nuxt-users 1.40.0 → 1.40.3

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=3.0.0"
   },
-  "version": "1.40.0",
+  "version": "1.40.3",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -168,7 +168,7 @@ const module$1 = defineNuxtModule({
     });
     addImportsDir(resolver.resolve("./runtime/composables"));
     addServerImportsDir(resolver.resolve("./runtime/server/composables"));
-    addServerScanDir(resolver.resolve("./runtime/server"));
+    addServerScanDir(resolver.resolve("./runtime/server/tasks"));
     addServerHandler({
       middleware: true,
       handler: resolver.resolve("./runtime/server/middleware/authorization.server")

package/dist/runtime/components/NUsersLoginForm.vue

@@ -136,7 +136,7 @@ const handleForgotPassword = async () => {
             name="password"
             :placeholder="props.passwordPlaceholder || t('login.passwordPlaceholder')"
             required
-            :minlength="passwordValidation.minLength"
+            :minlength="passwordValidation?.minLength || 8"
           >
         </div>
       </slot>

package/dist/runtime/components/NUsersPasswordStrengthIndicator.vue

@@ -23,35 +23,35 @@ const hasPassword = computed(() => props.password?.length > 0);
 const validationRules = computed(() => {
   if (!props.password) return [];
   const rules = [];
-  if (moduleOptions.passwordValidation.minLength) {
+  if (moduleOptions.passwordValidation?.minLength) {
     const hasMinLength = props.password.length >= moduleOptions.passwordValidation.minLength;
     rules.push({
       text: t("passwordStrength.minLength", [moduleOptions.passwordValidation.minLength]),
       passed: hasMinLength
     });
   }
-  if (moduleOptions.passwordValidation.requireUppercase) {
+  if (moduleOptions.passwordValidation?.requireUppercase) {
     const hasUppercase = /[A-Z]/.test(props.password);
     rules.push({
       text: t("passwordStrength.uppercase"),
       passed: hasUppercase
     });
   }
-  if (moduleOptions.passwordValidation.requireLowercase) {
+  if (moduleOptions.passwordValidation?.requireLowercase) {
     const hasLowercase = /[a-z]/.test(props.password);
     rules.push({
       text: t("passwordStrength.lowercase"),
       passed: hasLowercase
     });
   }
-  if (moduleOptions.passwordValidation.requireNumbers) {
+  if (moduleOptions.passwordValidation?.requireNumbers) {
     const hasNumbers = /\d/.test(props.password);
     rules.push({
       text: t("passwordStrength.number"),
       passed: hasNumbers
     });
   }
-  if (moduleOptions.passwordValidation.requireSpecialChars) {
+  if (moduleOptions.passwordValidation?.requireSpecialChars) {
     const hasSpecialChars = /[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(props.password);
     rules.push({
       text: t("passwordStrength.specialChar"),

package/dist/runtime/components/NUsersRegisterForm.vue

@@ -150,7 +150,7 @@ const handleSubmit = async () => {
             name="password"
             :placeholder="props.passwordPlaceholder || t('register.passwordPlaceholder')"
             required
-            :minlength="passwordValidation.minLength"
+            :minlength="passwordValidation?.minLength || 8"
           >
         </div>
       </slot>

package/dist/runtime/components/NUsersUserCard.d.vue.ts

@@ -11,11 +11,11 @@ declare var __VLS_1: {
     user: any;
     index: number;
 }, __VLS_3: {
-    canEdit: any;
+    canEdit: boolean;
     editUser: () => Promise<void>;
     user: any;
 }, __VLS_5: {
-    canDelete: any;
+    canDelete: boolean;
     deleteUser: () => Promise<void>;
     user: any;
 };

