@thecodeorigin/auth 0.0.8 → 0.0.9

package/dist/contract/index.d.mts

@@ -55,6 +55,66 @@ declare const ImpersonationCandidateSchema: z.ZodObject<{
     image: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 type ImpersonationCandidate = z.infer<typeof ImpersonationCandidateSchema>;
+declare const DirectoryUserSchema: z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    picture: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type DirectoryUser = z.infer<typeof DirectoryUserSchema>;
+declare const DirectoryUserPageSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        sub: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        picture: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    hasMore: z.ZodBoolean;
+}, z.core.$strip>;
+type DirectoryUserPage = z.infer<typeof DirectoryUserPageSchema>;
+declare const OrganizationContextSchema: z.ZodObject<{
+    organization: z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodString;
+        personal: z.ZodBoolean;
+    }, z.core.$strip>;
+    organizations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodString;
+        personal: z.ZodBoolean;
+    }, z.core.$strip>>;
+    abilities: z.ZodArray<z.ZodObject<{
+        action: z.ZodString;
+        subject: z.ZodString;
+        conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    systemRole: z.ZodNullable<z.ZodString>;
+    entitlement: z.ZodNullable<z.ZodObject<{
+        product: z.ZodString;
+        plan: z.ZodString;
+        status: z.ZodString;
+        active: z.ZodBoolean;
+        currentPeriodEnd: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type OrganizationContext = z.infer<typeof OrganizationContextSchema>;
+declare const IntegrationKeyContextSchema: z.ZodObject<{
+    keyId: z.ZodString;
+    organizationId: z.ZodString;
+    clientId: z.ZodString;
+    audience: z.ZodLiteral<"vault">;
+    resourceType: z.ZodLiteral<"environment">;
+    resourceId: z.ZodString;
+    permissions: z.ZodArray<z.ZodLiteral<"secrets:read">>;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+type IntegrationKeyContext = z.infer<typeof IntegrationKeyContextSchema>;
 /** Server-safe session projection — no tokens, no KV internals. */
 interface ServerAuthSession {
     sub: string;
@@ -113,5 +173,5 @@ declare const PublicSessionSchema: z.ZodObject<{
 }, z.core.$strip>;
 type PublicSession = z.infer<typeof PublicSessionSchema>;
 
-export { AbilityRuleSchema, ImpersonationCandidateSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
-export type { AbilityRule, ImpersonationCandidate, PublicSession, PublicUser, RpOrganization, ServerAuthSession, UserinfoClaims };
+export { AbilityRuleSchema, DirectoryUserPageSchema, DirectoryUserSchema, ImpersonationCandidateSchema, IntegrationKeyContextSchema, OrganizationContextSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
+export type { AbilityRule, DirectoryUser, DirectoryUserPage, ImpersonationCandidate, IntegrationKeyContext, OrganizationContext, PublicSession, PublicUser, RpOrganization, ServerAuthSession, UserinfoClaims };

package/dist/contract/index.d.ts

@@ -55,6 +55,66 @@ declare const ImpersonationCandidateSchema: z.ZodObject<{
     image: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 type ImpersonationCandidate = z.infer<typeof ImpersonationCandidateSchema>;
+declare const DirectoryUserSchema: z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    picture: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type DirectoryUser = z.infer<typeof DirectoryUserSchema>;
+declare const DirectoryUserPageSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        sub: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        picture: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    hasMore: z.ZodBoolean;
+}, z.core.$strip>;
+type DirectoryUserPage = z.infer<typeof DirectoryUserPageSchema>;
+declare const OrganizationContextSchema: z.ZodObject<{
+    organization: z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodString;
+        personal: z.ZodBoolean;
+    }, z.core.$strip>;
+    organizations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodString;
+        personal: z.ZodBoolean;
+    }, z.core.$strip>>;
+    abilities: z.ZodArray<z.ZodObject<{
+        action: z.ZodString;
+        subject: z.ZodString;
+        conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    systemRole: z.ZodNullable<z.ZodString>;
+    entitlement: z.ZodNullable<z.ZodObject<{
+        product: z.ZodString;
+        plan: z.ZodString;
+        status: z.ZodString;
+        active: z.ZodBoolean;
+        currentPeriodEnd: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type OrganizationContext = z.infer<typeof OrganizationContextSchema>;
+declare const IntegrationKeyContextSchema: z.ZodObject<{
+    keyId: z.ZodString;
+    organizationId: z.ZodString;
+    clientId: z.ZodString;
+    audience: z.ZodLiteral<"vault">;
+    resourceType: z.ZodLiteral<"environment">;
+    resourceId: z.ZodString;
+    permissions: z.ZodArray<z.ZodLiteral<"secrets:read">>;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+type IntegrationKeyContext = z.infer<typeof IntegrationKeyContextSchema>;
 /** Server-safe session projection — no tokens, no KV internals. */
 interface ServerAuthSession {
     sub: string;
@@ -113,5 +173,5 @@ declare const PublicSessionSchema: z.ZodObject<{
 }, z.core.$strip>;
 type PublicSession = z.infer<typeof PublicSessionSchema>;
 
