nuxt-convex-module 0.12.3 → 0.14.0

package/dist/runtime/better-auth/vue/auth-client-loader.js

@@ -0,0 +1,186 @@
+import { getCurrentScope, onScopeDispose, shallowRef, watch } from "vue";
+let loaded;
+let loading;
+let deferred = false;
+const waiting = /* @__PURE__ */ new Set();
+let evaluated;
+let stopSignal;
+export function loadAuthClient() {
+  if (evaluated) registerAuthClient(evaluated);
+  loading ??= import("#convex/auth-client").then(
+    ({ authClient }) => {
+      registerAuthClient(authClient);
+      return authClient;
+    },
+    (error) => {
+      loading = void 0;
+      throw error;
+    }
+  );
+  return loading;
+}
+export function registerEvaluatedAuthClient(client) {
+  if (loaded || evaluated === client) return;
+  if (!deferred) return registerAuthClient(client);
+  evaluated = client;
+  const signal = client.$store?.atoms?.$sessionSignal;
+  stopSignal = signal?.listen?.(() => registerAuthClient(client));
+}
+export function registerAuthClient(client) {
+  if (loaded) return;
+  stopSignal?.();
+  stopSignal = void 0;
+  evaluated = void 0;
+  loaded = client;
+  loading ??= Promise.resolve(client);
+  const listeners = [...waiting];
+  waiting.clear();
+  for (const listener of listeners) {
+    try {
+      listener(client);
+    } catch (error) {
+      report(error);
+    }
+  }
+}
+function report(error) {
+  if (typeof globalThis.reportError === "function") globalThis.reportError(error);
+  else queueMicrotask(() => {
+    throw error;
+  });
+}
+export function loadedAuthClient() {
+  return loaded;
+}
+export function onAuthClient(listener) {
+  if (loaded) {
+    listener(loaded);
+    return () => {
+    };
+  }
+  waiting.add(listener);
+  return () => waiting.delete(listener);
+}
+export function deferAuthClient() {
+  if (deferred || loaded) return;
+  deferred = true;
+  const onVisible = () => {
+    if (document.visibilityState !== "visible") return;
+    void loadAuthClient().then(() => document.removeEventListener("visibilitychange", onVisible), () => {
+    });
+  };
+  document.addEventListener("visibilitychange", onVisible);
+}
+export function retryAuthClientLoad() {
+  if (loaded || typeof window === "undefined") return;
+  const retry = () => {
+    if (document.visibilityState !== "visible") return;
+    void loadAuthClient().then(() => {
+      window.removeEventListener("online", retry);
+      document.removeEventListener("visibilitychange", retry);
+    }, () => {
+    });
+  };
+  window.addEventListener("online", retry);
+  document.addEventListener("visibilitychange", retry);
+}
+export function isAuthClientDeferred() {
+  return deferred && !loaded;
+}
+function reach(client, path) {
+  let owner;
+  let value = client;
+  for (const key of path) {
+    owner = value;
+    value = value[key];
+  }
+  return { owner, value };
+}
+function call(client, path, args) {
+  const { owner, value } = reach(client, path);
+  return Reflect.apply(value, owner, args);
+}
+const HOOK = /^use[A-Z]/;
+function pendingSubscription(path, args) {
+  let unsubscribe;
+  const stopWaiting = onAuthClient((client) => {
+    unsubscribe = call(client, path, args);
+  });
+  void loadAuthClient().catch(() => {
+  });
+  return () => {
+    stopWaiting();
+    unsubscribe?.();
+  };
+}
+function pendingHook(path, args) {
+  const scope = getCurrentScope();
+  const refetch = async (...refetchArgs) => {
+    await loadAuthClient();
+    const next = state.value.refetch;
+    if (next === refetch) return;
+    return next(...refetchArgs);
+  };
+  const state = shallowRef({
+    data: null,
+    error: null,
+    isPending: true,
+    isRefetching: false,
+    refetch
+  });
+  if (import.meta.server) return state;
+  const stopWaiting = onAuthClient((client) => {
+    const follow = () => watch(call(client, path, args), (value) => {
+      state.value = value;
+    }, { immediate: true, flush: "sync" });
+    if (!scope) follow();
+    else if (scope.active) scope.run(follow);
+  });
+  if (scope) onScopeDispose(stopWaiting);
+  void loadAuthClient().catch(() => loadAuthClient()).catch((error) => {
+    if (!loaded) state.value = { ...state.value, isPending: false, error };
+  });
+  return state;
+}
+const withReceivers = /* @__PURE__ */ new WeakMap();
+function withReceiver(member, owner) {
+  if (typeof member !== "function" || typeof owner !== "object" || owner === null) return member;
+  let byMethod = withReceivers.get(owner);
+  if (!byMethod) withReceivers.set(owner, byMethod = /* @__PURE__ */ new WeakMap());
+  let wrapped = byMethod.get(member);
+  if (!wrapped) {
+    wrapped = new Proxy(member, {
+      apply: (fn, _this, args) => Reflect.apply(fn, owner, args)
+    });
+    byMethod.set(member, wrapped);
+  }
+  return wrapped;
+}
+function lazyPath(path) {
+  return new Proxy(() => {
+  }, {
+    get(_target, key) {
+      if (loaded) {
+        const owner = reach(loaded, path).value;
+        return withReceiver(owner[key], owner);
+      }
+      if (key === "then") return void 0;
+      return lazyPath([...path, key]);
+    },
+    apply(_target, _this, args) {
+      if (loaded) return call(loaded, path, args);
+      const name = path.at(-1);
+      if (typeof name === "string" && HOOK.test(name) && typeof args[0] !== "function") return pendingHook(path, args);
+      if (name === "subscribe" || name === "listen") return pendingSubscription(path, args);
+      return loadAuthClient().then((client) => call(client, path, args));
+    }
+  });
+}
+export const lazyAuthClient = lazyPath([]);
+export function __resetAuthClientLoaderForTests() {
+  deferred = false;
+  stopSignal?.();
+  stopSignal = void 0;
+  evaluated = void 0;
+  waiting.clear();
+}

