@onmax/nuxt-better-auth 0.0.2-alpha.9 → 0.0.3

package/dist/runtime/app/internal/auth-action-handles.js

@@ -0,0 +1,105 @@
+import { ref } from "#imports";
+import { normalizeAuthActionError } from "./auth-action-error.js";
+import { isRecord } from "./utils.js";
+export function isAuthActionErrorResult(value) {
+  if (!isRecord(value))
+    return false;
+  if (!("error" in value))
+    return false;
+  return Boolean(value.error);
+}
+function isRedirectResult(value) {
+  if (!isRecord(value))
+    return false;
+  return value.redirect === true && typeof value.url === "string" && value.url.length > 0;
+}
+function getRedirectResult(value) {
+  if (isRedirectResult(value))
+    return value;
+  if (!isRecord(value))
+    return null;
+  const nested = value.data;
+  if (isRedirectResult(nested))
+    return nested;
+  return null;
+}
+const REDIRECT_PENDING_FALLBACK_MS = 1e4;
+export function createActionHandle(getMethod, options = {}) {
+  const status = ref("idle");
+  const data = ref(null);
+  const error = ref(null);
+  let latestCallId = 0;
+  const run = async (...args) => {
+    const callId = ++latestCallId;
+    status.value = "pending";
+    data.value = null;
+    error.value = null;
+    try {
+      const result = await getMethod()(...args);
+      if (isAuthActionErrorResult(result)) {
+        const normalizedError = normalizeAuthActionError(result.error);
+        if (callId === latestCallId) {
+          status.value = "error";
+          data.value = null;
+          error.value = normalizedError;
+        }
+        return;
+      }
+      if (callId === latestCallId) {
+        if (options.keepPendingOnRedirect !== false) {
+          const redirectResult = getRedirectResult(result);
+          if (redirectResult) {
+            status.value = "pending";
+            data.value = result;
+            error.value = null;
+            setTimeout(() => {
+              if (callId !== latestCallId || status.value !== "pending")
+                return;
+              status.value = "success";
+            }, REDIRECT_PENDING_FALLBACK_MS);
+            return;
+          }
+        }
+        status.value = "success";
+        data.value = result;
+        error.value = null;
+      }
+    } catch (thrown) {
+      const normalizedError = normalizeAuthActionError(thrown);
+      if (callId === latestCallId) {
+        status.value = "error";
+        data.value = null;
+        error.value = normalizedError;
+      }
+    }
+  };
+  const execute = (async (...args) => {
+    await run(...args);
+  });
+  return {
+    execute,
+    status,
+    data,
+    error
+  };
+}
+export function createActionHandles(getTarget, targetName) {
+  const handles = /* @__PURE__ */ new Map();
+  return new Proxy({}, {
+    get(_target, prop) {
+      if (prop === "then")
+        return void 0;
+      if (handles.has(prop))
+        return handles.get(prop);
+      const handle = createActionHandle(() => {
+        const target = getTarget();
+        const method = target[prop];
+        if (typeof method !== "function")
+          throw new TypeError(`${targetName}.${String(prop)}() is not a function`);
+        return method;
+      });
+      handles.set(prop, handle);
+      return handle;
+    }
+  });
+}

package/dist/runtime/app/internal/redirect-helpers.d.ts

@@ -0,0 +1,4 @@
+export declare function isSafeLocalRedirect(redirect: unknown): string | undefined;
+export declare function resolvePostAuthRedirect(requestURL: URL): string | undefined;
+export declare function resolvePostAuthSuccessRedirect(requestURL: URL): (() => Promise<void>) | undefined;
+export declare function withFallbackSocialCallbackURL(data: unknown, requestURL: URL): unknown;

