@zitadel/sdk-nuxt 0.0.0 → 0.1.0-alpha.2

package/dist/{chunk-J2P7YNGG.js → chunk-E7GMYXBM.js}

@@ -64,6 +64,7 @@ function createNextgenMiddleware(options = {}) {
     allowedTokenTypes = ["JWT", "at+JWT"],
     jwksTimeoutMs,
     proxyTimeoutMs = 5e3,
+    opaqueTokenTimeoutMs = 5e3,
     onExchangeResponse
   } = options;
   if (!loginPath.startsWith("/") || loginPath.startsWith("//")) {
@@ -97,6 +98,7 @@ function createNextgenMiddleware(options = {}) {
       audience,
       allowedTokenTypes,
       jwksTimeoutMs,
+      opaqueTokenTimeoutMs,
       pathname
     });
   });
@@ -108,9 +110,17 @@ async function proxyRequest(event, authUrl, proxyPath, url, proxyTimeoutMs, onEx
   const hasBody = !["GET", "HEAD"].includes(method);
   const rawBody = hasBody ? await readRawBody(event, false) : void 0;
   const body = rawBody != null ? new Uint8Array(rawBody) : void 0;
+  const upstreamHeaders = buildUpstreamHeaders(event);
+  const isExchangeRequest = method === "POST" && suffix.startsWith("/sessions/exchange");
+  if (isExchangeRequest && !upstreamHeaders.has("authorization")) {
+    const projectId = url.searchParams.get("project_id");
+    if (projectId) {
+      upstreamHeaders.set("authorization", `Bearer sk_${projectId}`);
+    }
+  }
   const upstream = await fetch(target, {
     method,
-    headers: buildUpstreamHeaders(event),
+    headers: upstreamHeaders,
     body,
     redirect: "manual",
     signal: AbortSignal.timeout(proxyTimeoutMs)
@@ -139,6 +149,33 @@ async function proxyRequest(event, authUrl, proxyPath, url, proxyTimeoutMs, onEx
   }
   return response.body;
 }
+var DECODER = new TextDecoder();
+function isJwtShaped(token) {
+  const parts = token.split(".");
+  if (parts.length < 3 || !parts[0]) return false;
+  try {
+    const header = JSON.parse(
+      DECODER.decode(base64UrlDecode(parts[0]))
+    );
+    return typeof header?.alg === "string" && !("enc" in header);
+  } catch {
+    return false;
+  }
+}
+async function validateOpaqueSessionToken(token, issuerUrl, timeoutMs) {
+  try {
+    const res = await fetch(`${issuerUrl}/sessions/me`, {
+      method: "GET",
+      headers: { cookie: `__nextgen_session=${token}` },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return { userId: body.user_id };
+  } catch {
+    return null;
+  }
+}
 async function handleAuth(event, opts) {
   const {
     url,
@@ -149,6 +186,7 @@ async function handleAuth(event, opts) {
     audience,
     allowedTokenTypes,
     jwksTimeoutMs,
+    opaqueTokenTimeoutMs,
     pathname
   } = opts;
   delete event.node.req.headers["x-nextgen-auth-token"];
@@ -176,6 +214,25 @@ async function handleAuth(event, opts) {
     };
     return;
   }
+  if (!payload && cookieToken && !isJwtShaped(cookieToken)) {
+    const opaqueResult = await validateOpaqueSessionToken(
+      cookieToken,
+      url,
+      opaqueTokenTimeoutMs
+    );
+    if (opaqueResult) {
+      event.context.nextgenAuth = {
+        isAuthenticated: true,
+        session: {
+          userId: opaqueResult.userId ?? "unknown",
+          email: null,
+          name: null,
+          token: cookieToken
+        }
+      };
+      return;
+    }
+  }
   event.context.nextgenAuth = { isAuthenticated: false, session: null };
   for (const name of Object.keys(parseCookies(event))) {
     if (name.startsWith("__nextgen")) {

package/dist/index.js

@@ -2,7 +2,7 @@ import "./chunk-ZNXAFGLP.js";
 import {
   createNextgenMiddleware,
   getAuth
-} from "./chunk-J2P7YNGG.js";
+} from "./chunk-E7GMYXBM.js";
 
 // src/index.ts
 import { ZitadelLogin, ZitadelLogout } from "@zitadel/components";

package/dist/runtime/server/handler.js

@@ -1,6 +1,6 @@
 import {
   createNextgenMiddleware
-} from "../../chunk-J2P7YNGG.js";
+} from "../../chunk-E7GMYXBM.js";
 
 // src/runtime/server/handler.ts
 var config = useRuntimeConfig();

package/dist/runtime/server/middleware.js

@@ -1,7 +1,7 @@
 import {
   createNextgenMiddleware,
   getAuth
-} from "../../chunk-J2P7YNGG.js";
+} from "../../chunk-E7GMYXBM.js";
 export {
   createNextgenMiddleware,
   getAuth

package/dist/server.js

@@ -2,7 +2,7 @@ import "./chunk-ZNXAFGLP.js";
 import {
   createNextgenMiddleware,
   getAuth
-} from "./chunk-J2P7YNGG.js";
+} from "./chunk-E7GMYXBM.js";
 export {
   createNextgenMiddleware,
   getAuth

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zitadel/sdk-nuxt",
-  "version": "0.0.0",
+  "version": "0.1.0-alpha.2",
   "description": "Nuxt proxy middleware and helpers for Nextgen Auth",
   "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/sdk-nuxt#readme",
   "bugs": {
@@ -33,9 +33,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@zitadel/api": "0.0.0",
-    "@zitadel/components": "0.0.0",
-    "@zitadel/sdk-core": "0.0.0"
+    "@zitadel/api": "0.1.0-alpha.2",
+    "@zitadel/components": "0.1.0-alpha.2",
+    "@zitadel/sdk-core": "0.1.0-alpha.2"
   },
   "peerDependencies": {
     "h3": ">=1",