@peterbud/nuxt-aegis 1.1.0-alpha.4 → 1.1.0-alpha.6

package/README.md

@@ -61,12 +61,12 @@ export default defineNuxtConfig({
   
   nuxtAegis: {
     token: {
-      secret: process.env.NUXT_AEGIS_TOKEN_SECRET!,
+      secret: process.env.NUXT_NUXT_AEGIS_TOKEN_SECRET!,
     },
     providers: {
       google: {
-        clientId: process.env.GOOGLE_CLIENT_ID!,
-        clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+        clientId: process.env.NUXT_NUXT_AEGIS_PROVIDERS_GOOGLE_CLIENT_ID!,
+        clientSecret: process.env.NUXT_NUXT_AEGIS_PROVIDERS_GOOGLE_CLIENT_SECRET!,
       },
     },
   },
@@ -114,6 +114,7 @@ const { user, isLoggedIn, login, logout } = useAuth()
 
 Ready to dive deeper? Check out the full documentation:
 
+- **[Documentation Home](https://peterbud.github.io/nuxt-aegis/)** - Main documentation site.
 - **[Getting Started](https://peterbud.github.io/nuxt-aegis/getting-started/installation)** - Installation and setup guides.
 - **[Architecture](https://peterbud.github.io/nuxt-aegis/architecture/)** - Overview of the system architecture.
 - **[Providers](https://peterbud.github.io/nuxt-aegis/providers/)** - Configure Google, GitHub, Auth0, Password, and Mock providers.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-aegis",
   "configKey": "nuxtAegis",
-  "version": "1.1.0-alpha.4",
+  "version": "1.1.0-alpha.6",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -74,6 +74,11 @@ const module$1 = defineNuxtModule({
     logging: {
       level: "info",
       security: false
+    },
+    impersonation: {
+      enabled: false,
+      tokenExpiration: 900,
+      originalUserLookupClaim: "sub"
     }
   },
   setup(options, nuxt) {
@@ -225,7 +230,7 @@ const module$1 = defineNuxtModule({
       if (cm.global) {
         const userPublicRoutes = cm.publicRoutes || [];
         const redirectRoutes = [cm.redirectTo, cm.loggedOutRedirectTo];
-        const allPublicRoutes = [.../* @__PURE__ */ new Set([...userPublicRoutes, ...redirectRoutes])];
+        const allPublicRoutes = [...new Set([...userPublicRoutes, ...redirectRoutes].filter((route) => Boolean(route)))];
         options.clientMiddleware.publicRoutes = allPublicRoutes;
         if (allPublicRoutes.length === 0) {
           throw new Error(

package/dist/runtime/app/composables/useAuth.d.ts

@@ -17,7 +17,7 @@ interface UseAuthReturn<T extends BaseTokenClaims = BaseTokenClaims> {
     isImpersonating: ComputedRef<boolean>;
     /** Reactive property containing original user data when impersonating */
     originalUser: ComputedRef<{
-        originalUserId: string;
+        originalUserSub: string;
         originalUserEmail?: string;
         originalUserName?: string;
     } | null>;

package/dist/runtime/app/composables/useAuth.js

@@ -19,7 +19,7 @@ export function useAuth() {
       return null;
     }
     return {
-      originalUserId: impersonation.originalUserId,
+      originalUserSub: impersonation.originalUserSub,
       originalUserEmail: impersonation.originalUserEmail,
       originalUserName: impersonation.originalUserName
     };
@@ -125,7 +125,7 @@ export function useAuth() {
           authState.value.error = null;
           logger.debug("Impersonation started successfully", {
             targetUser: payload.sub,
-            originalUser: payload.impersonation?.originalUserId
+            originalUser: payload.impersonation?.originalUserSub
           });
         }
       }

package/dist/runtime/server/middleware/auth.js

@@ -82,7 +82,7 @@ export default defineEventHandler(async (event) => {
   event.context.user = userData;
   if (payload.impersonation) {
     event.context.originalUser = {
-      sub: payload.impersonation.originalUserId,
+      sub: payload.impersonation.originalUserSub,
       email: payload.impersonation.originalUserEmail,
       name: payload.impersonation.originalUserName
     };