package/dist/runtime/app/internal/redirect-helpers.js

@@ -0,0 +1,37 @@
+import { navigateTo, useRuntimeConfig } from "#imports";
+import { isRecord } from "./utils.js";
+export function isSafeLocalRedirect(redirect) {
+  if (typeof redirect !== "string")
+    return;
+  if (!redirect.startsWith("/") || redirect.startsWith("//"))
+    return;
+  return redirect;
+}
+export function resolvePostAuthRedirect(requestURL) {
+  const runtimeConfig = useRuntimeConfig();
+  const authConfig = runtimeConfig.public.auth;
+  const redirectQueryKey = authConfig?.redirectQueryKey ?? "redirect";
+  const queryRedirect = requestURL.searchParams?.get(redirectQueryKey);
+  const safeQueryRedirect = isSafeLocalRedirect(queryRedirect);
+  if (safeQueryRedirect)
+    return safeQueryRedirect;
+  return isSafeLocalRedirect(authConfig?.redirects?.authenticated);
+}
+export function resolvePostAuthSuccessRedirect(requestURL) {
+  const target = resolvePostAuthRedirect(requestURL);
+  if (!target)
+    return;
+  return async () => {
+    await navigateTo(target);
+  };
+}
+export function withFallbackSocialCallbackURL(data, requestURL) {
+  const callbackURL = resolvePostAuthRedirect(requestURL);
+  if (!callbackURL)
+    return data;
+  if (!isRecord(data))
+    return { callbackURL };
+  if (typeof data.callbackURL === "string")
+    return data;
+  return { ...data, callbackURL };
+}

package/dist/runtime/app/internal/session-fetch.d.ts

@@ -0,0 +1,12 @@
+import type { Ref } from 'vue';
+import type { AppAuthClient, AuthSession, AuthUser } from '#nuxt-better-auth';
+export declare function stripToken(session: AuthSession & {
+    token?: string;
+}): AuthSession;
+export declare function fetchSessionServer(session: Ref<AuthSession | null>, user: Ref<AuthUser | null>, authReady: Ref<boolean>, options?: {
+    headers?: HeadersInit;
+}): Promise<void>;
+export declare function fetchSessionClient(client: AppAuthClient, session: Ref<AuthSession | null>, user: Ref<AuthUser | null>, authReady: Ref<boolean>, options?: {
+    headers?: HeadersInit;
+    force?: boolean;
+}): Promise<void>;

package/dist/runtime/app/internal/session-fetch.js

@@ -0,0 +1,56 @@
+import { useRequestFetch, useRequestHeaders } from "#imports";
+import { normalizeAuthActionError } from "./auth-action-error.js";
+export function stripToken(session) {
+  const { token: _, ...safe } = session;
+  return safe;
+}
+function isExpectedSignedOutSessionError(error) {
+  const normalizedError = normalizeAuthActionError(error);
+  if (normalizedError.status === 401)
+    return true;
+  return normalizedError.code === "UNAUTHORIZED";
+}
+export async function fetchSessionServer(session, user, authReady, options = {}) {
+  try {
+    const headers = options.headers || useRequestHeaders(["cookie"]);
+    const requestFetch = useRequestFetch();
+    const data = await requestFetch("/api/auth/get-session", { headers });
+    if (data?.session && data?.user) {
+      session.value = stripToken(data.session);
+      user.value = data.user;
+    } else {
+      session.value = null;
+      user.value = null;
+    }
+  } catch {
+    session.value = null;
+    user.value = null;
+  } finally {
+    if (!authReady.value)
+      authReady.value = true;
+  }
+}
+export async function fetchSessionClient(client, session, user, authReady, options = {}) {
+  try {
+    const headers = options.headers || useRequestHeaders(["cookie"]);
+    const fetchOptions = headers ? { headers } : void 0;
+    const query = options.force ? { disableCookieCache: true } : void 0;
+    const result = await client.getSession({ query }, fetchOptions);
+    const data = result.data;
+    if (data?.session && data?.user) {
+      session.value = stripToken(data.session);
+      user.value = data.user;
+    } else {
+      session.value = null;
+      user.value = null;
+    }
+  } catch (error) {
+    session.value = null;
+    user.value = null;
+    if (!isExpectedSignedOutSessionError(error))
+      console.error("[nuxt-better-auth] Failed to fetch session:", error);
+  } finally {
+    if (!authReady.value)
+      authReady.value = true;
+  }
+}

package/dist/runtime/app/internal/utils.d.ts

@@ -0,0 +1 @@
+export declare function isRecord(value: unknown): value is Record<string, unknown>;

package/dist/runtime/app/internal/utils.js

@@ -0,0 +1,3 @@
+export function isRecord(value) {
+  return Boolean(value && typeof value === "object");
+}

