@thecodeorigin/auth 0.0.1

package/README.md

@@ -0,0 +1,84 @@
+<!--
+Get your module up and running quickly.
+
+Find and replace all on all files (CMD+SHIFT+F):
+- Name: My Module
+- Package name: my-module
+- Description: My new Nuxt module
+-->
+
+# My Module
+
+[![npm version][npm-version-src]][npm-version-href]
+[![npm downloads][npm-downloads-src]][npm-downloads-href]
+[![License][license-src]][license-href]
+[![Nuxt][nuxt-src]][nuxt-href]
+
+My new Nuxt module for doing amazing things.
+
+- [✨ &nbsp;Release Notes](/CHANGELOG.md)
+<!-- - [🏀 Online playground](https://stackblitz.com/github/your-org/my-module?file=playground%2Fapp.vue) -->
+<!-- - [📖 &nbsp;Documentation](https://example.com) -->
+
+## Features
+
+<!-- Highlight some of the features your module provide here -->
+- ⛰ &nbsp;Foo
+- 🚠 &nbsp;Bar
+- 🌲 &nbsp;Baz
+
+## Quick Setup
+
+Install the module to your Nuxt application with one command:
+
+```bash
+npx nuxt module add my-module
+```
+
+That's it! You can now use My Module in your Nuxt app ✨
+
+
+## Contribution
+
+<details>
+  <summary>Local development</summary>
+  
+  ```bash
+  # Install dependencies
+  npm install
+  
+  # Generate type stubs
+  npm run dev:prepare
+  
+  # Develop with the playground
+  npm run dev
+  
+  # Build the playground
+  npm run dev:build
+  
+  # Run ESLint
+  npm run lint
+  
+  # Run Vitest
+  npm run test
+  npm run test:watch
+  
+  # Release new version
+  npm run release
+  ```
+
+</details>
+
+
+<!-- Badges -->
+[npm-version-src]: https://img.shields.io/npm/v/my-module/latest.svg?style=flat&colorA=020420&colorB=00DC82
+[npm-version-href]: https://npmjs.com/package/my-module
+
+[npm-downloads-src]: https://img.shields.io/npm/dm/my-module.svg?style=flat&colorA=020420&colorB=00DC82
+[npm-downloads-href]: https://npm.chart.dev/my-module
+
+[license-src]: https://img.shields.io/npm/l/my-module.svg?style=flat&colorA=020420&colorB=00DC82
+[license-href]: https://npmjs.com/package/my-module
+
+[nuxt-src]: https://img.shields.io/badge/Nuxt-020420?logo=nuxt
+[nuxt-href]: https://nuxt.com

package/dist/contract/index.d.mts

@@ -0,0 +1,117 @@
+import { z } from 'zod';
+
+declare const RpOrganizationSchema: z.ZodObject<{
+    id: z.ZodString;
+    slug: z.ZodString;
+    name: z.ZodString;
+    role: z.ZodString;
+    personal: z.ZodBoolean;
+}, z.core.$strip>;
+type RpOrganization = z.infer<typeof RpOrganizationSchema>;
+/** CASL ability rule emitted into /oauth2/userinfo by the IdP. */
+declare const AbilityRuleSchema: z.ZodObject<{
+    action: z.ZodString;
+    subject: z.ZodString;
+    conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+type AbilityRule = z.infer<typeof AbilityRuleSchema>;
+declare const UserinfoClaimsSchema: z.ZodObject<{
+    org: z.ZodNullable<z.ZodString>;
+    roles: z.ZodNullable<z.ZodString>;
+    personal: z.ZodBoolean;
+    entitlement: z.ZodNullable<z.ZodObject<{
+        product: z.ZodString;
+        plan: z.ZodString;
+        status: z.ZodString;
+        active: z.ZodBoolean;
+        currentPeriodEnd: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+    organizations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodString;
+        personal: z.ZodBoolean;
+    }, z.core.$strip>>;
+    abilities: z.ZodArray<z.ZodObject<{
+        action: z.ZodString;
+        subject: z.ZodString;
+        conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    role: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type UserinfoClaims = z.infer<typeof UserinfoClaimsSchema>;
+declare const PublicUserSchema: z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    picture: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type PublicUser = z.infer<typeof PublicUserSchema>;
+declare const ImpersonationCandidateSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    image: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type ImpersonationCandidate = z.infer<typeof ImpersonationCandidateSchema>;
+/** Server-safe session projection — no tokens, no KV internals. */
+interface ServerAuthSession {
+    sub: string;
+    email: string;
+    name: string | null;
+    picture: string | null;
+    systemRole: string | null;
+    abilities: AbilityRule[];
+    organizations: RpOrganization[];
+    activeOrg: string | null;
+    entitlement: {
+        product: string;
+        plan: string;
+        status: string;
+        active: boolean;
+        currentPeriodEnd: number | null;
+    } | null;
+    isImpersonation: boolean;
+    impersonator: PublicUser | null;
+}
+/** Browser-visible session — NO tokens. */
+declare const PublicSessionSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        sub: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        picture: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    abilities: z.ZodArray<z.ZodObject<{
+        action: z.ZodString;
+        subject: z.ZodString;
+        conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    systemRole: z.ZodNullable<z.ZodString>;
+    organizations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodString;
+        personal: z.ZodBoolean;
+    }, z.core.$strip>>;
+    activeOrg: z.ZodNullable<z.ZodString>;
+    entitlement: z.ZodNullable<z.ZodObject<{
+        product: z.ZodString;
+        plan: z.ZodString;
+        status: z.ZodString;
+        active: z.ZodBoolean;
+        currentPeriodEnd: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+    impersonator: z.ZodNullable<z.ZodObject<{
+        sub: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        picture: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type PublicSession = z.infer<typeof PublicSessionSchema>;
+
+export { AbilityRuleSchema, ImpersonationCandidateSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
+export type { AbilityRule, ImpersonationCandidate, PublicSession, PublicUser, RpOrganization, ServerAuthSession, UserinfoClaims };

