nuxt-convex-module 0.0.0

package/dist/runtime/better-auth/vue/client.d.ts

@@ -0,0 +1,358 @@
+export declare const authClient: import("better-auth/vue").VueAuthClient<{
+    plugins: {
+        id: "convex";
+        version: string;
+        $InferServerPlugin: ReturnType<(opts: {
+            authConfig: import("convex/server").AuthConfig;
+            jwt?: {
+                expirationSeconds?: number;
+                definePayload?: (session: {
+                    user: import("better-auth").User & Record<string, any>;
+                    session: import("better-auth").Session & Record<string, any>;
+                }) => Promise<Record<string, any>> | Record<string, any> | undefined;
+            };
+            jwtExpirationSeconds?: number;
+            jwks?: string;
+            jwksRotateOnTokenGenerationError?: boolean;
+            options?: import("better-auth").BetterAuthOptions;
+        }) => {
+            id: "convex";
+            version: string;
+            init: (ctx: import("better-auth").AuthContext) => void;
+            hooks: {
+                before: ({
+                    matcher(context: import("better-auth").HookEndpointContext): boolean;
+                    handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                        context: {
+                            headers: Headers;
+                        };
+                    } | undefined>;
+                } | {
+                    matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+                    handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                        context: import("better-auth").MiddlewareContext<import("better-auth").MiddlewareOptions, {
+                            returned?: unknown | undefined;
+                            responseHeaders?: Headers | undefined;
+                        } & import("better-auth").PluginContext<import("better-auth").BetterAuthOptions> & import("better-auth").InfoContext & {
+                            options: import("better-auth").BetterAuthOptions;
+                            trustedOrigins: string[];
+                            trustedProviders: string[];
+                            isTrustedOrigin: (url: string, settings?: {
+                                allowRelativePaths: boolean;
+                            }) => boolean;
+                            oauthConfig: {
+                                skipStateCookieCheck?: boolean | undefined;
+                                storeStateStrategy: "database" | "cookie";
+                            };
+                            newSession: {
+                                session: {
+                                    id: string;
+                                    createdAt: Date;
+                                    updatedAt: Date;
+                                    userId: string;
+                                    expiresAt: Date;
+                                    token: string;
+                                    ipAddress?: string | null | undefined;
+                                    userAgent?: string | null | undefined;
+                                } & Record<string, any>;
+                                user: {
+                                    id: string;
+                                    createdAt: Date;
+                                    updatedAt: Date;
+                                    email: string;
+                                    emailVerified: boolean;
+                                    name: string;
+                                    image?: string | null | undefined;
+                                } & Record<string, any>;
+                            } | null;
+                            session: {
+                                session: {
+                                    id: string;
+                                    createdAt: Date;
+                                    updatedAt: Date;
+                                    userId: string;
+                                    expiresAt: Date;
+                                    token: string;
+                                    ipAddress?: string | null | undefined;
+                                    userAgent?: string | null | undefined;
+                                } & Record<string, any>;
+                                user: {
+                                    id: string;
+                                    createdAt: Date;
+                                    updatedAt: Date;
+                                    email: string;
+                                    emailVerified: boolean;
+                                    name: string;
+                                    image?: string | null | undefined;
+                                } & Record<string, any>;
+                            } | null;
+                            setNewSession: (session: {
+                                session: {
+                                    id: string;
+                                    createdAt: Date;
+                                    updatedAt: Date;
+                                    userId: string;
+                                    expiresAt: Date;
+                                    token: string;
+                                    ipAddress?: string | null | undefined;
+                                    userAgent?: string | null | undefined;
+                                } & Record<string, any>;
+                                user: {
+                                    id: string;
+                                    createdAt: Date;
+                                    updatedAt: Date;
+                                    email: string;
+                                    emailVerified: boolean;
+                                    name: string;
+                                    image?: string | null | undefined;
+                                } & Record<string, any>;
+                            } | null) => void;
+                            socialProviders: import("better-auth").OAuthProvider[];
+                            authCookies: import("better-auth").BetterAuthCookies;
+                            logger: ReturnType<(options?: import("better-auth").Logger | undefined) => import("better-auth").InternalLogger>;
+                            rateLimit: {
+                                enabled: boolean;
+                                window: number;
+                                max: number;
+                                storage: "memory" | "database" | "secondary-storage";
+                            } & Omit<import("better-auth").BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
+                            adapter: import("better-auth").DBAdapter<import("better-auth").BetterAuthOptions>;
+                            internalAdapter: import("better-auth").InternalAdapter<import("better-auth").BetterAuthOptions>;
+                            createAuthCookie: (cookieName: string, overrideAttributes?: Partial<import("better-auth").CookieOptions> | undefined) => import("better-auth").BetterAuthCookie;
+                            secret: string;
+                            secretConfig: string | import("better-auth").SecretConfig;
+                            sessionConfig: {
+                                updateAge: number;
+                                expiresIn: number;
+                                freshAge: number;
+                                cookieRefreshCache: false | {
+                                    enabled: true;
+                                    updateAge: number;
+                                };
+                            };
+                            generateId: (options: {
+                                model: import("better-auth").ModelNames;
+                                size?: number | undefined;
+                            }) => string | false;
+                            secondaryStorage: import("better-auth").SecondaryStorage | undefined;
+                            password: {
+                                hash: (password: string) => Promise<string>;
+                                verify: (data: {
+                                    password: string;
+                                    hash: string;
+                                }) => Promise<boolean>;
+                                config: {
+                                    minPasswordLength: number;
+                                    maxPasswordLength: number;
+                                };
+                                checkPassword: (userId: string, ctx: import("better-auth").GenericEndpointContext<import("better-auth").BetterAuthOptions>) => Promise<boolean>;
+                            };
+                            tables: import("better-auth").BetterAuthDBSchema;
+                            runMigrations: () => Promise<void>;
+                            publishTelemetry: (event: {
+                                type: string;
+                                anonymousId?: string | undefined;
+                                payload: Record<string, any>;
+                            }) => Promise<void>;
+                            skipOriginCheck: boolean | string[];
+                            skipCSRFCheck: boolean;
+                            runInBackground: (promise: Promise<unknown>) => void;
+                            runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("better-auth").Awaitable<unknown>;
+                        }>;
+                    }>;
+                })[];
+                after: {
