@peterbud/nuxt-aegis 1.1.0-alpha.2 → 1.1.0-alpha.3

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-aegis",
   "configKey": "nuxtAegis",
-  "version": "1.1.0-alpha.2",
+  "version": "1.1.0-alpha.3",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -21,6 +21,8 @@ const module$1 = defineNuxtModule({
     tokenRefresh: {
       enabled: true,
       automaticRefresh: true,
+      rotationEnabled: true,
+      // Enable refresh token rotation by default for security
       cookie: {
         cookieName: "nuxt-aegis-refresh",
         maxAge: 60 * 60 * 24 * 7,
@@ -95,18 +97,18 @@ const module$1 = defineNuxtModule({
       nuxtAegis: options
     });
     const runtimeConfig = nuxt.options.runtimeConfig;
+    const logger = useLogger("nuxt-aegis");
     if (options.enableSSR && nuxt.options.ssr === false) {
-      const logger2 = useLogger("nuxt-aegis");
-      logger2.warn(
+      logger.warn(
         "nuxtAegis.enableSSR is true but Nuxt SSR is disabled. SSR authentication will not work. Set ssr: true in nuxt.config.ts or disable enableSSR."
       );
     }
     const resolver = createResolver(import.meta.url);
     if (options.tokenRefresh?.encryption?.enabled) {
-      const encryptionKey = options.tokenRefresh.encryption.key || process.env.NUXT_AEGIS_ENCRYPTION_KEY;
+      const encryptionKey = options.tokenRefresh.encryption.key;
       if (!encryptionKey) {
-        throw new Error(
-          "[Nuxt Aegis] Encryption is enabled but no encryption key is configured. Please set tokenRefresh.encryption.key in nuxt.config.ts or NUXT_AEGIS_ENCRYPTION_KEY environment variable."
+        logger.warn(
+          "[Nuxt Aegis] Encryption is enabled but no encryption key is configured. The application will fail at runtime if encryption is attempted. Please set tokenRefresh.encryption.key in nuxt.config.ts or in the appropriate environment variable."
         );
       }
       if (!runtimeConfig.nuxtAegis) {
@@ -211,7 +213,6 @@ const module$1 = defineNuxtModule({
       addPlugin(resolver.resolve("./runtime/app/plugins/api.server"));
       addPlugin(resolver.resolve("./runtime/app/plugins/ssr-state.server"));
     }
-    const logger = useLogger("nuxt-aegis");
     if (options.clientMiddleware?.enabled) {
       const cm = options.clientMiddleware;
       if (cm.global) {

package/dist/runtime/app/composables/useAuth.js

@@ -1,5 +1,5 @@
 import { useRuntimeConfig, navigateTo, useState, computed } from "#imports";
-import { clearAccessToken } from "../utils/tokenStore.js";
+import { clearAccessToken, setAccessToken, getAccessToken } from "../utils/tokenStore.js";
 import { createLogger } from "../utils/logger.js";
 import { validateRedirectPath } from "../utils/redirectValidation.js";
 import { filterTimeSensitiveClaims } from "../utils/tokenUtils.js";
@@ -39,7 +39,6 @@ export function useAuth() {
         method: "POST"
       });
       if (response?.accessToken) {
-        const { setAccessToken } = await import("../utils/tokenStore.js");
         setAccessToken(response.accessToken);
         const tokenParts = response.accessToken.split(".");
         if (tokenParts[1]) {
@@ -95,7 +94,6 @@ export function useAuth() {
       authState.value.error = null;
       authState.value.isLoading = true;
       logger.debug("Starting impersonation...", { targetUserId });
-      const { getAccessToken } = await import("../utils/tokenStore.js");
       const currentToken = getAccessToken();
       if (!currentToken) {
         throw new Error("Must be authenticated to impersonate");
@@ -111,7 +109,6 @@ export function useAuth() {
         }
       });
       if (response?.accessToken) {
-        const { setAccessToken } = await import("../utils/tokenStore.js");
         setAccessToken(response.accessToken);
         const tokenParts = response.accessToken.split(".");
         if (tokenParts[1]) {
@@ -138,7 +135,6 @@ export function useAuth() {
       authState.value.error = null;
       authState.value.isLoading = true;
       logger.debug("Stopping impersonation...");
-      const { getAccessToken } = await import("../utils/tokenStore.js");
       const currentToken = getAccessToken();
       if (!currentToken) {
         throw new Error("No active session");
@@ -150,7 +146,6 @@ export function useAuth() {
         }
       });
       if (response?.accessToken) {
-        const { setAccessToken } = await import("../utils/tokenStore.js");
         setAccessToken(response.accessToken);
         const tokenParts = response.accessToken.split(".");
         if (tokenParts[1]) {