package/dist/runtime/better-auth/vue/client.d.ts

@@ -1,6 +1,6 @@
 import { convexClient } from '@convex-dev/better-auth/client/plugins';
-import { createAuthClient } from 'better-auth/vue';
-export declare const authClient: ReturnType<typeof createAuthClient<{
+import { type VueAuthClient } from 'better-auth/vue';
+export declare const authClient: VueAuthClient<{
     plugins: ReturnType<typeof convexClient>[];
-}>>;
+}>;
 export type AuthClient = typeof authClient;

package/dist/runtime/better-auth/vue/cross-domain.d.ts

@@ -1,3 +1,29 @@
+import type { AuthClient } from '#convex/auth-client';
+/**
+ * An {@link AuthClient} that also includes the `crossDomainClient()` plugin.
+ *
+ * The aliased client's type only reflects the plugins the app installed (the
+ * bundled default omits `crossDomainClient()`), so this describes the
+ * cross-domain additions itself.
+ *
+ * @public
+ */
+export type AuthClientWithCrossDomain = AuthClient & {
+    updateSession: () => void;
+    crossDomain?: {
+        oneTimeToken: {
+            verify: (args: {
+                token: string;
+            }) => Promise<{
+                data?: {
+                    session?: {
+                        token: string;
+                    } | null;
+                } | null;
+            }>;
+        };
+    };
+};
 /**
  * Options for {@link consumeCrossDomainOneTimeToken}.
  *