package/dist/contract/index.d.ts

@@ -0,0 +1,117 @@
+import { z } from 'zod';
+
+declare const RpOrganizationSchema: z.ZodObject<{
+    id: z.ZodString;
+    slug: z.ZodString;
+    name: z.ZodString;
+    role: z.ZodString;
+    personal: z.ZodBoolean;
+}, z.core.$strip>;
+type RpOrganization = z.infer<typeof RpOrganizationSchema>;
+/** CASL ability rule emitted into /oauth2/userinfo by the IdP. */
+declare const AbilityRuleSchema: z.ZodObject<{
+    action: z.ZodString;
+    subject: z.ZodString;
+    conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+type AbilityRule = z.infer<typeof AbilityRuleSchema>;
+declare const UserinfoClaimsSchema: z.ZodObject<{
+    org: z.ZodNullable<z.ZodString>;
+    roles: z.ZodNullable<z.ZodString>;
+    personal: z.ZodBoolean;
+    entitlement: z.ZodNullable<z.ZodObject<{
+        product: z.ZodString;
+        plan: z.ZodString;
+        status: z.ZodString;
+        active: z.ZodBoolean;
+        currentPeriodEnd: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+    organizations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodString;
+        personal: z.ZodBoolean;
+    }, z.core.$strip>>;
+    abilities: z.ZodArray<z.ZodObject<{
+        action: z.ZodString;
+        subject: z.ZodString;
+        conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    role: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type UserinfoClaims = z.infer<typeof UserinfoClaimsSchema>;
+declare const PublicUserSchema: z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    picture: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type PublicUser = z.infer<typeof PublicUserSchema>;
+declare const ImpersonationCandidateSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    image: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type ImpersonationCandidate = z.infer<typeof ImpersonationCandidateSchema>;
+/** Server-safe session projection — no tokens, no KV internals. */
+interface ServerAuthSession {
+    sub: string;
+    email: string;
+    name: string | null;
+    picture: string | null;
+    systemRole: string | null;
+    abilities: AbilityRule[];
+    organizations: RpOrganization[];
+    activeOrg: string | null;
+    entitlement: {
+        product: string;
+        plan: string;
+        status: string;
+        active: boolean;
+        currentPeriodEnd: number | null;
+    } | null;
+    isImpersonation: boolean;
+    impersonator: PublicUser | null;
+}
+/** Browser-visible session — NO tokens. */
+declare const PublicSessionSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        sub: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        picture: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    abilities: z.ZodArray<z.ZodObject<{
+        action: z.ZodString;
+        subject: z.ZodString;
+        conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    systemRole: z.ZodNullable<z.ZodString>;
+    organizations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodString;
+        personal: z.ZodBoolean;
+    }, z.core.$strip>>;
+    activeOrg: z.ZodNullable<z.ZodString>;
+    entitlement: z.ZodNullable<z.ZodObject<{
+        product: z.ZodString;
+        plan: z.ZodString;
+        status: z.ZodString;
+        active: z.ZodBoolean;
+        currentPeriodEnd: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+    impersonator: z.ZodNullable<z.ZodObject<{
+        sub: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        picture: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type PublicSession = z.infer<typeof PublicSessionSchema>;
+
+export { AbilityRuleSchema, ImpersonationCandidateSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
+export type { AbilityRule, ImpersonationCandidate, PublicSession, PublicUser, RpOrganization, ServerAuthSession, UserinfoClaims };

