nuxt-bearer-auth 0.1.0

package/dist/module.mjs

@@ -0,0 +1,222 @@
+import { defineNuxtModule, createResolver, installModule, addImports, addPlugin, addRouteMiddleware, addServerPlugin, addServerHandler } from '@nuxt/kit';
+import { defu } from 'defu';
+
+const defaultOptions = {
+  apiBaseUrl: "",
+  redisUrl: "redis://127.0.0.1:6379",
+  sessionSecret: "",
+  appEnv: process.env.APP_ENV || process.env.NODE_ENV || "development",
+  installCsurf: true,
+  endpoints: {
+    login: "auth/login",
+    socialLogin: "auth/social-login",
+    logout: "auth/logout",
+    me: "auth/account/me",
+    refresh: "auth/refresh",
+    forgotPassword: "auth/forgot-password",
+    resetPassword: "auth/reset-password",
+    verifyOtp: "auth/verify-otp",
+    resendOtp: "auth/resend-otp/:identifier",
+    register: "auth/register"
+  },
+  responsePaths: {
+    token: ["data.token", "token", "access_token", "data.access_token"],
+    refreshToken: [
+      "data.refreshToken",
+      "data.refresh_token",
+      "refreshToken",
+      "refresh_token"
+    ],
+    user: ["data.user", "user", "data", "$"],
+    userId: ["id", "uuid", "data.id", "data.uuid"],
+    message: ["message", "data.message"],
+    success: ["success", "status"],
+    code: ["code", "data.code"],
+    nextAction: ["next_action", "data.next_action", "nextAction"]
+  },
+  redirects: {
+    login: "/login",
+    authenticated: "/dashboard",
+    logout: "/",
+    unauthorized: "/auth/not-allowed"
+  },
+  routes: {
+    localApiPrefix: "/api/auth",
+    public: ["/", "/login", "/forgot-password", "/reset-password"],
+    authPages: ["/login", "/forgot-password", "/reset-password"],
+    protectedApiPrefixes: ["/api"],
+    publicApiPrefixes: [
+      "/api/auth/login",
+      "/api/auth/social-login",
+      "/api/auth/register",
+      "/api/auth/forgot-password",
+      "/api/auth/reset-password",
+      "/api/auth/otp-verification",
+      "/api/auth/resend-otp",
+      "/api/_csrf",
+      "/_nuxt",
+      "/__nuxt",
+      "/_ipx",
+      "/favicon.ico"
+    ],
+    middleware: true
+  },
+  sessionCookie: {
+    name: "nuxt_bearer_auth_session",
+    devName: "nuxt_bearer_auth_session_dev",
+    maxAge: 60 * 60 * 24 * 7,
+    sameSite: "lax",
+    secure: void 0,
+    path: "/"
+  },
+  csrf: {
+    enabled: true,
+    https: false,
+    cookieKey: "nuxt_bearer_auth_csrf",
+    devCookieKey: "nuxt_bearer_auth_csrf_dev",
+    headerName: "x-csrf-token",
+    methods: ["POST", "PUT", "PATCH", "DELETE"],
+    methodsToProtect: ["POST", "PUT", "PATCH", "DELETE"],
+    cookie: {
+      path: "/",
+      httpOnly: true,
+      sameSite: "strict"
+    }
+  },
+  verificationRequiredActions: ["verify_account", "verification_required"],
+  twoFactorRequiredActions: ["two_factor_required", "2fa_required"]
+};
+const module = defineNuxtModule({
+  meta: {
+    name: "nuxt-bearer-auth",
+    configKey: "bearerAuth",
+    compatibility: {
+      nuxt: "^3.12.0 || ^4.0.0"
+    }
+  },
+  defaults: defaultOptions,
+  async setup(moduleOptions, nuxt) {
+    const resolver = createResolver(import.meta.url);
+    const options = defu(moduleOptions, defaultOptions);
+    nuxt.options.runtimeConfig.bearerAuth = defu(
+      nuxt.options.runtimeConfig.bearerAuth,
+      {
+        apiBaseUrl: options.apiBaseUrl,
+        redisUrl: options.redisUrl,
+        sessionSecret: options.sessionSecret,
+        appEnv: options.appEnv,
+        endpoints: options.endpoints,
+        responsePaths: options.responsePaths,
+        sessionCookie: options.sessionCookie,
+        verificationRequiredActions: options.verificationRequiredActions,
+        twoFactorRequiredActions: options.twoFactorRequiredActions
+      }