package/dist/runtime/server/routes/unimpersonate.post.js

@@ -47,7 +47,7 @@ export default defineEventHandler(async (event) => {
       domain: cookieConfig?.domain
     });
     logger.security("Impersonation ended", {
-      originalUser: currentToken.impersonation?.originalUserId,
+      originalUser: currentToken.impersonation?.originalUserSub,
       wasImpersonating: currentToken.sub
     });
     return { accessToken };

package/dist/runtime/server/utils/impersonation.d.ts

@@ -23,10 +23,11 @@ export declare function fetchTargetUser(requester: BaseTokenClaims, targetUserId
  * @param requester - The user performing impersonation
  * @param targetUserData - Target user data from database
  * @param reason - Optional reason for impersonation
+ * @param originalUserLookupId - Original user lookup ID used for restoration
  * @param _event - H3 event for context
  * @returns JWT access token (no refresh token)
  */
-export declare function generateImpersonatedToken(requester: BaseTokenClaims, targetUserData: Record<string, unknown>, reason: string | undefined, _event: H3Event): Promise<string>;
+export declare function generateImpersonatedToken(requester: BaseTokenClaims, targetUserData: Record<string, unknown>, reason: string | undefined, originalUserLookupId: string, _event: H3Event): Promise<string>;
 /**
  * Start impersonation session
  * @param requester - The user requesting impersonation (must be admin)

package/dist/runtime/server/utils/impersonation.js

@@ -21,6 +21,18 @@ function getClientInfo(event) {
   const userAgent = headers["user-agent"];
   return { ip, userAgent };
 }
+function resolveOriginalUserLookupId(requester) {
+  const config = useRuntimeConfig();
+  const lookupClaim = config.nuxtAegis?.impersonation?.originalUserLookupClaim || "sub";
+  const lookupValue = requester[lookupClaim];
+  if (typeof lookupValue !== "string" || lookupValue.length === 0) {
+    throw createError({
+      statusCode: 500,
+      message: `Impersonation originalUserLookupClaim "${lookupClaim}" must resolve to a non-empty string on the requester token`
+    });
+  }
+  return lookupValue;
+}
 export async function checkImpersonationAllowed(requester, targetUserId, event) {
   checkImpersonationEnabled();
   if (requester.impersonation) {
@@ -75,7 +87,7 @@ export async function fetchTargetUser(requester, targetUserId, event) {
     });
   }
 }
-export async function generateImpersonatedToken(requester, targetUserData, reason, _event) {
+export async function generateImpersonatedToken(requester, targetUserData, reason, originalUserLookupId, _event) {
   const config = useRuntimeConfig();
   const tokenConfig = config.nuxtAegis?.token;
   const impersonationConfig = config.nuxtAegis?.impersonation;
@@ -93,7 +105,8 @@ export async function generateImpersonatedToken(requester, targetUserData, reaso
     }
   }
   const impersonationContext = {
-    originalUserId: requester.sub,
+    originalUserSub: requester.sub,
+    originalUserLookupId,
     originalUserEmail: requester.email,
     originalUserName: requester.name,
     impersonatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -132,7 +145,8 @@ export async function generateImpersonatedToken(requester, targetUserData, reaso
 export async function startImpersonation(requester, targetUserId, reason, event) {
   await checkImpersonationAllowed(requester, targetUserId, event);
   const targetUserData = await fetchTargetUser(requester, targetUserId, event);
-  const accessToken = await generateImpersonatedToken(requester, targetUserData, reason, event);
+  const originalUserLookupId = resolveOriginalUserLookupId(requester);
+  const accessToken = await generateImpersonatedToken(requester, targetUserData, reason, originalUserLookupId, event);
   const { ip, userAgent } = getClientInfo(event);
   const targetPayload = {
     sub: targetUserData.sub || targetUserData.id || targetUserData.email,
@@ -170,14 +184,14 @@ export async function endImpersonation(currentToken, event) {
     originalUserData = await fetchTargetUser(
       currentToken,
       // Pass current token as requester (for context)
-      impersonation.originalUserId,
+      impersonation.originalUserLookupId,
       event
     );
   } catch (error) {
     const err = error;
     if (err.statusCode === 404) {
       logger.warn("Original user not found in database, using stored context", {
-        userId: impersonation.originalUserId
+        userLookupId: impersonation.originalUserLookupId
       });
     } else {
       throw error;
@@ -192,7 +206,7 @@ export async function endImpersonation(currentToken, event) {
     });
   }
   const originalPayload = {
-    sub: originalUserData ? originalUserData.sub || originalUserData.id || originalUserData.email : impersonation.originalUserId,
+    sub: originalUserData ? originalUserData.sub || originalUserData.id || originalUserData.email : impersonation.originalUserSub,
     email: originalUserData ? originalUserData.email : impersonation.originalUserEmail,
     name: originalUserData ? originalUserData.name : impersonation.originalUserName,
     picture: originalUserData?.picture,

