@thecodeorigin/auth 0.0.1 → 0.0.2

package/dist/module.d.mts

@@ -9,14 +9,28 @@ interface AuthRoutes {
 }
 interface ModuleOptions {
     domain: string;
-    clientId: string;
-    clientSecret: string;
-    issuer?: string;
     scopes?: string[];
     sessionStorageBase?: string;
     sessionCookieName?: string;
     routes?: Partial<AuthRoutes>;
 }
+declare module '@nuxt/schema' {
+    interface RuntimeConfig {
+        auth: {
+            clientSecret: string;
+            sessionStorageBase: string;
+            sessionCookieName: string;
+        };
+    }
+    interface PublicRuntimeConfig {
+        auth: {
+            domain: string;
+            clientId: string;
+            routes: AuthRoutes;
+            scopes: string[];
+        };
+    }
+}
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
 
 export { _default as default };

package/dist/module.d.ts

@@ -9,14 +9,28 @@ interface AuthRoutes {
 }
 interface ModuleOptions {
     domain: string;
-    clientId: string;
-    clientSecret: string;
-    issuer?: string;
     scopes?: string[];
     sessionStorageBase?: string;
     sessionCookieName?: string;
     routes?: Partial<AuthRoutes>;
 }
+declare module '@nuxt/schema' {
+    interface RuntimeConfig {
+        auth: {
+            clientSecret: string;
+            sessionStorageBase: string;
+            sessionCookieName: string;
+        };
+    }
+    interface PublicRuntimeConfig {
+        auth: {
+            domain: string;
+            clientId: string;
+            routes: AuthRoutes;
+            scopes: string[];
+        };
+    }
+}
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
 
 export { _default as default };

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@thecodeorigin/auth",
   "configKey": "auth",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -5,8 +5,6 @@ const module$1 = defineNuxtModule({
   meta: { name: "@thecodeorigin/auth", configKey: "auth" },
   defaults: {
     domain: "",
-    clientId: "",
-    clientSecret: "",
     scopes: ["openid", "profile", "email"],
     sessionStorageBase: "auth",
     sessionCookieName: "tco_auth",
@@ -14,16 +12,18 @@ const module$1 = defineNuxtModule({
   },
   setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
-    const routes = options.routes;
-    const issuer = options.issuer || (options.domain ? `https://${options.domain}/api/auth` : "");
-    nuxt.options.runtimeConfig.auth = defu(
-      nuxt.options.runtimeConfig.auth,
-      { clientSecret: options.clientSecret, sessionStorageBase: options.sessionStorageBase, sessionCookieName: options.sessionCookieName }
-    );
-    nuxt.options.runtimeConfig.public.auth = defu(
-      nuxt.options.runtimeConfig.public.auth,
-      { domain: options.domain, clientId: options.clientId, issuer, scopes: options.scopes, routes }
-    );
+    const routes = { signIn: "/auth/sign-in", callback: "/auth/callback", signOut: "/auth/sign-out", home: "/", error: "/auth/sign-in", ...options.routes };
+    nuxt.options.runtimeConfig.auth = defu(nuxt.options.runtimeConfig.auth, {
+      clientSecret: "",
+      sessionStorageBase: options.sessionStorageBase,
+      sessionCookieName: options.sessionCookieName
+    });
+    nuxt.options.runtimeConfig.public.auth = defu(nuxt.options.runtimeConfig.public.auth, {
+      domain: options.domain,
+      clientId: "",
+      routes,
+      scopes: options.scopes
+    });
     addServerHandler({ route: routes.signIn, handler: resolver.resolve("./runtime/server/routes/sign-in.get") });
     addServerHandler({ route: routes.callback, handler: resolver.resolve("./runtime/server/routes/callback.get") });
     addServerHandler({ route: routes.signOut, handler: resolver.resolve("./runtime/server/routes/sign-out.get") });

package/dist/runtime/server/api/_auth/stop-impersonating.post.js

@@ -1,7 +1,7 @@
 import { createError, defineEventHandler } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
 import { useStorage } from "nitropack/runtime";
 import { idpFetch } from "../../utils/idp.js";
-import { resolveAuthConfig } from "../../utils/oidc.js";
 import { readSessionRecord, readSessionRecordById, toPublicSession, writeSessionRecord } from "../../utils/session.js";
 export default defineEventHandler(async (event) => {
   const s = await readSessionRecord(event);
@@ -15,7 +15,7 @@ export default defineEventHandler(async (event) => {
   if (!backup)
     throw createError({ statusCode: 500, statusMessage: "Original session missing \u2014 sign in again" });
   await writeSessionRecord(s.id, backup);
-  const cfg = resolveAuthConfig();
-  await useStorage(cfg.storageBase).removeItem(`session:${s.rec.backupId}`);
+  const { auth: runtimeConfig } = useRuntimeConfig();
+  await useStorage(runtimeConfig.sessionStorageBase).removeItem(`session:${s.rec.backupId}`);
   return toPublicSession(backup);
 });

