nuxt-bearer-auth 0.1.0

package/dist/runtime/server/api/auth/logout.post.js

@@ -0,0 +1,20 @@
+import { callAuthApi, getAuthEndpoint } from "../../utils/external-api.js";
+import { destroyBearerAuthSession } from "../../utils/sessions.js";
+import { defineEventHandler } from "h3";
+export default defineEventHandler(async (event) => {
+  try {
+    await callAuthApi(getAuthEndpoint("logout"), {
+      event,
+      method: "POST",
+      body: {}
+    });
+  } catch (error) {
+    console.warn("[nuxt-bearer-auth] Remote logout failed:", error);
+  } finally {
+    await destroyBearerAuthSession(event);
+  }
+  return {
+    success: true,
+    message: "Logged out successfully"
+  };
+});

package/dist/runtime/server/api/auth/me.get.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    user: import("../../../types/auth").BearerAuthUser;
+}>>;
+export default _default;
+//# sourceMappingURL=me.get.d.ts.map

package/dist/runtime/server/api/auth/me.get.js

@@ -0,0 +1,37 @@
+import { createError, defineEventHandler, getQuery } from "h3";
+import { callAuthApi, getAuthEndpoint } from "../../utils/external-api.js";
+import { toPublicError } from "../../utils/errors.js";
+import { normalizeAuthResponse } from "../../utils/normalize.js";
+import {
+  requireBearerAuthSession,
+  updateBearerAuthSession
+} from "../../utils/sessions.js";
+export default defineEventHandler(async (event) => {
+  const session = requireBearerAuthSession(event);
+  const query = getQuery(event);
+  const forceRefresh = query.refresh === "true" || query.refresh === "1";
+  if (!forceRefresh && session.profile) {
+    return {
+      user: session.profile
+    };
+  }
+  try {
+    const response = await callAuthApi(getAuthEndpoint("me"), {
+      event,
+      method: "GET"
+    });
+    const auth = normalizeAuthResponse(response);
+    if (!auth.user) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: auth.message || "User unauthenticated"
+      });
+    }
+    await updateBearerAuthSession(event, { profile: auth.user });
+    return {
+      user: auth.user
+    };
+  } catch (error) {
+    toPublicError(error, "Fetching authenticated user failed");
+  }
+});

package/dist/runtime/server/api/auth/otp-verification.post.d.ts

@@ -0,0 +1,8 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    success: boolean;
+    user: import("../../../types/auth").BearerAuthUser | null;
+    message: string;
+    data: unknown;
+}>>;
+export default _default;
+//# sourceMappingURL=otp-verification.post.d.ts.map

package/dist/runtime/server/api/auth/otp-verification.post.js

@@ -0,0 +1,38 @@
+import { createError, defineEventHandler, readBody } from "h3";
+import { callAuthApi, getAuthEndpoint } from "../../utils/external-api.js";
+import { toPublicError } from "../../utils/errors.js";
+import { normalizeAuthResponse } from "../../utils/normalize.js";
+import { createBearerAuthSession } from "../../utils/sessions.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const body = await readBody(event);
+    if (!body.otp || !body.identifier) {
+      throw createError({
+        statusCode: 422,
+        statusMessage: "OTP and identifier are required"
+      });
+    }
+    const response = await callAuthApi(getAuthEndpoint("verifyOtp"), {
+      event,
+      method: "POST",
+      body
+    });
+    const auth = normalizeAuthResponse(response);
+    if (auth.token && auth.userId) {
+      await createBearerAuthSession(event, {
+        userId: auth.userId,
+        token: auth.token,
+        refreshToken: auth.refreshToken,
+        profile: auth.user
+      });
+    }
+    return {
+      success: true,
+      user: auth.user || null,
+      message: auth.message || "OTP verified successfully",
+      data: response
+    };
+  } catch (error) {
+    toPublicError(error, "OTP verification failed");
+  }
+});

package/dist/runtime/server/api/auth/refresh.post.d.ts

@@ -0,0 +1,7 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    success: boolean;
+    user: import("../../../types/auth").BearerAuthUser | null;
+    message: string;
+}>>;
+export default _default;
+//# sourceMappingURL=refresh.post.d.ts.map