package/dist/runtime/app/plugins/api.client.js

@@ -5,88 +5,91 @@ import { isRouteMatch } from "../utils/routeMatching.js";
 import { createLogger } from "../utils/logger.js";
 import { validateRedirectPath } from "../utils/redirectValidation.js";
 const logger = createLogger("API:Client");
-export default defineNuxtPlugin(async (nuxtApp) => {
-  let isRefreshing = false;
-  let refreshPromise = null;
-  let isInitialized = false;
-  const autoRefreshEnabled = nuxtApp.$config.public.nuxtAegis.tokenRefresh.automaticRefresh ?? true;
-  async function attemptTokenRefresh() {
-    if (isRefreshing) return refreshPromise;
-    logger.debug("Attempting token refresh...");
-    isRefreshing = true;
-    refreshPromise = nuxtApp.runWithContext(async () => {
-      const auth = useAuth();
-      try {
-        await auth.refresh();
-        return getAccessToken();
-      } catch (error) {
-        logger.error("Token refresh failed:", error);
-        return null;
-      } finally {
-        isRefreshing = false;
-        refreshPromise = null;
-      }
-    });
-    return refreshPromise;
-  }
-  const api = $fetch.create({
-    onRequest({ options }) {
-      const token = getAccessToken();
-      if (token) {
-        options.headers.set("Authorization", `Bearer ${token}`);
-      }
-    },
-    async onResponseError({ options, response }) {
-      if (response.status === 401 && autoRefreshEnabled) {
-        const newToken = await attemptTokenRefresh();
-        if (newToken) {
-          options.headers.set("Authorization", `Bearer ${newToken}`);
-          return;
+export default defineNuxtPlugin({
+  name: "nuxt-aegis-api-client",
+  async setup(nuxtApp) {
+    let isRefreshing = false;
+    let refreshPromise = null;
+    let isInitialized = false;
+    const autoRefreshEnabled = nuxtApp.$config.public.nuxtAegis.tokenRefresh.automaticRefresh ?? true;
+    async function attemptTokenRefresh() {
+      if (isRefreshing) return refreshPromise;
+      logger.debug("Attempting token refresh...");
+      isRefreshing = true;
+      refreshPromise = nuxtApp.runWithContext(async () => {
+        const auth = useAuth();
+        try {
+          await auth.refresh();
+          return getAccessToken();
+        } catch (error) {
+          logger.error("Token refresh failed:", error);
+          return null;
+        } finally {
+          isRefreshing = false;
+          refreshPromise = null;
         }
-        clearAccessToken();
-        const config = useRuntimeConfig();
-        const errorUrl = validateRedirectPath(config.public.nuxtAegis.redirect?.error || "/");
-        await nuxtApp.runWithContext(() => navigateTo(`${errorUrl}?error=token_refresh_failed&error_description=${encodeURIComponent("Session expired. Please log in again.")}`));
-      }
-    },
-    retry: autoRefreshEnabled ? 1 : 0,
-    retryStatusCodes: [401]
-  });
-  const result = {
-    provide: {
-      api
+      });
+      return refreshPromise;
     }
-  };
-  if (!isInitialized && autoRefreshEnabled) {
-    isInitialized = true;
-    logger.debug("Initializing auth state on startup...");
-    nuxtApp.hook("app:mounted", async () => {
-      await nuxtApp.runWithContext(async () => {
-        const callbackPath = nuxtApp.$config.public.nuxtAegis.callbackPath;
-        if (typeof window !== "undefined" && window.location.pathname === callbackPath) {
-          logger.debug("On auth callback page, skipping refresh");