-export { AbilityRuleSchema, ImpersonationCandidateSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
-export type { AbilityRule, ImpersonationCandidate, PublicSession, PublicUser, RpOrganization, ServerAuthSession, UserinfoClaims };
+export { AbilityRuleSchema, DirectoryUserPageSchema, DirectoryUserSchema, ImpersonationCandidateSchema, IntegrationKeyContextSchema, OrganizationContextSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
+export type { AbilityRule, DirectoryUser, DirectoryUserPage, ImpersonationCandidate, IntegrationKeyContext, OrganizationContext, PublicSession, PublicUser, RpOrganization, ServerAuthSession, UserinfoClaims };

package/dist/contract/index.mjs

@@ -39,6 +39,35 @@ const ImpersonationCandidateSchema = z.object({
   name: z.string().nullable(),
   image: z.string().nullable()
 });
+const DirectoryUserSchema = z.object({
+  sub: z.string().min(1),
+  email: z.string().email(),
+  name: z.string().nullable(),
+  picture: z.string().nullable()
+});
+const DirectoryUserPageSchema = z.object({
+  items: z.array(DirectoryUserSchema),
+  hasMore: z.boolean()
+});
+const OrganizationContextSchema = z.object({
+  organization: RpOrganizationSchema,
+  organizations: z.array(RpOrganizationSchema),
+  abilities: z.array(AbilityRuleSchema),
+  systemRole: z.string().nullable(),
+  entitlement: UserinfoClaimsSchema.shape.entitlement
+});
+const IntegrationKeyContextSchema = z.object({
+  keyId: z.string().min(1),
+  organizationId: z.string().min(1),
+  clientId: z.string().min(1),
+  audience: z.literal("vault"),
+  resourceType: z.literal("environment"),
+  resourceId: z.string().uuid(),
+  permissions: z.array(z.literal("secrets:read")).length(1),
+  name: z.string().min(1).max(100),
+  prefix: z.string().min(1),
+  expiresAt: z.number().int().positive().nullable()
+});
 const PublicSessionSchema = z.object({
   user: PublicUserSchema,
   abilities: z.array(AbilityRuleSchema),
@@ -49,4 +78,4 @@ const PublicSessionSchema = z.object({
   impersonator: PublicUserSchema.nullable()
 });
 
-export { AbilityRuleSchema, ImpersonationCandidateSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };
+export { AbilityRuleSchema, DirectoryUserPageSchema, DirectoryUserSchema, ImpersonationCandidateSchema, IntegrationKeyContextSchema, OrganizationContextSchema, PublicSessionSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema };

package/dist/module.json

@@ -1,9 +1,9 @@
 {
   "name": "@thecodeorigin/auth",
   "configKey": "auth",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "builder": {
-    "@nuxt/module-builder": "1.0.2",
+    "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"
   }
 }

package/dist/module.mjs

@@ -46,6 +46,7 @@ const module$1 = defineNuxtModule({
       ["/api/_auth/sign-out", "sign-out.post"],
       ["/api/_auth/organizations", "organizations.get"],
       ["/api/_auth/organizations/switch", "organizations/switch.post"],
+      ["/api/_auth/organizations/:orgId/users", "organizations/[orgId]/users.get"],
       ["/api/_auth/impersonatable-users", "impersonatable-users.get"],
       ["/api/_auth/impersonate", "impersonate.post"],
       ["/api/_auth/stop-impersonating", "stop-impersonating.post"]

