@thecodeorigin/auth 0.0.6 → 0.0.8

package/dist/module.d.mts

@@ -1,6 +1,7 @@
 import * as _nuxt_schema from '@nuxt/schema';
 
 interface AuthRoutes {
+    login: string;
     signIn: string;
     callback: string;
     signOut: string;
@@ -12,6 +13,7 @@ interface ModuleOptions {
     scopes?: string[];
     sessionStorageBase?: string;
     sessionCookieName?: string;
+    logoutIntentCookieName?: string;
     routes?: Partial<AuthRoutes>;
 }
 declare module '@nuxt/schema' {
@@ -20,6 +22,7 @@ declare module '@nuxt/schema' {
             clientSecret: string;
             sessionStorageBase: string;
             sessionCookieName: string;
+            logoutIntentCookieName: string;
         };
     }
     interface PublicRuntimeConfig {
@@ -27,6 +30,7 @@ declare module '@nuxt/schema' {
             domain: string;
             clientId: string;
             routes: AuthRoutes;
+            logoutIntentCookieName: string;
             scopes: string[];
         };
     }

package/dist/module.d.ts

@@ -1,6 +1,7 @@
 import * as _nuxt_schema from '@nuxt/schema';
 
 interface AuthRoutes {
+    login: string;
     signIn: string;
     callback: string;
     signOut: string;
@@ -12,6 +13,7 @@ interface ModuleOptions {
     scopes?: string[];
     sessionStorageBase?: string;
     sessionCookieName?: string;
+    logoutIntentCookieName?: string;
     routes?: Partial<AuthRoutes>;
 }
 declare module '@nuxt/schema' {
@@ -20,6 +22,7 @@ declare module '@nuxt/schema' {
             clientSecret: string;
             sessionStorageBase: string;
             sessionCookieName: string;
+            logoutIntentCookieName: string;
         };
     }
     interface PublicRuntimeConfig {
@@ -27,6 +30,7 @@ declare module '@nuxt/schema' {
             domain: string;
             clientId: string;
             routes: AuthRoutes;
+            logoutIntentCookieName: string;
             scopes: string[];
         };
     }

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@thecodeorigin/auth",
   "configKey": "auth",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -8,20 +8,34 @@ const module$1 = defineNuxtModule({
     scopes: ["openid", "profile", "email"],
     sessionStorageBase: "auth",
     sessionCookieName: "tco_auth",
-    routes: { signIn: "/auth/sign-in", callback: "/auth/callback", signOut: "/auth/sign-out", home: "/", error: "/auth/sign-in" }
+    routes: { login: "/auth/login", signIn: "/auth/sign-in", callback: "/auth/callback", signOut: "/auth/sign-out", home: "/", error: "/auth/sign-in" }
   },
   setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
-    const routes = { signIn: "/auth/sign-in", callback: "/auth/callback", signOut: "/auth/sign-out", home: "/", error: "/auth/sign-in", ...options.routes };
+    const routes = {
+      login: "/auth/login",
+      signIn: "/auth/sign-in",
+      callback: "/auth/callback",
+      signOut: "/auth/sign-out",
+      home: "/",
+      error: "/auth/sign-in",
+      ...options.routes
+    };
+    const logoutIntentCookieName = options.logoutIntentCookieName ?? `${options.sessionCookieName}_logout`;
+    if (routes.login === routes.signIn) {
+      throw new Error("[auth] routes.login and routes.signIn must use different paths");
+    }
     nuxt.options.runtimeConfig.auth = defu(nuxt.options.runtimeConfig.auth, {
       clientSecret: "",
       sessionStorageBase: options.sessionStorageBase,
-      sessionCookieName: options.sessionCookieName
+      sessionCookieName: options.sessionCookieName,
+      logoutIntentCookieName
     });
     nuxt.options.runtimeConfig.public.auth = defu(nuxt.options.runtimeConfig.public.auth, {
       domain: options.domain,
       clientId: "",
       routes,
+      logoutIntentCookieName,
       scopes: options.scopes
     });
     addServerHandler({ route: routes.signIn, handler: resolver.resolve("./runtime/server/routes/sign-in.get") });
@@ -35,8 +49,13 @@ const module$1 = defineNuxtModule({
       ["/api/_auth/impersonatable-users", "impersonatable-users.get"],
       ["/api/_auth/impersonate", "impersonate.post"],
       ["/api/_auth/stop-impersonating", "stop-impersonating.post"]
-    ])
-      addServerHandler({ route, handler: resolver.resolve(`./runtime/server/api/_auth/${file}`) });
+    ]) {
+      addServerHandler({
+        route,
+        handler: resolver.resolve(`./runtime/server/api/_auth/${file}`),
+        method: file.endsWith(".post") ? "post" : "get"
+      });
+    }
     addServerImportsDir(resolver.resolve("./runtime/server/utils"));
     addImportsDir(resolver.resolve("./runtime/app/composables"));
     addRouteMiddleware({ name: "auth", path: resolver.resolve("./runtime/app/middleware/auth.global"), global: true });

