@phila/sso-nuxt 0.0.2 → 0.0.4

package/README.md

@@ -0,0 +1,145 @@
+# @phila/sso-nuxt
+
+Nuxt 3 module for Azure AD B2C authentication. Installs Pinia, registers a client plugin, auto-imports `useAuth` and `useSSOStore`, and optionally guards all routes.
+
+## Installation
+
+```bash
+pnpm add @phila/sso-nuxt @phila/sso-core @phila/sso-vue @azure/msal-browser
+```
+
+## Setup
+
+Add the module to your `nuxt.config.ts`:
+
+```ts
+export default defineNuxtConfig({
+  modules: ["@phila/sso-nuxt"],
+
+  sso: {
+    globalAuth: true,
+    loginPath: "/login",
+    excludePaths: ["/logout"],
+  },
+});
+```
+
+## Module Options
+
+| Option                | Type       | Default                   | Description                                                             |
+| --------------------- | ---------- | ------------------------- | ----------------------------------------------------------------------- |
+| `globalAuth`          | `boolean`  | `true`                    | Register a global route middleware that redirects unauthenticated users |
+| `loginPath`           | `string`   | `"/login"`                | Path to redirect unauthenticated users to                               |
+| `excludePaths`        | `string[]` | `["/logout"]`             | Paths that bypass the auth middleware (matched with `startsWith`)       |
+| `signInPolicy`        | `string`   | `"B2C_1A_AD_SIGNIN_ONLY"` | B2C sign-in user flow                                                   |
+| `resetPasswordPolicy` | `string`   | `"B2C_1A_PASSWORDRESET"`  | B2C password reset user flow                                            |
+
+## Runtime Configuration
+
+The module exposes all SSO settings via Nuxt runtime config. Set them in `nuxt.config.ts` or override with environment variables:
+
+| Runtime Config Key       | Environment Variable                    | Default                      |
+| ------------------------ | --------------------------------------- | ---------------------------- |
+| `ssoClientId`            | `NUXT_PUBLIC_SSO_CLIENT_ID`             | `""`                         |
+| `ssoRedirectUri`         | `NUXT_PUBLIC_SSO_REDIRECT_URI`          | `"http://localhost:3000"`    |
+| `ssoTenant`              | `NUXT_PUBLIC_SSO_TENANT`                | `"PhilaB2CDev"`              |
+| `ssoAuthorityDomain`     | `NUXT_PUBLIC_SSO_AUTHORITY_DOMAIN`      | `"PhilaB2CDev.b2clogin.com"` |
+| `ssoApiScope`            | `NUXT_PUBLIC_SSO_API_SCOPE`             | `""`                         |
+| `ssoSignInPolicy`        | `NUXT_PUBLIC_SSO_SIGN_IN_POLICY`        | from module options          |
+| `ssoResetPasswordPolicy` | `NUXT_PUBLIC_SSO_RESET_PASSWORD_POLICY` | from module options          |
+| `ssoLoginPath`           | `NUXT_PUBLIC_SSO_LOGIN_PATH`            | from module options          |
+| `ssoExcludePaths`        | `NUXT_PUBLIC_SSO_EXCLUDE_PATHS`         | from module options          |
+
+Example `.env`:
+
+```env
+NUXT_PUBLIC_SSO_CLIENT_ID=your-client-id