package/dist/runtime/components/NUsersUserCard.vue

@@ -25,9 +25,16 @@ const canEdit = computed(() => {
   if (nuxtUsers.auth?.permissions) {
     const userPermissions = nuxtUsers.auth.permissions[currentUser.value.role] || [];
     const apiBasePath = nuxtUsers.apiBasePath;
-    return userPermissions.some(
-      (permission) => permission === "*" || permission === `${apiBasePath}/*` || permission === `${apiBasePath}/[id].put` || permission === `${apiBasePath}/[id].patch`
-    );
+    return userPermissions.some((permission) => {
+      if (typeof permission === "string") {
+        return permission === "*" || permission === `${apiBasePath}/*` || permission === `${apiBasePath}/[id].put` || permission === `${apiBasePath}/[id].patch`;
+      }
+      const pathMatches = permission.path === "*" || permission.path === `${apiBasePath}/*` || permission.path === `${apiBasePath}/[id].put` || permission.path === `${apiBasePath}/[id].patch`;
+      if (!pathMatches) {
+        return false;
+      }
+      return permission.methods.some((method) => method.toUpperCase() === "PUT" || method.toUpperCase() === "PATCH");
+    });
   }
   return false;
 });
@@ -36,9 +43,16 @@ const canDelete = computed(() => {
   if (nuxtUsers.auth?.permissions) {
     const userPermissions = nuxtUsers.auth.permissions[currentUser.value.role] || [];
     const apiBasePath = nuxtUsers.apiBasePath;
-    return userPermissions.some(
-      (permission) => permission === "*" || permission === `${apiBasePath}/*` || permission === `${apiBasePath}/[id].delete`
-    );
+    return userPermissions.some((permission) => {
+      if (typeof permission === "string") {
+        return permission === "*" || permission === `${apiBasePath}/*` || permission === `${apiBasePath}/[id].delete`;
+      }
+      const pathMatches = permission.path === "*" || permission.path === `${apiBasePath}/*` || permission.path === `${apiBasePath}/[id].delete`;
+      if (!pathMatches) {
+        return false;
+      }
+      return permission.methods.some((method) => method.toUpperCase() === "DELETE");
+    });
   }
   return false;
 });

package/dist/runtime/components/NUsersUserCard.vue.d.ts

@@ -11,11 +11,11 @@ declare var __VLS_1: {
     user: any;
     index: number;
 }, __VLS_3: {
-    canEdit: any;
+    canEdit: boolean;
     editUser: () => Promise<void>;
     user: any;
 }, __VLS_5: {
-    canDelete: any;
+    canDelete: boolean;
     deleteUser: () => Promise<void>;
     user: any;
 };

package/dist/runtime/composables/usePublicPaths.js

@@ -1,5 +1,5 @@
 import { useRuntimeConfig } from "#app";
-import { NO_AUTH_PATHS, NO_AUTH_API_PATHS } from "../constants.js";
+import { PUBLIC_PAGES, PUBLIC_API_ENDPOINTS, AUTHENTICATED_AUTO_ACCESS_ENDPOINTS } from "../constants.js";
 import { hasPermission, isWhitelisted } from "../utils/permissions.js";
 import { useAuthentication } from "./useAuthentication.js";
 export const usePublicPaths = () => {
@@ -8,13 +8,13 @@ export const usePublicPaths = () => {
   const apiBasePath = config.apiBasePath || "/api/nuxt-users";
   const { user } = useAuthentication();
   const getPublicPaths = () => {
-    const noAuthPaths = [...NO_AUTH_PATHS];
-    const noAuthApiPaths = NO_AUTH_API_PATHS.map((path) => `${apiBasePath}${path}`);
+    const publicPages = [...PUBLIC_PAGES];
+    const publicApiEndpoints = PUBLIC_API_ENDPOINTS.map((endpoint) => `${endpoint.methods.join(", ")}: ${apiBasePath}${endpoint.path}`);
     const whitelistedPaths = config.auth?.whitelist || [];
     const customPasswordResetPath = config.passwordResetUrl && config.passwordResetUrl !== "/reset-password" ? config.passwordResetUrl : null;
     const allPublicPaths = [
-      ...noAuthPaths,
-      ...noAuthApiPaths,
+      ...publicPages,
+      ...publicApiEndpoints,
       ...whitelistedPaths
     ];
     if (customPasswordResetPath) {
@@ -25,8 +25,8 @@ export const usePublicPaths = () => {
       all: allPublicPaths,
       // Categorized public paths
       builtIn: {
-        pages: noAuthPaths,
-        api: noAuthApiPaths
+        pages: publicPages,
+        api: publicApiEndpoints
       },
       whitelist: whitelistedPaths,
       customPasswordResetPath,
@@ -69,11 +69,11 @@ export const usePublicPaths = () => {
     if (path.startsWith("/_")) {
       return true;
     }
-    if (NO_AUTH_PATHS.includes(path)) {
+    if (PUBLIC_PAGES.includes(path)) {
       return true;
     }
-    const noAuthApiPaths = NO_AUTH_API_PATHS.map((p) => `${apiBasePath}${p}`);
-    if (noAuthApiPaths.includes(path)) {
+    const publicApiEndpoints = PUBLIC_API_ENDPOINTS.map((endpoint) => `${endpoint.methods.join(", ")}: ${apiBasePath}${endpoint.path}`);
+    if (publicApiEndpoints.includes(path)) {
       return true;
     }
     if (config.passwordResetUrl && config.passwordResetUrl !== "/reset-password" && path === config.passwordResetUrl) {
@@ -83,6 +83,10 @@ export const usePublicPaths = () => {
       return true;
     }
     if (user.value) {
+      const autoWhitelistedApiEndpoints = AUTHENTICATED_AUTO_ACCESS_ENDPOINTS.map((endpoint) => `${endpoint.methods.join(", ")}: ${apiBasePath}${endpoint.path}`);
+      if (autoWhitelistedApiEndpoints.includes(path)) {
+        return true;
+      }
       return hasPermission(user.value.role, path, method, config.auth?.permissions || {});
     }
     return false;
@@ -94,11 +98,11 @@ export const usePublicPaths = () => {
     if (path.startsWith("/_")) {
       return true;
     }
-    if (NO_AUTH_PATHS.includes(path)) {
+    if (PUBLIC_PAGES.includes(path)) {
       return true;
     }
-    const noAuthApiPaths = NO_AUTH_API_PATHS.map((p) => `${apiBasePath}${p}`);
-    if (noAuthApiPaths.includes(path)) {
+    const publicApiEndpoints = PUBLIC_API_ENDPOINTS.map((endpoint) => `${endpoint.methods.join(", ")}: ${apiBasePath}${endpoint.path}`);
+    if (publicApiEndpoints.includes(path)) {
       return true;
     }
     if (config.passwordResetUrl && config.passwordResetUrl !== "/reset-password" && path === config.passwordResetUrl) {