+    );
+    nuxt.options.runtimeConfig.public.bearerAuth = defu(
+      nuxt.options.runtimeConfig.public.bearerAuth,
+      {
+        redirects: options.redirects,
+        routes: options.routes
+      }
+    );
+    if (options.installCsurf && options.csrf?.enabled) {
+      await installModule("nuxt-csurf", {
+        https: options.csrf.https,
+        cookieKey: options.appEnv === "local" || options.appEnv === "development" ? options.csrf.devCookieKey : options.csrf.cookieKey,
+        cookie: options.csrf.cookie,
+        methods: options.csrf.methods,
+        methodsToProtect: options.csrf.methodsToProtect,
+        encryptAlgorithm: "aes-256-cbc",
+        addCsrfTokenToEventCtx: true,
+        headerName: options.csrf.headerName
+      });
+    }
+    addImports([
+      {
+        name: "useBearerAuth",
+        from: resolver.resolve("runtime/composables/useBearerAuth")
+      },
+      {
+        name: "useBearerAuth",
+        as: "useAuth",
+        from: resolver.resolve("runtime/composables/useBearerAuth")
+      }
+    ]);
+    addPlugin(resolver.resolve("runtime/plugins/bearer-auth.server"));
+    if (options.routes?.middleware !== false) {
+      addRouteMiddleware({
+        name: "bearer-auth",
+        path: resolver.resolve("runtime/middleware/bearer-auth.global"),
+        global: true
+      });
+    }
+    addServerPlugin(resolver.resolve("runtime/server/plugins/redis"));
+    addServerHandler({
+      middleware: true,
+      handler: resolver.resolve("runtime/server/middleware/auth")
+    });
+    const prefix = options.routes?.localApiPrefix || "/api/auth";
+    addServerHandler({
+      route: `${prefix}/login`,
+      method: "post",
+      handler: resolver.resolve("runtime/server/api/auth/login.post")
+    });
+    addServerHandler({
+      route: `${prefix}/social-login`,
+      method: "post",
+      handler: resolver.resolve("runtime/server/api/auth/social-login.post")
+    });
+    addServerHandler({
+      route: `${prefix}/logout`,
+      method: "post",
+      handler: resolver.resolve("runtime/server/api/auth/logout.post")
+    });
+    addServerHandler({
+      route: `${prefix}/me`,
+      method: "get",
+      handler: resolver.resolve("runtime/server/api/auth/me.get")
+    });
+    addServerHandler({
+      route: `${prefix}/refresh`,
+      method: "post",
+      handler: resolver.resolve("runtime/server/api/auth/refresh.post")
+    });
+    addServerHandler({
+      route: `${prefix}/forgot-password`,
+      method: "post",
+      handler: resolver.resolve("runtime/server/api/auth/forgot-password.post")
+    });
+    addServerHandler({
+      route: `${prefix}/reset-password`,
+      method: "post",
+      handler: resolver.resolve("runtime/server/api/auth/reset-password.post")
+    });
+    addServerHandler({
+      route: `${prefix}/otp-verification`,
+      method: "post",
+      handler: resolver.resolve("runtime/server/api/auth/otp-verification.post")
+    });
+    addServerHandler({
+      route: `${prefix}/resend-otp/:identifier`,
+      method: "post",
+      handler: resolver.resolve("runtime/server/api/auth/resend-otp/[identifier].post")
+    });
+    addServerHandler({
+      route: `${prefix}/register`,
+      method: "post",
+      handler: resolver.resolve("runtime/server/api/auth/register.post")
+    });
+    addServerHandler({
+      route: `${prefix}/sessions`,
+      method: "get",
+      handler: resolver.resolve("runtime/server/api/auth/sessions.get")
+    });
+    addServerHandler({
+      route: `${prefix}/sessions/:id`,
+      method: "delete",
+      handler: resolver.resolve("runtime/server/api/auth/sessions/[id].delete")
+    });
+  }
+});
+
+export { module as default };