package/dist/runtime/app/internal/vue-safe-auth-proxy.d.ts

@@ -0,0 +1,3 @@
+export declare function isAuthProxyProbeKey(prop: PropertyKey): boolean;
+export declare function createVueSafeAuthFacade<T extends object>(resolve: (prop: PropertyKey, receiver: object) => unknown): T;
+export declare function createVueSafeAuthProxy<T>(target: T): T;

package/dist/runtime/app/internal/vue-safe-auth-proxy.js

@@ -0,0 +1,68 @@
+const promiseProbeKeys = /* @__PURE__ */ new Set(["then", "catch", "finally"]);
+export function isAuthProxyProbeKey(prop) {
+  return typeof prop !== "string" || promiseProbeKeys.has(prop) || prop.startsWith("__v");
+}
+function isObjectLike(value) {
+  return typeof value === "object" && value !== null || typeof value === "function";
+}
+export function createVueSafeAuthFacade(resolve) {
+  const propertyCache = /* @__PURE__ */ new Map();
+  const facadeTarget = {};
+  Object.defineProperty(facadeTarget, "__v_skip", {
+    value: true,
+    configurable: true
+  });
+  return new Proxy(facadeTarget, {
+    get(_target, prop, receiver) {
+      if (prop === "__v_skip")
+        return true;
+      if (isAuthProxyProbeKey(prop))
+        return void 0;
+      if (propertyCache.has(prop))
+        return propertyCache.get(prop);
+      const value = resolve(prop, receiver);
+      propertyCache.set(prop, value);
+      return value;
+    }
+  });
+}
+export function createVueSafeAuthProxy(target) {
+  if (!isObjectLike(target))
+    return target;
+  const cache = /* @__PURE__ */ new WeakMap();
+  const wrap = (value) => {
+    if (!isObjectLike(value))
+      return value;
+    const cached = cache.get(value);
+    if (cached)
+      return cached;
+    const propertyCache = /* @__PURE__ */ new Map();
+    const handler = {
+      get(target2, prop, receiver) {
+        if (prop === "__v_skip")
+          return true;
+        if (isAuthProxyProbeKey(prop))
+          return void 0;
+        if (propertyCache.has(prop))
+          return propertyCache.get(prop);
+        const wrapped = wrap(Reflect.get(target2, prop, receiver));
+        propertyCache.set(prop, wrapped);
+        return wrapped;
+      }
+    };
+    if (typeof value === "function") {
+      handler.apply = (target2, thisArg, args) => Reflect.apply(target2, thisArg, args);
+    }
+    const proxy = new Proxy(value, handler);
+    cache.set(value, proxy);
+    return proxy;
+  };
+  const createRootFacade = (value) => {
+    if (!isObjectLike(value))
+      return value;
+    const proxy = createVueSafeAuthFacade((prop, receiver) => wrap(Reflect.get(value, prop, receiver)));
+    cache.set(value, proxy);
+    return proxy;
+  };
+  return createRootFacade(target);
+}

package/dist/runtime/app/internal/wrap-auth-method.d.ts

@@ -0,0 +1,18 @@
+import type { ComputedRef } from 'vue';
+export declare function refreshSessionAfterAuthAction(fetchSession: (options?: {
+    force?: boolean;
+}) => Promise<void>, loggedIn: ComputedRef<boolean>, waitForSession: () => Promise<void>): Promise<void>;
+export declare function wrapOnSuccess(fetchSession: (options?: {
+    force?: boolean;
+}) => Promise<void>, loggedIn: ComputedRef<boolean>, waitForSession: () => Promise<void>, cb: (ctx: unknown) => void | Promise<void>): (ctx: unknown) => Promise<void>;
+export declare function wrapAuthMethod<T extends (...args: unknown[]) => Promise<unknown>>(method: T, deps: {
+    fetchSession: (options?: {
+        force?: boolean;
+    }) => Promise<void>;
+    loggedIn: ComputedRef<boolean>;
+    waitForSession: () => Promise<void>;
+    resolvePostAuthSuccessRedirect: () => (() => Promise<void>) | undefined;
+}, wrapOptions?: {
+    shouldSkipSessionSync?: (data: unknown, options: unknown) => boolean;
+    transformData?: (data: unknown, options: unknown) => unknown;
+}): T;

