@thecodeorigin/auth 0.0.10 → 0.0.11

package/README.md

@@ -1,84 +1,149 @@
-<!--
-Get your module up and running quickly.
+# @thecodeorigin/auth
+
+Shared Nuxt authentication and authorization for THECODEORIGIN applications.
+ID verifies the account through OIDC authorization code + PKCE. Each application
+then creates its own Better Auth session in its own KV storage.
+
+## Session behavior
+
+- Signed, host-only, application-specific opaque cookies identify KV sessions.
+  Better Auth adds `__Secure-` to the configured cookie name on HTTPS; consumers
+  should use the session API rather than reading the configured base name.
+- Identity, organization access, abilities and entitlement are captured at login.
+  Organization switching selects the saved organization abilities locally.
+- Sessions have an absolute expiry (seven days by default). Reading a session,
+  using an application, or renewing an ID session never extends that deadline.
+- Signing out of ID or choosing a different ID account does not affect an
+  application's existing session. Signing out of an application ends only that
+  application's session.
+- Permission changes in ID take effect when the application authenticates again.
+  Set a shorter `sessionMaxAge` if the application needs a shorter snapshot lifetime.
+- Directory lookups and support impersonation are explicit online ID operations.
+  An expired ID access credential can prevent those operations; it does not
+  invalidate local application authentication or ordinary authorization.
+- Account replacement and impersonation rotate the application session. The
+  administrator's restoration handle retains the original session expiry.
+
+Better Auth owns session creation, signed cookies, KV reads and revocation. Its
+internal establishment endpoint is never exposed as an HTTP route. The module
+preserves the registered `/auth/callback` URI and validates ID-token signature,
+issuer, audience, nonce and subject in addition to PKCE and state.
+
+## Configure a Nuxt application
+
+```ts
+export default defineNuxtConfig({
+  modules: ['@thecodeorigin/auth', '@nuxthub/core'],
+  hub: { kv: true },
+  auth: {
+    domain: 'id.thecodeorigin.com',
+    sessionStorageBase: 'kv',
+    sessionCookieName: 'tco_my_application_auth',
+    sessionMaxAge: 60 * 60 * 24 * 7,
+    routes: {
+      login: '/auth/login',
+      signIn: '/auth/sign-in',
+      callback: '/auth/callback',
+      home: '/dashboard',
+      error: '/auth/login',
+    },
+  },
+})
+```
+
+Configure `NUXT_PUBLIC_AUTH_CLIENT_ID` and `NUXT_AUTH_CLIENT_SECRET` with the
+application's confidential ID client. `NUXT_AUTH_SESSION_SECRET` may provide a
+separate signing secret of at least 32 characters. If omitted, the module derives
+an application-specific signing key from the client secret using HKDF. Rotating
+that source secret invalidates existing application cookies. No new database,
+ID session table or infrastructure seed is required.
+
+Use a unique cookie name per application, including applications on different
+localhost ports. Cookies do not isolate ports. Storage keys also include the
+client ID and cookie namespace. Legacy unsigned module cookies are not accepted;
+the first visit after migration requires authentication.
+
+Cloudflare KV is eventually consistent. Server expiry is authoritative even if
+KV retains a record. Revocation and concurrent mutations are not globally atomic;
+the module rechecks expected session and login intent before publishing changes.
+
+## Shared application APIs
+
+```ts
+const auth = useAuth()
+await auth.signIn('/projects')
+await auth.switchAccount('/projects')
+await auth.logout() // revoke locally, clear cached data, navigate to the signed-out screen
+await auth.switchOrganization(organizationId)
+
+// Login cards retain application presentation; the module owns flow and errors.
+const { error, loggedOut, loading, handleSignIn, handleUseAnotherAccount } = useAuthLogin()
+```
 
-Find and replace all on all files (CMD+SHIFT+F):
-- Name: My Module
-- Package name: my-module
-- Description: My new Nuxt module
--->
+`signOut()` revokes the local session without navigation. It throws on failure;
+callers must not display successful logout after a failed revocation.
+`logout()` additionally performs a full navigation. Account and impersonation UI
+should also use full navigation after successful identity changes to reset stores.
+The module checks other tabs on focus and session-change notifications.