+NUXT_PUBLIC_SSO_TENANT=YourTenant
+NUXT_PUBLIC_SSO_AUTHORITY_DOMAIN=YourTenant.b2clogin.com
+NUXT_PUBLIC_SSO_REDIRECT_URI=http://localhost:3000
+NUXT_PUBLIC_SSO_API_SCOPE=https://YourTenant.onmicrosoft.com/api/read
+```
+
+### API Scopes
+
+`ssoApiScope` accepts a comma-separated string. The module splits it into an array at runtime:
+
+```env
+NUXT_PUBLIC_SSO_API_SCOPE=https://tenant.onmicrosoft.com/api/read,https://tenant.onmicrosoft.com/api/write
+```
+
+## Auto-Imports
+
+The module auto-imports these composables globally:
+
+- `useAuth()` — primary auth composable (state, actions, utilities)
+- `useSSOStore()` — direct Pinia store access
+
+No `import` statements needed in your components:
+
+```vue
+<script setup>
+const { isAuthenticated, userName, authReady, signIn, signOut } = useAuth();
+</script>
+
+<template>
+  <div v-if="!authReady">Loading...</div>
+  <div v-else-if="isAuthenticated">
+    <p>Welcome, {{ userName }}</p>
+    <button @click="signOut()">Sign out</button>
+  </div>
+  <div v-else>
+    <button @click="signIn()">Sign in</button>
+  </div>
+</template>
+```
+
+## Route Middleware
+
+When `globalAuth: true` (default), the module registers a global route middleware that:
+
+1. Waits for auth initialization (`authReady`) before making decisions
+2. Allows navigation to `loginPath` and all `excludePaths`
+3. Redirects unauthenticated users to `loginPath`
+
+### Excluding Paths
+
+Paths in `excludePaths` are matched using `startsWith`, so `/public` also matches `/public/about`:
+
+```ts
+export default defineNuxtConfig({
+  sso: {
+    excludePaths: ["/logout", "/public", "/callback"],
+  },
+});
+```
+
+The `loginPath` is always excluded automatically.
+
+### Disabling the Middleware
+
+Set `globalAuth: false` to disable the global middleware and handle auth checks manually:
+
+```ts
+export default defineNuxtConfig({
+  sso: {
+    globalAuth: false,
+  },
+});
+```
+
+## What the Module Does
+
+During setup, the module automatically:
+
+1. Installs `@pinia/nuxt` (apps don't need to add it separately)
+2. Adds `@phila/sso-core` and `@phila/sso-vue` to the Vite transpile list
+3. Configures Vite dev server to serve files from the monorepo root
+4. Declares all SSO keys in `runtimeConfig.public`
+5. Registers a client-only plugin that initializes the B2C auth client
+6. Auto-imports `useAuth` and `useSSOStore`
+7. Registers the global auth route middleware (when `globalAuth: true`)
+
+## License
+
+MIT

package/dist/module.js

@@ -4,7 +4,7 @@ import { dirname, resolve } from "node:path";
 import { defu } from "defu";
 const __dirname$1 = dirname(fileURLToPath(import.meta.url));
 const philaIdentityRoot = resolve(__dirname$1, "../../..");
-defineNuxtModule({
+const module$1 = defineNuxtModule({
   meta: {
     name: "@phila/sso-nuxt",
     configKey: "sso"
@@ -30,6 +30,7 @@ defineNuxtModule({
       ssoRedirectUri: "http://localhost:3000",
       ssoTenant: "PhilaB2CDev",
       ssoAuthorityDomain: "PhilaB2CDev.b2clogin.com",
+      ssoApiScope: "",