-          return;
+    const api = $fetch.create({
+      onRequest({ options }) {
+        const token = getAccessToken();
+        if (token) {
+          options.headers.set("Authorization", `Bearer ${token}`);
         }
-        if (typeof window !== "undefined") {
-          const publicRoutes = nuxtApp.$config.public.nuxtAegis?.clientMiddleware?.publicRoutes || [];
-          const currentPath = window.location.pathname;
-          if (isRouteMatch(currentPath, publicRoutes)) {
-            logger.debug("On public route, skipping refresh on startup");
+      },
+      async onResponseError({ options, response }) {
+        if (response.status === 401 && autoRefreshEnabled) {
+          const newToken = await attemptTokenRefresh();
+          if (newToken) {
+            options.headers.set("Authorization", `Bearer ${newToken}`);
             return;
           }
+          clearAccessToken();
+          const config = useRuntimeConfig();
+          const errorUrl = validateRedirectPath(config.public.nuxtAegis.redirect?.error || "/");
+          await nuxtApp.runWithContext(() => navigateTo(`${errorUrl}?error=token_refresh_failed&error_description=${encodeURIComponent("Session expired. Please log in again.")}`));
         }
-        const currentToken = getAccessToken();
-        if (currentToken) {
-          logger.debug("Access token already present, skipping refresh on startup");
-          return;
-        }
-        try {
-          await useAuth().refresh();
-        } catch {
-          logger.debug("No valid refresh token found on startup");
-        }
-      });
+      },
+      retry: autoRefreshEnabled ? 1 : 0,
+      retryStatusCodes: [401]
     });
+    const result = {
+      provide: {
+        api
+      }
+    };
+    if (!isInitialized && autoRefreshEnabled) {
+      isInitialized = true;
+      logger.debug("Initializing auth state on startup...");
+      nuxtApp.hook("app:mounted", async () => {
+        await nuxtApp.runWithContext(async () => {
+          const callbackPath = nuxtApp.$config.public.nuxtAegis.callbackPath;
+          if (typeof window !== "undefined" && window.location.pathname === callbackPath) {
+            logger.debug("On auth callback page, skipping refresh");
+            return;
+          }
+          if (typeof window !== "undefined") {
+            const publicRoutes = nuxtApp.$config.public.nuxtAegis?.clientMiddleware?.publicRoutes || [];
+            const currentPath = window.location.pathname;
+            if (isRouteMatch(currentPath, publicRoutes)) {
+              logger.debug("On public route, skipping refresh on startup");
+              return;
+            }
+          }
+          const currentToken = getAccessToken();
+          if (currentToken) {
+            logger.debug("Access token already present, skipping refresh on startup");
+            return;
+          }
+          try {
+            await useAuth().refresh();
+          } catch {
+            logger.debug("No valid refresh token found on startup");
+          }
+        });
+      });
+    }
+    return result;
   }
-  return result;
 });

package/dist/runtime/app/plugins/api.server.js

@@ -1,6 +1,6 @@
 import { defineNuxtPlugin, useRequestEvent } from "#app";
 export default defineNuxtPlugin({
-  name: "api-server",
+  name: "nuxt-aegis-api-server",
   enforce: "pre",
   async setup() {
     const api = $fetch.create({