package/dist/runtime/server/api/auth/refresh.post.js

@@ -0,0 +1,37 @@
+import { callAuthApi, getAuthEndpoint } from "../../utils/external-api.js";
+import { toPublicError } from "../../utils/errors.js";
+import { normalizeAuthResponse } from "../../utils/normalize.js";
+import {
+  requireBearerAuthSession,
+  updateBearerAuthSession
+} from "../../utils/sessions.js";
+import { createError, defineEventHandler } from "h3";
+export default defineEventHandler(async (event) => {
+  const session = requireBearerAuthSession(event);
+  try {
+    const response = await callAuthApi(getAuthEndpoint("refresh"), {
+      event,
+      method: "POST",
+      body: session.refreshToken ? { refresh_token: session.refreshToken, refreshToken: session.refreshToken } : {}
+    });
+    const auth = normalizeAuthResponse(response);
+    if (!auth.token) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: auth.message || "Token refresh failed"
+      });
+    }
+    await updateBearerAuthSession(event, {
+      token: auth.token,
+      refreshToken: auth.refreshToken || session.refreshToken,
+      profile: auth.user || session.profile
+    });
+    return {
+      success: true,
+      user: auth.user || session.profile,
+      message: auth.message || "Session refreshed"
+    };
+  } catch (error) {
+    toPublicError(error, "Refreshing session failed");
+  }
+});

package/dist/runtime/server/api/auth/register.post.d.ts

@@ -0,0 +1,8 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    success: boolean;
+    user: import("../../../types/auth").BearerAuthUser | null;
+    message: string;
+    data: unknown;
+}>>;
+export default _default;
+//# sourceMappingURL=register.post.d.ts.map

package/dist/runtime/server/api/auth/register.post.js

@@ -0,0 +1,32 @@
+import { defineEventHandler, readBody } from "h3";
+import { callAuthApi, getAuthEndpoint } from "../../utils/external-api.js";
+import { toPublicError } from "../../utils/errors.js";
+import { normalizeAuthResponse } from "../../utils/normalize.js";
+import { createBearerAuthSession } from "../../utils/sessions.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const body = await readBody(event);
+    const response = await callAuthApi(getAuthEndpoint("register"), {
+      event,
+      method: "POST",
+      body
+    });
+    const auth = normalizeAuthResponse(response);
+    if (auth.token && auth.userId) {
+      await createBearerAuthSession(event, {
+        userId: auth.userId,
+        token: auth.token,
+        refreshToken: auth.refreshToken,
+        profile: auth.user
+      });
+    }
+    return {
+      success: auth.success,
+      user: auth.user || null,
+      message: auth.message || "Registration successful",
+      data: response
+    };
+  } catch (error) {
+    toPublicError(error, "Registration failed");
+  }
+});

package/dist/runtime/server/api/auth/resend-otp/[identifier].post.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<unknown>>;
+export default _default;
+//# sourceMappingURL=%5Bidentifier%5D.post.d.ts.map

package/dist/runtime/server/api/auth/resend-otp/[identifier].post.js

@@ -0,0 +1,21 @@
+import { defineEventHandler, getRouterParam, readBody } from "h3";
+import { callAuthApi, getAuthEndpoint } from "../../../utils/external-api.js";
+import { toPublicError } from "../../../utils/errors.js";
+import { interpolatePath } from "../../../utils/paths.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const identifier = getRouterParam(event, "identifier");
+    const body = await readBody(event).catch(() => ({}));
+    const endpoint = interpolatePath(getAuthEndpoint("resendOtp"), {
+      identifier
+    });
+    const response = await callAuthApi(endpoint, {
+      event,
+      method: "POST",
+      body
+    });
+    return response;
+  } catch (error) {
+    toPublicError(error, "Resending OTP failed");
+  }
+});

package/dist/runtime/server/api/auth/reset-password.post.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<unknown>>;
+export default _default;
+//# sourceMappingURL=reset-password.post.d.ts.map

package/dist/runtime/server/api/auth/reset-password.post.js

@@ -0,0 +1,16 @@
+import { defineEventHandler, readBody } from "h3";
+import { callAuthApi, getAuthEndpoint } from "../../utils/external-api.js";
+import { toPublicError } from "../../utils/errors.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const body = await readBody(event);
+    const response = await callAuthApi(getAuthEndpoint("resetPassword"), {
+      event,
+      method: "POST",
+      body
+    });
+    return response;
+  } catch (error) {
+    toPublicError(error, "Reset password request failed");
+  }
+});