 
-# My Module
+`recoverSession()` is for same-origin business API 401 handling. It returns false
+only after confirming that the local session is absent. Network/service errors
+preserve existing state. Capture `useAuth()` in a valid Nuxt context before the
+request, and never call `signOut()` merely because an unrelated API returned 401.
 
-[![npm version][npm-version-src]][npm-version-href]
-[![npm downloads][npm-downloads-src]][npm-downloads-href]
-[![License][license-src]][license-href]
-[![Nuxt][nuxt-src]][nuxt-href]
+Server helpers remain available through auto-imports and `@thecodeorigin/auth/server`:
+`getServerAuthSession`, `defineAuthenticatedHandler`, `defineAuthorizedHandler`,
+`defineSensitiveAuthorizedHandler`, `defineAdminHandler`, and CASL helpers.
+`getFreshServerAuthSession` remains a compatibility alias for a current local KV
+read; `force` does not contact ID. All authorization checks use the same snapshot.
 
-My new Nuxt module for doing amazing things.
+Local session mutations require same-origin POST requests. The legacy GET logout
+route directs users to the login surface without mutating authentication.
 
-- [✨ &nbsp;Release Notes](/CHANGELOG.md)
-<!-- - [🏀 Online playground](https://stackblitz.com/github/your-org/my-module?file=playground%2Fapp.vue) -->
-<!-- - [📖 &nbsp;Documentation](https://example.com) -->
+## Work on the module across the ecosystem locally
+
+From `packages/auth`, install dependencies and build:
+
+```sh
+pnpm install
+pnpm prepack
+```
 
-## Features
+From the ecosystem superproject:
 
-<!-- Highlight some of the features your module provide here -->
-- ⛰ &nbsp;Foo
-- 🚠 &nbsp;Bar
-- 🌲 &nbsp;Baz
+```sh
+node .ecosystem/scripts/auth-local.mjs link
+node .ecosystem/scripts/auth-local.mjs status
+export PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=false
+```
+
+The helper points all seven consumer `node_modules/@thecodeorigin/auth` links at
+the built local package and records their previous targets under ignored local
+state. It changes no dependency manifests, lockfiles, deployments or gitlinks.
+The environment setting prevents pnpm's automatic dependency verification during
+local Nuxt hooks from replacing the links with published packages. Rebuild the
+module after edits and restart local consumer dev servers. An explicit install
+may replace links; run `link` again afterward.
+
+Restore installed versions with:
+
+```sh
+node .ecosystem/scripts/auth-local.mjs unlink
+```
 
-## Quick Setup
+Publishing the new module and updating each application's version pin is a
+separate release step. The local link is for this ecosystem checkout, not a
+replacement for a published dependency in independently cloned applications.
+Vault's existing integration-key contracts are included in the source module.
 
-Install the module to your Nuxt application with one command:
+## Verify
 
-```bash
-npx nuxt module add my-module
+```sh
+pnpm test
+pnpm lint
+pnpm test:types
 ```
 
-That's it! You can now use My Module in your Nuxt app ✨
-
-
-## Contribution
-
-<details>
-  <summary>Local development</summary>
-  
-  ```bash
-  # Install dependencies
-  npm install
-  
-  # Generate type stubs
-  npm run dev:prepare
-  
-  # Develop with the playground
-  npm run dev
-  
-  # Build the playground
-  npm run dev:build
-  
-  # Run ESLint
-  npm run lint
-  
-  # Run Vitest
-  npm run test
-  npm run test:watch
-  
-  # Release new version
-  npm run release
-  ```
-
-</details>
-
-
-<!-- Badges -->
-[npm-version-src]: https://img.shields.io/npm/v/my-module/latest.svg?style=flat&colorA=020420&colorB=00DC82
-[npm-version-href]: https://npmjs.com/package/my-module
-
-[npm-downloads-src]: https://img.shields.io/npm/dm/my-module.svg?style=flat&colorA=020420&colorB=00DC82
-[npm-downloads-href]: https://npm.chart.dev/my-module
-
-[license-src]: https://img.shields.io/npm/l/my-module.svg?style=flat&colorA=020420&colorB=00DC82
-[license-href]: https://npmjs.com/package/my-module
-
-[nuxt-src]: https://img.shields.io/badge/Nuxt-020420?logo=nuxt
-[nuxt-href]: https://nuxt.com
+Focused tests exercise real Better Auth sessions across separate instances with
+shared KV, complete callback validation, fixed expiry, local organization access,
+account rotation, independent logout, support restoration and client recovery.

