@onmax/nuxt-better-auth 0.0.1 → 0.0.2-alpha.1

package/dist/runtime/app/plugins/session.client.js

@@ -0,0 +1,16 @@
+import { defineNuxtPlugin } from "#imports";
+import { useUserSession } from "../composables/useUserSession.js";
+export default defineNuxtPlugin(async (nuxtApp) => {
+  const { fetchSession } = useUserSession();
+  const safeFetch = async () => {
+    try {
+      await fetchSession();
+    } catch {
+    }
+  };
+  if (!nuxtApp.payload.serverRendered) {
+    await safeFetch();
+  } else if (nuxtApp.payload.prerenderedAt || nuxtApp.payload.isCached) {
+    nuxtApp.hook("app:mounted", safeFetch);
+  }
+});

package/dist/runtime/app/plugins/session.server.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/app/plugins/session.server.js

@@ -0,0 +1,23 @@
+import { defineNuxtPlugin, useRequestEvent, useRequestHeaders, useState } from "#imports";
+export default defineNuxtPlugin({
+  name: "auth:session-init",
+  enforce: "pre",
+  async setup() {
+    const session = useState("auth:session", () => null);
+    const user = useState("auth:user", () => null);
+    const authReady = useState("auth:ready", () => false);
+    const event = useRequestEvent();
+    if (event) {
+      try {
+        const headers = useRequestHeaders(["cookie"]);
+        const data = await $fetch("/api/auth/get-session", { headers });
+        if (data?.session && data?.user) {
+          session.value = data.session;
+          user.value = data.user;
+        }
+      } catch {
+      }
+    }
+    authReady.value = true;
+  }
+});

package/dist/runtime/config.d.ts

@@ -0,0 +1,36 @@
+import type { BetterAuthOptions } from 'better-auth';
+import type { ClientOptions } from 'better-auth/client';
+import type { ServerAuthContext } from './types/augment.js';
+export type { ServerAuthContext };
+export interface ClientAuthContext {
+    siteUrl: string;
+}
+type ServerAuthConfig = Omit<BetterAuthOptions, 'database' | 'secret' | 'baseURL'>;
+type ClientAuthConfig = Omit<ClientOptions, 'baseURL'> & {
+    baseURL?: string;
+};
+export type ServerAuthConfigFn = (ctx: ServerAuthContext) => ServerAuthConfig;
+export type ClientAuthConfigFn = (ctx: ClientAuthContext) => ClientAuthConfig;
+export interface BetterAuthModuleOptions {
+    /** Server config path relative to rootDir. Default: 'server/auth.config' */
+    serverConfig?: string;
+    /** Client config path relative to rootDir. Default: 'app/auth.config' */
+    clientConfig?: string;
+    redirects?: {
+        login?: string;
+        guest?: string;
+    };
+    /** Enable KV secondary storage for sessions. Requires hub.kv: true */
+    secondaryStorage?: boolean;
+}
+export interface AuthRuntimeConfig {
+    redirects: {
+        login: string;
+        guest: string;
+    };
+}
+export interface AuthPrivateRuntimeConfig {
+    secondaryStorage: boolean;
+}
+export declare function defineServerAuth<T extends ServerAuthConfig>(config: (ctx: ServerAuthContext) => T): (ctx: ServerAuthContext) => T;
+export declare function defineClientAuth(config: ClientAuthConfigFn): ClientAuthConfigFn;

package/dist/runtime/config.js

@@ -0,0 +1,6 @@
+export function defineServerAuth(config) {
+  return config;
+}
+export function defineClientAuth(config) {
+  return config;
+}

package/dist/runtime/server/api/_better-auth/_schema.d.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+export declare const paginationQuerySchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type PaginationQuery = z.infer<typeof paginationQuerySchema>;
+export declare function sanitizeSearchPattern(search: string): string;

package/dist/runtime/server/api/_better-auth/_schema.js

@@ -0,0 +1,11 @@
+import { z } from "zod";
+export const paginationQuerySchema = z.object({
+  page: z.coerce.number().int().min(1).default(1),
+  limit: z.coerce.number().int().min(1).max(100).default(20),
+  search: z.string().max(100).default("")
+});
+export function sanitizeSearchPattern(search) {
+  if (!search)
+    return "";
+  return `%${search.replace(/[%_\\]/g, "\\$&")}%`;
+}

package/dist/runtime/server/api/_better-auth/accounts.get.d.ts

@@ -0,0 +1,14 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    accounts: never[];
+    total: number;
+    error: string;
+    page?: undefined;
+    limit?: undefined;
+} | {
+    accounts: any;
+    total: any;
+    page: number;
+    limit: number;
+    error?: undefined;
+}>>;
+export default _default;