package/dist/runtime/types/config.d.ts

@@ -51,6 +51,8 @@ export interface ImpersonationConfig {
     enabled?: boolean;
     /** Token expiration time for impersonated sessions in seconds (default: 900 = 15 minutes) */
     tokenExpiration?: number;
+    /** Token claim name used to resolve the original user when ending impersonation (default: 'sub') */
+    originalUserLookupClaim?: string;
 }
 /**
  * Runtime config for Nuxt Aegis

package/dist/runtime/types/token.d.ts

@@ -7,8 +7,10 @@
  * Contains essential information about the original user when impersonating
  */
 export interface ImpersonationContext {
-    /** Original user ID (sub) who is performing the impersonation */
-    originalUserId: string;
+    /** Original user subject (`sub`) who is performing the impersonation */
+    originalUserSub: string;
+    /** Original user lookup ID used to refetch the user when ending impersonation */
+    originalUserLookupId: string;
     /** Original user email */
     originalUserEmail?: string;
     /** Original user name */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peterbud/nuxt-aegis",
-  "version": "1.1.0-alpha.4",
+  "version": "1.1.0-alpha.6",
   "description": "Nuxt module for authentication with JWT token generation and session management.",
   "publishConfig": {
     "access": "public"
@@ -52,30 +52,25 @@
     "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit"
   },
   "dependencies": {
-    "@nuxt/kit": "^4.3.0",
+    "@nuxt/kit": "^4.4.6",
     "consola": "^3.4.2",
-    "defu": "^6.1.4",
-    "jose": "^6.1.3",
-    "ufo": "^1.6.3"
+    "defu": "^6.1.7",
+    "jose": "^6.2.3",
+    "ufo": "^1.6.4"
   },
   "devDependencies": {
-    "@nuxt/devtools": "^3.1.1",
-    "@nuxt/eslint-config": "^1.13.0",
+    "@nuxt/devtools": "^3.2.4",
+    "@nuxt/eslint-config": "^1.15.2",
     "@nuxt/module-builder": "^1.0.2",
-    "@nuxt/schema": "^4.3.0",
-    "@nuxt/test-utils": "^3.23.0",
+    "@nuxt/schema": "^4.4.6",
+    "@nuxt/test-utils": "^4.0.3",
     "@types/node": "latest",
     "changelogen": "^0.6.2",
-    "eslint": "^9.39.2",
-    "nuxt": "^4.3.0",
-    "typescript": "~5.9.3",
-    "vitest": "^3.2.4",
-    "vue-tsc": "^3.2.3"
-  },
-  "pnpm": {
-    "overrides": {
-      "vue-router": "4.4.5"
-    }
+    "eslint": "^10.4.0",
+    "nuxt": "^4.4.6",
+    "typescript": "~6.0.3",
+    "vitest": "^4.1.7",
+    "vue-tsc": "^3.3.1"
   },
   "packageManager": "pnpm@10.17.1"
 }