 @@
     "@libsql/client": "^0.17.4",
     "@libsql/linux-x64-gnu": "0.5.29",
     "@nuxt/devtools": "^3.4.1",
+    "@nuxt/fonts": "0.14.0",
     "@nuxt/module-builder": "^1.0.3",
     "@nuxt/schema": "^4.5.2",
     "@nuxt/test-utils": "^4.1.0",