package/dist/runtime/constants.d.ts

@@ -1,2 +1,9 @@
-export declare const NO_AUTH_PATHS: string[];
-export declare const NO_AUTH_API_PATHS: string[];
+export declare const PUBLIC_PAGES: string[];
+export declare const PUBLIC_API_ENDPOINTS: {
+    path: string;
+    methods: string[];
+}[];
+export declare const AUTHENTICATED_AUTO_ACCESS_ENDPOINTS: {
+    path: string;
+    methods: string[];
+}[];

package/dist/runtime/constants.js

@@ -1,2 +1,11 @@
-export const NO_AUTH_PATHS = ["/login", "/reset-password"];
-export const NO_AUTH_API_PATHS = ["/session", "/password/forgot", "/password/reset"];
+export const PUBLIC_PAGES = ["/login", "/reset-password"];
+export const PUBLIC_API_ENDPOINTS = [
+  { path: "/password/forgot", methods: ["POST"] },
+  { path: "/password/reset", methods: ["POST"] },
+  { path: "/session", methods: ["POST", "DELETE"] }
+  // Login and logout endpoints
+];
+export const AUTHENTICATED_AUTO_ACCESS_ENDPOINTS = [
+  { path: "/me", methods: ["GET", "PATCH"] },
+  { path: "/password", methods: ["PATCH"] }
+];