package/dist/runtime/server/api/_better-auth/accounts.get.js

@@ -0,0 +1,28 @@
+import { defineEventHandler, getQuery } from "h3";
+import { paginationQuerySchema, sanitizeSearchPattern } from "./_schema.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const { db, schema } = await import("hub:db");
+    if (!schema.account)
+      return { accounts: [], total: 0, error: "Account table not found" };
+    const query = paginationQuerySchema.parse(getQuery(event));
+    const { page, limit, search } = query;
+    const offset = (page - 1) * limit;
+    const { count, like, desc } = await import("drizzle-orm");
+    let dbQuery = db.select().from(schema.account);
+    let countQuery = db.select({ count: count() }).from(schema.account);
+    if (search) {
+      const pattern = sanitizeSearchPattern(search);
+      dbQuery = dbQuery.where(like(schema.account.providerId, pattern));
+      countQuery = countQuery.where(like(schema.account.providerId, pattern));
+    }
+    const [accounts, totalResult] = await Promise.all([
+      dbQuery.orderBy(desc(schema.account.createdAt)).limit(limit).offset(offset),
+      countQuery
+    ]);
+    return { accounts, total: totalResult[0]?.count ?? 0, page, limit };
+  } catch (error) {
+    console.error("[DevTools] Fetch accounts failed:", error);
+    return { accounts: [], total: 0, error: "Failed to fetch accounts" };
+  }
+});

package/dist/runtime/server/api/_better-auth/config.get.d.ts

@@ -0,0 +1,35 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    config: {
+        module: {
+            redirects: {
+                login?: string;
+                guest?: string;
+            };
+            secondaryStorage: boolean;
+            useDatabase: boolean;
+        };
+        server: {
+            baseURL: string | undefined;
+            basePath: string;
+            socialProviders: string[];
+            plugins: any[];
+            trustedOrigins: string[] | ((request: Request) => string[] | Promise<string[]>);
+            session: {
+                expiresIn: string;
+                updateAge: string;
+                cookieCache: boolean;
+            };
+            emailAndPassword: boolean;
+            rateLimit: boolean;
+            advanced: {
+                useSecureCookies: string | boolean;
+                disableCSRFCheck: boolean;
+            };
+        };
+    };
+    error?: undefined;
+} | {
+    config: null;
+    error: any;
+}>>;
+export default _default;

package/dist/runtime/server/api/_better-auth/config.get.js

@@ -0,0 +1,46 @@
+import { defineEventHandler } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
+import { serverAuth } from "../../utils/auth.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const auth = await serverAuth(event);
+    const options = auth.options;
+    const runtimeConfig = useRuntimeConfig();
+    const publicAuth = runtimeConfig.public?.auth;
+    const privateAuth = runtimeConfig.auth;
+    const sessionConfig = options.session || {};
+    const expiresInDays = sessionConfig.expiresIn ? Math.round(sessionConfig.expiresIn / 86400) : 7;
+    const updateAgeDays = sessionConfig.updateAge ? Math.round(sessionConfig.updateAge / 86400) : 1;
+    return {
+      config: {
+        // Module config (nuxt.config.ts)
+        module: {
+          redirects: publicAuth?.redirects || { login: "/login", guest: "/" },
+          secondaryStorage: privateAuth?.secondaryStorage ?? false,
+          useDatabase: publicAuth?.useDatabase ?? false
+        },
+        // Server config (server/auth.config.ts)
+        server: {
+          baseURL: options.baseURL,
+          basePath: options.basePath || "/api/auth",
+          socialProviders: Object.keys(options.socialProviders || {}),
+          plugins: (options.plugins || []).map((p) => p.id || "unknown"),
+          trustedOrigins: options.trustedOrigins || [],
+          session: {
+            expiresIn: `${expiresInDays} days`,
+            updateAge: `${updateAgeDays} days`,
+            cookieCache: sessionConfig.cookieCache?.enabled ?? false
+          },
+          emailAndPassword: !!options.emailAndPassword,
+          rateLimit: options.rateLimit?.enabled ?? false,
+          advanced: {
+            useSecureCookies: options.advanced?.useSecureCookies ?? "auto",
+            disableCSRFCheck: options.advanced?.disableCSRFCheck ?? false
+          }
+        }
+      }
+    };
+  } catch (error) {
+    return { config: null, error: error.message || "Failed to fetch config" };
+  }
+});

package/dist/runtime/server/api/_better-auth/sessions.delete.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    success: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/api/_better-auth/sessions.delete.js

