@zitadel/sdk-nuxt 0.1.0-alpha.10 → 0.1.0-alpha.12

package/dist/{chunk-E7GMYXBM.js → chunk-AQZKZRKQ.js}

@@ -1,4 +1,5 @@
 // src/runtime/server/middleware.ts
+import { useRuntimeConfig } from "#imports";
 import {
   HOP_BY_HOP,
   INTERNAL_HEADERS,
@@ -17,12 +18,7 @@ import {
 } from "h3";
 
 // src/runtime/lib/jwt.ts
-import {
-  JWKS_TTL_MS,
-  base64UrlDecode,
-  decodeJwt,
-  verifyJwt
-} from "@zitadel/sdk-core/jwt";
+import { JWKS_TTL_MS, base64UrlDecode, decodeJwt, verifyJwt } from "@zitadel/sdk-core/jwt";
 
 // src/runtime/server/middleware.ts
 function buildUpstreamHeaders(event) {
@@ -38,10 +34,7 @@ function buildUpstreamHeaders(event) {
   const socketIp = event.node.req.socket?.remoteAddress;
   if (socketIp) {
     const existingXff = headers.get("x-forwarded-for");
-    headers.set(
-      "x-forwarded-for",
-      existingXff ? `${existingXff}, ${socketIp}` : socketIp
-    );
+    headers.set("x-forwarded-for", existingXff ? `${existingXff}, ${socketIp}` : socketIp);
   }
   if (!headers.has("x-forwarded-host")) {
     headers.set("x-forwarded-host", url.host);
@@ -64,8 +57,7 @@ function createNextgenMiddleware(options = {}) {
     allowedTokenTypes = ["JWT", "at+JWT"],
     jwksTimeoutMs,
     proxyTimeoutMs = 5e3,
-    opaqueTokenTimeoutMs = 5e3,
-    onExchangeResponse
+    opaqueTokenTimeoutMs = 5e3
   } = options;
   if (!loginPath.startsWith("/") || loginPath.startsWith("//")) {
     throw new Error(
@@ -80,14 +72,7 @@ function createNextgenMiddleware(options = {}) {
       return;
     }
     if (pathname === proxyPath || pathname.startsWith(`${proxyPath}/`)) {
-      return proxyRequest(
-        event,
-        url,
-        proxyPath,
-        urlObj,
-        proxyTimeoutMs,
-        onExchangeResponse
-      );
+      return proxyRequest(event, url, proxyPath, urlObj, proxyTimeoutMs);
     }
     return handleAuth(event, {
       url,
@@ -103,7 +88,7 @@ function createNextgenMiddleware(options = {}) {
     });
   });
 }
-async function proxyRequest(event, authUrl, proxyPath, url, proxyTimeoutMs, onExchangeResponse) {
+async function proxyRequest(event, authUrl, proxyPath, url, proxyTimeoutMs) {
   const suffix = url.pathname.slice(proxyPath.length);
   const target = `${authUrl}${suffix}${url.search}`;
   const method = event.node.req.method ?? "GET";
@@ -111,11 +96,11 @@ async function proxyRequest(event, authUrl, proxyPath, url, proxyTimeoutMs, onEx
   const rawBody = hasBody ? await readRawBody(event, false) : void 0;
   const body = rawBody != null ? new Uint8Array(rawBody) : void 0;
   const upstreamHeaders = buildUpstreamHeaders(event);
-  const isExchangeRequest = method === "POST" && suffix.startsWith("/sessions/exchange");
-  if (isExchangeRequest && !upstreamHeaders.has("authorization")) {
-    const projectId = url.searchParams.get("project_id");
-    if (projectId) {
-      upstreamHeaders.set("authorization", `Bearer sk_${projectId}`);
+  if (!upstreamHeaders.has("authorization")) {
+    const config = useRuntimeConfig();
+    const projectSecret = config.nextgen?.projectSecret;
+    if (projectSecret) {
+      upstreamHeaders.set("authorization", `Bearer ${projectSecret}`);
     }
   }
   const upstream = await fetch(target, {
@@ -130,14 +115,10 @@ async function proxyRequest(event, authUrl, proxyPath, url, proxyTimeoutMs, onEx
   for (const cookie of setCookieHeaders) {
     responseHeaders.append("set-cookie", cookie);
   }
-  let response = new Response(upstream.body, {
+  const response = new Response(upstream.body, {
     status: upstream.status,
     headers: responseHeaders
   });
-  const isExchange = method === "POST" && suffix.startsWith("/sessions/exchange");
-  if (isExchange && onExchangeResponse) {
-    response = await onExchangeResponse(response);
-  }
   event.node.res.statusCode = response.status;
   for (const [key, value] of response.headers.entries()) {
     if (key.toLowerCase() === "set-cookie") continue;
@@ -154,9 +135,7 @@ function isJwtShaped(token) {
   const parts = token.split(".");
   if (parts.length < 3 || !parts[0]) return false;
   try {
-    const header = JSON.parse(
-      DECODER.decode(base64UrlDecode(parts[0]))
-    );
+    const header = JSON.parse(DECODER.decode(base64UrlDecode(parts[0])));
     return typeof header?.alg === "string" && !("enc" in header);
   } catch {
     return false;
@@ -215,11 +194,7 @@ async function handleAuth(event, opts) {
     return;
   }
   if (!payload && cookieToken && !isJwtShaped(cookieToken)) {
-    const opaqueResult = await validateOpaqueSessionToken(
-      cookieToken,
-      url,
-      opaqueTokenTimeoutMs
-    );
+    const opaqueResult = await validateOpaqueSessionToken(cookieToken, url, opaqueTokenTimeoutMs);
     if (opaqueResult) {
       event.context.nextgenAuth = {
         isAuthenticated: true,