package/dist/runtime/app/internal/wrap-auth-method.js

@@ -0,0 +1,69 @@
+import { nextTick } from "#imports";
+import { isRecord } from "./utils.js";
+export async function refreshSessionAfterAuthAction(fetchSession, loggedIn, waitForSession) {
+  await fetchSession({ force: true });
+  if (!loggedIn.value)
+    await waitForSession();
+  await nextTick();
+}
+export function wrapOnSuccess(fetchSession, loggedIn, waitForSession, cb) {
+  return async (ctx) => {
+    await refreshSessionAfterAuthAction(fetchSession, loggedIn, waitForSession);
+    await cb(ctx);
+  };
+}
+export function wrapAuthMethod(method, deps, wrapOptions = {}) {
+  return (async (...args) => {
+    const originalData = args[0];
+    const options = args[1];
+    const data = wrapOptions.transformData?.(originalData, options) ?? originalData;
+    const dataRecord = isRecord(data) ? data : void 0;
+    const optionsRecord = isRecord(options) ? options : void 0;
+    if (wrapOptions.shouldSkipSessionSync?.(data, options))
+      return method(data, options);
+    const fetchOptions = isRecord(dataRecord?.fetchOptions) ? dataRecord.fetchOptions : void 0;
+    const nestedOnSuccess = fetchOptions?.onSuccess;
+    const topLevelOnSuccess = optionsRecord?.onSuccess;
+    const fallbackOnSuccess = deps.resolvePostAuthSuccessRedirect();
+    const wrappedFallbackOnSuccess = fallbackOnSuccess && wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, async () => {
+      if (!deps.loggedIn.value)
+        return;
+      await fallbackOnSuccess();
+    });
+    if (typeof nestedOnSuccess === "function") {
+      const nextData = {
+        ...dataRecord,
+        fetchOptions: {
+          ...fetchOptions,
+          onSuccess: wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, nestedOnSuccess)
+        }
+      };
+      return method(nextData, options);
+    }
+    if (typeof topLevelOnSuccess === "function") {
+      const nextOptions = {
+        ...optionsRecord,
+        onSuccess: wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, topLevelOnSuccess)
+      };
+      return method(data, nextOptions);
+    }
+    if (wrappedFallbackOnSuccess) {
+      if (fetchOptions) {
+        const nextData = {
+          ...dataRecord,
+          fetchOptions: {
+            ...fetchOptions,
+            onSuccess: wrappedFallbackOnSuccess
+          }
+        };
+        return method(nextData, options);
+      }
+      const nextOptions = {
+        ...optionsRecord,
+        onSuccess: wrappedFallbackOnSuccess
+      };
+      return method(data, nextOptions);
+    }
+    return method(data, options);
+  });
+}