@@ -0,0 +1,22 @@
+import { createError, defineEventHandler, readBody } from "h3";
+import { z } from "zod";
+const deleteSessionSchema = z.object({
+  id: z.string().min(1, "Session ID required")
+});
+export default defineEventHandler(async (event) => {
+  try {
+    const body = deleteSessionSchema.parse(await readBody(event));
+    const { db, schema } = await import("hub:db");
+    if (!schema.session)
+      throw createError({ statusCode: 500, message: "Session table not found" });
+    const { eq } = await import("drizzle-orm");
+    await db.delete(schema.session).where(eq(schema.session.id, body.id));
+    return { success: true };
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw createError({ statusCode: 400, message: error.errors[0]?.message || "Invalid request" });
+    }
+    console.error("[DevTools] Delete session failed:", error);
+    throw createError({ statusCode: 500, message: "Failed to delete session" });
+  }
+});

package/dist/runtime/server/api/_better-auth/sessions.get.d.ts

@@ -0,0 +1,14 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    sessions: never[];
+    total: number;
+    error: string;
+    page?: undefined;
+    limit?: undefined;
+} | {
+    sessions: any;
+    total: any;
+    page: number;
+    limit: number;
+    error?: undefined;
+}>>;
+export default _default;

package/dist/runtime/server/api/_better-auth/sessions.get.js

@@ -0,0 +1,34 @@
+import { defineEventHandler, getQuery } from "h3";
+import { paginationQuerySchema, sanitizeSearchPattern } from "./_schema.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const { db, schema } = await import("hub:db");
+    if (!schema.session)
+      return { sessions: [], total: 0, error: "Session table not found" };
+    const query = paginationQuerySchema.parse(getQuery(event));
+    const { page, limit, search } = query;
+    const offset = (page - 1) * limit;
+    const { count, like, or, desc } = await import("drizzle-orm");
+    let dbQuery = db.select().from(schema.session);
+    let countQuery = db.select({ count: count() }).from(schema.session);
+    if (search) {
+      const pattern = sanitizeSearchPattern(search);
+      const searchCondition = or(
+        like(schema.session.userId, pattern),
+        schema.session.ipAddress ? like(schema.session.ipAddress, pattern) : void 0
+      );
+      if (searchCondition) {
+        dbQuery = dbQuery.where(searchCondition);
+        countQuery = countQuery.where(searchCondition);
+      }
+    }
+    const [sessions, totalResult] = await Promise.all([
+      dbQuery.orderBy(desc(schema.session.createdAt)).limit(limit).offset(offset),
+      countQuery
+    ]);
+    return { sessions, total: totalResult[0]?.count ?? 0, page, limit };
+  } catch (error) {
+    console.error("[DevTools] Fetch sessions failed:", error);
+    return { sessions: [], total: 0, error: "Failed to fetch sessions" };
+  }
+});

package/dist/runtime/server/api/_better-auth/users.get.d.ts

@@ -0,0 +1,14 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    users: never[];
+    total: number;
+    error: string;
+    page?: undefined;
+    limit?: undefined;
+} | {
+    users: any;
+    total: any;
+    page: number;
+    limit: number;
+    error?: undefined;
+}>>;
+export default _default;

package/dist/runtime/server/api/_better-auth/users.get.js

@@ -0,0 +1,34 @@
+import { defineEventHandler, getQuery } from "h3";
+import { paginationQuerySchema, sanitizeSearchPattern } from "./_schema.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const { db, schema } = await import("hub:db");
+    if (!schema.user)
+      return { users: [], total: 0, error: "User table not found" };
+    const query = paginationQuerySchema.parse(getQuery(event));
+    const { page, limit, search } = query;
+    const offset = (page - 1) * limit;
+    const { count, like, or, desc } = await import("drizzle-orm");
+    let dbQuery = db.select().from(schema.user);
+    let countQuery = db.select({ count: count() }).from(schema.user);
+    if (search) {
+      const pattern = sanitizeSearchPattern(search);
+      const searchCondition = or(
+        like(schema.user.name, pattern),
+        like(schema.user.email, pattern)
+      );
+      if (searchCondition) {
+        dbQuery = dbQuery.where(searchCondition);
+        countQuery = countQuery.where(searchCondition);
+      }
+    }
+    const [users, totalResult] = await Promise.all([
+      dbQuery.orderBy(desc(schema.user.createdAt)).limit(limit).offset(offset),
+      countQuery
+    ]);
+    return { users, total: totalResult[0]?.count ?? 0, page, limit };
+  } catch (error) {
+    console.error("[DevTools] Fetch users failed:", error);
+    return { users: [], total: 0, error: "Failed to fetch users" };
+  }
+});

package/dist/runtime/server/api/auth/[...all].d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<Response>>;
+export default _default;

package/dist/runtime/server/api/auth/[...all].js

@@ -0,0 +1,6 @@
+import { defineEventHandler, toWebRequest } from "h3";
+import { serverAuth } from "../../utils/auth.js";
+export default defineEventHandler(async (event) => {
+  const auth = await serverAuth(event);
+  return auth.handler(toWebRequest(event));
+});

package/dist/runtime/server/middleware/route-access.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/middleware/route-access.js