package/dist/runtime/app/composables/useAuth.d.ts

@@ -91,6 +91,19 @@ export declare function useAuth(): {
     isImpersonating: import("vue").ComputedRef<boolean>;
     getOrganizations: () => RpOrganization[];
     switchOrganization: (orgId: string) => Promise<void>;
+    getOrganizationUsers: (organizationId: string, query?: {
+        q?: string;
+        limit?: number;
+        offset?: number;
+    }) => Promise<{
+        items: {
+            sub: string;
+            email: string;
+            name: string | null;
+            picture: string | null;
+        }[];
+        hasMore: boolean;
+    }>;
     getImpersonatableUsers: (query?: {
         q?: string;
         limit?: number;

package/dist/runtime/app/composables/useAuth.js

@@ -20,6 +20,12 @@ export function useAuth() {
       body: { organizationId: orgId }
     });
   }
+  function getOrganizationUsers(organizationId, query) {
+    return $fetch(
+      `/api/_auth/organizations/${encodeURIComponent(organizationId)}/users`,
+      { query }
+    );
+  }
   function getImpersonatableUsers(query) {
     return $fetch("/api/_auth/impersonatable-users", { query });
   }
@@ -56,6 +62,7 @@ export function useAuth() {
     isImpersonating,
     getOrganizations,
     switchOrganization,
+    getOrganizationUsers,
     getImpersonatableUsers,
     impersonate,
     stopImpersonating,

package/dist/runtime/app/composables/useCasl.d.ts

@@ -1,8 +1,11 @@
+import type { Subject } from '@casl/ability';
+interface BrowserAbility {
+    can: (action: string, subject: Subject, field?: string) => boolean;
+    cannot: (action: string, subject: Subject, field?: string) => boolean;
+}
 export declare function useCasl(): {
-    ability: {
-        can: (action: string, subject: string, field?: string) => boolean;
-        cannot: (action: string, subject: string, field?: string) => boolean;
-    };
-    can: (action: string, subject: string, field?: string) => boolean;
-    cannot: (action: string, subject: string, field?: string) => boolean;
+    ability: BrowserAbility;
+    can: (action: string, subject: Subject, field?: string) => boolean;
+    cannot: (action: string, subject: Subject, field?: string) => boolean;
 };
+export {};

package/dist/runtime/app/middleware/auth.global.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("#app").RouteMiddleware;
+declare const _default: import("nuxt/app").RouteMiddleware;
 export default _default;

package/dist/runtime/app/middleware/casl.global.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("#app").RouteMiddleware;
+declare const _default: import("nuxt/app").RouteMiddleware;
 export default _default;

package/dist/runtime/app/plugins/0.session.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("#app").Plugin<Record<string, unknown>> & import("#app").ObjectPlugin<Record<string, unknown>>;
+declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
 export default _default;

package/dist/runtime/app/plugins/ability.d.ts

@@ -1,7 +1,7 @@
 import type { MongoAbility } from '@casl/ability';
-declare const _default: import("#app").Plugin<{
+declare const _default: import("nuxt/app").Plugin<{
     ability: MongoAbility<import("@casl/ability").AbilityTuple, import("@casl/ability").MongoQuery>;
-}> & import("#app").ObjectPlugin<{
+}> & import("nuxt/app").ObjectPlugin<{
     ability: MongoAbility<import("@casl/ability").AbilityTuple, import("@casl/ability").MongoQuery>;
 }>;
 export default _default;

package/dist/runtime/server/api/_auth/impersonate.post.js

@@ -28,6 +28,7 @@ export default defineEventHandler(async (event) => {
     refreshToken: null,
     idToken: null,
     accessExpiresAt: res.expiresAt,
+    authorizationRefreshedAt: Date.now(),
     isImpersonation: true,
     impersonator: { sub: s.rec.user.sub, email: s.rec.user.email, name: s.rec.user.name, picture: s.rec.user.picture },
     backupId

package/dist/runtime/server/api/_auth/organizations/[orgId]/users.get.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    items: {
+        sub: string;
+        email: string;
+        name: string | null;
+        picture: string | null;
+    }[];
+    hasMore: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/api/_auth/organizations/[orgId]/users.get.js