+                    matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+                    handler: import("better-auth/api").AuthMiddleware;
+                }[];
+            };
+            endpoints: {
+                getOpenIdConfig: import("better-auth").StrictEndpoint<"/convex/.well-known/openid-configuration", {
+                    method: "GET";
+                    metadata: {
+                        isAction: false;
+                    };
+                }, import("better-auth/plugins").OIDCMetadata>;
+                getJwks: import("better-auth").StrictEndpoint<"/convex/jwks", {
+                    method: "GET";
+                    metadata: {
+                        openapi: {
+                            description: string;
+                            responses: {
+                                "200": {
+                                    description: string;
+                                    content: {
+                                        "application/json": {
+                                            schema: {
+                                                type: "object";
+                                                properties: {
+                                                    keys: {
+                                                        type: string;
+                                                        description: string;
+                                                        items: {
+                                                            type: string;
+                                                            properties: {
+                                                                kid: {
+                                                                    type: string;
+                                                                    description: string;
+                                                                };
+                                                                kty: {
+                                                                    type: string;
+                                                                    description: string;
+                                                                };
+                                                                alg: {
+                                                                    type: string;
+                                                                    description: string;
+                                                                };
+                                                                use: {
+                                                                    type: string;
+                                                                    description: string;
+                                                                    enum: string[];
+                                                                    nullable: boolean;
+                                                                };
+                                                                n: {
+                                                                    type: string;
+                                                                    description: string;
+                                                                    nullable: boolean;
+                                                                };
+                                                                e: {
+                                                                    type: string;
+                                                                    description: string;
+                                                                    nullable: boolean;
+                                                                };
+                                                                crv: {
+                                                                    type: string;
+                                                                    description: string;
+                                                                    nullable: boolean;
+                                                                };
+                                                                x: {
+                                                                    type: string;
+                                                                    description: string;
+                                                                    nullable: boolean;
+                                                                };
+                                                                y: {
+                                                                    type: string;
+                                                                    description: string;
+                                                                    nullable: boolean;
+                                                                };
+                                                            };
+                                                            required: string[];
+                                                        };
+                                                    };
+                                                };
+                                                required: string[];
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                }, import("better-auth").JSONWebKeySet>;
+                getLatestJwks: import("better-auth").StrictEndpoint<"/convex/latest-jwks", {
+                    isAction: boolean;
+                    method: "POST";
+                    metadata: {
+                        SERVER_ONLY: true;
+                        openapi: {
+                            description: string;
+                        };
+                    };
+                }, any[]>;
+                rotateKeys: import("better-auth").StrictEndpoint<"/convex/rotate-keys", {
+                    isAction: boolean;
+                    method: "POST";
+                    metadata: {
+                        SERVER_ONLY: true;
+                        openapi: {
+                            description: string;
+                        };
+                    };
+                }, any[]>;
+                getToken: import("better-auth").StrictEndpoint<"/convex/token", {
+                    method: "GET";
+                    requireHeaders: true;
+                    use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                        session: {
+                            session: Record<string, any> & {
+                                id: string;
+                                createdAt: Date;
+                                updatedAt: Date;
+                                userId: string;
+                                expiresAt: Date;
+                                token: string;
+                                ipAddress?: string | null | undefined;
+                                userAgent?: string | null | undefined;
+                            };
+                            user: Record<string, any> & {
+                                id: string;
+                                createdAt: Date;
+                                updatedAt: Date;
+                                email: string;
+                                emailVerified: boolean;
+                                name: string;
+                                image?: string | null | undefined;
+                            };
+                        };
+                    }>)[];
+                    metadata: {
+                        openapi: {
+                            description: string;
+                            responses: {
+                                200: {
+                                    description: string;
+                                    content: {
+                                        "application/json": {
+                                            schema: {
+                                                type: "object";
+                                                properties: {
+                                                    token: {
+                                                        type: string;
+                                                    };
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                }, {
+                    token: string;
+                }>;
+            };
+            schema: {
+                jwks: {
+                    fields: {
+                        publicKey: {
+                            type: "string";
+                            required: true;
+                        };
+                        privateKey: {
+                            type: "string";
+                            required: true;
+                        };
+                        createdAt: {
+                            type: "date";
+                            required: true;
+                        };
+                        expiresAt: {
+                            type: "date";
+                            required: false;
+                        };
+                    };
+                };
+                user: {
+                    readonly fields: {
+                        readonly userId: {
+                            readonly type: "string";
+                            readonly required: false;
+                            readonly input: false;
+                        };
+                    };
+                };
+            };
+        }>;
+    }[];
+}>;
+export type AuthClient = typeof authClient;