package/dist/runtime/server/api/auth/sessions/[id].delete.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    success: boolean;
+    message: string;
+}>>;
+export default _default;
+//# sourceMappingURL=%5Bid%5D.delete.d.ts.map

package/dist/runtime/server/api/auth/sessions/[id].delete.js

@@ -0,0 +1,20 @@
+import { createError, defineEventHandler, getRouterParam } from "h3";
+import {
+  deleteUserBearerAuthSession,
+  requireBearerAuthSession
+} from "../../../utils/sessions.js";
+export default defineEventHandler(async (event) => {
+  const session = requireBearerAuthSession(event);
+  const sessionId = getRouterParam(event, "id");
+  if (!sessionId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Session ID is required"
+    });
+  }
+  await deleteUserBearerAuthSession(session.userId, sessionId);
+  return {
+    success: true,
+    message: "Session terminated"
+  };
+});

package/dist/runtime/server/api/auth/sessions.get.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    sessions: import("../../../types/auth").PublicSession[];
+}>>;
+export default _default;
+//# sourceMappingURL=sessions.get.d.ts.map

package/dist/runtime/server/api/auth/sessions.get.js

@@ -0,0 +1,11 @@
+import {
+  getUserBearerAuthSessions,
+  requireBearerAuthSession
+} from "../../utils/sessions.js";
+import { defineEventHandler } from "h3";
+export default defineEventHandler(async (event) => {
+  const session = requireBearerAuthSession(event);
+  return {
+    sessions: await getUserBearerAuthSessions(session.userId)
+  };
+});

package/dist/runtime/server/api/auth/social-login.post.d.ts

@@ -0,0 +1,7 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    success: boolean;
+    user: import("../../../types/auth").BearerAuthUser | undefined;
+    message: string;
+}>>;
+export default _default;
+//# sourceMappingURL=social-login.post.d.ts.map

package/dist/runtime/server/api/auth/social-login.post.js

@@ -0,0 +1,41 @@
+import { createError, defineEventHandler, readBody } from "h3";
+import { callAuthApi, getAuthEndpoint } from "../../utils/external-api.js";
+import { toPublicError } from "../../utils/errors.js";
+import { normalizeAuthResponse } from "../../utils/normalize.js";
+import { createBearerAuthSession } from "../../utils/sessions.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const body = await readBody(event);
+    if (!body.jwt && !body.token && !body.accessToken) {
+      throw createError({
+        statusCode: 422,
+        statusMessage: "Provider token is required"
+      });
+    }
+    const response = await callAuthApi(getAuthEndpoint("socialLogin"), {
+      event,
+      method: "POST",
+      body
+    });
+    const auth = normalizeAuthResponse(response);
+    if (!auth.token || !auth.userId) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: auth.message || "Social login failed"
+      });
+    }
+    await createBearerAuthSession(event, {
+      userId: auth.userId,
+      token: auth.token,
+      refreshToken: auth.refreshToken,
+      profile: auth.user
+    });
+    return {
+      success: true,
+      user: auth.user,
+      message: auth.message || "Login successful"
+    };
+  } catch (error) {
+    toPublicError(error, "Social login failed");
+  }
+});

package/dist/runtime/server/middleware/auth.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;
+//# sourceMappingURL=auth.d.ts.map

package/dist/runtime/server/middleware/auth.js

@@ -0,0 +1,29 @@
+import { createError, defineEventHandler, getRequestURL } from "h3";
+import { getBearerAuthSession } from "../utils/sessions.js";
+const SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig();
+  const publicConfig = config.public.bearerAuth;
+  const path = getRequestURL(event).pathname;
+  const method = event.method.toUpperCase();
+  const isProtectedApi = publicConfig.routes.protectedApiPrefixes.some(
+    (prefix) => path.startsWith(prefix)
+  );
+  const isPublicApi = publicConfig.routes.publicApiPrefixes.some(
+    (prefix) => path.startsWith(prefix)
+  );
+  if (isPublicApi || !isProtectedApi && SAFE_METHODS.has(method)) {
+    return;
+  }
+  const session = await getBearerAuthSession(event);
+  if (session) {
+    event.context.auth = session;
+    return;
+  }
+  if (isProtectedApi) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Authentication required"
+    });
+  }
+});

package/dist/runtime/server/plugins/redis.d.ts

@@ -0,0 +1,3 @@
+declare const _default: any;
+export default _default;
+//# sourceMappingURL=redis.d.ts.map