package/dist/runtime/server/routes/callback.get.js

@@ -1,7 +1,8 @@
 import { defineEventHandler, deleteCookie, getCookie, getQuery, sendRedirect } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
 import { z } from "zod";
 import { UserinfoClaimsSchema } from "../../../contract";
-import { callbackRedirectUri, exchangeCode, fetchUserinfo, resolveAuthConfig, safePath } from "../utils/oidc.js";
+import { callbackRedirectUri, exchangeCode, fetchUserinfo, safePath } from "../utils/oidc.js";
 import { newSessionId, setSessionCookie, writeSessionRecord } from "../utils/session.js";
 const RawUserinfoSchema = UserinfoClaimsSchema.extend({
   sub: z.string(),
@@ -11,23 +12,23 @@ const RawUserinfoSchema = UserinfoClaimsSchema.extend({
   picture: z.string().optional()
 });
 export default defineEventHandler(async (event) => {
-  const cfg = resolveAuthConfig();
+  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   const q = getQuery(event);
-  const fail = (e) => sendRedirect(event, `${cfg.routes.error}?error=${encodeURIComponent(e)}`);
+  const fail = (e) => sendRedirect(event, `${publicRuntimeConfig.routes.error}?error=${encodeURIComponent(e)}`);
   if (q.error)
     return fail(String(q.error));
   const state = getCookie(event, "tco_state");
   const verifier = getCookie(event, "tco_verifier");
-  const redirectTo = safePath(getCookie(event, "tco_redirect"), cfg.routes.home);
+  const redirectTo = safePath(getCookie(event, "tco_redirect"), publicRuntimeConfig.routes.home);
   for (const c of ["tco_state", "tco_verifier", "tco_redirect"])
-    deleteCookie(event, c, { path: cfg.routes.callback });
+    deleteCookie(event, c, { path: publicRuntimeConfig.routes.callback });
   if (!q.code || !q.state || !state || q.state !== state || !verifier)
     return fail("invalid_state");
   let tokens;
   let userinfoRaw;
   try {
-    tokens = await exchangeCode(cfg, String(q.code), verifier, callbackRedirectUri(event, cfg));
-    userinfoRaw = await fetchUserinfo(cfg, tokens.access_token);
+    tokens = await exchangeCode(String(q.code), verifier, callbackRedirectUri(event));
+    userinfoRaw = await fetchUserinfo(tokens.access_token);
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     console.error("[auth:callback] exchange failed:", detail);

package/dist/runtime/server/routes/sign-in.get.js

@@ -1,22 +1,23 @@
 import { createError, defineEventHandler, getQuery, sendRedirect, setCookie } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
 import { withQuery } from "ufo";
-import { callbackRedirectUri, pkceChallenge, randomString, resolveAuthConfig, safePath } from "../utils/oidc.js";
+import { callbackRedirectUri, pkceChallenge, randomString, safePath } from "../utils/oidc.js";
 export default defineEventHandler(async (event) => {
-  const cfg = resolveAuthConfig();
-  if (!cfg.issuer || !cfg.clientId || !cfg.clientSecret)
+  const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
+  if (!publicRuntimeConfig.domain || !publicRuntimeConfig.clientId || !runtimeConfig.clientSecret)
     throw createError({ statusCode: 503, statusMessage: "Auth not configured" });
   const state = randomString(32);
   const verifier = randomString(64);
-  const redirectTo = safePath(getQuery(event).redirect, cfg.routes.home);
-  const opts = { httpOnly: true, secure: !import.meta.dev, sameSite: "lax", maxAge: 600, path: cfg.routes.callback };
+  const redirectTo = safePath(getQuery(event).redirect, publicRuntimeConfig.routes.home);
+  const opts = { httpOnly: true, secure: !import.meta.dev, sameSite: "lax", maxAge: 600, path: publicRuntimeConfig.routes.callback };
   setCookie(event, "tco_state", state, opts);
   setCookie(event, "tco_verifier", verifier, opts);
   setCookie(event, "tco_redirect", redirectTo, opts);
-  return sendRedirect(event, withQuery(`${cfg.issuer}/oauth2/authorize`, {
-    client_id: cfg.clientId,
-    redirect_uri: callbackRedirectUri(event, cfg),
+  return sendRedirect(event, withQuery(`https://${publicRuntimeConfig.domain}/api/auth/oauth2/authorize`, {
+    client_id: publicRuntimeConfig.clientId,
+    redirect_uri: callbackRedirectUri(event),
     response_type: "code",
-    scope: cfg.scopes.join(" "),
+    scope: publicRuntimeConfig.scopes.join(" "),
     state,
     code_challenge: await pkceChallenge(verifier),
     code_challenge_method: "S256"