package/dist/contract/index.mjs

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+
+const RpOrganizationSchema = z.object({
+  id: z.string(),
+  slug: z.string(),
+  name: z.string(),
+  role: z.string(),
+  personal: z.boolean()
+});
+const AbilityRuleSchema = z.object({
+  action: z.string(),
+  subject: z.string(),
+  conditions: z.record(z.string(), z.string()).optional()
+});
+const UserinfoClaimsSchema = z.object({
+  org: z.string().nullable(),
+  roles: z.string().nullable(),
+  personal: z.boolean(),
+  entitlement: z.object({
+    product: z.string(),
+    plan: z.string(),
+    status: z.string(),
+    active: z.boolean(),
+    currentPeriodEnd: z.number().nullable()
+  }).nullable(),
+  organizations: z.array(RpOrganizationSchema),
+  abilities: z.array(AbilityRuleSchema),
+  role: z.string().nullable()
+});
+const PublicUserSchema = z.object({
+  sub: z.string(),
+  email: z.string(),
+  name: z.string().nullable(),
+  picture: z.string().nullable()
+});
+const ImpersonationCandidateSchema = z.object({
+  id: z.string(),
+  email: z.string(),
+  name: z.string().nullable(),
+  image: z.string().nullable()
+});
+const PublicSessionSchema = z.object({
+  user: PublicUserSchema,
+  abilities: z.array(AbilityRuleSchema),
+  systemRole: z.string().nullable(),
+  organizations: z.array(RpOrganizationSchema),
+  activeOrg: z.string().nullable(),
+  entitlement: UserinfoClaimsSchema.shape.entitlement,
+  impersonator: PublicUserSchema.nullable()
+});
+
+export { AbilityRuleSchema, ImpersonationCandidateSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };

package/dist/module.d.mts

@@ -0,0 +1,23 @@
+import * as _nuxt_schema from '@nuxt/schema';
+
+interface AuthRoutes {
+    signIn: string;
+    callback: string;
+    signOut: string;
+    home: string;
+    error: string;
+}
+interface ModuleOptions {
+    domain: string;
+    clientId: string;
+    clientSecret: string;
+    issuer?: string;
+    scopes?: string[];
+    sessionStorageBase?: string;
+    sessionCookieName?: string;
+    routes?: Partial<AuthRoutes>;
+}
+declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
+
+export { _default as default };
+export type { AuthRoutes, ModuleOptions };

package/dist/module.d.ts

@@ -0,0 +1,23 @@
+import * as _nuxt_schema from '@nuxt/schema';
+
+interface AuthRoutes {
+    signIn: string;
+    callback: string;
+    signOut: string;
+    home: string;
+    error: string;
+}
+interface ModuleOptions {
+    domain: string;
+    clientId: string;
+    clientSecret: string;
+    issuer?: string;
+    scopes?: string[];
+    sessionStorageBase?: string;
+    sessionCookieName?: string;
+    routes?: Partial<AuthRoutes>;
+}
+declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
+
+export { _default as default };
+export type { AuthRoutes, ModuleOptions };

package/dist/module.json

@@ -0,0 +1,9 @@
+{
+  "name": "@thecodeorigin/auth",
+  "configKey": "auth",
+  "version": "0.0.1",
+  "builder": {
+    "@nuxt/module-builder": "1.0.2",
+    "unbuild": "3.6.1"
+  }
+}