package/dist/contract/index.d.mts

@@ -38,6 +38,11 @@ declare const UserinfoClaimsSchema: z.ZodObject<{
         subject: z.ZodString;
         conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, z.core.$strip>>;
+    organizationAuthorizations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        action: z.ZodString;
+        subject: z.ZodString;
+        conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>>>;
     role: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 type UserinfoClaims = z.infer<typeof UserinfoClaimsSchema>;
@@ -102,7 +107,8 @@ declare const OrganizationContextSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 type OrganizationContext = z.infer<typeof OrganizationContextSchema>;
-declare const IntegrationKeyContextSchema: z.ZodObject<{
+declare const EnvironmentIntegrationKeyContextSchema: z.ZodObject<{
+    createdBy: z.ZodOptional<z.ZodString>;
     keyId: z.ZodString;
     organizationId: z.ZodString;
     clientId: z.ZodString;
@@ -113,10 +119,80 @@ declare const IntegrationKeyContextSchema: z.ZodObject<{
     name: z.ZodString;
     prefix: z.ZodString;
     expiresAt: z.ZodNullable<z.ZodNumber>;
-}, z.core.$strip>;
+}, z.core.$strict>;
+declare const EnvironmentCapabilitySchema: z.ZodObject<{
+    resourceType: z.ZodLiteral<"environment">;
+    resourceId: z.ZodUUID;
+    actions: z.ZodArray<z.ZodEnum<{
+        "secrets:read": "secrets:read";
+        "secrets:create": "secrets:create";
+    }>>;
+    keyPrefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+declare const DeploymentIntegrationKeyContextSchema: z.ZodObject<{
+    keyId: z.ZodString;
+    organizationId: z.ZodString;
+    version: z.ZodLiteral<2>;
+    clientId: z.ZodString;
+    audience: z.ZodLiteral<"vault">;
+    createdBy: z.ZodString;
+    capabilities: z.ZodArray<z.ZodObject<{
+        resourceType: z.ZodLiteral<"environment">;
+        resourceId: z.ZodUUID;
+        actions: z.ZodArray<z.ZodEnum<{
+            "secrets:read": "secrets:read";
+            "secrets:create": "secrets:create";
+        }>>;
+        keyPrefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "secrets:read": "secrets:read";
+        "secrets:create": "secrets:create";
+    }>>;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>;
+declare const IntegrationKeyContextSchema: z.ZodUnion<readonly [z.ZodObject<{
+    createdBy: z.ZodOptional<z.ZodString>;
+    keyId: z.ZodString;
+    organizationId: z.ZodString;
+    clientId: z.ZodString;
+    audience: z.ZodLiteral<"vault">;
+    resourceType: z.ZodLiteral<"environment">;
+    resourceId: z.ZodString;
+    permissions: z.ZodArray<z.ZodLiteral<"secrets:read">>;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    keyId: z.ZodString;
+    organizationId: z.ZodString;
+    version: z.ZodLiteral<2>;
+    clientId: z.ZodString;
+    audience: z.ZodLiteral<"vault">;
+    createdBy: z.ZodString;
+    capabilities: z.ZodArray<z.ZodObject<{
+        resourceType: z.ZodLiteral<"environment">;
+        resourceId: z.ZodUUID;
+        actions: z.ZodArray<z.ZodEnum<{
+            "secrets:read": "secrets:read";
+            "secrets:create": "secrets:create";
+        }>>;
+        keyPrefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "secrets:read": "secrets:read";
+        "secrets:create": "secrets:create";
+    }>>;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>]>;
 type IntegrationKeyContext = z.infer<typeof IntegrationKeyContextSchema>;
 /** Server-safe session projection — no tokens, no KV internals. */
 interface ServerAuthSession {
+    expiresAt?: number;
     sub: string;
     email: string;
     name: string | null;
@@ -137,6 +213,7 @@ interface ServerAuthSession {
 }
 /** Browser-visible session — NO tokens. */
 declare const PublicSessionSchema: z.ZodObject<{
+    expiresAt: z.ZodOptional<z.ZodNumber>;
     user: z.ZodObject<{
         sub: z.ZodString;
         email: z.ZodString;
@@ -173,5 +250,5 @@ declare const PublicSessionSchema: z.ZodObject<{