package/dist/runtime/middleware/authorization.client.js

@@ -1,20 +1,20 @@
 import { defineNuxtRouteMiddleware, navigateTo, useRuntimeConfig } from "#app";
 import { useAuthentication } from "../composables/useAuthentication.js";
 import { hasPermission, isWhitelisted } from "../utils/permissions.js";
-import { NO_AUTH_PATHS, NO_AUTH_API_PATHS } from "../constants.js";
+import { PUBLIC_PAGES, AUTHENTICATED_AUTO_ACCESS_ENDPOINTS } from "../constants.js";
 export default defineNuxtRouteMiddleware(async (to) => {
   const { public: { nuxtUsers: publicNuxtUsers } } = useRuntimeConfig();
   const publicOptions = publicNuxtUsers;
   const base = publicOptions.apiBasePath || "/api/nuxt-users";
-  if (NO_AUTH_PATHS.includes(to.path)) {
+  if (PUBLIC_PAGES.includes(to.path)) {
     console.log(`[Nuxt Users] client.middleware.auth.global: ${to.path}`);
     return;
   }
-  const openApiPaths = NO_AUTH_API_PATHS.map((path) => `${base}${path}`);
+  const openApiPaths = AUTHENTICATED_AUTO_ACCESS_ENDPOINTS.map((endpoint) => `${endpoint.methods.join(", ")}: ${base}${endpoint.path}`);
   if (openApiPaths.includes(to.path)) {
     return;
   }
-  if (isWhitelisted(to.path, publicOptions.auth.whitelist)) {
+  if (isWhitelisted(to.path, publicOptions.auth?.whitelist || [])) {
     console.log(`[Nuxt Users] client.middleware.auth.global: Whitelisted: ${to.path}`);
     return;
   }
@@ -33,7 +33,7 @@ export default defineNuxtRouteMiddleware(async (to) => {
     console.log(`[Nuxt Users] client.middleware.auth.global: Unauthenticated ${to.path}, redirecting to /login`);
     return navigateTo("/login");
   }
-  if (!user.value || !hasPermission(user.value.role, to.path, "GET", publicOptions.auth.permissions)) {
+  if (!user.value || !hasPermission(user.value.role, to.path, "GET", publicOptions.auth?.permissions || {})) {
     console.log(`[Nuxt Users] client.middleware.auth.global: User with role ${user.value?.role} denied access to ${to.path}`);
     return navigateTo("/login");
   }

package/dist/runtime/server/middleware/authorization.server.js

@@ -1,82 +1,58 @@
-import { defineEventHandler, getCookie, createError } from "h3";
+import { defineEventHandler, getCookie } from "h3";
 import { useRuntimeConfig } from "#imports";
-import { getCurrentUserFromToken } from "../utils/index.js";
+import { getCurrentUserFromToken, handleUnauthenticatedRequest, handleInvalidToken, handleUnauthorizedRequest } from "../utils/index.js";
 import { hasPermission, isWhitelisted } from "../../utils/permissions.js";
-import { NO_AUTH_PATHS, NO_AUTH_API_PATHS } from "../../constants.js";
+import { PUBLIC_PAGES, PUBLIC_API_ENDPOINTS, AUTHENTICATED_AUTO_ACCESS_ENDPOINTS } from "../../constants.js";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
   const options = nuxtUsers;
   const base = options.apiBasePath || "/api/nuxt-users";
-  const isPageOrApiRoute = !event.path.includes(".") && (event.path === "/" || event.path.startsWith("/api/") || !event.path.startsWith("/_"));
+  const isApiRoute = event.path.startsWith("/api/");
+  const isMeEndpoint = event.path === `${base}/me`;
+  const isPageOrApiRoute = !event.path.includes(".") && (event.path === "/" || isApiRoute || !event.path.startsWith("/_"));
   if (!isPageOrApiRoute) {
     return;
   }
-  const noAuthPaths = [...NO_AUTH_PATHS];
+  const publicAuthPaths = [...PUBLIC_PAGES];
   if (options.passwordResetUrl && options.passwordResetUrl !== "/reset-password") {
-    noAuthPaths.push(options.passwordResetUrl);
+    publicAuthPaths.push(options.passwordResetUrl);
   }
-  if (noAuthPaths.includes(event.path)) {
+  if (publicAuthPaths.includes(event.path)) {