package/dist/runtime/better-auth/vue/cross-domain.js

@@ -1,4 +1,4 @@
-import { authClient } from "#convex/auth-client";
+import { loadAuthClient, onAuthClient } from "./auth-client-loader.js";
 const normalizePathname = (path) => {
   const slashed = path.startsWith("/") ? path : `/${path}`;
   let end = slashed.length;
@@ -12,41 +12,58 @@ export async function consumeCrossDomainOneTimeToken(options = {}) {
   }
   const url = new URL(window.location.href);
   const token = url.searchParams.get("ott");
-  if (token) {
-    const authClientWithCrossDomain = authClient;
-    url.searchParams.delete("ott");
-    window.history.replaceState({}, "", url);
-    if (!authClientWithCrossDomain.crossDomain) {
-      return;
-    }
-    if (options.callbackRoute && normalizePathname(url.pathname) !== normalizePathname(options.callbackRoute)) {
-      console.warn(
-        `[nuxt-convex-module] Ignoring cross-domain one-time token on "${url.pathname}" \u2014 consumption is restricted to "${options.callbackRoute}" (convex.betterAuth.crossDomainCallbackRoute).`
-      );
-      return;
-    }
-    if (import.meta.dev && !options.callbackRoute) {
-      console.warn(
-        `[nuxt-convex-module] Exchanged a cross-domain one-time token on "${url.pathname}" with no \`convex.betterAuth.crossDomainCallbackRoute\` set \u2014 any page can complete sign-in. Restrict it to your callback route.`
-      );
-    }
-    try {
-      const result = await authClientWithCrossDomain.crossDomain.oneTimeToken.verify({
-        token
-      });
-      const session = result.data?.session;
-      if (session) {
-        await authClient.getSession({
-          fetchOptions: {
-            headers: {
-              Authorization: `Bearer ${session.token}`
-            }
+  if (!token) return;
+  url.searchParams.delete("ott");
+  window.history.replaceState({}, "", url);
+  const authClient = await loadAuthClient().catch(() => loadAuthClient()).catch((error) => {
+    console.warn("[nuxt-convex-module] Failed to load the Better Auth client:", error);
+  });
+  if (!authClient) {
+    onAuthClient((client) => void exchangeKeptToken(client, token, url, options));
+    return;
+  }
+  await exchangeOneTimeToken(authClient, token, url, options);
+}
+async function exchangeKeptToken(authClient, token, url, options) {
+  const current = await Promise.resolve().then(() => authClient.getSession()).catch(() => void 0);
+  if (!current || current.error || current.data?.session) {
+    if (!current?.data?.session) console.warn("[nuxt-convex-module] Failed to consume cross-domain one-time token:", current?.error ?? "the session lookup failed");
+    return;
+  }
+  await exchangeOneTimeToken(authClient, token, url, options);
+}
+async function exchangeOneTimeToken(authClient, token, url, options) {
+  const authClientWithCrossDomain = authClient;
+  if (!authClientWithCrossDomain?.crossDomain) {
+    return;
+  }
+  if (options.callbackRoute && normalizePathname(url.pathname) !== normalizePathname(options.callbackRoute)) {
+    console.warn(
+      `[nuxt-convex-module] Ignoring cross-domain one-time token on "${url.pathname}" \u2014 consumption is restricted to "${options.callbackRoute}" (convex.betterAuth.crossDomainCallbackRoute).`
+    );
+    return;
+  }
+  if (import.meta.dev && !options.callbackRoute) {
+    console.warn(
+      `[nuxt-convex-module] Exchanged a cross-domain one-time token on "${url.pathname}" with no \`convex.betterAuth.crossDomainCallbackRoute\` set \u2014 any page can complete sign-in. Restrict it to your callback route.`
+    );
+  }
+  try {
+    const result = await authClientWithCrossDomain.crossDomain.oneTimeToken.verify({
+      token
+    });
+    const session = result.data?.session;
+    if (session) {
+      await authClientWithCrossDomain.getSession({
+        fetchOptions: {
+          headers: {
+            Authorization: `Bearer ${session.token}`
           }
-        });
-        await authClientWithCrossDomain.updateSession();
-      }
-    } catch (error) {
-      console.warn("[nuxt-convex-module] Failed to consume cross-domain one-time token:", error);
+        }
+      });
+      await authClientWithCrossDomain.updateSession();
     }
+  } catch (error) {
+    console.warn("[nuxt-convex-module] Failed to consume cross-domain one-time token:", error);
   }
 }

package/dist/runtime/better-auth/vue/index.d.ts

@@ -6,8 +6,9 @@
  */
 export { useBetterAuth, type UseBetterAuthReturn, type BetterAuthSession, type BetterAuthUser } from './use-better-auth.js';
 export { authClient, type AuthClient } from '#convex/auth-client';
+export { loadAuthClient } from './auth-client-loader.js';
 export { usePreloadedAuthQuery } from './hydration.js';
-export { consumeCrossDomainOneTimeToken, type ConsumeCrossDomainOneTimeTokenOptions } from './cross-domain.js';
+export { consumeCrossDomainOneTimeToken, type AuthClientWithCrossDomain, type ConsumeCrossDomainOneTimeTokenOptions } from './cross-domain.js';
 export { resolveAuthRedirect } from './redirect.js';
 export { AuthBoundary } from './auth-boundary.js';
 export { convexClient, crossDomainClient } from '@convex-dev/better-auth/client/plugins';

package/dist/runtime/better-auth/vue/index.js

@@ -1,5 +1,6 @@
 export { useBetterAuth } from "./use-better-auth.js";
 export { authClient } from "#convex/auth-client";
+export { loadAuthClient } from "./auth-client-loader.js";
 export { usePreloadedAuthQuery } from "./hydration.js";
 export { consumeCrossDomainOneTimeToken } from "./cross-domain.js";
 export { resolveAuthRedirect } from "./redirect.js";