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { ZitadelLogin, ZitadelLogout } from '@zitadel/components';
 export { createNextgenMiddleware, getAuth } from './runtime/server/middleware.js';
 import { ZitadelProject } from '@zitadel/api/config';
 export { ClientAuthResult } from './runtime/types.js';
-export { AuthResult, NextgenMiddlewareOptions } from '@zitadel/sdk-core/types';
+export { AuthResult, NextgenMiddlewareOptions } from '@zitadel/sdk-core/middleware';
 import 'h3';
 
 /**

package/dist/index.js

@@ -2,7 +2,7 @@ import "./chunk-ZNXAFGLP.js";
 import {
   createNextgenMiddleware,
   getAuth
-} from "./chunk-E7GMYXBM.js";
+} from "./chunk-AQZKZRKQ.js";
 
 // src/index.ts
 import { ZitadelLogin, ZitadelLogout } from "@zitadel/components";

package/dist/module.js

@@ -6,6 +6,27 @@ import {
   addImportsDir,
   createResolver
 } from "@nuxt/kit";
+import { existsSync, readFileSync } from "fs";
+import { resolve as resolvePath } from "path";
+function loadProjectSecret(rootDir) {
+  if (process.env.ZITADEL_PROJECT_SECRET) {
+    return process.env.ZITADEL_PROJECT_SECRET;
+  }
+  const path = resolvePath(rootDir, ".env.local");
+  if (!existsSync(path)) {
+    return void 0;
+  }
+  for (const line of readFileSync(path, "utf8").split(/\r?\n/)) {
+    const match = line.match(/^\s*(?:export\s+)?ZITADEL_PROJECT_SECRET\s*=\s*(.*)$/);
+    if (match && match[1] !== void 0) {
+      const raw = match[1].trim();
+      const quoted = raw.match(/^(['"])(.*)\1\s*(?:#.*)?$/);
+      const value = quoted ? quoted[2] : raw.replace(/\s+#.*$/, "").trim();
+      return value === "" ? void 0 : value;
+    }
+  }
+  return void 0;
+}
 var module_default = defineNuxtModule({
   meta: {
     name: "@zitadel/sdk-nuxt",
@@ -23,7 +44,12 @@ var module_default = defineNuxtModule({
       url: options.url ?? "http://localhost:4000",
       loginPath: options.loginPath ?? "/login",
       protectedRoutes: options.protectedRoutes ?? [],
-      jwtKey: options.jwtKey
+      jwtKey: options.jwtKey,
+      // Server-only — never exposed to the client. Override at deploy time via
+      // `NUXT_NEXTGEN_PROJECT_SECRET`. Left undefined when the env var (and
+      // `.env.local`) provide no value, so the middleware surfaces a missing
+      // bearer instead of silently sending an empty one.
+      projectSecret: loadProjectSecret(nuxt.options.rootDir)
     };
     nuxt.options.runtimeConfig.public.zitadelProxyPath = options.proxyPath ?? "/__nextgen";
     nuxt.options.runtimeConfig.public.nextgenProxyPath = options.proxyPath ?? "/__nextgen";