 }, z.core.$strip>;
 type PublicSession = z.infer<typeof PublicSessionSchema>;
 
-export { AbilityRuleSchema, DirectoryUserPageSchema, DirectoryUserSchema, ImpersonationCandidateSchema, IntegrationKeyContextSchema, OrganizationContextSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
+export { AbilityRuleSchema, DeploymentIntegrationKeyContextSchema, DirectoryUserPageSchema, DirectoryUserSchema, EnvironmentCapabilitySchema, EnvironmentIntegrationKeyContextSchema, ImpersonationCandidateSchema, IntegrationKeyContextSchema, OrganizationContextSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
 export type { AbilityRule, DirectoryUser, DirectoryUserPage, ImpersonationCandidate, IntegrationKeyContext, OrganizationContext, PublicSession, PublicUser, RpOrganization, ServerAuthSession, UserinfoClaims };

package/dist/contract/index.d.ts

@@ -38,6 +38,11 @@ declare const UserinfoClaimsSchema: z.ZodObject<{
         subject: z.ZodString;
         conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, z.core.$strip>>;
+    organizationAuthorizations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        action: z.ZodString;
+        subject: z.ZodString;
+        conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>>>;
     role: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 type UserinfoClaims = z.infer<typeof UserinfoClaimsSchema>;
@@ -102,7 +107,8 @@ declare const OrganizationContextSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 type OrganizationContext = z.infer<typeof OrganizationContextSchema>;
-declare const IntegrationKeyContextSchema: z.ZodObject<{
+declare const EnvironmentIntegrationKeyContextSchema: z.ZodObject<{
+    createdBy: z.ZodOptional<z.ZodString>;
     keyId: z.ZodString;
     organizationId: z.ZodString;
     clientId: z.ZodString;
@@ -113,10 +119,80 @@ declare const IntegrationKeyContextSchema: z.ZodObject<{
     name: z.ZodString;
     prefix: z.ZodString;
     expiresAt: z.ZodNullable<z.ZodNumber>;
-}, z.core.$strip>;
+}, z.core.$strict>;
+declare const EnvironmentCapabilitySchema: z.ZodObject<{
+    resourceType: z.ZodLiteral<"environment">;
+    resourceId: z.ZodUUID;
+    actions: z.ZodArray<z.ZodEnum<{
+        "secrets:read": "secrets:read";
+        "secrets:create": "secrets:create";
+    }>>;
+    keyPrefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+declare const DeploymentIntegrationKeyContextSchema: z.ZodObject<{
+    keyId: z.ZodString;
+    organizationId: z.ZodString;
+    version: z.ZodLiteral<2>;
+    clientId: z.ZodString;
+    audience: z.ZodLiteral<"vault">;
+    createdBy: z.ZodString;
+    capabilities: z.ZodArray<z.ZodObject<{
+        resourceType: z.ZodLiteral<"environment">;
+        resourceId: z.ZodUUID;
+        actions: z.ZodArray<z.ZodEnum<{
+            "secrets:read": "secrets:read";
+            "secrets:create": "secrets:create";
+        }>>;
+        keyPrefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "secrets:read": "secrets:read";
+        "secrets:create": "secrets:create";
+    }>>;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>;
+declare const IntegrationKeyContextSchema: z.ZodUnion<readonly [z.ZodObject<{
+    createdBy: z.ZodOptional<z.ZodString>;
+    keyId: z.ZodString;
+    organizationId: z.ZodString;
+    clientId: z.ZodString;
+    audience: z.ZodLiteral<"vault">;
+    resourceType: z.ZodLiteral<"environment">;
+    resourceId: z.ZodString;
+    permissions: z.ZodArray<z.ZodLiteral<"secrets:read">>;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    keyId: z.ZodString;
+    organizationId: z.ZodString;
+    version: z.ZodLiteral<2>;
+    clientId: z.ZodString;
+    audience: z.ZodLiteral<"vault">;
+    createdBy: z.ZodString;
+    capabilities: z.ZodArray<z.ZodObject<{
+        resourceType: z.ZodLiteral<"environment">;
+        resourceId: z.ZodUUID;
+        actions: z.ZodArray<z.ZodEnum<{
+            "secrets:read": "secrets:read";
+            "secrets:create": "secrets:create";