       ssoSignInPolicy: options.signInPolicy,
       ssoResetPasswordPolicy: options.resetPasswordPolicy,
       ssoLoginPath: options.loginPath,
@@ -37,6 +38,7 @@ defineNuxtModule({
     });
     addPlugin({ src: resolver.resolve("./runtime/plugin.client"), mode: "client" });
     addImports({ name: "useAuth", as: "useAuth", from: "@phila/sso-vue" });
+    addImports({ name: "useSSOStore", as: "useSSOStore", from: "@phila/sso-vue" });
     if (options.globalAuth) {
       addRouteMiddleware({
         name: "auth",
@@ -46,4 +48,7 @@ defineNuxtModule({
     }
   }
 });
+export {
+  module$1 as default
+};
 //# sourceMappingURL=module.js.map

package/dist/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sources":["../src/module.ts"],"sourcesContent":["// ABOUTME: Nuxt module that wires up phila-identity SSO with zero app boilerplate\n// ABOUTME: Installs pinia, registers the client plugin, auto-imports useAuth, and optionally guards routes\n\nimport {\n  defineNuxtModule,\n  addPlugin,\n  addImports,\n  addRouteMiddleware,\n  installModule,\n  createResolver,\n  extendViteConfig,\n} from \"@nuxt/kit\";\nimport { fileURLToPath } from \"node:url\";\nimport { dirname, resolve } from \"node:path\";\nimport { defu } from \"defu\";\n\nconst __dirname = dirname(fileURLToPath(import.meta.url));\n// packages/sso-nuxt/src → packages/sso-nuxt → packages → phila-identity\nconst philaIdentityRoot = resolve(__dirname, \"../../..\");\n\nexport interface ModuleOptions {\n  globalAuth?: boolean;\n  loginPath?: string;\n  excludePaths?: string[];\n  signInPolicy?: string;\n  resetPasswordPolicy?: string;\n}\n\nexport default defineNuxtModule<ModuleOptions>({\n  meta: {\n    name: \"@phila/sso-nuxt\",\n    configKey: \"sso\",\n  },\n  defaults: {\n    globalAuth: true,\n    loginPath: \"/login\",\n    excludePaths: [\"/logout\"],\n    signInPolicy: \"B2C_1A_AD_SIGNIN_ONLY\",\n    resetPasswordPolicy: \"B2C_1A_PASSWORDRESET\",\n  },\n  async setup(options, nuxt) {\n    const resolver = createResolver(import.meta.url);\n\n    // 1. Install @pinia/nuxt so apps don't need to list it explicitly\n    await installModule(\"@pinia/nuxt\");\n\n    // 2. Transpile local file: linked packages so Vite/SSR can process them\n    nuxt.options.build.transpile.push(\"@phila/sso-core\", \"@phila/sso-vue\");\n\n    // 3. Allow Vite dev server to serve files from phila-identity source tree\n    extendViteConfig(config => {\n      config.server = config.server ?? {};\n      config.server.fs = config.server.fs ?? {};\n      config.server.fs.allow = [...