package/dist/runtime/composables/useBearerAuth.d.ts

@@ -0,0 +1,34 @@
+import type { BearerAuthUser, FetchUserOptions, LoginCredentials, SocialLoginCredentials } from "../types/auth.js";
+export declare function useBearerAuth<User extends BearerAuthUser = BearerAuthUser>(): {
+    user: any;
+    status: any;
+    ready: any;
+    error: any;
+    loading: any;
+    isAuthenticated: any;
+    serverReady: any;
+    login: (credentials: LoginCredentials, redirectPath?: string | null) => Promise<any>;
+    socialLogin: (credentials: SocialLoginCredentials, redirectPath?: string | null) => Promise<any>;
+    register: (payload: Record<string, unknown>, redirectPath?: string | null) => Promise<any>;
+    verifyOtp: (payload: Record<string, unknown>, redirectPath?: string | null) => Promise<any>;
+    fetchUser: (options?: FetchUserOptions) => Promise<{
+        data: User | null;
+        error: string | null;
+    } | {
+        data: any;
+        error: null;
+    } | {
+        data: null;
+        error: any;
+    }>;
+    refresh: () => Promise<any>;
+    logout: (destination?: string) => Promise<void>;
+    forgotPassword: (payload: Record<string, unknown>) => Promise<any>;
+    resetPassword: (payload: Record<string, unknown>) => Promise<any>;
+    resendOtp: (identifier: string, payload?: Record<string, unknown>) => Promise<any>;
+    setUser: (value: User | null) => void;
+    setAuthReady: (value: boolean) => void;
+    setServerChecked: () => void;
+    clearAuthState: () => void;
+};
+//# sourceMappingURL=useBearerAuth.d.ts.map