package/dist/runtime/better-auth/vue/client.js

@@ -0,0 +1,5 @@
+import { convexClient } from "@convex-dev/better-auth/client/plugins";
+import { createAuthClient } from "better-auth/vue";
+export const authClient = createAuthClient({
+  plugins: [convexClient()]
+});

package/dist/runtime/better-auth/vue/cross-domain.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Options for {@link consumeCrossDomainOneTimeToken}.
+ *
+ * @public
+ */
+export interface ConsumeCrossDomainOneTimeTokenOptions {
+    /**
+     * Only exchange the one-time token when the page URL matches this route
+     * (e.g. `'/auth/callback'`; trailing slashes ignored). On every other route
+     * the `ott` parameter is scrubbed from the URL but **not** exchanged.
+     *
+     * The cross-domain protocol cannot bind the token to the browser that
+     * started the sign-in flow (magic-link flows legitimately finish in another
+     * browsing context), so without this restriction a crafted
+     * `/any-page?ott=…` link silently signs the visitor into the link author's
+     * session — login CSRF. Restricting consumption to the one route your
+     * sign-in `callbackURL`s point at shrinks that surface to a single
+     * predictable URL.
+     *
+     * In Nuxt, set `convex.betterAuth.crossDomainCallbackRoute` instead — the
+     * client plugin forwards it here.
+     */
+    callbackRoute?: string;
+}
+/**
+ * Exchange a `?ott=...` one-time token (set by the Better Auth cross-domain
+ * plugin when redirecting from an auth origin) for a full session — the Vue
+ * port of `ConvexBetterAuthProvider`'s one-time-token `useEffect`.
+ *
+ * Safe to call unconditionally — returns early when the URL has no `ott`
+ * parameter or the cross-domain plugin is not installed on the auth client.
+ *
+ * The token is not bound to the browser that initiated sign-in (upstream
+ * design), so anyone holding a fresh token can mint a link that logs its
+ * visitor into *their* session — see
+ * {@link ConsumeCrossDomainOneTimeTokenOptions.callbackRoute} for the
+ * mitigation.
+ */
+export declare function consumeCrossDomainOneTimeToken(options?: ConsumeCrossDomainOneTimeTokenOptions): Promise<void>;