(config.server.fs.allow ?? []), philaIdentityRoot];\n    });\n\n    // 4 & 5. Declare SSO keys in runtimeConfig.public (env vars override at runtime)\n    nuxt.options.runtimeConfig.public = defu(nuxt.options.runtimeConfig.public, {\n      ssoClientId: \"\",\n      ssoRedirectUri: \"http://localhost:3000\",\n      ssoTenant: \"PhilaB2CDev\",\n      ssoAuthorityDomain: \"PhilaB2CDev.b2clogin.com\",\n      ssoSignInPolicy: options.signInPolicy,\n      ssoResetPasswordPolicy: options.resetPasswordPolicy,\n      ssoLoginPath: options.loginPath,\n      ssoExcludePaths: options.excludePaths,\n    });\n\n    // 6. Register client-only plugin that initialises the B2C auth client\n    addPlugin({ src: resolver.resolve(\"./runtime/plugin.client\"), mode: \"client\" });\n\n    // 7. Auto-import useAuth so components don't need an explicit import\n    addImports({ name: \"useAuth\", as: \"useAuth\", from: \"@phila/sso-vue\" });\n\n    // 8. Optionally register global route guard\n    if (options.globalAuth) {\n      addRouteMiddleware({\n        name: \"auth\",\n        path: resolver.resolve(\"./runtime/middleware.auth\"),\n        global: true,\n      });\n    }\n  },\n});\n"],"names":["__dirname"],"mappings":";;;;AAgBA,MAAMA,cAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;AAExD,MAAM,oBAAoB,QAAQA,aAAW,UAAU;AAUxC,iBAAgC;AAAA,EAC7C,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,WAAW;AAAA,EAAA;AAAA,EAEb,UAAU;AAAA,IACR,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,cAAc,CAAC,SAAS;AAAA,IACxB,cAAc;AAAA,IACd,qBAAqB;AAAA,EAAA;AAAA,EAEvB,MAAM,MAAM,SAAS,MAAM;AACzB,UAAM,WAAW,eAAe,YAAY,GAAG;AAG/C,UAAM,cAAc,aAAa;AAGjC,SAAK,QAAQ,MAAM,UAAU,KAAK,mBAAmB,gBAAgB;AAGrE,qBAAiB,CAAA,WAAU;AACzB,aAAO,SAAS,OAAO,UAAU,CAAA;AACjC,aAAO,OAAO,KAAK,OAAO,OAAO,MAAM,CAAA;AACvC,aAAO,OAAO,GAAG,QAAQ,CAAC,GAAI,OAAO,OAAO,GAAG,SAAS,CAAA,GAAK,iBAAiB;AAAA,IAChF,CAAC;AAGD,SAAK,QAAQ,cAAc,SAAS,KAAK,KAAK,QAAQ,cAAc,QAAQ;AAAA,MAC1E,aAAa;AAAA,MACb,gBAAgB;AAAA,MAChB,WAAW;AAAA,MACX,oBAAoB;AAAA,MACpB,iBAAiB,QAAQ;AAAA,MACzB,wBAAwB,QAAQ;AAAA,MAChC,cAAc,QAAQ;AAAA,MACtB,iBAAiB,QAAQ;AAAA,IAAA,CAC1B;AAGD,cAAU,EAAE,KAAK,SAAS,QAAQ,yBAAyB,GAAG,MAAM,UAAU;AAG9E,eAAW,EAAE,MAAM,WAAW,IAAI,WAAW,MAAM,kBAAkB;AAGrE,QAAI,QAAQ,YAAY;AACtB,yBAAmB;AAAA,QACjB,MAAM;AAAA,QACN,MAAM,SAAS,QAAQ,2BAA2B;AAAA,QAClD,QAAQ;AAAA,MAAA,CACT;AAAA,IACH;AAAA,EACF;AACF,CAAC;"}
+{"version":3,"file":"module.js","sources":["../src/module.ts"],"sourcesContent":["// ABOUTME: Nuxt module that wires up phila-identity SSO with zero app boilerplate\n// ABOUTME: Installs pinia, registers the client plugin, auto-imports useAuth, and optionally guards routes\n\nimport {\n  defineNuxtModule,\n  addPlugin,\n  addImports,\n  addRouteMiddleware,\n  installModule,\n  createResolver,\n  extendViteConfig,\n} from \"@nuxt/kit\";\nimport { fileURLToPath } from \"node:url\";\nimport { dirname, resolve } from \"node:path\";\nimport { defu } from \"defu\";\n\nconst __dirname = dirname(fileURLToPath(import.meta.url));\n// packages/sso-nuxt/src → packages/sso-nuxt → packages → phila-identity\nconst philaIdentityRoot = resolve(__dirname, \"../../..