package/dist/runtime/app/composables/useAuth.js

@@ -42,7 +42,8 @@ export function useAuth() {
     return navigateTo(qs ? `${routes.signIn}?${qs}` : routes.signIn, { external: true });
   }
   async function signOut() {
-    await $fetch("/api/_auth/sign-out", { method: "POST" }).catch(() => {
+    const signOutRoute = "/api/_auth/sign-out";
+    await $fetch(signOutRoute, { method: "POST" }).catch(() => {
     });
     session.value = null;
   }

package/dist/runtime/app/middleware/auth.global.js

@@ -1,11 +1,22 @@
-import { defineNuxtRouteMiddleware, navigateTo, useRuntimeConfig, useState } from "#app";
+import { defineNuxtRouteMiddleware, navigateTo, useCookie, useRuntimeConfig, useState } from "#app";
+import { resolveAuthRedirect } from "../utils/auth-redirect.js";
 export default defineNuxtRouteMiddleware((to) => {
   const session = useState("tco-auth-session", () => null);
-  const routes = useRuntimeConfig().public.auth?.routes ?? {};
+  const authConfig = useRuntimeConfig().public.auth;
+  const routes = authConfig?.routes;
+  const logoutIntentCookieName = authConfig?.logoutIntentCookieName ?? "tco_auth_logout";
+  const logoutIntent = useCookie(logoutIntentCookieName);
   const authed = !!session.value;
   const isPublic = to.meta.public === true || to.meta.unauthenticatedOnly === true;
   if (authed && to.meta.unauthenticatedOnly)
-    return navigateTo(routes.home);
-  if (!authed && !isPublic)
-    return navigateTo(`${routes.signIn}?redirect=${encodeURIComponent(to.fullPath)}`, { external: true });
+    return navigateTo(routes?.home ?? "/");
+  if (!authed && !isPublic) {
+    const redirect = resolveAuthRedirect({
+      loginRoute: routes?.login ?? "/auth/login",
+      signInRoute: routes?.signIn ?? "/auth/sign-in",
+      target: to.fullPath,
+      logoutIntent: logoutIntent.value === "1"
+    });
+    return navigateTo(redirect.to, { external: redirect.external });
+  }
 });

package/dist/runtime/app/utils/auth-redirect.d.ts

@@ -0,0 +1,10 @@
+export interface AuthRedirectOptions {
+    loginRoute: string;
+    signInRoute: string;
+    target: string;
+    logoutIntent: boolean;
+}
+export declare function resolveAuthRedirect(options: AuthRedirectOptions): {
+    external: boolean;
+    to: string;
+};

package/dist/runtime/app/utils/auth-redirect.js

@@ -0,0 +1,13 @@
+export function resolveAuthRedirect(options) {
+  const redirect = encodeURIComponent(options.target);
+  if (options.logoutIntent) {
+    return {
+      external: false,
+      to: `${options.loginRoute}?loggedout=1&redirect=${redirect}`
+    };
+  }
+  return {
+    external: true,
+    to: `${options.signInRoute}?redirect=${redirect}`
+  };
+}

