nuxt-media-library 0.0.50 → 0.0.51

package/README.md

@@ -47,8 +47,11 @@ export default defineNuxtConfig({
   mediaLibrary: {
     // Auto-register Vue components from src/runtime/components
     components: true,
-    // Chunk uploader config (used by MlFileUpload)
-    baseURL: 'https://api.example.com',
+    // Where the Nuxt server reaches the media library (with /v1). Server-side
+    // only, never sent to browsers; prefer NUXT_MEDIA_LIBRARY_BASE_URL.
+    baseURL: 'http://media-library.internal/v1',
+    // Only for direct browser uploads (proxyUploads: false): a public address.
+    // publicBaseURL: 'https://media.example.com/v1',
     // Uploads always go through Nuxt server (/api/media-library/uploads/*)
     routes: {
       createSession: '/uploads/sessions',
@@ -60,11 +63,18 @@ export default defineNuxtConfig({
     partSize: 8 * 1024 * 1024,
     concurrency: 3,
     checksum: { algorithm: 'SHA-256', perPart: true, final: true },
-    headers: {},
+    // Sent to browsers too, except credentials: Authorization, Cookie,
+    // Proxy-Authorization and X-Api-Key stay server-side (the proxies add them).
+    headers: { 'X-Tenant': 'acme' },
   },
 })
 ```
 
+Nuxt puts the public runtime config in every page, so the module never copies
+`baseURL` or credential headers there. Set the media library's internal
+address and any service token only server-side
+(`NUXT_MEDIA_LIBRARY_BASE_URL`, `NUXT_MEDIA_LIBRARY_SERVICE_TOKEN`).
+
 ### Nuxt usage
 
 ```vue
@@ -164,7 +174,7 @@ app's decision, not the service's:
 // nuxt.config.ts
 export default defineNuxtConfig({
   mediaLibrary: {
-    baseURL: process.env.MEDIA_LIBRARY_URL,      // server side, e.g. http://media-library.internal/v1
+    // server side only: set NUXT_MEDIA_LIBRARY_BASE_URL (e.g. http://media-library.internal/v1)
     serviceUploads: { proxy: true },             // parts go through /api/media-library/service-uploads
     // or, direct to the media library (needs CORS for the site):
     // serviceUploads: { baseURL: 'https://media.example.com/v1' },

package/dist/module.d.mts

@@ -14,7 +14,17 @@ interface ChunkUploaderRoutesConfig {
 }
 interface ModuleOptions {
     components?: boolean;
+    /**
+     * Where the Nuxt server reaches the media library, with `/v1` (often an
+     * internal address). Server-side only: never sent to browsers. Prefer
+     * NUXT_MEDIA_LIBRARY_BASE_URL at runtime.
+     */
     baseURL?: string;
+    /**
+     * The media library address browsers use for direct uploads
+     * (`proxyUploads: false`), with `/v1`. Public: only set a public address.
+     */
+    publicBaseURL?: string;
     routes?: ChunkUploaderRoutesConfig;
     partSize?: number;
     concurrency?: number;

package/dist/module.d.ts

@@ -14,7 +14,17 @@ interface ChunkUploaderRoutesConfig {
 }
 interface ModuleOptions {
     components?: boolean;
+    /**
+     * Where the Nuxt server reaches the media library, with `/v1` (often an
+     * internal address). Server-side only: never sent to browsers. Prefer
+     * NUXT_MEDIA_LIBRARY_BASE_URL at runtime.
+     */
     baseURL?: string;
+    /**
+     * The media library address browsers use for direct uploads
+     * (`proxyUploads: false`), with `/v1`. Public: only set a public address.
+     */
+    publicBaseURL?: string;
     routes?: ChunkUploaderRoutesConfig;
     partSize?: number;
     concurrency?: number;

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "media-library",
   "configKey": "mediaLibrary",
-  "version": "0.0.50",
+  "version": "0.0.51",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,9 +1,24 @@
-import { defineNuxtModule, createResolver, addImportsDir, addComponentsDir, addServerHandler, addPlugin } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, addImportsDir, addComponentsDir, addServerHandler, useLogger, addPlugin } from '@nuxt/kit';
 export * from '../dist/runtime/types/resourcePolicy.js';
 export * from '../dist/runtime/types/uploader.js';
 export * from '../dist/runtime/types/preview.js';
 export * from '../dist/runtime/types/asset.js';
 