package/dist/runtime/better-auth/vue/cross-domain.js

@@ -0,0 +1,45 @@
+import { authClient } from "#convex/auth-client";
+const normalizePathname = (path) => {
+  const slashed = path.startsWith("/") ? path : `/${path}`;
+  const trimmed = slashed.replace(/\/+$/, "");
+  return trimmed === "" ? "/" : trimmed;
+};
+export async function consumeCrossDomainOneTimeToken(options = {}) {
+  if (typeof window === "undefined" || !window.location?.href) {
+    return;
+  }
+  const url = new URL(window.location.href);
+  const token = url.searchParams.get("ott");
+  if (token) {
+    const authClientWithCrossDomain = authClient;
+    url.searchParams.delete("ott");
+    window.history.replaceState({}, "", url);
+    if (!authClientWithCrossDomain.crossDomain) {
+      return;
+    }
+    if (options.callbackRoute && normalizePathname(url.pathname) !== normalizePathname(options.callbackRoute)) {
+      console.warn(
+        `[nuxt-convex-module] ignoring cross-domain one-time token on "${url.pathname}" \u2014 consumption is restricted to "${options.callbackRoute}" (convex.betterAuth.crossDomainCallbackRoute).`
+      );
+      return;
+    }
+    try {
+      const result = await authClientWithCrossDomain.crossDomain.oneTimeToken.verify({
+        token
+      });
+      const session = result.data?.session;
+      if (session) {
+        await authClient.getSession({
+          fetchOptions: {
+            headers: {
+              Authorization: `Bearer ${session.token}`
+            }
+          }
+        });
+        authClientWithCrossDomain.updateSession();
+      }
+    } catch (error) {
+      console.warn("[nuxt-convex-module] failed to consume cross-domain one-time token", error);
+    }
+  }
+}

package/dist/runtime/better-auth/vue/hydration.d.ts

@@ -0,0 +1,20 @@
+import type { FunctionReference } from 'convex/server';
+import { type ComputedRef, type MaybeRefOrGetter } from 'vue';
+import { type Preloaded } from '../../vue/hydration.js';
+/**
+ * Auth-aware version of {@link usePreloadedQuery} for payloads returned by
+ * `convexAuth(event).preloadAuthQuery(...)`.
+ *
+ * A Vue/Nuxt port of `@convex-dev/better-auth`'s `usePreloadedAuthQuery`
+ * (`src/nextjs/client.tsx`): show the preloaded server result until the preload
+ * "expires" — i.e. auth settles as unauthenticated, or a live authenticated
+ * result arrives — then follow the live query. The last committed value is held
+ * while auth is (re)loading so a transient loading state does not flash the
+ * (possibly stale) preloaded value. At runtime yields `undefined` for
+ * unauthenticated users (as upstream does); the declared type also includes
+ * `null` so code annotated against upstream's `| null` signature keeps
+ * compiling.
+ *
+ * @public
+ */
+export declare const usePreloadedAuthQuery: <Query extends FunctionReference<"query">>(preloadedQuery: MaybeRefOrGetter<Preloaded<Query>>) => ComputedRef<Query["_returnType"] | null | undefined>;