package/dist/runtime/server/plugins/redis.js

@@ -0,0 +1,23 @@
+import {
+  ensureBearerAuthRedisConnection,
+  getBearerAuthRedisClient
+} from "../utils/sessions.js";
+import { isProductionRuntime } from "../utils/config.js";
+export default defineNitroPlugin(async () => {
+  try {
+    await ensureBearerAuthRedisConnection();
+  } catch (error) {
+    console.error("[nuxt-bearer-auth] Redis connection failed:", error);
+  }
+  if (isProductionRuntime()) {
+    const cleanup = async () => {
+      try {
+        await getBearerAuthRedisClient().quit();
+      } catch (error) {
+        console.error("[nuxt-bearer-auth] Redis cleanup failed:", error);
+      }
+    };
+    process.once("SIGTERM", cleanup);
+    process.once("SIGINT", cleanup);
+  }
+});

package/dist/runtime/server/utils/config.d.ts

@@ -0,0 +1,16 @@
+import type { BearerAuthCookieOptions, BearerAuthEndpointOptions, BearerAuthResponsePaths } from "../../../types.js";
+export interface RuntimeBearerAuthConfig {
+    apiBaseUrl: string;
+    redisUrl: string;
+    appEnv: string;
+    endpoints: BearerAuthEndpointOptions;
+    responsePaths: BearerAuthResponsePaths;
+    sessionCookie: BearerAuthCookieOptions;
+    verificationRequiredActions: string[];
+    twoFactorRequiredActions: string[];
+}
+export declare function getBearerAuthConfig(): RuntimeBearerAuthConfig;
+export declare function requireApiBaseUrl(): string;
+export declare function getSessionCookieName(): string;
+export declare function isProductionRuntime(): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/runtime/server/utils/config.js

@@ -0,0 +1,24 @@
+import { createError } from "h3";
+export function getBearerAuthConfig() {
+  const config = useRuntimeConfig();
+  return config.bearerAuth;
+}
+export function requireApiBaseUrl() {
+  const config = getBearerAuthConfig();
+  if (!config.apiBaseUrl) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: "bearerAuth.apiBaseUrl is required to proxy authentication requests."
+    });
+  }
+  return config.apiBaseUrl;
+}
+export function getSessionCookieName() {
+  const config = getBearerAuthConfig();
+  const isDev = config.appEnv === "local" || config.appEnv === "development" || process.env.NODE_ENV !== "production";
+  return isDev ? config.sessionCookie.devName || config.sessionCookie.name : config.sessionCookie.name;
+}
+export function isProductionRuntime() {
+  const config = getBearerAuthConfig();
+  return config.appEnv === "production" || process.env.NODE_ENV === "production";
+}

package/dist/runtime/server/utils/errors.d.ts

@@ -0,0 +1,2 @@
+export declare function toPublicError(error: unknown, fallback?: string): never;
+//# sourceMappingURL=errors.d.ts.map

package/dist/runtime/server/utils/errors.js

@@ -0,0 +1,20 @@
+import { FetchError } from "ofetch";
+import { createError } from "h3";
+export function toPublicError(error, fallback = "Request failed") {
+  if (error instanceof FetchError) {
+    const statusCode = error.response?.status || error.statusCode || 500;
+    const data = error.response?._data;
+    throw createError({
+      statusCode,
+      statusMessage: data?.message || error.message || fallback,
+      data
+    });
+  }
+  if (typeof error === "object" && error !== null && "statusCode" in error) {
+    throw error;
+  }
+  throw createError({
+    statusCode: 500,
+    statusMessage: error instanceof Error ? error.message : fallback
+  });
+}

package/dist/runtime/server/utils/external-api.d.ts

@@ -0,0 +1,15 @@
+import type { H3Event } from "h3";
+import type { BearerAuthEndpointOptions } from "../../../types.js";
+type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+export interface ExternalApiOptions {
+    event?: H3Event;
+    method?: HttpMethod;
+    body?: unknown;
+    query?: Record<string, unknown>;
+    token?: string;
+    headers?: Record<string, string>;
+}
+export declare function callAuthApi<T = unknown>(endpoint: string, options?: ExternalApiOptions): Promise<T>;
+export declare function getAuthEndpoint(name: keyof BearerAuthEndpointOptions): string;
+export {};
+//# sourceMappingURL=external-api.d.ts.map