@@ -0,0 +1,25 @@
+import { createError, defineEventHandler, getRouterParam, getValidatedQuery } from "h3";
+import { z } from "zod";
+import { idpFetch } from "../../../../utils/idp.js";
+import { readSessionRecord } from "../../../../utils/session.js";
+const querySchema = z.object({
+  q: z.string().trim().min(2).max(200),
+  limit: z.coerce.number().int().min(1).max(20).default(20),
+  offset: z.coerce.number().int().min(0).default(0)
+});
+export default defineEventHandler(async (event) => {
+  const session = await readSessionRecord(event);
+  if (!session)
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  const orgId = getRouterParam(event, "orgId");
+  if (!orgId || orgId !== session.rec.activeOrg)
+    throw createError({ statusCode: 403, statusMessage: "Forbidden" });
+  const query = await getValidatedQuery(event, querySchema.parse);
+  return idpFetch(
+    event,
+    session.id,
+    session.rec,
+    `/api/auth/rp/organizations/${encodeURIComponent(orgId)}/users`,
+    { query }
+  );
+});

package/dist/runtime/server/api/_auth/organizations/switch.post.js

@@ -1,16 +1,26 @@
 import { createError, defineEventHandler, readValidatedBody } from "h3";
 import { z } from "zod";
+import { idpFetch } from "../../../utils/idp.js";
 import { readSessionRecord, toPublicSession, writeSessionRecord } from "../../../utils/session.js";
-const bodySchema = z.object({ organizationId: z.string() });
+const bodySchema = z.object({ organizationId: z.string().min(1) });
 export default defineEventHandler(async (event) => {
-  const s = await readSessionRecord(event);
-  if (!s)
+  const session = await readSessionRecord(event);
+  if (!session)
     throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
   const { organizationId } = await readValidatedBody(event, bodySchema.parse);
-  const org = s.rec.organizations.find((o) => o.id === organizationId);
-  if (!org)
-    throw createError({ statusCode: 403, statusMessage: "Not a member of that organization" });
-  s.rec.activeOrg = org.id;
-  await writeSessionRecord(s.id, s.rec);
-  return toPublicSession(s.rec);
+  const context = await idpFetch(
+    event,
+    session.id,
+    session.rec,
+    "/api/auth/rp/organizations/switch",
+    { method: "POST", body: { organizationId } }
+  );
+  session.rec.activeOrg = context.organization.id;
+  session.rec.organizations = context.organizations;
+  session.rec.abilities = context.abilities;
+  session.rec.systemRole = context.systemRole;
+  session.rec.entitlement = context.entitlement;
+  session.rec.authorizationRefreshedAt = Date.now();
+  await writeSessionRecord(session.id, session.rec);
+  return toPublicSession(session.rec);
 });

package/dist/runtime/server/index.d.ts

@@ -1,2 +1,7 @@
-export { getServerAuthSession } from './utils/session.js';
+export { abilitySubject, canPerformStatic, createServerAbility, requireServerAbility, } from './utils/ability.js';
+export type { ServerAbility } from './utils/ability.js';
+export { resolveOrganizationUser } from './utils/directory.js';
+export { defineAuthorizedHandler, defineSensitiveAuthorizedHandler, } from './utils/handlers.js';
+export { verifyOrganizationIntegrationKey } from './utils/integration-key.js';
+export { getFreshServerAuthSession, getServerAuthSession } from './utils/session.js';
 export type { ServerAuthSession } from './utils/session.js';

package/dist/runtime/server/index.js

@@ -1 +1,13 @@
-export { getServerAuthSession } from "./utils/session.js";
+export {
+  abilitySubject,
+  canPerformStatic,
+  createServerAbility,
+  requireServerAbility
+} from "./utils/ability.js";
+export { resolveOrganizationUser } from "./utils/directory.js";
+export {
+  defineAuthorizedHandler,
+  defineSensitiveAuthorizedHandler
+} from "./utils/handlers.js";
+export { verifyOrganizationIntegrationKey } from "./utils/integration-key.js";
+export { getFreshServerAuthSession, getServerAuthSession } from "./utils/session.js";

package/dist/runtime/server/routes/callback.get.js

@@ -55,6 +55,7 @@ export default defineEventHandler(async (event) => {
     refreshToken: tokens.refresh_token ?? null,
     idToken: tokens.id_token ?? null,
     accessExpiresAt: Date.now() + (tokens.expires_in ?? 3600) * 1e3,
+    authorizationRefreshedAt: Date.now(),
     isImpersonation: false,
     impersonator: null,
     backupId: null