package/dist/runtime/composables/useBearerAuth.js

@@ -0,0 +1,259 @@
+let serverCheckPromise = null;
+let serverCheckResolve = null;
+async function authFetch(request, options = {}) {
+  try {
+    const csrf = typeof useCsrf === "function" ? useCsrf() : null;
+    const fetcher = csrf?.csrfFetch || $fetch;
+    return await fetcher(request, options);
+  } catch (error) {
+    throw error;
+  }
+}
+export function useBearerAuth() {
+  const config = useRuntimeConfig();
+  const publicAuth = config.public.bearerAuth;
+  const apiPrefix = publicAuth.routes.localApiPrefix || "/api/auth";
+  const user = useState("bearer-auth-user", () => null);
+  const status = useState("bearer-auth-status", () => "idle");
+  const ready = useState("bearer-auth-ready", () => false);
+  const error = useState("bearer-auth-error", () => null);
+  const serverChecked = useState("bearer-auth-server-checked", () => false);
+  const serverReady = computed(() => {
+    if (import.meta.client || serverChecked.value) {
+      return Promise.resolve();
+    }
+    if (!serverCheckPromise) {
+      serverCheckPromise = new Promise((resolve) => {
+        serverCheckResolve = resolve;
+      });
+    }
+    return serverCheckPromise;
+  });
+  const loading = computed(() => status.value === "loading");
+  const isAuthenticated = computed(() => status.value === "authenticated");
+  function resolveErrorMessage(err, fallback) {
+    if (err instanceof Error) return err.message;
+    if (typeof err === "object" && err !== null && "data" in err && typeof err.data === "object") {
+      const data = err.data;
+      return data?.message || data?.statusMessage || fallback;
+    }
+    return fallback;
+  }
+  async function completeAuthenticatedFlow(authenticatedUser, redirectPath) {
+    user.value = authenticatedUser || null;
+    status.value = authenticatedUser ? "authenticated" : "unauthenticated";
+    ready.value = true;
+    if (redirectPath !== null) {
+      await navigateTo(redirectPath || publicAuth.redirects.authenticated);
+    }
+  }
+  async function login(credentials, redirectPath) {
+    status.value = "loading";
+    error.value = null;
+    try {
+      const response = await authFetch(`${apiPrefix}/login`, {
+        method: "POST",
+        body: credentials
+      });
+      if (response.user && !response.nextAction) {
+        await completeAuthenticatedFlow(response.user, redirectPath);
+      } else {
+        user.value = response.user || null;
+        status.value = "unauthenticated";
+        ready.value = true;
+      }
+      return response;
+    } catch (err) {
+      error.value = resolveErrorMessage(err, "Login failed");
+      status.value = "unauthenticated";
+      ready.value = true;
+      throw err;
+    }
+  }
+  async function socialLogin(credentials, redirectPath) {
+    status.value = "loading";
+    error.value = null;
+    try {
+      const response = await authFetch(
+        `${apiPrefix}/social-login`,
+        {
+          method: "POST",
+          body: credentials
+        }
+      );
+      await completeAuthenticatedFlow(response.user || null, redirectPath);
+      return response;
+    } catch (err) {
+      error.value = resolveErrorMessage(err, "Social login failed");
+      status.value = "unauthenticated";
+      ready.value = true;
+      throw err;
+    }
+  }
+  async function register(payload, redirectPath) {
+    status.value = "loading";
+    error.value = null;
+    try {
+      const response = await authFetch(`${apiPrefix}/register`, {
+        method: "POST",
+        body: payload
+      });
+      if (response.user) {
+        await completeAuthenticatedFlow(response.user, redirectPath);
+      } else {
+        status.value = "unauthenticated";
+        ready.value = true;
+      }
+      return response;
+    } catch (err) {
+      error.value = resolveErrorMessage(err, "Registration failed");
+      status.value = "unauthenticated";
+      ready.value = true;
+      throw err;
+    }
+  }
+  async function verifyOtp(payload, redirectPath) {
+    status.value = "loading";
+    error.value = null;
+    try {
+      const response = await authFetch(
+        `${apiPrefix}/otp-verification`,
+        {
+          method: "POST",
+          body: payload
+        }
+      );
+      if (response.user) {
+        await completeAuthenticatedFlow(response.user, redirectPath);
+      } else {
+        status.value = "unauthenticated";
+        ready.value = true;
+      }
+      return response;
+    } catch (err) {
+      error.value = resolveErrorMessage(err, "OTP verification failed");
+      status.value = "unauthenticated";
+      ready.value = true;
+      throw err;
+    }
+  }
+  async function fetchUser(options = {}) {
+    if (status.value === "loading") {
+      return new Promise((resolve) => {
+        const unwatch = watch(status, (newStatus) => {
+          if (newStatus !== "loading") {
+            unwatch();
+            resolve({ data: user.value, error: error.value });
+          }
+        });
+      });
+    }
+    status.value = "loading";
+    error.value = null;
+    try {
+      const query = options.refresh ? "?refresh=true" : "";
+      const response = await authFetch(
+        `${apiPrefix}/me${query}`,
+        {
+          method: "GET"
+        }
+      );
+      user.value = response.user || null;
+      status.value = user.value ? "authenticated" : "unauthenticated";
+      ready.value = true;
+      return { data: user.value, error: null };
+    } catch (err) {
+      clearAuthState();
+      ready.value = true;
+      error.value = resolveErrorMessage(err, "Session expired");
+      return { data: null, error: error.value };
+    }
+  }
+  async function refresh() {
+    try {
+      const response = await authFetch(`${apiPrefix}/refresh`, {
+        method: "POST"
+      });
+      if (response.user) {
+        user.value = response.user;
+        status.value = "authenticated";
+      }
+      ready.value = true;
+      return response;
+    } catch (err) {
+      clearAuthState();
+      ready.value = true;
+      throw err;
+    }
+  }
+  async function logout(destination = publicAuth.redirects.logout) {
+    status.value = "loading";
+    error.value = null;
+    try {
+      await authFetch(`${apiPrefix}/logout`, { method: "POST" });
+    } finally {
+      clearAuthState();
+      ready.value = true;
+      await navigateTo(destination);
+    }
+  }
+  async function forgotPassword(payload) {
+    return await authFetch(`${apiPrefix}/forgot-password`, {
+      method: "POST",
+      body: payload
+    });
+  }
+  async function resetPassword(payload) {
+    return await authFetch(`${apiPrefix}/reset-password`, {
+      method: "POST",
+      body: payload
+    });
+  }
+  async function resendOtp(identifier, payload = {}) {
+    return await authFetch(`${apiPrefix}/resend-otp/${encodeURIComponent(identifier)}`, {
+      method: "POST",
+      body: payload
+    });
+  }
+  function setServerChecked() {
+    if (import.meta.server) {
+      serverChecked.value = true;
+      serverCheckResolve?.();
+    }
+  }
+  function setAuthReady(value) {
+    ready.value = value;
+  }
+  function setUser(value) {
+    user.value = value;
+    status.value = value ? "authenticated" : "unauthenticated";
+  }
+  function clearAuthState() {
+    user.value = null;
+    error.value = null;
+    status.value = "unauthenticated";
+  }
+  return {
+    user,
+    status,
+    ready,
+    error,
+    loading,
+    isAuthenticated,
+    serverReady,
+    login,
+    socialLogin,
+    register,
+    verifyOtp,
+    fetchUser,
+    refresh,
+    logout,
+    forgotPassword,
+    resetPassword,
+    resendOtp,
+    setUser,
+    setAuthReady,
+    setServerChecked,
+    clearAuthState
+  };
+}