\");\n\nexport interface ModuleOptions {\n  globalAuth?: boolean;\n  loginPath?: string;\n  excludePaths?: string[];\n  signInPolicy?: string;\n  resetPasswordPolicy?: string;\n}\n\nexport default defineNuxtModule<ModuleOptions>({\n  meta: {\n    name: \"@phila/sso-nuxt\",\n    configKey: \"sso\",\n  },\n  defaults: {\n    globalAuth: true,\n    loginPath: \"/login\",\n    excludePaths: [\"/logout\"],\n    signInPolicy: \"B2C_1A_AD_SIGNIN_ONLY\",\n    resetPasswordPolicy: \"B2C_1A_PASSWORDRESET\",\n  },\n  async setup(options, nuxt) {\n    const resolver = createResolver(import.meta.url);\n\n    // 1. Install @pinia/nuxt so apps don't need to list it explicitly\n    await installModule(\"@pinia/nuxt\");\n\n    // 2. Transpile local file: linked packages so Vite/SSR can process them\n    nuxt.options.build.transpile.push(\"@phila/sso-core\", \"@phila/sso-vue\");\n\n    // 3. Allow Vite dev server to serve files from phila-identity source tree\n    extendViteConfig(config => {\n      config.server = config.server ?? {};\n      config.server.fs = config.server.fs ?? {};\n      config.server.fs.allow = [...(config.server.fs.allow ?? []), philaIdentityRoot];\n    });\n\n    // 4 & 5. Declare SSO keys in runtimeConfig.public (env vars override at runtime)\n    nuxt.options.runtimeConfig.public = defu(nuxt.options.runtimeConfig.public, {\n      ssoClientId: \"\",\n      ssoRedirectUri: \"http://localhost:3000\",\n      ssoTenant: \"PhilaB2CDev\",\n      ssoAuthorityDomain: \"PhilaB2CDev.b2clogin.com\",\n      ssoApiScope: \"\",\n      ssoSignInPolicy: options.signInPolicy,\n      ssoResetPasswordPolicy: options.resetPasswordPolicy,\n      ssoLoginPath: options.loginPath,\n      ssoExcludePaths: options.excludePaths,\n    });\n\n    // 6. Register client-only plugin that initialises the B2C auth client\n    addPlugin({ src: resolver.resolve(\"./runtime/plugin.client\"), mode: \"client\" });\n\n    // 7. Auto-import useAuth so components don't need an explicit import\n    addImports({ name: \"useAuth\", as: \"useAuth\", from: \"@phila/sso-vue\" });\n    addImports({ name: \"useSSOStore\", as: \"useSSOStore\", from: \"@phila/sso-vue\" });\n\n    // 8. Optionally register global route guard\n    if (options.globalAuth) {\n      addRouteMiddleware({\n        name: \"auth\",\n        path: resolver.resolve(\"./runtime/middleware.auth\"),\n        global: true,\n      });\n    }\n  },\n});\n"],"names":["__dirname"],"mappings":";;;;AAgBA,MAAMA,cAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;AAExD,MAAM,oBAAoB,QAAQA,aAAW,UAAU;AAUvD,MAAA,WAAe,iBAAgC;AAAA,EAC7C,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,WAAW;AAAA,EAAA;AAAA,EAEb,UAAU;AAAA,IACR,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,cAAc,CAAC,SAAS;AAAA,IACxB,cAAc;AAAA,IACd,qBAAqB;AAAA,EAAA;AAAA,EAEvB,MAAM,MAAM,SAAS,MAAM;AACzB,UAAM,WAAW,eAAe,YAAY,GAAG;AAG/C,UAAM,cAAc,aAAa;AAGjC,SAAK,QAAQ,MAAM,UAAU,KAAK,mBAAmB,gBAAgB;AAGrE,qBAAiB,CAAA,WAAU;AACzB,aAAO,SAAS,OAAO,UAAU,CAAA;AACjC,aAAO,OAAO,KAAK,OAAO,OAAO,MAAM,CAAA;AACvC,aAAO,OAAO,GAAG,QAAQ,CAAC,GAAI,OAAO,OAAO,GAAG,SAAS,CAAA,GAAK,iBAAiB;AAAA,IAChF,CAAC;AAGD,SAAK,QAAQ,cAAc,SAAS,KAAK,KAAK,QAAQ,cAAc,QAAQ;AAAA,MAC1E,aAAa;AAAA,MACb,gBAAgB;AAAA,MAChB,WAAW;AAAA,MACX,oBAAoB;AAAA,MACpB,aAAa;AAAA,MACb,iBAAiB,QAAQ;AAAA,MACzB,wBAAwB,QAAQ;AAAA,MAChC,cAAc,QAAQ;AAAA,MACtB,iBAAiB,QAAQ;AAAA,IAAA,CAC1B;AAGD,cAAU,EAAE,KAAK,SAAS,QAAQ,yBAAyB,GAAG,MAAM,UAAU;AAG9E,eAAW,EAAE,MAAM,WAAW,IAAI,WAAW,MAAM,kBAAkB;AACrE,eAAW,EAAE,MAAM,eAAe,IAAI,eAAe,MAAM,kBAAkB;AAG7E,QAAI,QAAQ,YAAY;AACtB,yBAAmB;AAAA,QACjB,MAAM;AAAA,QACN,MAAM,SAAS,QAAQ,2BAA2B;AAAA,QAClD,QAAQ;AAAA,MAAA,CACT;AAAA,IACH;AAAA,EACF;AACF,CAAC;"}