package/dist/runtime/server/utils/external-api.js

@@ -0,0 +1,31 @@
+import { $fetch } from "ofetch";
+import { getBearerAuthConfig, requireApiBaseUrl } from "./config.js";
+import { getBearerAuthSession } from "./sessions.js";
+export async function callAuthApi(endpoint, options = {}) {
+  const baseURL = requireApiBaseUrl();
+  const method = options.method || "POST";
+  let token = options.token;
+  if (!token && options.event) {
+    const session = await getBearerAuthSession(options.event);
+    token = session?.token;
+  }
+  const fetchOptions = {
+    baseURL,
+    method,
+    query: options.query,
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      ...token ? { Authorization: `Bearer ${token}` } : {},
+      ...options.headers
+    },
+    retry: 0
+  };
+  if (options.body !== void 0 && method !== "GET") {
+    fetchOptions.body = options.body;
+  }
+  return await $fetch(endpoint, fetchOptions);
+}
+export function getAuthEndpoint(name) {
+  return getBearerAuthConfig().endpoints[name];
+}

package/dist/runtime/server/utils/normalize.d.ts

@@ -0,0 +1,16 @@
+import type { BearerAuthUser } from "../../types/auth.js";
+export interface NormalizedAuthResponse {
+    raw: unknown;
+    token?: string;
+    refreshToken?: string;
+    user?: BearerAuthUser;
+    userId?: string;
+    message?: string;
+    success: boolean;
+    code?: string | number;
+    nextAction?: string;
+}
+export declare function normalizeAuthResponse(response: unknown): NormalizedAuthResponse;
+export declare function requiresVerification(nextAction?: string): boolean;
+export declare function requiresTwoFactor(nextAction?: string): boolean;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/runtime/server/utils/normalize.js

@@ -0,0 +1,30 @@
+import { getBearerAuthConfig } from "./config.js";
+import { readFirstPath } from "./paths.js";
+export function normalizeAuthResponse(response) {
+  const { responsePaths } = getBearerAuthConfig();
+  const user = readFirstPath(response, responsePaths.user);
+  const userId = user ? readFirstPath(user, responsePaths.userId) : void 0;
+  const successValue = readFirstPath(
+    response,
+    responsePaths.success
+  );
+  return {
+    raw: response,
+    token: readFirstPath(response, responsePaths.token),
+    refreshToken: readFirstPath(response, responsePaths.refreshToken),
+    user,
+    userId: userId === void 0 ? void 0 : String(userId),
+    message: readFirstPath(response, responsePaths.message),
+    success: successValue === void 0 || successValue === true || successValue === "success" || successValue === "ok",
+    code: readFirstPath(response, responsePaths.code),
+    nextAction: readFirstPath(response, responsePaths.nextAction)
+  };
+}
+export function requiresVerification(nextAction) {
+  if (!nextAction) return false;
+  return getBearerAuthConfig().verificationRequiredActions.includes(nextAction);
+}
+export function requiresTwoFactor(nextAction) {
+  if (!nextAction) return false;
+  return getBearerAuthConfig().twoFactorRequiredActions.includes(nextAction);
+}

package/dist/runtime/server/utils/paths.d.ts

@@ -0,0 +1,4 @@
+export declare function readPath(source: unknown, path: string): unknown;
+export declare function readFirstPath<T = unknown>(source: unknown, paths?: string[]): T | undefined;
+export declare function interpolatePath(path: string, params: Record<string, string | number | undefined>): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/runtime/server/utils/paths.js

@@ -0,0 +1,23 @@
+export function readPath(source, path) {
+  if (!path) return void 0;
+  if (path === "$") return source;
+  return path.split(".").reduce((current, key) => {
+    if (current === null || current === void 0) return void 0;
+    if (typeof current !== "object") return void 0;
+    return current[key];
+  }, source);
+}
+export function readFirstPath(source, paths = []) {
+  for (const path of paths) {
+    const value = readPath(source, path);
+    if (value !== void 0 && value !== null) {
+      return value;
+    }
+  }
+  return void 0;
+}
+export function interpolatePath(path, params) {
+  return Object.entries(params).reduce((current, [key, value]) => {
+    return current.replace(`:${key}`, encodeURIComponent(String(value ?? "")));
+  }, path);
+}