package/dist/runtime/middleware/bearer-auth.global.d.ts

@@ -0,0 +1,3 @@
+declare const _default: any;
+export default _default;
+//# sourceMappingURL=bearer-auth.global.d.ts.map

package/dist/runtime/middleware/bearer-auth.global.js

@@ -0,0 +1,28 @@
+import { useBearerAuth } from "../composables/useBearerAuth.js";
+export default defineNuxtRouteMiddleware(async (to) => {
+  const config = useRuntimeConfig();
+  const publicAuth = config.public.bearerAuth;
+  const auth = useBearerAuth();
+  const isPublicRoute = publicAuth.routes.public.some((route) => {
+    return route === to.path || route !== "/" && to.path.startsWith(route);
+  });
+  const isAuthPage = publicAuth.routes.authPages.some((route) => {
+    return route === to.path || route !== "/" && to.path.startsWith(route);
+  });
+  if (import.meta.server) {
+    await auth.serverReady.value;
+  }
+  if (import.meta.client && !auth.ready.value) {
+    await auth.fetchUser();
+  }
+  if (auth.isAuthenticated.value && isAuthPage) {
+    const redirectPath = typeof to.query.redirect === "string" ? to.query.redirect : publicAuth.redirects.authenticated;
+    return navigateTo(redirectPath);
+  }
+  if (!auth.isAuthenticated.value && !isPublicRoute) {
+    return navigateTo({
+      path: publicAuth.redirects.login,
+      query: { redirect: to.fullPath }
+    });
+  }
+});

package/dist/runtime/plugins/bearer-auth.server.d.ts

@@ -0,0 +1,3 @@
+declare const _default: any;
+export default _default;
+//# sourceMappingURL=bearer-auth.server.d.ts.map