package/dist/runtime/plugin.js

@@ -1,10 +1,5 @@
 // src/runtime/plugin.ts
-import {
-  defineNuxtPlugin,
-  useRequestEvent,
-  useRuntimeConfig,
-  useState
-} from "#imports";
+import { defineNuxtPlugin, useRequestEvent, useRuntimeConfig, useState } from "#imports";
 import { configureZitadel } from "@zitadel/api/config";
 var plugin_default = defineNuxtPlugin(() => {
   const event = useRequestEvent();

package/dist/runtime/server/handler.js

@@ -1,6 +1,6 @@
 import {
   createNextgenMiddleware
-} from "../../chunk-E7GMYXBM.js";
+} from "../../chunk-AQZKZRKQ.js";
 
 // src/runtime/server/handler.ts
 import { useRuntimeConfig } from "#imports";

package/dist/runtime/server/middleware.d.ts

@@ -1,7 +1,7 @@
-import { AuthResult, NextgenMiddlewareOptions } from '@zitadel/sdk-core/types';
+import { AuthResult, NextgenMiddlewareOptions } from '@zitadel/sdk-core/middleware';
 import { EventHandler, H3Event } from 'h3';
 
-declare module 'h3' {
+declare module "h3" {
     interface H3EventContext {
         nextgenAuth: AuthResult;
     }

package/dist/runtime/server/middleware.js

@@ -1,7 +1,7 @@
 import {
   createNextgenMiddleware,
   getAuth
-} from "../../chunk-E7GMYXBM.js";
+} from "../../chunk-AQZKZRKQ.js";
 export {
   createNextgenMiddleware,
   getAuth

package/dist/runtime/types.d.ts

@@ -1,5 +1,5 @@
-import { UnauthState } from '@zitadel/sdk-core/types';
-export { AuthResult, AuthState, NextgenMiddlewareOptions, NextgenSession, UnauthState } from '@zitadel/sdk-core/types';
+import { UnauthState } from '@zitadel/sdk-core/middleware';
+export { AuthResult, AuthState, NextgenMiddlewareOptions, NextgenSession, UnauthState } from '@zitadel/sdk-core/middleware';
 
 /**
  * Re-exports shared SDK types from `@zitadel/sdk-core`.

package/dist/server.d.ts

@@ -1,3 +1,3 @@
 export { createNextgenMiddleware, getAuth } from './runtime/server/middleware.js';
-import '@zitadel/sdk-core/types';
+import '@zitadel/sdk-core/middleware';
 import 'h3';

package/dist/server.js

@@ -2,7 +2,7 @@ import "./chunk-ZNXAFGLP.js";
 import {
   createNextgenMiddleware,
   getAuth
-} from "./chunk-E7GMYXBM.js";
+} from "./chunk-AQZKZRKQ.js";
 export {
   createNextgenMiddleware,
   getAuth

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zitadel/sdk-nuxt",
-  "version": "0.1.0-alpha.10",
+  "version": "0.1.0-alpha.12",
   "description": "Nuxt proxy middleware and helpers for Nextgen Auth",
   "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/sdk-nuxt#readme",
   "bugs": {
@@ -33,9 +33,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@zitadel/api": "0.1.0-alpha.10",
-    "@zitadel/components": "0.1.0-alpha.10",
-    "@zitadel/sdk-core": "0.1.0-alpha.10"
+    "@zitadel/api": "0.1.0-alpha.12",
+    "@zitadel/sdk-core": "0.1.0-alpha.12",
+    "@zitadel/components": "0.1.0-alpha.12"
   },
   "peerDependencies": {
     "h3": ">=1",