package/dist/runtime/server/utils/ability.d.ts

@@ -0,0 +1,15 @@
+import type { MongoAbility, Subject } from '@casl/ability';
+import type { ServerAuthSession } from './session.js';
+export type ServerAbility = MongoAbility<[string, Subject]>;
+export declare function createServerAbility(session: ServerAuthSession, options?: {
+    allowSystemAdmin?: boolean;
+}): ServerAbility;
+export declare function abilitySubject<Name extends string, Resource extends Record<string, unknown>>(name: Name, resource: Resource): Resource & import("@casl/ability").ForcedSubject<Name>;
+export declare function requireServerAbility(session: ServerAuthSession, action: string, resource: Subject, options?: {
+    allowSystemAdmin?: boolean;
+}): void;
+/**
+ * Static checks are safe only for unconditional rules. Conditional rules must
+ * be evaluated through requireServerAbility() against a loaded resource.
+ */
+export declare function canPerformStatic(session: ServerAuthSession, action: string, subject: string): boolean;

package/dist/runtime/server/utils/ability.js

@@ -0,0 +1,25 @@
+import { createMongoAbility, subject as tagSubject } from "@casl/ability";
+import { createError } from "h3";
+export function createServerAbility(session, options = {}) {
+  const allowSystemAdmin = options.allowSystemAdmin ?? true;
+  const rules = allowSystemAdmin && session.systemRole === "admin" ? [{ action: "manage", subject: "all" }] : session.abilities.map((rule) => ({
+    action: rule.action,
+    subject: rule.subject,
+    ...rule.conditions ? { conditions: rule.conditions } : {}
+  }));
+  return createMongoAbility(rules);
+}
+export function abilitySubject(name, resource) {
+  return tagSubject(name, resource);
+}
+export function requireServerAbility(session, action, resource, options = {}) {
+  if (!createServerAbility(session, options).can(action, resource))
+    throw createError({ statusCode: 403, statusMessage: "Forbidden" });
+}
+export function canPerformStatic(session, action, subject) {
+  if (session.systemRole === "admin")
+    return true;
+  return session.abilities.some(
+    (rule) => !rule.conditions && (rule.action === action || rule.action === "manage") && (rule.subject === subject || rule.subject === "all")
+  );
+}

package/dist/runtime/server/utils/directory.d.ts

@@ -0,0 +1,3 @@
+import type { H3Event } from 'h3';
+import type { DirectoryUser } from '../../../contract/index.js';
+export declare function resolveOrganizationUser(event: H3Event, organizationId: string, userId: string): Promise<DirectoryUser>;

package/dist/runtime/server/utils/directory.js

@@ -0,0 +1,14 @@
+import { createError } from "h3";
+import { idpFetch } from "./idp.js";
+import { readSessionRecord } from "./session.js";
+export async function resolveOrganizationUser(event, organizationId, userId) {
+  const session = await readSessionRecord(event);
+  if (!session || organizationId !== session.rec.activeOrg)
+    throw createError({ statusCode: 403, statusMessage: "Forbidden" });
+  return idpFetch(
+    event,
+    session.id,
+    session.rec,
+    `/api/auth/rp/organizations/${encodeURIComponent(organizationId)}/users/${encodeURIComponent(userId)}`
+  );
+}

package/dist/runtime/server/utils/handlers.d.ts

@@ -1,7 +1,10 @@
 import type { H3Event } from 'h3';
 import type { ServerAuthSession } from './session.js';
 export declare function defineAuthenticatedHandler<T>(handler: (event: H3Event, session: NonNullable<ServerAuthSession>) => Promise<T> | T): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<T>>;
-export declare function defineAuthorizedHandler<T>(_checks: string[], handler: (event: H3Event, ctx: {
+export declare function defineAuthorizedHandler<T>(checks: string[], handler: (event: H3Event, ctx: {
+    session: NonNullable<ServerAuthSession>;
+}) => Promise<T> | T): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<T>>;
+export declare function defineSensitiveAuthorizedHandler<T>(checks: string[], handler: (event: H3Event, ctx: {
     session: NonNullable<ServerAuthSession>;
 }) => Promise<T> | T): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<T>>;
 export declare function defineAdminHandler<T>(_checks: string[], handler: (event: H3Event, ctx: {