+        }>>;
+        keyPrefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "secrets:read": "secrets:read";
+        "secrets:create": "secrets:create";
+    }>>;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>]>;
 type IntegrationKeyContext = z.infer<typeof IntegrationKeyContextSchema>;
 /** Server-safe session projection — no tokens, no KV internals. */
 interface ServerAuthSession {
+    expiresAt?: number;
     sub: string;
     email: string;
     name: string | null;
@@ -137,6 +213,7 @@ interface ServerAuthSession {
 }
 /** Browser-visible session — NO tokens. */
 declare const PublicSessionSchema: z.ZodObject<{
+    expiresAt: z.ZodOptional<z.ZodNumber>;
     user: z.ZodObject<{
         sub: z.ZodString;
         email: z.ZodString;
@@ -173,5 +250,5 @@ declare const PublicSessionSchema: z.ZodObject<{
 }, z.core.$strip>;
 type PublicSession = z.infer<typeof PublicSessionSchema>;
 
-export { AbilityRuleSchema, DirectoryUserPageSchema, DirectoryUserSchema, ImpersonationCandidateSchema, IntegrationKeyContextSchema, OrganizationContextSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
+export { AbilityRuleSchema, DeploymentIntegrationKeyContextSchema, DirectoryUserPageSchema, DirectoryUserSchema, EnvironmentCapabilitySchema, EnvironmentIntegrationKeyContextSchema, ImpersonationCandidateSchema, IntegrationKeyContextSchema, OrganizationContextSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
 export type { AbilityRule, DirectoryUser, DirectoryUserPage, ImpersonationCandidate, IntegrationKeyContext, OrganizationContext, PublicSession, PublicUser, RpOrganization, ServerAuthSession, UserinfoClaims };

package/dist/contract/index.mjs

@@ -25,6 +25,8 @@ const UserinfoClaimsSchema = z.object({
   }).nullable(),
   organizations: z.array(RpOrganizationSchema),
   abilities: z.array(AbilityRuleSchema),
+  /** Per-organization snapshot captured during authentication, never inferred from role names. */
+  organizationAuthorizations: z.record(z.string(), z.array(AbilityRuleSchema)).default({}),
   role: z.string().nullable()
 });
 const PublicUserSchema = z.object({
@@ -56,7 +58,8 @@ const OrganizationContextSchema = z.object({
   systemRole: z.string().nullable(),
   entitlement: UserinfoClaimsSchema.shape.entitlement
 });
-const IntegrationKeyContextSchema = z.object({
+const EnvironmentIntegrationKeyContextSchema = z.object({
+  createdBy: z.string().min(1).optional(),
   keyId: z.string().min(1),
   organizationId: z.string().min(1),
   clientId: z.string().min(1),
@@ -67,8 +70,37 @@ const IntegrationKeyContextSchema = z.object({
   name: z.string().min(1).max(100),
   prefix: z.string().min(1),
   expiresAt: z.number().int().positive().nullable()
+}).strict();
+const EnvironmentCapabilitySchema = z.object({
+  resourceType: z.literal("environment"),
+  resourceId: z.uuid(),
+  actions: z.array(z.enum(["secrets:read", "secrets:create"])).min(1).max(2),
+  keyPrefixes: z.array(z.string().min(1).max(128).regex(/^[A-Z_][A-Z0-9_]*$/)).min(1).max(20).optional()
+}).strict().superRefine((value, context) => {
+  if (new Set(value.actions).size !== value.actions.length || value.actions.includes("secrets:create") !== Boolean(value.keyPrefixes?.length))
+    context.addIssue({ code: "custom", message: "Invalid environment capability" });
+});
+const DeploymentIntegrationKeyContextSchema = z.object({
+  keyId: z.string().min(1),
+  organizationId: z.string().min(1),
+  version: z.literal(2),
+  clientId: z.string().min(1),
+  audience: z.literal("vault"),
+  createdBy: z.string().min(1),
+  capabilities: z.array(EnvironmentCapabilitySchema).min(1).max(100),
+  permissions: z.array(z.enum(["secrets:read", "secrets:create"])).min(1).max(2),
+  name: z.string().min(1).max(100),
+  prefix: z.string().min(1),
+  expiresAt: z.number().int().positive()
+}).strict().superRefine((value, context) => {
+  const actions = new Set(value.capabilities.flatMap((capability) => capability.actions));