package/dist/runtime/better-auth/vue/hydration.js

@@ -0,0 +1,52 @@
+import { computed, ref, watch } from "vue";
+import { useConvexAuth } from "../../vue/auth/index.js";
+import { usePreloadedPayload, useReactiveQuery } from "../../vue/hydration.js";
+const useConvexPreloadedQuery = (preloadedQuery, { requireAuth = true } = {}) => {
+  const { isLoading, isAuthenticated } = useConvexAuth();
+  const preloadExpired = ref(false);
+  watch(
+    [isLoading, isAuthenticated],
+    () => {
+      if (requireAuth && !isLoading.value && !isAuthenticated.value) {
+        preloadExpired.value = true;
+      }
+    },
+    { immediate: true }
+  );
+  const { query, args, preloadedResult } = usePreloadedPayload(preloadedQuery);
+  if (import.meta.server) {
+    return preloadedResult;
+  }
+  const result = useReactiveQuery(
+    query,
+    computed(() => requireAuth && !isAuthenticated.value ? "skip" : args.value)
+  );
+  watch(
+    result,
+    () => {
+      if (result.value !== void 0) {
+        preloadExpired.value = true;
+      }
+    },
+    { immediate: true }
+  );
+  if (requireAuth) {
+    return computed(() => preloadExpired.value ? result.value : preloadedResult.value);
+  }
+  return computed(() => result.value === void 0 ? preloadedResult.value : result.value);
+};
+export const usePreloadedAuthQuery = (preloadedQuery) => {
+  const { isLoading } = useConvexAuth();
+  const latestData = useConvexPreloadedQuery(preloadedQuery);
+  const data = ref(latestData.value);
+  watch(
+    [latestData, isLoading],
+    () => {
+      if (!isLoading.value) {
+        data.value = latestData.value;
+      }
+    },
+    { immediate: true }
+  );
+  return computed(() => data.value);
+};

package/dist/runtime/better-auth/vue/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Public client-side API for the opt-in Better Auth integration — a Vue/Nuxt
+ * port of `@convex-dev/better-auth`'s `react` integration.
+ *
+ * @module better-auth/client
+ */
+export { useAuth, type UseAuthService, type AuthSession, type AuthUser } from './use-auth.js';
+export { authClient, type AuthClient } from '#convex/auth-client';
+export { usePreloadedAuthQuery } from './hydration.js';
+export { consumeCrossDomainOneTimeToken, type ConsumeCrossDomainOneTimeTokenOptions } from './cross-domain.js';
+export { AuthBoundary } from './auth-boundary.js';
+export { convexClient, crossDomainClient } from '@convex-dev/better-auth/client/plugins';

package/dist/runtime/better-auth/vue/index.js

@@ -0,0 +1,6 @@
+export { useAuth } from "./use-auth.js";
+export { authClient } from "#convex/auth-client";
+export { usePreloadedAuthQuery } from "./hydration.js";
+export { consumeCrossDomainOneTimeToken } from "./cross-domain.js";
+export { AuthBoundary } from "./auth-boundary.js";
+export { convexClient, crossDomainClient } from "@convex-dev/better-auth/client/plugins";

package/dist/runtime/better-auth/vue/plugin.client.d.ts

@@ -0,0 +1,6 @@
+import { ConvexVueClient } from '../../vue/client.js';
+type ConvexNuxtInjection = {
+    convex?: ConvexVueClient;
+};
+declare const _default: import("nuxt/app").Plugin<ConvexNuxtInjection> & import("nuxt/app").ObjectPlugin<ConvexNuxtInjection>;
+export default _default;