package/dist/runtime/server/routes/sign-out.get.js

@@ -1,13 +1,13 @@
 import { defineEventHandler, sendRedirect } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
 import { $fetch } from "ofetch";
-import { resolveAuthConfig } from "../utils/oidc.js";
 import { destroySession } from "../utils/session.js";
 export default defineEventHandler(async (event) => {
-  const cfg = resolveAuthConfig();
+  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   const rec = await destroySession(event);
   if (rec?.accessToken) {
     try {
-      await $fetch(`${cfg.issuer}/oauth2/endsession`, {
+      await $fetch(`https://${publicRuntimeConfig.domain}/api/auth/oauth2/endsession`, {
         method: "POST",
         body: new URLSearchParams({ token: rec.refreshToken ?? rec.accessToken }).toString(),
         headers: { "Content-Type": "application/x-www-form-urlencoded" }
@@ -15,5 +15,5 @@ export default defineEventHandler(async (event) => {
     } catch {
     }
   }
-  return sendRedirect(event, cfg.routes.home);
+  return sendRedirect(event, publicRuntimeConfig.routes.home);
 });

package/dist/runtime/server/utils/handlers.d.ts

@@ -0,0 +1,9 @@
+import type { H3Event } from 'h3';
+import type { ServerAuthSession } from './session.js';
+export declare function defineAuthenticatedHandler<T>(handler: (event: H3Event, session: NonNullable<ServerAuthSession>) => Promise<T> | T): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<T>>;
+export declare function defineAuthorizedHandler<T>(_checks: string[], handler: (event: H3Event, ctx: {
+    session: NonNullable<ServerAuthSession>;
+}) => Promise<T> | T): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<T>>;
+export declare function defineAdminHandler<T>(_checks: string[], handler: (event: H3Event, ctx: {
+    session: NonNullable<ServerAuthSession>;
+}) => Promise<T> | T): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<T>>;

package/dist/runtime/server/utils/handlers.js

@@ -0,0 +1,21 @@
+import { createError, defineEventHandler } from "h3";
+import { getServerAuthSession } from "./session.js";
+export function defineAuthenticatedHandler(handler) {
+  return defineEventHandler(async (event) => {
+    const session = await getServerAuthSession(event);
+    if (!session)
+      throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+    event.context.activeOrganizationId = session.activeOrg;
+    return handler(event, session);
+  });
+}
+export function defineAuthorizedHandler(_checks, handler) {
+  return defineAuthenticatedHandler(async (event, session) => handler(event, { session }));
+}
+export function defineAdminHandler(_checks, handler) {
+  return defineAuthenticatedHandler(async (event, session) => {
+    if (session.systemRole !== "admin")
+      throw createError({ statusCode: 403, statusMessage: "Forbidden" });
+    return handler(event, { session });
+  });
+}