+  if (new Set(value.capabilities.map((capability) => capability.resourceId)).size !== value.capabilities.length || new Set(value.permissions).size !== value.permissions.length || value.permissions.length !== actions.size || value.permissions.some((permission) => !actions.has(permission))) {
+    context.addIssue({ code: "custom", message: "Invalid environment capabilities" });
+  }
 });
+const IntegrationKeyContextSchema = z.union([EnvironmentIntegrationKeyContextSchema, DeploymentIntegrationKeyContextSchema]);
 const PublicSessionSchema = z.object({
+  expiresAt: z.number().optional(),
   user: PublicUserSchema,
   abilities: z.array(AbilityRuleSchema),
   systemRole: z.string().nullable(),
@@ -78,4 +110,4 @@ const PublicSessionSchema = z.object({
   impersonator: PublicUserSchema.nullable()
 });
 
-export { AbilityRuleSchema, DirectoryUserPageSchema, DirectoryUserSchema, ImpersonationCandidateSchema, IntegrationKeyContextSchema, OrganizationContextSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
+export { AbilityRuleSchema, DeploymentIntegrationKeyContextSchema, DirectoryUserPageSchema, DirectoryUserSchema, EnvironmentCapabilitySchema, EnvironmentIntegrationKeyContextSchema, ImpersonationCandidateSchema, IntegrationKeyContextSchema, OrganizationContextSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };

package/dist/module.d.mts

@@ -13,6 +13,8 @@ interface ModuleOptions {
     scopes?: string[];
     sessionStorageBase?: string;
     sessionCookieName?: string;
+    /** Absolute session lifetime in seconds; activity never extends it. */
+    sessionMaxAge?: number;
     logoutIntentCookieName?: string;
     routes?: Partial<AuthRoutes>;
 }
@@ -20,6 +22,8 @@ declare module '@nuxt/schema' {
     interface RuntimeConfig {
         auth: {
             clientSecret: string;
+            sessionSecret: string;
+            sessionMaxAge: number;
             sessionStorageBase: string;
             sessionCookieName: string;
             logoutIntentCookieName: string;

package/dist/module.d.ts

@@ -13,6 +13,8 @@ interface ModuleOptions {
     scopes?: string[];
     sessionStorageBase?: string;
     sessionCookieName?: string;
+    /** Absolute session lifetime in seconds; activity never extends it. */
+    sessionMaxAge?: number;
     logoutIntentCookieName?: string;
     routes?: Partial<AuthRoutes>;
 }
@@ -20,6 +22,8 @@ declare module '@nuxt/schema' {
     interface RuntimeConfig {
         auth: {
             clientSecret: string;
+            sessionSecret: string;
+            sessionMaxAge: number;
             sessionStorageBase: string;
             sessionCookieName: string;
             logoutIntentCookieName: string;

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@thecodeorigin/auth",
   "configKey": "auth",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,34 +1,53 @@
-import { defineNuxtModule, createResolver, addServerHandler, addServerImportsDir, addImportsDir, addRouteMiddleware, addPlugin } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, directoryToURL, tryResolveModule, resolveModule, addServerHandler, addServerImportsDir, addImportsDir, addRouteMiddleware, addPlugin } from '@nuxt/kit';
 import { defu } from 'defu';
 
 const module$1 = defineNuxtModule({
   meta: { name: "@thecodeorigin/auth", configKey: "auth" },
   defaults: {
-    domain: "",
+    domain: "id.thecodeorigin.com",
     scopes: ["openid", "profile", "email"],
-    sessionStorageBase: "auth",
-    sessionCookieName: "tco_auth",
-    routes: { login: "/auth/login", signIn: "/auth/sign-in", callback: "/auth/callback", signOut: "/auth/sign-out", home: "/", error: "/auth/sign-in" }
+    sessionStorageBase: "kv",
+    sessionMaxAge: 60 * 60 * 24 * 7,
+    routes: { login: "/auth/login", signIn: "/auth/sign-in", callback: "/auth/callback", signOut: "/auth/sign-out", home: "/", error: "/auth/login" }
   },
-  setup(options, nuxt) {
+  async setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
+    nuxt.options.alias["@thecodeorigin/auth/server"] = resolver.resolve("./runtime/server/index");