package/dist/runtime/server/utils/handlers.js

@@ -1,16 +1,46 @@
 import { createError, defineEventHandler } from "h3";
-import { getServerAuthSession } from "./session.js";
+import { canPerformStatic } from "./ability.js";
+import { getFreshServerAuthSession } from "./session.js";
+function parseCheck(check) {
+  const separator = check.lastIndexOf(":");
+  if (separator <= 0 || separator === check.length - 1)
+    throw createError({ statusCode: 500, statusMessage: `Invalid ability check: ${check}` });
+  return { subject: check.slice(0, separator), action: check.slice(separator + 1) };
+}
 export function defineAuthenticatedHandler(handler) {
   return defineEventHandler(async (event) => {
-    const session = await getServerAuthSession(event);
+    const session = await getFreshServerAuthSession(event);
     if (!session)
       throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
     event.context.activeOrganizationId = session.activeOrg;
     return handler(event, session);
   });
 }
-export function defineAuthorizedHandler(_checks, handler) {
-  return defineAuthenticatedHandler(async (event, session) => handler(event, { session }));
+export function defineAuthorizedHandler(checks, handler) {
+  return defineAuthenticatedHandler(async (event, session) => {
+    const allowed = checks.some((check) => {
+      const { action, subject } = parseCheck(check);
+      return canPerformStatic(session, action, subject);
+    });
+    if (!allowed)
+      throw createError({ statusCode: 403, statusMessage: "Forbidden" });
+    return handler(event, { session });
+  });
+}
+export function defineSensitiveAuthorizedHandler(checks, handler) {
+  return defineEventHandler(async (event) => {
+    const session = await getFreshServerAuthSession(event, { force: true });
+    if (!session)
+      throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+    event.context.activeOrganizationId = session.activeOrg;
+    const allowed = checks.some((check) => {
+      const { action, subject } = parseCheck(check);
+      return canPerformStatic(session, action, subject);
+    });
+    if (!allowed)
+      throw createError({ statusCode: 403, statusMessage: "Forbidden" });
+    return handler(event, { session });
+  });
 }
 export function defineAdminHandler(_checks, handler) {
   return defineAuthenticatedHandler(async (event, session) => {

package/dist/runtime/server/utils/idp.d.ts

@@ -1,5 +1,7 @@
 import type { H3Event } from 'h3';
+import type { OrganizationContext } from '../../../contract/index.js';
 import type { SessionRecord } from './session.js';
+export declare function refreshAuthorizationContext(event: H3Event, id: string, rec: SessionRecord): Promise<OrganizationContext>;
 /**
  * Call an IdP path with the session's bearer token. Refreshes once on expiry/401.
  * Persists the rotated record. Returns parsed JSON.

package/dist/runtime/server/utils/idp.js

@@ -4,6 +4,17 @@ import { $fetch } from "ofetch";
 import { idpBaseUrl } from "./oidc.js";
 import { readSessionRecordById, writeSessionRecord } from "./session.js";
 const SKEW_MS = 6e4;
+export async function refreshAuthorizationContext(event, id, rec) {
+  if (!rec.activeOrg)
+    throw createError({ statusCode: 403, statusMessage: "No active organization" });
+  return idpFetch(
+    event,
+    id,
+    rec,
+    "/api/auth/rp/organizations/context",
+    { method: "POST", body: { organizationId: rec.activeOrg } }
+  );
+}
 async function refresh(rec) {
   if (rec.isImpersonation || !rec.refreshToken)
     return false;

package/dist/runtime/server/utils/integration-key.d.ts

@@ -0,0 +1,13 @@
+import type { H3Event } from 'h3';
+export declare function verifyOrganizationIntegrationKey(_event: H3Event, key: string): Promise<{
+    keyId: string;
+    organizationId: string;
+    clientId: string;
+    audience: "vault";
+    resourceType: "environment";
+    resourceId: string;
+    permissions: "secrets:read"[];
+    name: string;
+    prefix: string;
+    expiresAt: number | null;
+}>;

package/dist/runtime/server/utils/integration-key.js

@@ -0,0 +1,27 @@
+import { createError } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
+import { $fetch } from "ofetch";
+import { IntegrationKeyContextSchema } from "../../../contract";
+import { idpBaseUrl } from "./oidc.js";
+export async function verifyOrganizationIntegrationKey(_event, key) {
+  const config = useRuntimeConfig();
+  try {
+    const raw = await $fetch(`${idpBaseUrl()}/api/auth/rp/integration-keys/verify`, {
+      method: "POST",
+      headers: {
+        Authorization: `Basic ${btoa(`${config.public.auth.clientId}:${config.auth.clientSecret}`)}`
+      },
+      body: { key }
+    });
+    return IntegrationKeyContextSchema.parse(raw);
+  } catch (error) {
+    const status = error.response?.status;
+    if (status === 401 || status === 403 || status === 429) {
+      throw createError({
+        statusCode: status,
+        statusMessage: status === 429 ? "Rate limited" : "Invalid API token"
+      });
+    }
+    throw createError({ statusCode: 503, statusMessage: "Authorization service unavailable" });
+  }
+}