@@ -0,0 +1,28 @@
+import { createError, defineEventHandler, getRequestURL } from "h3";
+import { getRouteRules } from "nitropack/runtime";
+import { matchesUser } from "../../utils/match-user.js";
+export default defineEventHandler(async (event) => {
+  const path = getRequestURL(event).pathname;
+  if (!path.startsWith("/api/"))
+    return;
+  if (path.startsWith("/api/auth/"))
+    return;
+  const rules = getRouteRules(event);
+  if (!rules.auth)
+    return;
+  const auth = rules.auth;
+  const mode = typeof auth === "string" ? auth : auth?.only ?? "user";
+  if (mode === "guest") {
+    const session = await getUserSession(event);
+    if (session)
+      throw createError({ statusCode: 403, statusMessage: "Authenticated users not allowed" });
+    return;
+  }
+  if (mode === "user") {
+    const session = await requireUserSession(event);
+    if (typeof auth === "object" && auth.user) {
+      if (!matchesUser(session.user, auth.user))
+        throw createError({ statusCode: 403, statusMessage: "Access denied" });
+    }
+  }
+});

package/dist/runtime/server/tsconfig.json

@@ -0,0 +1,3 @@
+{
+  "extends": "../../../.nuxt/tsconfig.server.json"
+}

package/dist/runtime/server/utils/auth.d.ts

@@ -0,0 +1,10 @@
+import type { H3Event } from 'h3';
+import { betterAuth } from 'better-auth';
+type AuthInstance = ReturnType<typeof betterAuth>;
+declare module 'h3' {
+    interface H3EventContext {
+        _betterAuth?: AuthInstance;
+    }
+}
+export declare function serverAuth(event: H3Event): Promise<AuthInstance>;
+export {};

package/dist/runtime/server/utils/auth.js

@@ -0,0 +1,32 @@
+import { createDatabase, db } from "#auth/database";
+import { createSecondaryStorage } from "#auth/secondary-storage";
+import createServerAuth from "#auth/server";
+import { betterAuth } from "better-auth";
+import { consola } from "consola";
+import { getRequestURL } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
+const logger = consola.withTag("nuxt-better-auth");
+function getBaseURL(event, siteUrl) {
+  if (siteUrl)
+    return siteUrl;
+  const origin = getRequestURL(event).origin;
+  if (process.env.NODE_ENV === "production")
+    throw new Error("siteUrl must be configured in production. Set NUXT_PUBLIC_SITE_URL or configure in nuxt.config.");
+  logger.warn("siteUrl not set, auto-detected:", origin);
+  return origin;
+}
+export async function serverAuth(event) {
+  if (event.context._betterAuth)
+    return event.context._betterAuth;
+  const runtimeConfig = useRuntimeConfig();
+  const database = createDatabase();
+  const userConfig = createServerAuth({ runtimeConfig, db });
+  event.context._betterAuth = betterAuth({
+    ...userConfig,
+    ...database && { database },
+    secondaryStorage: createSecondaryStorage(),
+    secret: runtimeConfig.betterAuthSecret,
+    baseURL: getBaseURL(event, runtimeConfig.public.siteUrl)
+  });
+  return event.context._betterAuth;
+}

package/dist/runtime/server/utils/session.d.ts

@@ -0,0 +1,9 @@
+import type { H3Event } from 'h3';
+import type { AuthSession, AuthUser, RequireSessionOptions } from '../../types.js';
+interface FullSession {
+    user: AuthUser;
+    session: AuthSession;
+}
+export declare function getUserSession(event: H3Event): Promise<FullSession | null>;
+export declare function requireUserSession(event: H3Event, options?: RequireSessionOptions): Promise<FullSession>;
+export {};

