@phila/sso-nuxt 0.0.1

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @phila/sso-nuxt
+
+## 0.0.1
+
+### Patch Changes
+
+- Initial deployment

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 City of Philadelphia
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@phila/sso-nuxt",
+  "version": "0.0.1",
+  "type": "module",
+  "exports": {
+    ".": "./src/module.ts"
+  },
+  "dependencies": {
+    "@nuxt/kit": "^3.0.0",
+    "@phila/sso-core": "file:../sso-core",
+    "@phila/sso-vue": "file:../sso-vue",
+    "defu": "^6.0.0"
+  },
+  "peerDependencies": {
+    "nuxt": "^3.0.0"
+  },
+  "devDependencies": {
+    "nuxt": "^3.17.0",
+    "typescript": "^5.9.3"
+  }
+}

package/src/module.ts

@@ -0,0 +1,84 @@
+// ABOUTME: Nuxt module that wires up phila-identity SSO with zero app boilerplate
+// ABOUTME: Installs pinia, registers the client plugin, auto-imports useAuth, and optionally guards routes
+
+import {
+  defineNuxtModule,
+  addPlugin,
+  addImports,
+  addRouteMiddleware,
+  installModule,
+  createResolver,
+  extendViteConfig,
+} from "@nuxt/kit";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+import { defu } from "defu";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// packages/sso-nuxt/src → packages/sso-nuxt → packages → phila-identity
+const philaIdentityRoot = resolve(__dirname, "../../..");
+
+export interface ModuleOptions {
+  globalAuth?: boolean;
+  loginPath?: string;
+  excludePaths?: string[];
+  signInPolicy?: string;
+  resetPasswordPolicy?: string;
+}
+
+export default defineNuxtModule<ModuleOptions>({
+  meta: {
+    name: "@phila/sso-nuxt",
+    configKey: "sso",
+  },
+  defaults: {
+    globalAuth: true,
+    loginPath: "/login",
+    excludePaths: ["/logout"],
+    signInPolicy: "B2C_1A_AD_SIGNIN_ONLY",
+    resetPasswordPolicy: "B2C_1A_PASSWORDRESET",
+  },
+  async setup(options, nuxt) {
+    const resolver = createResolver(import.meta.url);
+
+    // 1. Install @pinia/nuxt so apps don't need to list it explicitly
+    await installModule("@pinia/nuxt");
+
+    // 2. Transpile local file: linked packages so Vite/SSR can process them
+    nuxt.options.build.transpile.push("@phila/sso-core", "@phila/sso-vue");
+
+    // 3. Allow Vite dev server to serve files from phila-identity source tree
+    extendViteConfig(config => {
+      config.server = config.server ?? {};
+      config.server.fs = config.server.fs ?? {};
+      config.server.fs.allow = [...(config.server.fs.allow ?? []), philaIdentityRoot];
+    });
+
+    // 4 & 5. Declare SSO keys in runtimeConfig.public (env vars override at runtime)
+    nuxt.options.runtimeConfig.public = defu(nuxt.options.runtimeConfig.public, {
+      ssoClientId: "",
+      ssoRedirectUri: "http://localhost:3000",
+      ssoTenant: "PhilaB2CDev",
+      ssoAuthorityDomain: "PhilaB2CDev.b2clogin.com",
+      ssoSignInPolicy: options.signInPolicy,
+      ssoResetPasswordPolicy: options.resetPasswordPolicy,
+      ssoLoginPath: options.loginPath,
+      ssoExcludePaths: options.excludePaths,
+    });
+
+    // 6. Register client-only plugin that initialises the B2C auth client
+    addPlugin({ src: resolver.resolve("./runtime/plugin.client"), mode: "client" });
+
+    // 7. Auto-import useAuth so components don't need an explicit import
+    addImports({ name: "useAuth", as: "useAuth", from: "@phila/sso-vue" });
+
+    // 8. Optionally register global route guard
+    if (options.globalAuth) {
+      addRouteMiddleware({
+        name: "auth",
+        path: resolver.resolve("./runtime/middleware.auth"),
+        global: true,
+      });
+    }
+  },
+});

package/src/runtime/middleware.auth.ts

@@ -0,0 +1,16 @@
+// ABOUTME: Route middleware registered by @phila/sso-nuxt module
+// ABOUTME: Redirects unauthenticated users to the configured login path
+import { useSSOStore } from "@phila/sso-vue";
+
+export default defineNuxtRouteMiddleware(to => {
+  const config = useRuntimeConfig().public;
+  const store = useSSOStore();
+
+  // Don't redirect while auth is still initialising
+  if (!store.authReady) return;
+
+  const excluded = [config.ssoLoginPath as string, ...(config.ssoExcludePaths as string[])];
+  if (excluded.some(p => to.path.startsWith(p))) return;
+
+  if (!store.isAuthenticated) return navigateTo({ path: config.ssoLoginPath as string });
+});

package/src/runtime/plugin.client.ts

@@ -0,0 +1,25 @@
+// ABOUTME: Client-only Nuxt plugin registered by @phila/sso-nuxt module
+// ABOUTME: Initializes Azure AD B2C authentication on the Nuxt app instance
+import { createSSOPlugin } from "@phila/sso-vue";
+import { B2CProvider } from "@phila/sso-core";
+
+export default defineNuxtPlugin(nuxtApp => {
+  const config = useRuntimeConfig().public;
+  const plugin = createSSOPlugin({
+    clientConfig: {
+      provider: new B2CProvider({
+        clientId: config.ssoClientId as string,
+        b2cEnvironment: config.ssoTenant as string,
+        authorityDomain: config.ssoAuthorityDomain as string,
+        redirectUri: config.ssoRedirectUri as string,
+        policies: {
+          signUpSignIn: config.ssoSignInPolicy as string,
+          signInOnly: config.ssoSignInPolicy as string,
+          resetPassword: config.ssoResetPasswordPolicy as string,
+        },
+      }),
+      debug: import.meta.dev,
+    },
+  });
+  nuxtApp.vueApp.use(plugin);
+});

package/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "strict": true
+  },
+  "include": ["src/**/*.ts"]
+}