package/dist/module.mjs

@@ -0,0 +1,51 @@
+import { defineNuxtModule, createResolver, addServerHandler, addServerImportsDir, addImportsDir, addRouteMiddleware, addPlugin } from '@nuxt/kit';
+import { defu } from 'defu';
+
+const module$1 = defineNuxtModule({
+  meta: { name: "@thecodeorigin/auth", configKey: "auth" },
+  defaults: {
+    domain: "",
+    clientId: "",
+    clientSecret: "",
+    scopes: ["openid", "profile", "email"],
+    sessionStorageBase: "auth",
+    sessionCookieName: "tco_auth",
+    routes: { signIn: "/auth/sign-in", callback: "/auth/callback", signOut: "/auth/sign-out", home: "/", error: "/auth/sign-in" }
+  },
+  setup(options, nuxt) {
+    const resolver = createResolver(import.meta.url);
+    const routes = options.routes;
+    const issuer = options.issuer || (options.domain ? `https://${options.domain}/api/auth` : "");
+    nuxt.options.runtimeConfig.auth = defu(
+      nuxt.options.runtimeConfig.auth,
+      { clientSecret: options.clientSecret, sessionStorageBase: options.sessionStorageBase, sessionCookieName: options.sessionCookieName }
+    );
+    nuxt.options.runtimeConfig.public.auth = defu(
+      nuxt.options.runtimeConfig.public.auth,
+      { domain: options.domain, clientId: options.clientId, issuer, scopes: options.scopes, routes }
+    );
+    addServerHandler({ route: routes.signIn, handler: resolver.resolve("./runtime/server/routes/sign-in.get") });
+    addServerHandler({ route: routes.callback, handler: resolver.resolve("./runtime/server/routes/callback.get") });
+    addServerHandler({ route: routes.signOut, handler: resolver.resolve("./runtime/server/routes/sign-out.get") });
+    for (const [route, file] of [
+      ["/api/_auth/session", "session.get"],
+      ["/api/_auth/organizations", "organizations.get"],
+      ["/api/_auth/organizations/switch", "organizations/switch.post"],
+      ["/api/_auth/impersonatable-users", "impersonatable-users.get"],
+      ["/api/_auth/impersonate", "impersonate.post"],
+      ["/api/_auth/stop-impersonating", "stop-impersonating.post"]
+    ])
+      addServerHandler({ route, handler: resolver.resolve(`./runtime/server/api/_auth/${file}`) });
+    addServerImportsDir(resolver.resolve("./runtime/server/utils"));
+    addImportsDir(resolver.resolve("./runtime/app/composables"));
+    addRouteMiddleware({ name: "auth", path: resolver.resolve("./runtime/app/middleware/auth.global"), global: true });
+    addRouteMiddleware({ name: "casl", path: resolver.resolve("./runtime/app/middleware/casl.global"), global: true });
+    addPlugin(resolver.resolve("./runtime/app/plugins/0.session"));
+    addPlugin(resolver.resolve("./runtime/app/plugins/ability"));
+    nuxt.hook("prepare:types", ({ references }) => {
+      references.push({ path: resolver.resolve("./runtime/types.d.ts") });
+    });
+  }
+});
+
+export { module$1 as default };

package/dist/runtime/app/composables/useAuth.d.ts

@@ -0,0 +1,106 @@
+import type { ImpersonationCandidate, RpOrganization } from '../../../contract/index.js';
+export declare function useAuth(): {
+    session: import("vue").Ref<{
+        user: {
+            sub: string;
+            email: string;
+            name: string | null;
+            picture: string | null;
+        };
+        abilities: {
+            action: string;
+            subject: string;
+            conditions?: Record<string, string> | undefined;
+        }[];
+        systemRole: string | null;
+        organizations: {
+            id: string;
+            slug: string;
+            name: string;
+            role: string;
+            personal: boolean;
+        }[];
+        activeOrg: string | null;
+        entitlement: {
+            product: string;
+            plan: string;
+            status: string;
+            active: boolean;
+            currentPeriodEnd: number | null;
+        } | null;
+        impersonator: {
+            sub: string;
+            email: string;
+            name: string | null;
+            picture: string | null;
+        } | null;
+    } | null, {
+        user: {
+            sub: string;
+            email: string;
+            name: string | null;
+            picture: string | null;
+        };
+        abilities: {
+            action: string;
+            subject: string;
+            conditions?: Record<string, string> | undefined;
+        }[];
+        systemRole: string | null;
+        organizations: {
+            id: string;
+            slug: string;
+            name: string;
+            role: string;
+            personal: boolean;
+        }[];
+        activeOrg: string | null;
+        entitlement: {
+            product: string;
+            plan: string;
+            status: string;
+            active: boolean;
+            currentPeriodEnd: number | null;
+        } | null;
+        impersonator: {
+            sub: string;
+            email: string;
+            name: string | null;
+            picture: string | null;
+        } | null;
+    } | null>;
+    user: import("vue").ComputedRef<{
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    } | null>;
+    loggedIn: import("vue").ComputedRef<boolean>;
+    abilities: import("vue").ComputedRef<{
+        action: string;
+        subject: string;
+        conditions?: Record<string, string> | undefined;
+    }[]>;
+    impersonator: import("vue").ComputedRef<{
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    } | null>;
+    isImpersonating: import("vue").ComputedRef<boolean>;
+    getOrganizations: () => RpOrganization[];
+    switchOrganization: (orgId: string) => Promise<void>;
+    getImpersonatableUsers: (query?: {
+        q?: string;
+        limit?: number;
+        offset?: number;
+    }) => Promise<{
+        items: ImpersonationCandidate[];
+        hasMore: boolean;
+    }>;
+    impersonate: (userId: string) => Promise<void>;
+    stopImpersonating: () => Promise<void>;
+    signIn: (redirect?: string) => string | false | void | import("vue-router").RouteLocationAsRelativeGeneric | import("vue-router").RouteLocationAsPathGeneric | Promise<false | void | import("vue-router").NavigationFailure>;
+    signOut: () => string | false | void | import("vue-router").RouteLocationAsRelativeGeneric | import("vue-router").RouteLocationAsPathGeneric | Promise<false | void | import("vue-router").NavigationFailure>;
+    refresh: () => Promise<void>;
+};