package/dist/runtime/app/middleware/auth.global.js

@@ -1,37 +1,102 @@
-import { createError, defineNuxtRouteMiddleware, getRouteRules, navigateTo, useNuxtApp, useRequestHeaders, useRuntimeConfig, useUserSession } from "#imports";
+import { defu } from "defu";
+import { createRouter, toRouteMatcher } from "radix3";
+import { createError, defineNuxtRouteMiddleware, getRouteRules, navigateTo, useNuxtApp, useRequestHeaders, useRuntimeConfig } from "#imports";
+import { shouldSkipAuthRouteRules } from "../../internal/auth-route-rules.js";
 import { matchesUser } from "../../utils/match-user.js";
+import { useUserSession } from "../composables/useUserSession.js";
+let authRouteRulesPromise = null;
+let routeRulesMatcherPromise = null;
 export default defineNuxtRouteMiddleware(async (to) => {
+  if (shouldSkipAuthRouteRules(to.path))
+    return;
   const nuxtApp = useNuxtApp();
-  if (import.meta.client) {
-    const isPrerendered = nuxtApp.payload.prerenderedAt || nuxtApp.payload.isCached;
-    if (isPrerendered && nuxtApp.isHydrating)
-      return;
-  }
   if (to.meta.auth === void 0) {
-    const rules = await getRouteRules({ path: to.path });
-    if (rules.auth !== void 0)
-      to.meta.auth = rules.auth;
+    const routeRulesMatcher = await getRouteRulesMatcher();
+    const matches = routeRulesMatcher?.matchAll(to.path);
+    if (matches?.length) {
+      const merged = defu({}, ...matches.reverse());
+      if (merged.auth !== void 0)
+        to.meta.auth = merged.auth;
+    }
+    if (to.meta.auth === void 0) {
+      const rules = await getRouteRules({ path: to.path });
+      if (rules.auth !== void 0)
+        to.meta.auth = rules.auth;
+    }
   }
   const auth = to.meta.auth;
   if (auth === void 0 || auth === false)
     return;
   const config = useRuntimeConfig().public.auth;
   const { fetchSession, user, loggedIn } = useUserSession();
-  if (!loggedIn.value) {
-    const headers = import.meta.server ? useRequestHeaders(["cookie"]) : void 0;
-    await fetchSession({ headers });
-  }
   const mode = typeof auth === "string" ? auth : auth?.only ?? "user";
   const redirectTo = typeof auth === "object" ? auth.redirectTo : void 0;
+  if (!loggedIn.value || mode === "guest") {
+    const headers = import.meta.server ? useRequestHeaders(["cookie"]) : void 0;
+    const isHydratedPrerenderPayload = (import.meta.client || !import.meta.server) && nuxtApp.isHydrating && Boolean(nuxtApp.payload.prerenderedAt || nuxtApp.payload.isCached);
+    await fetchSession({ headers, ...isHydratedPrerenderPayload ? { force: true } : {} });
+  }
   if (mode === "guest") {
     if (loggedIn.value)
       return navigateTo(redirectTo ?? config?.redirects?.guest ?? "/");
     return;
   }
-  if (!loggedIn.value)
-    return navigateTo(redirectTo ?? config?.redirects?.login ?? "/login");
+  if (!loggedIn.value) {
+    const resolved = resolveLoginRedirect({
+      route: to,
+      loginTarget: redirectTo ?? config?.redirects?.login ?? "/login",
+      config
+    });
+    return resolved.external ? navigateTo(resolved.to, { external: true }) : navigateTo(resolved.to);
+  }
   if (typeof auth === "object" && auth.user) {
     if (!user.value || !matchesUser(user.value, auth.user))
       throw createError({ statusCode: 403, statusMessage: "Access denied" });
   }
 });
+function resolveLoginRedirect(input) {
+  const { route, loginTarget, config } = input;
+  const preserveRedirect = config?.preserveRedirect ?? true;
+  const redirectQueryKey = config?.redirectQueryKey ?? "redirect";
+  if (!preserveRedirect)
+    return { to: loginTarget, external: false };
+  if (!loginTarget.startsWith("/") || loginTarget.startsWith("//"))
+    return { to: loginTarget, external: false };
+  const [beforeHash, hash = ""] = loginTarget.split("#", 2);
+  const [path, query = ""] = beforeHash.split("?", 2);
+  try {
+    const params2 = new URLSearchParams(query);
+    if (params2.has(redirectQueryKey))
+      return { to: loginTarget, external: false };
+  } catch {
+    return { to: loginTarget, external: false };
+  }
+  if (import.meta.server) {
+    const separator = query ? "&" : "";
+    const encodedRedirect = encodeURIComponent(route.fullPath);
+    const url = `${path}?${query}${separator}${redirectQueryKey}=${encodedRedirect}${hash ? `#${hash}` : ""}`;
+    return { to: url, external: true };
+  }
+  const params = new URLSearchParams(query);
+  const queryObj = {};
+  for (const [k, v] of params.entries())
+    queryObj[k] = v;
+  queryObj[redirectQueryKey] = route.fullPath;
+  return { to: { path, query: queryObj, ...hash ? { hash: `#${hash}` } : {} }, external: false };
+}
+async function getAuthRouteRules() {
+  if (!authRouteRulesPromise) {
+    authRouteRulesPromise = import("#auth/route-rules").then((mod) => mod.authRouteRules || {}).catch(() => ({}));
+  }
+  return await authRouteRulesPromise;
+}
+async function getRouteRulesMatcher() {
+  if (!routeRulesMatcherPromise) {
+    routeRulesMatcherPromise = getAuthRouteRules().then((authRouteRules) => {
+      if (!Object.keys(authRouteRules).length)
+        return null;
+      return toRouteMatcher(createRouter({ routes: authRouteRules }));
+    });
+  }
+  return await routeRulesMatcherPromise;
+}