package/dist/runtime/server/utils/session.d.ts

@@ -1,5 +1,6 @@
 import type { H3Event } from 'h3';
-import type { AbilityRule, PublicSession } from '../../../contract/index.js';
+import type { AbilityRule, PublicSession, ServerAuthSession as ServerAuthSessionContract } from '../../../contract/index.js';
+export declare const AUTHORIZATION_TTL_MS = 120000;
 export interface SessionRecord {
     sub: string;
     user: {
@@ -17,6 +18,7 @@ export interface SessionRecord {
     refreshToken: string | null;
     idToken: string | null;
     accessExpiresAt: number;
+    authorizationRefreshedAt: number;
     isImpersonation: boolean;
     impersonator: {
         sub: string;
@@ -35,41 +37,13 @@ export declare function readSessionRecord(event: H3Event): Promise<{
 export declare function setSessionCookie(event: H3Event, id: string): Promise<void>;
 export declare function destroySession(event: H3Event): Promise<SessionRecord | null>;
 export declare function readSessionRecordById(id: string): Promise<SessionRecord | null>;
-/** Server-safe session for domain routes — no tokens, no internal storage fields. */
-export declare function getServerAuthSession(event: H3Event): Promise<{
-    sub: string;
-    email: string;
-    name: string | null;
-    picture: string | null;
-    systemRole: string | null;
-    abilities: {
-        action: string;
-        subject: string;
-        conditions?: Record<string, string> | undefined;
-    }[];
-    organizations: {
-        id: string;
-        slug: string;
-        name: string;
-        role: string;
-        personal: boolean;
-    }[];
-    activeOrg: string | null;
-    entitlement: {
-        product: string;
-        plan: string;
-        status: string;
-        active: boolean;
-        currentPeriodEnd: number | null;
-    } | null;
-    isImpersonation: boolean;
-    impersonator: {
-        sub: string;
-        email: string;
-        name: string | null;
-        picture: string | null;
-    } | null;
-} | null>;
-export type ServerAuthSession = NonNullable<Awaited<ReturnType<typeof getServerAuthSession>>>;
+export type ServerAuthSession = ServerAuthSessionContract;
+/** Server-safe session projection — no tokens or private refresh metadata. */
+export declare function toServerAuthSession(rec: SessionRecord): ServerAuthSession;
+/** Server-safe session for callers that explicitly do not need a live refresh. */
+export declare function getServerAuthSession(event: H3Event): Promise<ServerAuthSession | null>;
+export declare function getFreshServerAuthSession(event: H3Event, options?: {
+    force?: boolean;
+}): Promise<ServerAuthSession | null>;
 /** Browser-safe projection — tokens are excluded. */
 export declare function toPublicSession(rec: SessionRecord): PublicSession;