package/dist/runtime/better-auth/vue/plugin.client.js

@@ -2,18 +2,37 @@ import { defineNuxtPlugin, useRuntimeConfig, useState } from "#app";
 import { ConvexVueClient, ConvexClientKey } from "../../vue/client.js";
 import { ConvexAuthStateKey, createScopedConvexAuthState } from "../../vue/auth/index.js";
 import { CONVEX_INITIAL_TOKEN_KEY } from "../../nuxt/config.js";
-import { useBetterAuth } from "./use-better-auth.js";
+import { settleSessionWithoutClient, useBetterAuth } from "./use-better-auth.js";
+import { deferAuthClient } from "./auth-client-loader.js";
+import { NO_SESSION_KEY } from "./token-store.js";
 import { consumeCrossDomainOneTimeToken } from "./cross-domain.js";
+function holdsCrossDomainSession() {
+  return [() => localStorage, () => sessionStorage].some((open) => {
+    try {
+      const storage = open();
+      for (let index = 0; index < storage.length; index++) {
+        const key = storage.key(index);
+        if (key?.endsWith("_cookie") && storage.getItem(key)?.includes("session_token")) return true;
+      }
+    } catch {
+    }
+    return false;
+  });
+}
 export default defineNuxtPlugin({
   name: "nuxt-convex-module:better-auth:client",
   async setup(nuxtApp) {
-    const { url, crossDomainCallbackRoute } = useRuntimeConfig().public.convex;
+    const { url, crossDomainCallbackRoute, deferAuthClient: mayDefer } = useRuntimeConfig().public.convex;
     if (!url) {
       console.warn("[nuxt-convex-module] No Convex deployment URL configured \u2014 client and auth not created. Set NUXT_PUBLIC_CONVEX_URL or `convex.url` in nuxt.config.");
       return;
     }
     const client = new ConvexVueClient(url);
     nuxtApp.vueApp.provide(ConvexClientKey, client);
+    if (mayDefer !== false && useState(NO_SESSION_KEY, () => false).value && !new URL(window.location.href).searchParams.has("ott") && !holdsCrossDomainSession()) {
+      deferAuthClient();
+      nuxtApp.hook("app:suspense:resolve", settleSessionWithoutClient);
+    }
     await consumeCrossDomainOneTimeToken({
       callbackRoute: crossDomainCallbackRoute || void 0
     });

package/dist/runtime/better-auth/vue/plugin.server.js

@@ -1,10 +1,11 @@
 import { computed } from "vue";
-import { defineNuxtPlugin, useRuntimeConfig, useState, useRequestEvent, useResponseHeader } from "#app";
+import { defineNuxtPlugin, useRuntimeConfig, useState, useRequestEvent, useRequestHeaders, useResponseHeader } from "#app";
 import { ConvexVueClient, ConvexClientKey } from "../../vue/client.js";
 import { CONVEX_INITIAL_TOKEN_KEY, closeAfterRender } from "../../nuxt/config.js";
 import { convexAuth } from "../nuxt/server.js";
 import { ConvexAuthStateKey } from "../../vue/auth/index.js";
-import { BetterAuthTokenStoreKey, createBetterAuthTokenStore, seedInitialToken } from "./token-store.js";
+import { CACHING_HEADERS, isSharedRender, NO_SESSION_CONTEXT_KEY } from "../nuxt/shared-render.js";
+import { BetterAuthTokenStoreKey, createBetterAuthTokenStore, hasSessionCookie, NO_SESSION_KEY, seedInitialToken } from "./token-store.js";
 export async function prefetchAuthToken(event, initialToken, cacheControl) {
   try {
     const token = await convexAuth(event).getToken();
@@ -12,10 +13,20 @@ export async function prefetchAuthToken(event, initialToken, cacheControl) {
     if (token && event) {
       cacheControl.value = "private, no-store";
     }
+    return true;
   } catch (error) {
     console.warn("[nuxt-convex-module] Failed to prefetch auth token for SSR:", error);
+    return false;
   }
 }
+function renderContext(event) {
+  const context = event.context;
+  return {
+    routeRules: context._nitro?.routeRules,
+    cache: context.cache,
+    headers: Object.fromEntries(CACHING_HEADERS.map((name) => [name, event.node?.res?.getHeader?.(name)]))
+  };
+}
 export default defineNuxtPlugin({
   name: "nuxt-convex-module:better-auth:server",
   async setup(nuxtApp) {
@@ -36,8 +47,17 @@ export default defineNuxtPlugin({
     nuxtApp.vueApp.provide(ConvexAuthStateKey, ssrAuthState);
     const event = useRequestEvent();
     if (event && !import.meta.prerender) {
-      await prefetchAuthToken(event, initialToken, useResponseHeader("Cache-Control"));
+      const cacheControl = useResponseHeader("Cache-Control");
+      const noSession = useState(NO_SESSION_KEY, () => false);
+      const { cookie } = useRequestHeaders(["cookie"]);
+      const answered = await prefetchAuthToken(event, initialToken, cacheControl);
       seedInitialToken(tokenStore, initialToken.value);
+      noSession.value = answered && !initialToken.value && !hasSessionCookie(cookie) && !isSharedRender(renderContext(event));
+      nuxtApp.hooks.hook("app:rendered", () => {
+        if (noSession.value && isSharedRender(renderContext(event))) noSession.value = false;
+        const context = event.context;
+        context[NO_SESSION_CONTEXT_KEY] = noSession.value;
+      });
     }
   }
 });