package/dist/runtime/middleware.auth.js

@@ -1,11 +1,16 @@
 import { defineNuxtRouteMiddleware, useRuntimeConfig, navigateTo } from "nuxt/app";
 import { useSSOStore } from "@phila/sso-vue";
-defineNuxtRouteMiddleware((to) => {
+const middleware_auth = defineNuxtRouteMiddleware((to) => {
   const config = useRuntimeConfig().public;
   const store = useSSOStore();
   if (!store.authReady) return;
-  const excluded = [config.ssoLoginPath, ...config.ssoExcludePaths];
-  if (excluded.some((p) => to.path.startsWith(p))) return;
+  const rawExclude = config.ssoExcludePaths;
+  const excludePaths = Array.isArray(rawExclude) ? rawExclude : [];
+  const excluded = [config.ssoLoginPath, ...excludePaths];
+  if (excluded.some((p) => p && to.path.startsWith(p))) return;
   if (!store.isAuthenticated) return navigateTo({ path: config.ssoLoginPath });
 });
+export {
+  middleware_auth as default
+};
 //# sourceMappingURL=middleware.auth.js.map

package/dist/runtime/middleware.auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.auth.js","sources":["../../src/runtime/middleware.auth.ts"],"sourcesContent":["// ABOUTME: Route middleware registered by @phila/sso-nuxt module\n// ABOUTME: Redirects unauthenticated users to the configured login path\nimport { defineNuxtRouteMiddleware, useRuntimeConfig, navigateTo } from \"nuxt/app\";\nimport { useSSOStore } from \"@phila/sso-vue\";\n\nexport default defineNuxtRouteMiddleware(to => {\n  const config = useRuntimeConfig().public;\n  const store = useSSOStore();\n\n  // Don't redirect while auth is still initialising\n  if (!store.authReady) return;\n\n  const excluded = [config.ssoLoginPath as string, ...(config.ssoExcludePaths as string[])];\n  if (excluded.some(p => to.path.startsWith(p))) return;\n\n  if (!store.isAuthenticated) return navigateTo({ path: config.ssoLoginPath as string });\n});\n"],"names":[],"mappings":";;AAKe,0BAA0B,CAAA,OAAM;AAC7C,QAAM,SAAS,mBAAmB;AAClC,QAAM,QAAQ,YAAA;AAGd,MAAI,CAAC,MAAM,UAAW;AAEtB,QAAM,WAAW,CAAC,OAAO,cAAwB,GAAI,OAAO,eAA4B;AACxF,MAAI,SAAS,KAAK,CAAA,MAAK,GAAG,KAAK,WAAW,CAAC,CAAC,EAAG;AAE/C,MAAI,CAAC,MAAM,gBAAiB,QAAO,WAAW,EAAE,MAAM,OAAO,cAAwB;AACvF,CAAC;"}
+{"version":3,"file":"middleware.auth.js","sources":["../../src/runtime/middleware.auth.ts"],"sourcesContent":["// ABOUTME: Route middleware registered by @phila/sso-nuxt module\n// ABOUTME: Redirects unauthenticated users to the configured login path\nimport { defineNuxtRouteMiddleware, useRuntimeConfig, navigateTo } from \"nuxt/app\";\nimport { useSSOStore } from \"@phila/sso-vue\";\n\nexport default defineNuxtRouteMiddleware(to => {\n  const config = useRuntimeConfig().public;\n  const store = useSSOStore();\n\n  // Don't redirect while auth is still