package/dist/runtime/app/plugins/ssr-state.server.js

@@ -1,13 +1,16 @@
 import { defineNuxtPlugin, useState, useRequestEvent } from "#app";
 import { filterTimeSensitiveClaims } from "../utils/tokenUtils.js";
-export default defineNuxtPlugin(() => {
-  const event = useRequestEvent();
-  if (event?.context.user) {
-    const user = event.context.user;
-    useState("auth-state", () => ({
-      user: filterTimeSensitiveClaims(user),
-      isLoading: false,
-      error: null
-    }));
+export default defineNuxtPlugin({
+  name: "nuxt-aegis-ssr-state",
+  async setup() {
+    const event = useRequestEvent();
+    if (event?.context.user) {
+      const user = event.context.user;
+      useState("auth-state", () => ({
+        user: filterTimeSensitiveClaims(user),
+        isLoading: false,
+        error: null
+      }));
+    }
   }
 });

package/dist/runtime/server/middleware/auth.js

@@ -18,21 +18,20 @@ export default defineEventHandler(async (event) => {
   const routeRules = await getRouteRules(event);
   const authConfig = routeRules.nuxtAegis?.auth;
   const shouldProtect = authConfig === true || authConfig === "required" || authConfig === "protected";
-  const shouldSkip = authConfig === false || authConfig === "public" || authConfig === "skip";
-  if (!shouldProtect || shouldSkip) {
-    return;
-  }
   let token;
   const authHeader = getHeader(event, "authorization");
   if (authHeader?.startsWith("Bearer ")) {
     token = authHeader.substring(7);
   }
   if (!token) {
-    throw createError({
-      statusCode: 401,
-      statusMessage: "Unauthorized",
-      message: "Authentication required"
-    });
+    if (shouldProtect) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: "Unauthorized",
+        message: "Authentication required"
+      });
+    }
+    return;
   }
   if (!tokenConfig || !tokenConfig.secret) {
     logger.error("Token configuration is missing");
@@ -45,29 +44,38 @@ export default defineEventHandler(async (event) => {
   const payload = await verifyToken(token, tokenConfig.secret);
   if (!payload) {
     logger.debug("Token verification failed for path:", requestURL.pathname);
-    throw createError({
-      statusCode: 401,
-      statusMessage: "Unauthorized",
-      message: "Invalid or expired token"
-    });
+    if (shouldProtect) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: "Unauthorized",
+        message: "Invalid or expired token"
+      });
+    }
+    return;
   }
   if (tokenConfig.issuer && payload.iss !== tokenConfig.issuer) {
     logger.debug("Token issuer mismatch. Expected:", tokenConfig.issuer, "Got:", payload.iss);
-    throw createError({
-      statusCode: 401,
-      statusMessage: "Unauthorized",
-      message: "Invalid token issuer"
-    });
+    if (shouldProtect) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: "Unauthorized",
+        message: "Invalid token issuer"
+      });
+    }
+    return;
   }
   if (tokenConfig.audience && payload.aud) {
     const audienceMatch = Array.isArray(payload.aud) ? payload.aud.includes(tokenConfig.audience) : payload.aud === tokenConfig.audience;
     if (!audienceMatch) {
       logger.debug("Token audience mismatch. Expected:", tokenConfig.audience, "Got:", payload.aud);
-      throw createError({
-        statusCode: 401,
-        statusMessage: "Unauthorized",
-        message: "Invalid token audience"
-      });
+      if (shouldProtect) {
+        throw createError({
+          statusCode: 401,
+          statusMessage: "Unauthorized",
+          message: "Invalid token audience"
+        });
+      }
+      return;
     }
   }
   const { iat, exp, iss, aud, ...userData } = payload;