package/dist/runtime/server/utils/idp.js

@@ -1,19 +1,20 @@
 import { createError } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
 import { $fetch } from "ofetch";
-import { resolveAuthConfig } from "./oidc.js";
 import { readSessionRecordById, writeSessionRecord } from "./session.js";
 const SKEW_MS = 6e4;
-async function refresh(cfg, rec) {
+async function refresh(rec) {
   if (rec.isImpersonation || !rec.refreshToken)
     return false;
+  const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   try {
     const t = await $fetch(
-      `${cfg.issuer}/oauth2/token`,
+      `https://${publicRuntimeConfig.domain}/api/auth/oauth2/token`,
       {
         method: "POST",
         headers: {
           "Content-Type": "application/x-www-form-urlencoded",
-          "Authorization": `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`
+          "Authorization": `Basic ${btoa(`${publicRuntimeConfig.clientId}:${runtimeConfig.clientSecret}`)}`
         },
         body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: rec.refreshToken }).toString()
       }
@@ -27,12 +28,12 @@ async function refresh(cfg, rec) {
   }
 }
 export async function idpFetch(event, id, rec, path, opts = {}) {
-  const cfg = resolveAuthConfig();
+  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   if (!rec.isImpersonation && Date.now() > rec.accessExpiresAt - SKEW_MS) {
-    if (await refresh(cfg, rec))
+    if (await refresh(rec))
       await writeSessionRecord(id, rec);
   }
-  const call = () => $fetch(`${cfg.issuer}${path}`, {
+  const call = () => $fetch(`https://${publicRuntimeConfig.domain}${path}`, {
     method: opts.method,
     body: opts.body,
     query: opts.query,
@@ -49,7 +50,7 @@ export async function idpFetch(event, id, rec, path, opts = {}) {
       Object.assign(rec, fresh);
       return call();
     }
-    if (await refresh(cfg, rec)) {
+    if (await refresh(rec)) {
       await writeSessionRecord(id, rec);
       return call();
     }

package/dist/runtime/server/utils/oidc.d.ts

@@ -1,29 +1,36 @@
 import type { H3Event } from 'h3';
-export interface ResolvedAuthConfig {
-    issuer: string;
-    clientId: string;
-    clientSecret: string;
-    scopes: string[];
-    routes: {
-        signIn: string;
-        callback: string;
-        signOut: string;
-        home: string;
-        error: string;
-    };
-    cookieName: string;
-    storageBase: string;
+declare module 'nitropack' {
+    interface NitroRuntimeConfig {
+        auth: {
+            clientSecret: string;
+            sessionStorageBase: string;
+            sessionCookieName: string;
+        };
+    }
+    interface NitroRuntimePublicConfig {
+        auth: {
+            domain: string;
+            clientId: string;
+            routes: {
+                signIn: string;
+                callback: string;
+                signOut: string;
+                home: string;
+                error: string;
+            };
+            scopes: string[];
+        };
+    }
 }
-export declare function resolveAuthConfig(): ResolvedAuthConfig;
 export declare function randomString(len?: number): string;
 export declare function pkceChallenge(verifier: string): Promise<string>;
-export declare function callbackRedirectUri(event: H3Event, cfg: ResolvedAuthConfig): string;
-export declare function exchangeCode(cfg: ResolvedAuthConfig, code: string, verifier: string, redirectUri: string): Promise<{
+export declare function callbackRedirectUri(event: H3Event): string;
+export declare function exchangeCode(code: string, verifier: string, redirectUri: string): Promise<{
     access_token: string;
     refresh_token?: string;
     expires_in?: number;
     id_token?: string;
 }>;
-export declare function fetchUserinfo(cfg: ResolvedAuthConfig, accessToken: string): Promise<any>;
+export declare function fetchUserinfo(accessToken: string): Promise<any>;
 /** Same-origin, path-only redirect target (prevents open redirect). */
 export declare function safePath(target: string | undefined, fallback: string): string;

package/dist/runtime/server/utils/oidc.js

@@ -1,21 +1,6 @@
 import { getRequestHost, getRequestProtocol } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { $fetch } from "ofetch";
-export function resolveAuthConfig() {
-  const rc = useRuntimeConfig();
-  const pub = rc.public.auth ?? {};
-  const priv = rc.auth ?? {};
-  const domain = process.env.NUXT_THECODEORIGIN_DOMAIN || pub.domain || "";
-  return {
-    issuer: process.env.NUXT_THECODEORIGIN_ISSUER || pub.issuer || (domain ? `https://${domain}/api/auth` : ""),
-    clientId: process.env.NUXT_THECODEORIGIN_CLIENT_ID || pub.clientId || "",
-    clientSecret: process.env.NUXT_THECODEORIGIN_CLIENT_SECRET || priv.clientSecret || "",
-    scopes: pub.scopes ?? ["openid", "profile", "email"],
-    routes: pub.routes,
-    cookieName: priv.sessionCookieName || "tco_auth",
-    storageBase: priv.sessionStorageBase || "auth"
-  };
-}
 function b64url(buf) {
   return btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -27,19 +12,19 @@ export function randomString(len = 64) {
 export async function pkceChallenge(verifier) {
   return b64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
 }
-export function callbackRedirectUri(event, cfg) {
-  const proto = getRequestProtocol(event);
-  const host = getRequestHost(event);
-  return `${proto}://${host}${cfg.routes.callback}`;
+export function callbackRedirectUri(event) {
+  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
+  return `${getRequestProtocol(event)}://${getRequestHost(event)}${publicRuntimeConfig.routes.callback}`;
 }
-export async function exchangeCode(cfg, code, verifier, redirectUri) {
+export async function exchangeCode(code, verifier, redirectUri) {
+  const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   return $fetch(
-    `${cfg.issuer}/oauth2/token`,
+    `https://${publicRuntimeConfig.domain}/api/auth/oauth2/token`,
     {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
-        "Authorization": `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`
+        "Authorization": `Basic ${btoa(`${publicRuntimeConfig.clientId}:${runtimeConfig.clientSecret}`)}`
       },
       body: new URLSearchParams({
         grant_type: "authorization_code",
@@ -50,8 +35,9 @@ export async function exchangeCode(cfg, code, verifier, redirectUri) {
     }
   );
 }
-export async function fetchUserinfo(cfg, accessToken) {
-  return $fetch(`${cfg.issuer}/oauth2/userinfo`, {
+export async function fetchUserinfo(accessToken) {
+  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
+  return $fetch(`https://${publicRuntimeConfig.domain}/api/auth/oauth2/userinfo`, {
     headers: { Authorization: `Bearer ${accessToken}` }
   });
 }