package/dist/runtime/server/utils/session.js

@@ -1,5 +1,7 @@
-import { deleteCookie, getCookie, setCookie } from "h3";
+import { createError, deleteCookie, getCookie, setCookie } from "h3";
 import { useRuntimeConfig, useStorage } from "nitropack/runtime";
+import { refreshAuthorizationContext } from "./idp.js";
+export const AUTHORIZATION_TTL_MS = 12e4;
 function key(id) {
   return `session:${id}`;
 }
@@ -44,24 +46,55 @@ export async function readSessionRecordById(id) {
   const { auth: runtimeConfig } = useRuntimeConfig();
   return useStorage(runtimeConfig.sessionStorageBase).getItem(key(id));
 }
-export async function getServerAuthSession(event) {
-  const s = await readSessionRecord(event);
-  if (!s)
-    return null;
+export function toServerAuthSession(rec) {
   return {
-    sub: s.rec.sub,
-    email: s.rec.user.email,
-    name: s.rec.user.name,
-    picture: s.rec.user.picture,
-    systemRole: s.rec.systemRole,
-    abilities: s.rec.abilities,
-    organizations: s.rec.organizations,
-    activeOrg: s.rec.activeOrg,
-    entitlement: s.rec.entitlement,
-    isImpersonation: s.rec.isImpersonation,
-    impersonator: s.rec.impersonator
+    sub: rec.sub,
+    email: rec.user.email,
+    name: rec.user.name,
+    picture: rec.user.picture,
+    systemRole: rec.systemRole,
+    abilities: rec.abilities,
+    organizations: rec.organizations,
+    activeOrg: rec.activeOrg,
+    entitlement: rec.entitlement,
+    isImpersonation: rec.isImpersonation,
+    impersonator: rec.impersonator
   };
 }
+export async function getServerAuthSession(event) {
+  const session = await readSessionRecord(event);
+  return session ? toServerAuthSession(session.rec) : null;
+}
+export async function getFreshServerAuthSession(event, options = {}) {
+  const session = await readSessionRecord(event);
+  if (!session)
+    return null;
+  if (!options.force && Date.now() - session.rec.authorizationRefreshedAt <= AUTHORIZATION_TTL_MS)
+    return toServerAuthSession(session.rec);
+  try {
+    const context = await refreshAuthorizationContext(event, session.id, session.rec);
+    session.rec.activeOrg = context.organization.id;
+    session.rec.organizations = context.organizations;
+    session.rec.abilities = context.abilities;
+    session.rec.systemRole = context.systemRole;
+    session.rec.entitlement = context.entitlement;
+    session.rec.authorizationRefreshedAt = Date.now();
+    await writeSessionRecord(session.id, session.rec);
+    return toServerAuthSession(session.rec);
+  } catch (error) {
+    const status = error.statusCode ?? error.response?.status;
+    if (status === 401 || status === 403) {
+      session.rec.abilities = [];
+      session.rec.organizations = [];
+      session.rec.activeOrg = null;
+      session.rec.systemRole = null;
+      session.rec.authorizationRefreshedAt = Date.now();
+      await writeSessionRecord(session.id, session.rec);
+      throw createError({ statusCode: 403, statusMessage: "Authorization changed; sign in again" });
+    }
+    throw createError({ statusCode: 503, statusMessage: "Authorization service unavailable" });
+  }
+}
 export function toPublicSession(rec) {
   return {
     user: rec.user,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@thecodeorigin/auth",
   "type": "module",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "private": false,
   "description": "THECODEORIGIN Authentication Portal client module",
   "repository": "https://github.com/thecodeorigin/auth",
@@ -39,32 +39,8 @@
   "workspaces": [
     "playground"
   ],
-  "dependencies": {
-    "@casl/ability": "^6.8.1",
-    "@casl/vue": "^2.2.6",
-    "@nuxt/kit": "^4.4.8",
-    "defu": "^6.1.4",
-    "h3": "^1.14.0",
-    "ofetch": "^1.4.1",
-    "ufo": "^1.5.4",
-    "zod": "^4.3.6"
-  },
-  "devDependencies": {
-    "@nuxt/devtools": "^3.2.4",
-    "@nuxt/eslint-config": "^1.15.2",
-    "@nuxt/module-builder": "^1.0.2",
-    "@nuxt/schema": "^4.4.8",
-    "@nuxt/test-utils": "^4.0.3",
-    "@types/node": "latest",
-    "changelogen": "^0.6.2",
-    "eslint": "^10.4.1",
-    "nuxt": "^4.4.8",
-    "typescript": "~6.0.3",
-    "unbuild": "^3.6.1",
-    "vitest": "^4.1.8",
-    "vue-tsc": "^3.3.3"
-  },
   "scripts": {
+    "prepack": "nuxt-module-build build",
     "dev": "npm run dev:prepare && nuxt dev playground",
     "dev:build": "nuxt build playground",
     "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxt prepare playground",
@@ -72,5 +48,31 @@
     "test": "vitest run",
     "test:watch": "vitest watch",
     "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit"
+  },
+  "dependencies": {
+    "@casl/ability": "catalog:",
+    "@casl/vue": "catalog:",
+    "@nuxt/kit": "catalog:",
+    "defu": "catalog:",
+    "h3": "catalog:",
+    "ofetch": "catalog:",
+    "ufo": "catalog:",
+    "zod": "catalog:"
+  },
+  "devDependencies": {
+    "@antfu/eslint-config": "catalog:",
+    "@nuxt/devtools": "catalog:",
+    "@nuxt/eslint-config": "catalog:",
+    "@nuxt/module-builder": "catalog:",
+    "@nuxt/schema": "catalog:",
+    "@nuxt/test-utils": "catalog:",
+    "@types/node": "catalog:",
+    "changelogen": "catalog:",
+    "eslint": "catalog:",
+    "nuxt": "catalog:",
+    "typescript": "catalog:",
+    "unbuild": "catalog:",
+    "vitest": "catalog:",
+    "vue-tsc": "catalog:"
   }
-}
+}