package/dist/runtime/better-auth/vue/token-store.js

@@ -5,14 +5,38 @@ export function createBetterAuthTokenStore() {
     cachedTokenVersion: null,
     pendingToken: null,
     pendingTokenVersion: null,
-    initialTokenUsed: false
+    initialTokenUsed: false,
+    initialTokenSessionId: void 0
   };
 }
 export const BetterAuthTokenStoreKey = Symbol("BetterAuthTokenStore");
+export const NO_SESSION_KEY = "convex:betterAuth:noSession";
+export function hasSessionCookie(cookie) {
+  return !!cookie && cookie.split(";").some((pair) => pair.split("=", 1)[0].trim().endsWith("session_token"));
+}
 export const PENDING_AUTH_VERSION = "__pending__";
+export function readTokenClaims(token) {
+  try {
+    const payload = token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
+    return JSON.parse(atob(payload)) ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+const getTokenSessionId = (token) => {
+  const sessionId = readTokenClaims(token)?.sessionId;
+  return typeof sessionId === "string" ? sessionId : void 0;
+};
 export function seedInitialToken(store, initialToken) {
   if (store.initialTokenUsed || !initialToken) return;
   store.cachedToken.value = initialToken;
   store.cachedTokenVersion = PENDING_AUTH_VERSION;
+  store.initialTokenSessionId = getTokenSessionId(initialToken);
   store.initialTokenUsed = true;
 }
+export function clearToken(store) {
+  store.cachedToken.value = null;
+  store.cachedTokenVersion = null;
+  store.pendingToken = null;
+  store.pendingTokenVersion = null;
+}

package/dist/runtime/better-auth/vue/use-better-auth.d.ts

@@ -1,6 +1,6 @@
 import type { AuthTokenFetcher } from 'convex/browser';
 import { type ComputedRef } from 'vue';
-import { type AuthClient } from '#convex/auth-client';
+import type { AuthClient } from '#convex/auth-client';
 export type BetterAuthSession = AuthClient['useSession'] extends {
     (): infer R;
     (useFetch: any): any;
@@ -13,9 +13,9 @@ export type BetterAuthUser = {
 } & Record<string, unknown>;
 /** What `useBetterAuth()` returns. */
 export interface UseBetterAuthReturn {
-    /** `true` until the session is known and no prefetched token covers the gap. */
+    /** `true` until the session is known and no prefetched token covers the gap, or while a token from another user is replaced. */
     isLoading: ComputedRef<boolean>;
-    /** `true` when Better Auth reports a session, or a token is cached while it reloads. */
+    /** `true` when Better Auth reports a session, or the prefetched token covers the session loading. */
     isAuthenticated: ComputedRef<boolean>;
     /** Convex's token fetcher: the Better Auth JWT for the current session, or `null`. */
     fetchAccessToken: AuthTokenFetcher;
@@ -25,8 +25,8 @@ export interface UseBetterAuthReturn {
     session: BetterAuthSession;
     /** The current user, or `null` when signed out / still loading. */
     user: ComputedRef<BetterAuthUser | null>;
-    /** The session id (or user id); changes when the signed-in identity changes. */
-    authVersion: ComputedRef<string | null>;
+    /** The session id (or user id), `null` when signed out, `undefined` until the session settles. */
+    authVersion: ComputedRef<string | null | undefined>;
 }
 /**
  * The Better Auth service for the Vue/Nuxt runtime.
@@ -49,3 +49,9 @@ export interface UseBetterAuthReturn {
  * @public
  */
 export declare function useBetterAuth(initialToken?: string | null): UseBetterAuthReturn;
+/**
+ * Forget what the Better Auth integration keeps for the app's lifetime: the
+ * browser's token cache and its session subscription. Published from
+ * `nuxt-convex-module/testing`; call it between tests that sign in.
+ */
+export declare function resetBetterAuthState(): void;