package/dist/runtime/plugins/bearer-auth.server.js

@@ -0,0 +1,26 @@
+import { getBearerAuthSession } from "../server/utils/sessions.js";
+import { useBearerAuth } from "../composables/useBearerAuth.js";
+export default defineNuxtPlugin(async (nuxtApp) => {
+  if (import.meta.client) return;
+  const event = nuxtApp.ssrContext?.event;
+  if (!event) return;
+  const auth = useBearerAuth();
+  try {
+    const session = await getBearerAuthSession(event);
+    auth.setUser(session?.profile || null);
+    nuxtApp.payload.bearerAuth = {
+      user: session?.profile || null,
+      status: session?.profile ? "authenticated" : "unauthenticated"
+    };
+  } catch (error) {
+    console.error("[nuxt-bearer-auth] SSR auth hydration failed:", error);
+    auth.clearAuthState();
+    nuxtApp.payload.bearerAuth = {
+      user: null,
+      status: "unauthenticated"
+    };
+  } finally {
+    auth.setAuthReady(true);
+    auth.setServerChecked();
+  }
+});

package/dist/runtime/server/api/auth/forgot-password.post.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<unknown>>;
+export default _default;
+//# sourceMappingURL=forgot-password.post.d.ts.map

package/dist/runtime/server/api/auth/forgot-password.post.js

@@ -0,0 +1,16 @@
+import { defineEventHandler, readBody } from "h3";
+import { callAuthApi, getAuthEndpoint } from "../../utils/external-api.js";
+import { toPublicError } from "../../utils/errors.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const body = await readBody(event);
+    const response = await callAuthApi(getAuthEndpoint("forgotPassword"), {
+      event,
+      method: "POST",
+      body
+    });
+    return response;
+  } catch (error) {
+    toPublicError(error, "Forgot password request failed");
+  }
+});

package/dist/runtime/server/api/auth/login.post.d.ts

@@ -0,0 +1,15 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    success: boolean;
+    code: string | number | undefined;
+    nextAction: string | undefined;
+    user: import("../../../types/auth").BearerAuthUser | null;
+    message: string | undefined;
+} | {
+    success: boolean;
+    user: import("../../../types/auth").BearerAuthUser | undefined;
+    message: string;
+    code?: undefined;
+    nextAction?: undefined;
+}>>;
+export default _default;
+//# sourceMappingURL=login.post.d.ts.map

package/dist/runtime/server/api/auth/login.post.js

@@ -0,0 +1,54 @@
+import { createError, defineEventHandler, readBody } from "h3";
+import { callAuthApi, getAuthEndpoint } from "../../utils/external-api.js";
+import { toPublicError } from "../../utils/errors.js";
+import {
+  normalizeAuthResponse,
+  requiresTwoFactor,
+  requiresVerification
+} from "../../utils/normalize.js";
+import { createBearerAuthSession } from "../../utils/sessions.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const body = await readBody(event);
+    if (!body.identifier || !body.password) {
+      throw createError({
+        statusCode: 422,
+        statusMessage: "Identifier and password are required"
+      });
+    }
+    const response = await callAuthApi(getAuthEndpoint("login"), {
+      event,
+      method: "POST",
+      body
+    });
+    const auth = normalizeAuthResponse(response);
+    if (requiresVerification(auth.nextAction) || requiresTwoFactor(auth.nextAction)) {
+      return {
+        success: true,
+        code: auth.code,
+        nextAction: auth.nextAction,
+        user: auth.user || null,
+        message: auth.message
+      };
+    }
+    if (!auth.token || !auth.userId) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: auth.message || "Authentication failed"
+      });
+    }
+    await createBearerAuthSession(event, {
+      userId: auth.userId,
+      token: auth.token,
+      refreshToken: auth.refreshToken,
+      profile: auth.user
+    });
+    return {
+      success: true,
+      user: auth.user,
+      message: auth.message || "Login successful"
+    };
+  } catch (error) {
+    toPublicError(error, "Login failed");
+  }
+});

package/dist/runtime/server/api/auth/logout.post.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    success: boolean;
+    message: string;
+}>>;
+export default _default;
+//# sourceMappingURL=logout.post.d.ts.map