package/dist/runtime/app/composables/useAuth.js

@@ -0,0 +1,60 @@
+import { computed } from "vue";
+import { navigateTo, useRuntimeConfig, useState } from "#app";
+export function useAuth() {
+  const session = useState("tco-auth-session", () => null);
+  const routes = useRuntimeConfig().public.auth?.routes ?? {};
+  const user = computed(() => session.value?.user ?? null);
+  const loggedIn = computed(() => !!session.value);
+  const abilities = computed(() => session.value?.abilities ?? []);
+  const impersonator = computed(() => session.value?.impersonator ?? null);
+  const isImpersonating = computed(() => !!session.value?.impersonator);
+  async function refresh() {
+    session.value = await $fetch("/api/_auth/session");
+  }
+  function getOrganizations() {
+    return session.value?.organizations ?? [];
+  }
+  async function switchOrganization(orgId) {
+    session.value = await $fetch("/api/_auth/organizations/switch", {
+      method: "POST",
+      body: { organizationId: orgId }
+    });
+  }
+  function getImpersonatableUsers(query) {
+    return $fetch("/api/_auth/impersonatable-users", { query });
+  }
+  async function impersonate(userId) {
+    session.value = await $fetch("/api/_auth/impersonate", {
+      method: "POST",
+      body: { userId }
+    });
+  }
+  async function stopImpersonating() {
+    session.value = await $fetch("/api/_auth/stop-impersonating", { method: "POST" });
+  }
+  function signIn(redirect) {
+    return navigateTo(
+      redirect ? `${routes.signIn}?redirect=${encodeURIComponent(redirect)}` : routes.signIn,
+      { external: true }
+    );
+  }
+  function signOut() {
+    return navigateTo(routes.signOut, { external: true });
+  }
+  return {
+    session,
+    user,
+    loggedIn,
+    abilities,
+    impersonator,
+    isImpersonating,
+    getOrganizations,
+    switchOrganization,
+    getImpersonatableUsers,
+    impersonate,
+    stopImpersonating,
+    signIn,
+    signOut,
+    refresh
+  };
+}

package/dist/runtime/app/composables/useCasl.d.ts

@@ -0,0 +1,8 @@
+export declare function useCasl(): {
+    ability: {
+        can: (action: string, subject: string, field?: string) => boolean;
+        cannot: (action: string, subject: string, field?: string) => boolean;
+    };
+    can: (action: string, subject: string, field?: string) => boolean;
+    cannot: (action: string, subject: string, field?: string) => boolean;
+};

package/dist/runtime/app/composables/useCasl.js

@@ -0,0 +1,9 @@
+import { useNuxtApp } from "#app";
+export function useCasl() {
+  const { $ability } = useNuxtApp();
+  return {
+    ability: $ability,
+    can: (action, subject, field) => $ability.can(action, subject, field),
+    cannot: (action, subject, field) => $ability.cannot(action, subject, field)
+  };
+}

package/dist/runtime/app/middleware/auth.global.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("#app").RouteMiddleware;
+export default _default;

package/dist/runtime/app/middleware/auth.global.js

@@ -0,0 +1,11 @@
+import { defineNuxtRouteMiddleware, navigateTo, useRuntimeConfig, useState } from "#app";
+export default defineNuxtRouteMiddleware((to) => {
+  const session = useState("tco-auth-session", () => null);
+  const routes = useRuntimeConfig().public.auth?.routes ?? {};
+  const authed = !!session.value;
+  const isPublic = to.meta.public === true || to.meta.unauthenticatedOnly === true;
+  if (authed && to.meta.unauthenticatedOnly)
+    return navigateTo(routes.home);
+  if (!authed && !isPublic)
+    return navigateTo(`${routes.signIn}?redirect=${encodeURIComponent(to.fullPath)}`, { external: true });
+});