initialising\n  if (!store.authReady) return;\n\n  const rawExclude = config.ssoExcludePaths;\n  const excludePaths = Array.isArray(rawExclude) ? rawExclude : [];\n  const excluded = [config.ssoLoginPath as string, ...excludePaths];\n  if (excluded.some(p => p && to.path.startsWith(p))) return;\n\n  if (!store.isAuthenticated) return navigateTo({ path: config.ssoLoginPath as string });\n});\n"],"names":[],"mappings":";;AAKA,MAAA,kBAAe,0BAA0B,CAAA,OAAM;AAC7C,QAAM,SAAS,mBAAmB;AAClC,QAAM,QAAQ,YAAA;AAGd,MAAI,CAAC,MAAM,UAAW;AAEtB,QAAM,aAAa,OAAO;AAC1B,QAAM,eAAe,MAAM,QAAQ,UAAU,IAAI,aAAa,CAAA;AAC9D,QAAM,WAAW,CAAC,OAAO,cAAwB,GAAG,YAAY;AAChE,MAAI,SAAS,KAAK,CAAA,MAAK,KAAK,GAAG,KAAK,WAAW,CAAC,CAAC,EAAG;AAEpD,MAAI,CAAC,MAAM,gBAAiB,QAAO,WAAW,EAAE,MAAM,OAAO,cAAwB;AACvF,CAAC;"}

package/dist/runtime/plugin.client.js

@@ -1,8 +1,10 @@
 import { defineNuxtPlugin, useRuntimeConfig } from "nuxt/app";
 import { createSSOPlugin } from "@phila/sso-vue";
 import { B2CProvider } from "@phila/sso-core";
-defineNuxtPlugin((nuxtApp) => {
+const plugin_client = defineNuxtPlugin((nuxtApp) => {
   const config = useRuntimeConfig().public;
+  const apiScope = config.ssoApiScope || "";
+  const apiScopes = apiScope ? apiScope.split(",").map((s) => s.trim()) : [];
   const plugin = createSSOPlugin({
     clientConfig: {
       provider: new B2CProvider({
@@ -10,6 +12,7 @@ defineNuxtPlugin((nuxtApp) => {
         b2cEnvironment: config.ssoTenant,
         authorityDomain: config.ssoAuthorityDomain,
         redirectUri: config.ssoRedirectUri,
+        apiScopes,
         policies: {
           signUpSignIn: config.ssoSignInPolicy,
           signInOnly: config.ssoSignInPolicy,
@@ -21,4 +24,7 @@ defineNuxtPlugin((nuxtApp) => {
   });
   nuxtApp.vueApp.use(plugin);
 });
+export {
+  plugin_client as default
+};
 //# sourceMappingURL=plugin.client.js.map

package/dist/runtime/plugin.client.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.client.js","sources":["../../src/runtime/plugin.client.ts"],"sourcesContent":["// ABOUTME: Client-only Nuxt plugin registered by @phila/sso-nuxt module\n// ABOUTME: Initializes Azure AD B2C authentication on the Nuxt app instance\nimport { defineNuxtPlugin, useRuntimeConfig } from \"nuxt/app\";\nimport { createSSOPlugin } from \"@phila/sso-vue\";\nimport { B2CProvider } from \"@phila/sso-core\";\n\nexport default defineNuxtPlugin(nuxtApp => {\n  const config = useRuntimeConfig().public;\n  const plugin = createSSOPlugin({\n    clientConfig: {\n      provider: new B2CProvider({\n        clientId: config.ssoClientId as string,\n        b2cEnvironment: config.ssoTenant as string,\n        authorityDomain: config.ssoAuthorityDomain as string,\n        redirectUri: config.ssoRedirectUri as string,\n        policies: {\n          signUpSignIn: config.ssoSignInPolicy as string,\n          signInOnly: config.ssoSignInPolicy as string,\n          resetPassword: config.ssoResetPasswordPolicy as string,\n        },\n      }),\n      debug: import.meta.dev,\n    },\n  });\n  nuxtApp.vueApp.use(plugin);\n});\n"],"names":[],"mappings":";;;AAMe,iBAAiB,CAAA,YAAW;AACzC,QAAM,SAAS,mBAAmB;AAClC,QAAM,SAAS,gBAAgB;AAAA,IAC7B,cAAc;AAAA,MACZ,UAAU,IAAI,YAAY;AAAA,QACxB,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,QACvB,iBAAiB,OAAO;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB,UAAU;AAAA,UACR,cAAc,OAAO;AAAA,UACrB,YAAY,OAAO;AAAA,UACnB,eAAe,OAAO;AAAA,QAAA;AAAA,MACxB,CACD;AAAA,MACD,OAAO,YAAY;AAAA,IAAA;AAAA,EACrB,CACD;AACD,UAAQ,OAAO,IAAI,MAAM;AAC3B,CAAC;"}
+{"version":3,"file":"plugin.client.js","sources":["../../src/runtime/plugin.client.ts"],"sourcesContent":["// ABOUTME: Client-only Nuxt plugin registered by @phila/sso-nuxt module\n// ABOUTME: Initializes Azure AD B2C authentication on the Nuxt app instance\nimport { defineNuxtPlugin, useRuntimeConfig } from \"nuxt/app\";\nimport { createSSOPlugin } from \"@phila/sso-vue\";\nimport { B2CProvider } from \"@phila/sso-core\";\n\nexport default defineNuxtPlugin(nuxtApp => {\n  const config = useRuntimeConfig().public;\n  const apiScope = (config.ssoApiScope as string) || \"\";\n  const apiScopes = apiScope ? apiScope.split(\",\").map(s => s.trim()) : [];\n\n  const plugin = createSSOPlugin({\n    clientConfig: {\n      provider: new B2CProvider({\n        clientId: config.ssoClientId as string,\n        b2cEnvironment: config.ssoTenant as string,\n        authorityDomain: config.ssoAuthorityDomain as string,\n        redirectUri: config.ssoRedirectUri as string,\n        apiScopes,\n        policies: {\n          signUpSignIn: config.ssoSignInPolicy as string,\n          signInOnly: config.ssoSignInPolicy as string,\n          resetPassword: config.ssoResetPasswordPolicy as string,\n        },\n      }),\n      debug: import.meta.dev,\n    },\n  });\n  nuxtApp.vueApp.use(plugin);\n});\n"],"names":[],"mappings":";;;AAMA,MAAA,gBAAe,iBAAiB,CAAA,YAAW;AACzC,QAAM,SAAS,mBAAmB;AAClC,QAAM,WAAY,OAAO,eAA0B;AACnD,QAAM,YAAY,WAAW,SAAS,MAAM,GAAG,EAAE,IAAI,CAAA,MAAK,EAAE,KAAA,CAAM,IAAI,CAAA;AAEtE,QAAM,SAAS,gBAAgB;AAAA,IAC7B,cAAc;AAAA,MACZ,UAAU,IAAI,YAAY;AAAA,QACxB,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,QACvB,iBAAiB,OAAO;AAAA,QACxB,aAAa,OAAO;AAAA,QACpB;AAAA,QACA,UAAU;AAAA,UACR,cAAc,OAAO;AAAA,UACrB,YAAY,OAAO;AAAA,UACnB,eAAe,OAAO;AAAA,QAAA;AAAA,MACxB,CACD;AAAA,MACD,OAAO,YAAY;AAAA,IAAA;AAAA,EACrB,CACD;AACD,UAAQ,OAAO,IAAI,MAAM;AAC3B,CAAC;"}

package/package.json

@@ -1,11 +1,15 @@
 {
   "name": "@phila/sso-nuxt",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "type": "module",
   "exports": {
     ".": {
       "types": "./dist/module.d.ts",
       "import": "./dist/module.js"
+    },
+    "./module": {
+      "types": "./dist/module.d.ts",
+      "import": "./dist/module.js"
     }
   },
   "files": [
@@ -14,8 +18,8 @@
   "dependencies": {
     "@nuxt/kit": "^3.0.0",
     "defu": "^6.0.0",
-    "@phila/sso-core": "0.0.2",
-    "@phila/sso-vue": "0.0.2"
+    "@phila/sso-core": "0.0.4",
+    "@phila/sso-vue": "0.0.4"
   },
   "peerDependencies": {
     "nuxt": "^3.0.0"