+const CREDENTIAL_HEADERS = ["authorization", "proxy-authorization", "cookie", "x-api-key"];
+function browserHeaders(headers) {
+  if (!headers || typeof headers !== "object") return { headers: {}, dropped: [] };
+  const kept = {};
+  const dropped = [];
+  for (const [name, value] of Object.entries(headers)) {
+    if (CREDENTIAL_HEADERS.includes(name.toLowerCase())) dropped.push(name);
+    else kept[name] = value;
+  }
+  return { headers: kept, dropped };
+}
+function browserBaseURL(existingPublic, publicBaseURL) {
+  return existingPublic ?? publicBaseURL ?? "";
+}
+
 const SERVICE_UPLOADS_ROUTE = "/api/media-library/service-uploads";
 const module$1 = defineNuxtModule({
   meta: {
@@ -38,7 +53,10 @@ const module$1 = defineNuxtModule({
     const envTenantHeader = process.env.NUXT_MEDIA_LIBRARY_HEADERS_X_TENANT;
     const envHeaders = envTenantHeader ? { "X-tenant": envTenantHeader } : {};
     const existingHeaders = typeof existingPrivate.headers === "object" ? existingPrivate.headers : {};
-    const resolvedHeaders = { ...existingHeaders };
+    const optionCredentials = Object.fromEntries(
+      browserHeaders(options.headers).dropped.map((name) => [name, options.headers[name]])
+    );
+    const resolvedHeaders = { ...optionCredentials, ...existingHeaders };
     for (const [key, value] of Object.entries(envHeaders)) {
       if (!resolvedHeaders[key]) {
         resolvedHeaders[key] = value;
@@ -105,9 +123,17 @@ const module$1 = defineNuxtModule({
       // grants). Declared so NUXT_MEDIA_LIBRARY_SERVICE_TOKEN applies.
       serviceToken: existingPrivate.serviceToken ?? ""
     };
+    const logger = useLogger("media-library");
+    const publicHeaders = browserHeaders(existingPublic.headers ?? options.headers);
+    if (publicHeaders.dropped.length) {
+      logger.warn(`mediaLibrary.headers: ${publicHeaders.dropped.join(", ")} kept server-side, not sent to browsers.`);
+    }
+    if (existingPublic.proxyUploads === false && !existingPublic.baseURL && !options.publicBaseURL) {
+      logger.warn("proxyUploads is false but no public media library address is set: set mediaLibrary.publicBaseURL. baseURL is server-side only.");
+    }
     nuxt.options.runtimeConfig.public.mediaLibrary = {
       ...existingPublic,
-      baseURL: existingPublic.baseURL ?? options.baseURL ?? "",
+      baseURL: browserBaseURL(existingPublic.baseURL, options.publicBaseURL),
       routes: existingPublic.routes ?? routes,
       proxyUploads: existingPublic.proxyUploads ?? true,
       partSize: existingPublic.partSize ?? options.partSize ?? 8 * 1024 * 1024,
@@ -117,7 +143,7 @@ const module$1 = defineNuxtModule({
         perPart: existingPublic.checksum?.perPart ?? options.checksum?.perPart ?? true,
         final: existingPublic.checksum?.final ?? options.checksum?.final ?? true
       },
-      headers: existingPublic.headers ?? options.headers ?? {},
+      headers: publicHeaders.headers,
       // Where useMLServiceUpload sends parts (NUXT_PUBLIC_MEDIA_LIBRARY_SERVICE_UPLOAD_BASE_URL).
       serviceUploadBaseURL: existingPublic.serviceUploadBaseURL || options.serviceUploads?.baseURL || (options.serviceUploads?.proxy ? SERVICE_UPLOADS_ROUTE : "")
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-media-library",
-  "version": "0.0.50",
+  "version": "0.0.51",
   "description": "Nuxt module for media library management — chunked uploads, asset previews, and resource policies",
   "repository": {
     "type": "git",