package/dist/runtime/server/routes/refresh.post.js

@@ -8,6 +8,8 @@ import {
 } from "../utils/refreshToken.js";
 import { setRefreshTokenCookie } from "../utils/cookies.js";
 import { useRuntimeConfig } from "#imports";
+import { createLogger } from "../utils/logger.js";
+const logger = createLogger("Refresh");
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig(event);
   const cookieConfig = config.nuxtAegis?.tokenRefresh?.cookie;
@@ -65,22 +67,29 @@ export default defineEventHandler(async (event) => {
       // Include provider name in JWT payload
     };
     const newToken = await generateToken(payload, tokenConfig, customClaims);
-    const newRefreshToken = await generateAndStoreRefreshToken(
-      providerUserInfo,
-      // RS-2: Store complete OAuth provider user data
-      provider,
-      // Store provider name
-      tokenRefreshConfig,
-      hashedRefreshToken,
-      // Pass previous token hash for rotation tracking
-      customClaims,
-      // Preserve custom claims in new refresh token
-      event
-    );
-    if (newRefreshToken) {
-      setRefreshTokenCookie(event, newRefreshToken, cookieConfig);
+    const rotationEnabled = tokenRefreshConfig?.rotationEnabled ?? true;
+    if (rotationEnabled) {
+      logger.debug("Rotating refresh token for user:", payload.sub);
+      const newRefreshToken = await generateAndStoreRefreshToken(
+        providerUserInfo,
+        // RS-2: Store complete OAuth provider user data
+        provider,
+        // Store provider name
+        tokenRefreshConfig,
+        hashedRefreshToken,
+        // Pass previous token hash for rotation tracking
+        customClaims,
+        // Preserve custom claims in new refresh token
+        event
+      );
+      if (newRefreshToken) {
+        setRefreshTokenCookie(event, newRefreshToken, cookieConfig);
+      }
+      await revokeRefreshToken(hashedRefreshToken, event);
+    } else {
+      logger.debug("Reusing existing refresh token for user:", payload.sub);
+      setRefreshTokenCookie(event, refreshToken, cookieConfig);
     }
-    await revokeRefreshToken(hashedRefreshToken, event);
     return {
       success: true,
       message: "Token refreshed successfully",

package/dist/runtime/types/refresh.d.ts

@@ -50,6 +50,8 @@ export interface TokenRefreshConfig {
     enabled?: boolean;
     /** Automatically refresh tokens in the background (default: true) */
     automaticRefresh?: boolean;
+    /** Enable refresh token rotation on every refresh (default: true) */
+    rotationEnabled?: boolean;
     /** Refresh token cookie configuration */
     cookie?: CookieConfig;
     /** Encryption configuration for stored user data */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peterbud/nuxt-aegis",
-  "version": "1.1.0-alpha.2",
+  "version": "1.1.0-alpha.3",
   "description": "Nuxt module for authentication with JWT token generation and session management.",
   "publishConfig": {
     "access": "public"
@@ -52,7 +52,7 @@
     "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit"
   },
   "dependencies": {
-    "@nuxt/kit": "^4.2.1",
+    "@nuxt/kit": "^4.2.2",
     "consola": "^3.4.2",
     "defu": "^6.1.4",
     "jose": "^6.1.3",
@@ -60,17 +60,17 @@
   },
   "devDependencies": {
     "@nuxt/devtools": "^3.1.1",
-    "@nuxt/eslint-config": "^1.11.0",
+    "@nuxt/eslint-config": "^1.12.1",
     "@nuxt/module-builder": "^1.0.2",
-    "@nuxt/schema": "^4.2.1",
-    "@nuxt/test-utils": "^3.21.0",
+    "@nuxt/schema": "^4.2.2",
+    "@nuxt/test-utils": "^3.22.0",
     "@types/node": "latest",
     "changelogen": "^0.6.2",
-    "eslint": "^9.39.1",
-    "nuxt": "^4.2.1",
+    "eslint": "^9.39.2",
+    "nuxt": "^4.2.2",
     "typescript": "~5.9.3",
     "vitest": "^3.2.4",
-    "vue-tsc": "^3.1.5"
+    "vue-tsc": "^3.2.1"
   },
   "pnpm": {
     "overrides": {