package/dist/runtime/server/utils/session.js

@@ -1,9 +1,6 @@
 import { deleteCookie, getCookie, setCookie } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
 import { useStorage } from "nitropack/runtime";
-import { resolveAuthConfig } from "./oidc.js";
-function store(base) {
-  return useStorage(base);
-}
 function key(id) {
   return `session:${id}`;
 }
@@ -13,20 +10,20 @@ export function newSessionId() {
   return [...a].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 export async function writeSessionRecord(id, rec) {
-  const cfg = resolveAuthConfig();
-  await store(cfg.storageBase).setItem(key(id), rec);
+  const { auth: runtimeConfig } = useRuntimeConfig();
+  await useStorage(runtimeConfig.sessionStorageBase).setItem(key(id), rec);
 }
 export async function readSessionRecord(event) {
-  const cfg = resolveAuthConfig();
-  const id = getCookie(event, cfg.cookieName);
+  const { auth: runtimeConfig } = useRuntimeConfig();
+  const id = getCookie(event, runtimeConfig.sessionCookieName);
   if (!id)
     return null;
-  const rec = await store(cfg.storageBase).getItem(key(id));
+  const rec = await useStorage(runtimeConfig.sessionStorageBase).getItem(key(id));
   return rec ? { id, rec } : null;
 }
 export async function setSessionCookie(event, id) {
-  const cfg = resolveAuthConfig();
-  setCookie(event, cfg.cookieName, id, {
+  const { auth: runtimeConfig } = useRuntimeConfig();
+  setCookie(event, runtimeConfig.sessionCookieName, id, {
     httpOnly: true,
     secure: !import.meta.dev,
     sameSite: "lax",
@@ -35,18 +32,18 @@ export async function setSessionCookie(event, id) {
   });
 }
 export async function destroySession(event) {
-  const cfg = resolveAuthConfig();
-  const id = getCookie(event, cfg.cookieName);
+  const { auth: runtimeConfig } = useRuntimeConfig();
+  const id = getCookie(event, runtimeConfig.sessionCookieName);
   if (!id)
     return null;
-  const rec = await store(cfg.storageBase).getItem(key(id));
-  await store(cfg.storageBase).removeItem(key(id));
-  deleteCookie(event, cfg.cookieName, { path: "/" });
+  const rec = await useStorage(runtimeConfig.sessionStorageBase).getItem(key(id));
+  await useStorage(runtimeConfig.sessionStorageBase).removeItem(key(id));
+  deleteCookie(event, runtimeConfig.sessionCookieName, { path: "/" });
   return rec;
 }
 export async function readSessionRecordById(id) {
-  const cfg = resolveAuthConfig();
-  return store(cfg.storageBase).getItem(key(id));
+  const { auth: runtimeConfig } = useRuntimeConfig();
+  return useStorage(runtimeConfig.sessionStorageBase).getItem(key(id));
 }
 export async function getServerAuthSession(event) {
   const s = await readSessionRecord(event);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@thecodeorigin/auth",
   "type": "module",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "private": false,
   "description": "THECODEORIGIN Authentication Portal client module",
   "repository": "https://github.com/thecodeorigin/auth",