package/dist/runtime/server/api/_auth/sign-out.post.js

@@ -1,6 +1,8 @@
 import { defineEventHandler } from "h3";
+import { setLogoutIntent } from "../../utils/logout-intent.js";
 import { destroySession } from "../../utils/session.js";
 export default defineEventHandler(async (event) => {
   await destroySession(event);
+  setLogoutIntent(event);
   return { ok: true };
 });

package/dist/runtime/server/routes/callback.get.js

@@ -2,6 +2,7 @@ import { defineEventHandler, deleteCookie, getCookie, getQuery, sendRedirect } f
 import { useRuntimeConfig } from "nitropack/runtime";
 import { z } from "zod";
 import { UserinfoClaimsSchema } from "../../../contract";
+import { clearLogoutIntent } from "../utils/logout-intent.js";
 import { callbackRedirectUri, exchangeCode, fetchUserinfo, safePath } from "../utils/oidc.js";
 import { newSessionId, setSessionCookie, writeSessionRecord } from "../utils/session.js";
 const RawUserinfoSchema = UserinfoClaimsSchema.extend({
@@ -59,5 +60,6 @@ export default defineEventHandler(async (event) => {
     backupId: null
   });
   await setSessionCookie(event, id);
+  clearLogoutIntent(event);
   return sendRedirect(event, redirectTo);
 });

package/dist/runtime/server/routes/sign-in.get.js

@@ -1,12 +1,14 @@
 import { createError, defineEventHandler, getQuery, sendRedirect, setCookie } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { withQuery } from "ufo";
-import { callbackRedirectUri, pkceChallenge, randomString, safePath } from "../utils/oidc.js";
+import { clearLogoutIntent } from "../utils/logout-intent.js";
+import { callbackRedirectUri, idpBaseUrl, pkceChallenge, randomString, safePath } from "../utils/oidc.js";
 const ALLOWED_PROMPTS = /* @__PURE__ */ new Set(["login", "select_account", "consent", "none"]);
 export default defineEventHandler(async (event) => {
   const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   if (!publicRuntimeConfig.domain || !publicRuntimeConfig.clientId || !runtimeConfig.clientSecret)
     throw createError({ statusCode: 503, statusMessage: "Auth not configured" });
+  clearLogoutIntent(event);
   const query = getQuery(event);
   const state = randomString(32);
   const verifier = randomString(64);
@@ -16,7 +18,7 @@ export default defineEventHandler(async (event) => {
   setCookie(event, "tco_state", state, opts);
   setCookie(event, "tco_verifier", verifier, opts);
   setCookie(event, "tco_redirect", redirectTo, opts);
-  return sendRedirect(event, withQuery(`https://${publicRuntimeConfig.domain}/api/auth/oauth2/authorize`, {
+  return sendRedirect(event, withQuery(`${idpBaseUrl()}/api/auth/oauth2/authorize`, {
     client_id: publicRuntimeConfig.clientId,
     redirect_uri: callbackRedirectUri(event),
     response_type: "code",

package/dist/runtime/server/routes/sign-out.get.js

@@ -1,8 +1,10 @@
 import { defineEventHandler, sendRedirect } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
+import { setLogoutIntent } from "../utils/logout-intent.js";
 import { destroySession } from "../utils/session.js";
 export default defineEventHandler(async (event) => {
   const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   await destroySession(event);
+  setLogoutIntent(event);
   return sendRedirect(event, publicRuntimeConfig.routes.home);
 });

package/dist/runtime/server/utils/idp.js

@@ -1,6 +1,7 @@
 import { createError } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { $fetch } from "ofetch";
+import { idpBaseUrl } from "./oidc.js";
 import { readSessionRecordById, writeSessionRecord } from "./session.js";
 const SKEW_MS = 6e4;
 async function refresh(rec) {
@@ -9,7 +10,7 @@ async function refresh(rec) {
   const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   try {
     const t = await $fetch(
-      `https://${publicRuntimeConfig.domain}/api/auth/oauth2/token`,
+      `${idpBaseUrl()}/api/auth/oauth2/token`,
       {
         method: "POST",
         headers: {
@@ -28,12 +29,11 @@ async function refresh(rec) {
   }
 }
 export async function idpFetch(event, id, rec, path, opts = {}) {
-  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   if (!rec.isImpersonation && Date.now() > rec.accessExpiresAt - SKEW_MS) {
     if (await refresh(rec))
       await writeSessionRecord(id, rec);
   }
-  const call = () => $fetch(`https://${publicRuntimeConfig.domain}${path}`, {
+  const call = () => $fetch(`${idpBaseUrl()}${path}`, {
     method: opts.method,
     body: opts.body,
     query: opts.query,