     console.debug(`[Nuxt Users] authorization: NO_AUTH_PATH: ${event.path}`);
     return;
   }
-  const openApiPaths = NO_AUTH_API_PATHS.map((path) => `${base}${path}`);
-  if (openApiPaths.includes(event.path)) {
-    return;
+  for (const endpoint of PUBLIC_API_ENDPOINTS) {
+    if (event.path === `${base}${endpoint.path}` && endpoint.methods.includes(event.method)) {
+      console.debug(`[Nuxt Users] authorization: Public API endpoint ${event.path} (${event.method})`);
+      return;
+    }
   }
   if (isWhitelisted(event.path, options.auth.whitelist)) {
     console.debug(`[Nuxt Users] authorization: whitelisted: ${event.path}`);
     return;
   }
   const token = getCookie(event, "auth_token");
-  const isMeEndpoint = event.path === `${base}/me`;
   if (!token) {
-    if (event.path.startsWith("/api/")) {
-      if (isMeEndpoint) {
-        console.debug(`[Nuxt Users] authorization: ${event.path} No token found - expected for auth check`);
-      } else {
-        console.warn(`[Nuxt Users] authorization: ${event.path} No token found - API request rejected`);
-      }
-      throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
-    }
-    if (!event.path.startsWith("/api/")) {
-      console.debug(`[Nuxt Users] authorization: ${event.path} No token found - letting client handle page redirect`);
-      return;
-    }
+    return handleUnauthenticatedRequest(event, isApiRoute, isMeEndpoint);
   }
   const user = await getCurrentUserFromToken(token, options);
   if (!user) {
-    if (event.path.startsWith("/api/")) {
-      if (isMeEndpoint) {
-        console.debug(`[Nuxt Users] authorization: ${event.path} Invalid token - expected for auth check`);
-      } else {
-        console.warn(`[Nuxt Users] authorization: ${event.path} Invalid token - API request rejected`);
-      }
-      throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
-    }
-    if (!event.path.startsWith("/api/")) {
-      console.debug(`[Nuxt Users] authorization: ${event.path} Invalid token - letting client handle page redirect`);
-      return;
-    }
+    return handleInvalidToken(event, isApiRoute, isMeEndpoint);
   }
   if (!event.context) {
     event.context = {};
   }
   event.context.nuxtUsers = event.context.nuxtUsers || {};
   event.context.nuxtUsers.user = user;
-  if (event.path === `${base}/me`) {
-    console.debug(`[Nuxt Users] authorization: Auto-whitelisted /me endpoint for authenticated user ${user.id}`);
-    return;
-  }
-  if (!hasPermission(user.role, event.path, event.method, options.auth.permissions)) {
-    if (event.path.startsWith("/api/")) {
-      console.warn(`[Nuxt Users] authorization: ${event.path} User ${user.id} with role ${user.role} denied access - API request rejected`);
-      throw createError({ statusCode: 403, statusMessage: "Forbidden" });
-    }
-    if (!event.path.startsWith("/api/")) {
-      console.debug(`[Nuxt Users] authorization: ${event.path} User ${user.id} with role ${user.role} denied access - letting client handle page redirect`);
+  for (const endpoint of AUTHENTICATED_AUTO_ACCESS_ENDPOINTS) {
+    if (event.path === `${base}${endpoint.path}` && endpoint.methods.includes(event.method)) {
+      console.debug(`[Nuxt Users] authorization: Auto-whitelisted endpoint ${event.path} for authenticated user ${user.id}`);
       return;
     }
   }
+  if (!hasPermission(user.role, event.path, event.method, options.auth.permissions)) {
+    return handleUnauthorizedRequest(event, user, isApiRoute);
+  }
   console.debug(`[Nuxt Users] authorization: Authenticated request to ${event.path} for ${user.id} with role ${user.role}`);
   return;
 });