package/dist/runtime/better-auth/vue/plugin.client.js

@@ -0,0 +1,32 @@
+import { defineNuxtPlugin, useRuntimeConfig, useState } from "#app";
+import { ConvexVueClient, ConvexClientKey } from "../../vue/client.js";
+import { ConvexAuthStateKey, createScopedConvexAuthState } from "../../vue/auth/index.js";
+import { useAuth } from "./use-auth.js";
+import { consumeCrossDomainOneTimeToken } from "./cross-domain.js";
+export default defineNuxtPlugin({
+  name: "nuxt-convex-module:better-auth:client",
+  async setup(nuxtApp) {
+    const { url, crossDomainCallbackRoute } = useRuntimeConfig().public.convex;
+    if (!url) {
+      console.warn("[nuxt-convex-module] No Convex URL configured for client plugin.");
+      return { provide: {} };
+    }
+    const client = new ConvexVueClient(url);
+    nuxtApp.vueApp.provide(ConvexClientKey, client);
+    await consumeCrossDomainOneTimeToken({
+      callbackRoute: crossDomainCallbackRoute || void 0
+    });
+    const initialToken = useState("convex:initialToken", () => null);
+    const { state, scope } = createScopedConvexAuthState({
+      client,
+      useAuth: () => useAuth(initialToken.value)
+    });
+    nuxtApp.vueApp.provide(ConvexAuthStateKey, state);
+    void scope;
+    return {
+      provide: {
+        convex: client
+      }
+    };
+  }
+});

package/dist/runtime/better-auth/vue/plugin.server.d.ts

@@ -0,0 +1,24 @@
+import { useState, useRequestEvent } from '#app';
+import { ConvexVueClient } from '../../vue/client.js';
+type ConvexNuxtInjection = {
+    convex?: ConvexVueClient;
+};
+/**
+ * Prefetch the Convex JWT for SSR and stash it in `initialToken`.
+ *
+ * Exported for unit testing.
+ */
+export declare function prefetchAuthToken(event: ReturnType<typeof useRequestEvent>, initialToken: ReturnType<typeof useState<string | null>>): Promise<void>;
+/**
+ * Server-side Better Auth bootstrap.
+ *
+ * Mirrors the Next.js parity layer that calls `getToken()` from the root
+ * server layout and passes it as `initialToken` to `ConvexBetterAuthProvider`.
+ *
+ * The token is stashed into a Nuxt `useState('convex:initialToken')` so the
+ * client plugin can hand it to `useAuth(initialToken)` before the first
+ * Convex `setAuth` call — avoiding an extra Better Auth round-trip on first
+ * paint.
+ */
+declare const _default: import("nuxt/app").Plugin<ConvexNuxtInjection> & import("nuxt/app").ObjectPlugin<ConvexNuxtInjection>;
+export default _default;

package/dist/runtime/better-auth/vue/plugin.server.js

@@ -0,0 +1,42 @@
+import { computed } from "vue";
+import { setResponseHeader } from "h3";
+import { defineNuxtPlugin, useRuntimeConfig, useState, useRequestEvent } from "#app";
+import { ConvexVueClient, ConvexClientKey } from "../../vue/client.js";
+import { convexAuth } from "../nuxt/server.js";
+import { ConvexAuthStateKey } from "../../vue/auth/index.js";
+function buildProvide(ssrClient) {
+  return ssrClient ? { provide: { convex: ssrClient } } : { provide: {} };
+}
+export async function prefetchAuthToken(event, initialToken) {
+  try {
+    const token = await convexAuth(event).getToken();
+    initialToken.value = token ?? null;
+    if (token && event) {
+      setResponseHeader(event, "Cache-Control", "private, no-store");
+    }
+  } catch (error) {
+    console.warn("[nuxt-convex-module] Failed to prefetch auth token for SSR:", error);
+  }
+}
+export default defineNuxtPlugin({
+  name: "nuxt-convex-module:better-auth:server",
+  async setup(nuxtApp) {
+    const initialToken = useState("convex:initialToken", () => null);
+    const url = useRuntimeConfig().public.convex.url;
+    const ssrClient = url ? new ConvexVueClient(url) : void 0;
+    if (ssrClient) {
+      nuxtApp.vueApp.provide(ConvexClientKey, ssrClient);
+    }
+    const ssrAuthState = {
+      isLoading: computed(() => true),
+      isAuthenticated: computed(() => false),
+      isRefreshing: computed(() => false)
+    };
+    nuxtApp.vueApp.provide(ConvexAuthStateKey, ssrAuthState);
+    const event = useRequestEvent();
+    if (event) {
+      await prefetchAuthToken(event, initialToken);
+    }
+    return buildProvide(ssrClient);
+  }
+});