package/dist/runtime/server/utils/logout-intent.d.ts

@@ -0,0 +1,3 @@
+import type { H3Event } from 'h3';
+export declare function setLogoutIntent(event: H3Event): void;
+export declare function clearLogoutIntent(event: H3Event): void;

package/dist/runtime/server/utils/logout-intent.js

@@ -0,0 +1,17 @@
+import { deleteCookie, setCookie } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
+const LOGOUT_INTENT_MAX_AGE = 60 * 60 * 24 * 7;
+export function setLogoutIntent(event) {
+  const { auth: runtimeConfig } = useRuntimeConfig();
+  setCookie(event, runtimeConfig.logoutIntentCookieName, "1", {
+    httpOnly: false,
+    secure: !import.meta.dev,
+    sameSite: "lax",
+    path: "/",
+    maxAge: LOGOUT_INTENT_MAX_AGE
+  });
+}
+export function clearLogoutIntent(event) {
+  const { auth: runtimeConfig } = useRuntimeConfig();
+  deleteCookie(event, runtimeConfig.logoutIntentCookieName, { path: "/" });
+}

package/dist/runtime/server/utils/oidc.d.ts

@@ -5,6 +5,7 @@ declare module 'nitropack' {
             clientSecret: string;
             sessionStorageBase: string;
             sessionCookieName: string;
+            logoutIntentCookieName: string;
         };
     }
     interface NitroRuntimePublicConfig {
@@ -12,12 +13,14 @@ declare module 'nitropack' {
             domain: string;
             clientId: string;
             routes: {
+                login: string;
                 signIn: string;
                 callback: string;
                 signOut: string;
                 home: string;
                 error: string;
             };
+            logoutIntentCookieName: string;
             scopes: string[];
         };
     }
@@ -25,6 +28,8 @@ declare module 'nitropack' {
 export declare function randomString(len?: number): string;
 export declare function pkceChallenge(verifier: string): Promise<string>;
 export declare function callbackRedirectUri(event: H3Event): string;
+/** IdP origin. `domain` may already carry a scheme (e.g. `http://localhost:3000`); otherwise assume https. */
+export declare function idpBaseUrl(): string;
 export declare function exchangeCode(code: string, verifier: string, redirectUri: string): Promise<{
     access_token: string;
     refresh_token?: string;

package/dist/runtime/server/utils/oidc.js

@@ -16,10 +16,15 @@ export function callbackRedirectUri(event) {
   const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   return `${getRequestProtocol(event)}://${getRequestHost(event)}${publicRuntimeConfig.routes.callback}`;
 }
+export function idpBaseUrl() {
+  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
+  const domain = publicRuntimeConfig.domain;
+  return /^https?:\/\//.test(domain) ? domain : `https://${domain}`;
+}
 export async function exchangeCode(code, verifier, redirectUri) {
   const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   return $fetch(
-    `https://${publicRuntimeConfig.domain}/api/auth/oauth2/token`,
+    `${idpBaseUrl()}/api/auth/oauth2/token`,
     {
       method: "POST",
       headers: {
@@ -36,8 +41,7 @@ export async function exchangeCode(code, verifier, redirectUri) {
   );
 }
 export async function fetchUserinfo(accessToken) {
-  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
-  return $fetch(`https://${publicRuntimeConfig.domain}/api/auth/oauth2/userinfo`, {
+  return $fetch(`${idpBaseUrl()}/api/auth/oauth2/userinfo`, {
     headers: { Authorization: `Bearer ${accessToken}` }
   });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@thecodeorigin/auth",
   "type": "module",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "private": false,
   "description": "THECODEORIGIN Authentication Portal client module",
   "repository": "https://github.com/thecodeorigin/auth",