package/dist/runtime/server/utils/session.js

@@ -0,0 +1,22 @@
+import { createError } from "h3";
+import { matchesUser } from "../../utils/match-user.js";
+export async function getUserSession(event) {
+  const auth = await serverAuth(event);
+  const session = await auth.api.getSession({ headers: event.headers });
+  return session;
+}
+export async function requireUserSession(event, options) {
+  const session = await getUserSession(event);
+  if (!session)
+    throw createError({ statusCode: 401, statusMessage: "Authentication required" });
+  if (options?.user) {
+    if (!matchesUser(session.user, options.user))
+      throw createError({ statusCode: 403, statusMessage: "Access denied" });
+  }
+  if (options?.rule) {
+    const allowed = await options.rule({ user: session.user, session: session.session });
+    if (!allowed)
+      throw createError({ statusCode: 403, statusMessage: "Access denied" });
+  }
+  return session;
+}

package/dist/runtime/types/augment.d.ts

@@ -0,0 +1,42 @@
+import type { ComputedRef, Ref } from 'vue';
+export interface AuthUser {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    name: string;
+    image?: string | null;
+}
+export interface AuthSession {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    userId: string;
+    expiresAt: Date;
+    token: string;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+}
+export interface ServerAuthContext {
+    runtimeConfig: Record<string, unknown>;
+    db: unknown;
+}
+export interface UserSessionComposable {
+    client: unknown;
+    user: Ref<AuthUser | null>;
+    session: Ref<AuthSession | null>;
+    loggedIn: ComputedRef<boolean>;
+    ready: ComputedRef<boolean>;
+    signIn: unknown;
+    signUp: unknown;
+    fetchSession: (options?: {
+        headers?: HeadersInit;
+        force?: boolean;
+    }) => Promise<void>;
+    waitForSession: () => Promise<void>;
+    signOut: (options?: {
+        onSuccess?: () => void | Promise<void>;
+    }) => Promise<unknown>;
+    updateUser: (updates: Partial<AuthUser>) => void;
+}

package/dist/runtime/types.d.ts

@@ -0,0 +1,23 @@
+import type { NitroRouteRules } from 'nitropack/types';
+import type { AuthSession, AuthUser } from './types/augment.js';
+export type { AuthSession, AuthUser, ServerAuthContext, UserSessionComposable } from './types/augment.js';
+export type { Auth, InferSession, InferUser } from 'better-auth';
+export type AuthMode = 'guest' | 'user';
+export type UserMatch<T> = {
+    [K in keyof T]?: T[K] | T[K][];
+};
+export type AuthMeta = false | AuthMode | {
+    only?: AuthMode;
+    redirectTo?: string;
+    user?: UserMatch<AuthUser>;
+};
+export type AuthRouteRules = NitroRouteRules & {
+    auth?: AuthMeta;
+};
+export interface RequireSessionOptions {
+    user?: UserMatch<AuthUser>;
+    rule?: (ctx: {
+        user: AuthUser;
+        session: AuthSession;
+    }) => boolean | Promise<boolean>;
+}

package/dist/runtime/utils/match-user.d.ts

@@ -0,0 +1,2 @@
+import type { UserMatch } from '../types.js';
+export declare function matchesUser<T extends object>(user: T, match: UserMatch<T>): boolean;

package/dist/runtime/utils/match-user.js

@@ -0,0 +1,13 @@
+export function matchesUser(user, match) {
+  for (const [key, expected] of Object.entries(match)) {
+    const actual = user[key];
+    if (Array.isArray(expected)) {
+      if (!expected.includes(actual))
+        return false;
+    } else {
+      if (actual !== expected)
+        return false;
+    }
+  }
+  return true;
+}

package/dist/types.d.mts

@@ -1,13 +1,11 @@
-import type { ModuleHooks, ModuleRuntimeHooks, ModuleRuntimeConfig, ModulePublicRuntimeConfig } from './module.mjs'
+import type { NuxtModule } from '@nuxt/schema'
 
-declare module '#app' {
-  interface RuntimeNuxtHooks extends ModuleRuntimeHooks {}
-}
+import type { default as Module } from './module.mjs'
 
-declare module '@nuxt/schema' {
-  interface NuxtHooks extends ModuleHooks {}
-  interface RuntimeConfig extends ModuleRuntimeConfig {}
-  interface PublicRuntimeConfig extends ModulePublicRuntimeConfig {}
-}
+export type ModuleOptions = typeof Module extends NuxtModule<infer O> ? Partial<O> : Record<string, any>
 
-export * from "./module.mjs"
+export { type BetterAuthModuleOptions, type defineClientAuth, type defineServerAuth } from '../dist/runtime/config.js'
+
+export { type Auth, type AuthMeta, type AuthMode, type AuthRouteRules, type AuthSession, type AuthUser, type InferSession, type InferUser, type RequireSessionOptions, type ServerAuthContext, type UserMatch } from '../dist/runtime/types.js'
+
+export { default } from './module.mjs'