+    nuxt.options.alias["@thecodeorigin/auth/contract"] = resolver.resolve("./contract/index");
+    nuxt.options.vite.resolve ??= {};
+    nuxt.options.vite.resolve.dedupe = [.../* @__PURE__ */ new Set([
+      ...nuxt.options.vite.resolve.dedupe ?? [],
+      "@casl/vue",
+      "@casl/ability"
+    ])];
+    const consumerUrl = new URL("package.json", directoryToURL(nuxt.options.rootDir));
+    for (const dependency of ["@casl/vue", "@casl/ability"]) {
+      if (!nuxt.options.alias[dependency] && !await tryResolveModule(dependency, consumerUrl))
+        nuxt.options.alias[dependency] = resolveModule(dependency, { url: new URL(import.meta.url) });
+    }
     const routes = {
       login: "/auth/login",
       signIn: "/auth/sign-in",
       callback: "/auth/callback",
       signOut: "/auth/sign-out",
       home: "/",
-      error: "/auth/sign-in",
+      error: "/auth/login",
       ...options.routes
     };
-    const logoutIntentCookieName = options.logoutIntentCookieName ?? `${options.sessionCookieName}_logout`;
+    const appName = nuxt.options.appConfig?.name ?? nuxt.options.rootDir.split("/").filter(Boolean).at(-1) ?? "app";
+    const sessionCookieName = options.sessionCookieName ?? `tco_${appName.replace(/\W/g, "_")}_auth`;
+    const logoutIntentCookieName = options.logoutIntentCookieName ?? `${sessionCookieName}_logout`;
+    if (!Number.isSafeInteger(options.sessionMaxAge) || options.sessionMaxAge < 60)
+      throw new Error("[auth] sessionMaxAge must be an integer of at least 60 seconds");
     if (routes.login === routes.signIn) {
       throw new Error("[auth] routes.login and routes.signIn must use different paths");
     }
     nuxt.options.runtimeConfig.auth = defu(nuxt.options.runtimeConfig.auth, {
       clientSecret: "",
+      sessionSecret: "",
+      sessionMaxAge: options.sessionMaxAge,
       sessionStorageBase: options.sessionStorageBase,
-      sessionCookieName: options.sessionCookieName,
+      sessionCookieName,
       logoutIntentCookieName
     });
     nuxt.options.runtimeConfig.public.auth = defu(nuxt.options.runtimeConfig.public.auth, {
@@ -38,11 +57,12 @@ const module$1 = defineNuxtModule({
       logoutIntentCookieName,
       scopes: options.scopes
     });
-    addServerHandler({ route: routes.signIn, handler: resolver.resolve("./runtime/server/routes/sign-in.get") });
-    addServerHandler({ route: routes.callback, handler: resolver.resolve("./runtime/server/routes/callback.get") });
-    addServerHandler({ route: routes.signOut, handler: resolver.resolve("./runtime/server/routes/sign-out.get") });
+    addServerHandler({ route: routes.signIn, method: "get", handler: resolver.resolve("./runtime/server/routes/sign-in.get") });
+    addServerHandler({ route: routes.callback, method: "get", handler: resolver.resolve("./runtime/server/routes/callback.get") });
+    addServerHandler({ route: routes.signOut, method: "get", handler: resolver.resolve("./runtime/server/routes/sign-out.get") });
     for (const [route, file] of [
       ["/api/_auth/session", "session.get"],
+      ["/api/_auth/session-restore", "session-restore.get"],
       ["/api/_auth/sign-out", "sign-out.post"],
       ["/api/_auth/organizations", "organizations.get"],
       ["/api/_auth/organizations/switch", "organizations/switch.post"],
@@ -62,6 +82,7 @@ const module$1 = defineNuxtModule({
     addRouteMiddleware({ name: "auth", path: resolver.resolve("./runtime/app/middleware/auth.global"), global: true });
     addRouteMiddleware({ name: "casl", path: resolver.resolve("./runtime/app/middleware/casl.global"), global: true });
     addPlugin(resolver.resolve("./runtime/app/plugins/0.session"));
+    addPlugin(resolver.resolve("./runtime/app/plugins/session-sync.client"));
     addPlugin(resolver.resolve("./runtime/app/plugins/ability"));
     nuxt.hook("prepare:types", ({ references }) => {
       references.push({ path: resolver.resolve("./runtime/types.d.ts") });