package/dist/runtime/server/utils/authorization.d.ts

@@ -0,0 +1,23 @@
+import { type H3Event } from 'h3';
+import type { UserWithoutPassword } from 'nuxt-users/utils';
+/**
+ * Handles unauthenticated requests (no token found)
+ * @param event - H3 event object
+ * @param isApiRoute - Whether this is an API route
+ * @param isMeEndpoint - Whether this is the /me endpoint (used for auth status checks)
+ */
+export declare const handleUnauthenticatedRequest: (event: H3Event, isApiRoute: boolean, isMeEndpoint: boolean) => void;
+/**
+ * Handles invalid token requests
+ * @param event - H3 event object
+ * @param isApiRoute - Whether this is an API route
+ * @param isMeEndpoint - Whether this is the /me endpoint (used for auth status checks)
+ */
+export declare const handleInvalidToken: (event: H3Event, isApiRoute: boolean, isMeEndpoint: boolean) => void;
+/**
+ * Handles unauthorized requests (user lacks required permissions)
+ * @param event - H3 event object
+ * @param user - Authenticated user object
+ * @param isApiRoute - Whether this is an API route
+ */
+export declare const handleUnauthorizedRequest: (event: H3Event, user: UserWithoutPassword, isApiRoute: boolean) => void;

package/dist/runtime/server/utils/authorization.js

@@ -0,0 +1,33 @@
+import { createError } from "h3";
+export const handleUnauthenticatedRequest = (event, isApiRoute, isMeEndpoint) => {
+  if (isApiRoute) {
+    if (isMeEndpoint) {
+      console.debug(`[Nuxt Users] authorization: ${event.path} No token found - expected for auth check`);
+    } else {
+      console.warn(`[Nuxt Users] authorization: ${event.path} No token found - API request rejected`);
+    }
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  }
+  console.debug(`[Nuxt Users] authorization: ${event.path} No token found - letting client handle page redirect`);
+  return;
+};
+export const handleInvalidToken = (event, isApiRoute, isMeEndpoint) => {
+  if (isApiRoute) {
+    if (isMeEndpoint) {
+      console.debug(`[Nuxt Users] authorization: ${event.path} Invalid token - expected for auth check`);
+    } else {
+      console.warn(`[Nuxt Users] authorization: ${event.path} Invalid token - API request rejected`);
+    }
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  }
+  console.debug(`[Nuxt Users] authorization: ${event.path} Invalid token - letting client handle page redirect`);
+  return;
+};
+export const handleUnauthorizedRequest = (event, user, isApiRoute) => {
+  if (isApiRoute) {
+    console.warn(`[Nuxt Users] authorization: ${event.method}: ${event.path} User ${user.id} with role ${user.role} denied access - API request rejected`);
+    throw createError({ statusCode: 403, statusMessage: "Forbidden" });
+  }
+  console.debug(`[Nuxt Users] authorization: ${event.path} User ${user.id} with role ${user.role} denied access - letting client handle page redirect`);
+  return;
+};

package/dist/runtime/server/utils/index.d.ts

@@ -7,3 +7,4 @@ export { createPasswordResetTokensTable } from './create-password-reset-tokens-t
 export { createMigrationsTable } from './create-migrations-table.js';
 export { runMigrations, getAppliedMigrations } from './migrate.js';
 export { createGoogleOAuth2Client, getGoogleAuthUrl, getGoogleUserFromCode, findOrCreateGoogleUser, createAuthTokenForUser, generateSecurePassword } from './google-oauth.js';
+export { handleUnauthenticatedRequest, handleInvalidToken, handleUnauthorizedRequest } from './authorization.js';

package/dist/runtime/server/utils/index.js

@@ -7,3 +7,4 @@ export { createPasswordResetTokensTable } from "./create-password-reset-tokens-t
 export { createMigrationsTable } from "./create-migrations-table.js";
 export { runMigrations, getAppliedMigrations } from "./migrate.js";
 export { createGoogleOAuth2Client, getGoogleAuthUrl, getGoogleUserFromCode, findOrCreateGoogleUser, createAuthTokenForUser, generateSecurePassword } from "./google-oauth.js";
+export { handleUnauthenticatedRequest, handleInvalidToken, handleUnauthorizedRequest } from "./authorization.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-users",
-  "version": "1.40.0",
+  "version": "1.40.3",
   "description": "A comprehensive user management module for Nuxt 3 and Nuxt 4 applications with authentication, authorization, database support, and CLI tools",
   "keywords": [
     "nuxt",
@@ -64,9 +64,9 @@
     "postbuild": "node scripts/post-build.js",
     "check:translations": "tsx scripts/check-translations.ts",
     "check:locale-consistency": "tsx scripts/check-locale-consistency.ts",
-    "check:auth": "npm whoami --registry=https://registry.npmjs.org/ || (echo '❌ Not authenticated with npm. Please run: npm login' && exit 1)",
+    "check:npm_token": "if [ -z \"$NPM_TOKEN\" ]; then echo '❌ NPM_TOKEN environment variable is not set. Please set it to your npm token.'; exit 1; fi",
     "prerelease": "node -v | grep -q 'v22' || (echo 'Please use Node.js v22 for deployment' && exit 1)",
-    "release": "yarn check:auth && yarn lint && yarn check:translations && yarn check:locale-consistency && yarn test && yarn prepack && changelogen --release && npm publish && git push --follow-tags",
+    "release": "yarn check:npm_token && yarn lint && yarn check:translations && yarn check:locale-consistency && yarn test && yarn prepack && dotenv -- changelogen --release && dotenv -- npm publish --registry https://registry.npmjs.org/ && git push --follow-tags",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "pretest": "node -v | grep -q 'v22' || (echo 'Please use Node.js v22 for testing' && exit 1)",
@@ -130,6 +130,7 @@
     "@types/nodemailer": "^6.4.17",
     "@types/pg": "^8.15.4",
     "changelogen": "^0.6.2",
+    "dotenv-cli": "^11.0.0",
     "eslint": "^9.30.1",
     "nuxt": "^4.0.0",
     "tsx": "^4.20.3",