nuxt-users 1.49.2 → 1.50.0

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { defineCommand, runMain } from 'citty';
 import { readFileSync } from 'node:fs';
-import { d as defaultOptions } from './shared/nuxt-users.KrHIaTTL.mjs';
+import { d as defaultOptions } from './shared/nuxt-users.CcNeTWsL.mjs';
 import { defu } from 'defu';
 import { runMigrations, getAppliedMigrations } from '../dist/runtime/server/utils/migrate.js';
 import { createUser as createUser$1 } from '../dist/runtime/server/utils/user.js';

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=3.0.0"
   },
-  "version": "1.49.2",
+  "version": "1.50.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,6 +1,6 @@
 import { defineNuxtModule, createResolver, addPlugin, addImportsDir, addServerImportsDir, addServerScanDir, addServerHandler, addServerPlugin, addRouteMiddleware, addComponentsDir } from '@nuxt/kit';
 import { defu } from 'defu';
-import { d as defaultOptions } from './shared/nuxt-users.KrHIaTTL.mjs';
+import { d as defaultOptions } from './shared/nuxt-users.CcNeTWsL.mjs';
 export * from '../dist/runtime/server/internal/index.js';
 
 const module$1 = defineNuxtModule({

package/dist/runtime/constants.d.ts

@@ -1,3 +1,4 @@
+export declare const OAUTH_STATE_COOKIE = "nuxt_users_oauth_state";
 export declare const PUBLIC_PAGES: string[];
 export declare const PUBLIC_API_ENDPOINTS: {
     path: string;

package/dist/runtime/constants.js

@@ -1,3 +1,4 @@
+export const OAUTH_STATE_COOKIE = "nuxt_users_oauth_state";
 export const PUBLIC_PAGES = ["/login", "/reset-password"];
 export const PUBLIC_API_ENDPOINTS = [
   { path: "/password/forgot", methods: ["POST"] },

package/dist/runtime/server/api/nuxt-users/[id].patch.js

@@ -12,7 +12,7 @@ export default defineEventHandler(async (event) => {
     });
   }
   const body = await readBody(event);
-  const currentUser = event.context.user;
+  const currentUser = event.context.nuxtUsers?.user;
   if (currentUser && currentUser.id === userId && typeof body.active !== "undefined") {
     throw createError({
       statusCode: 403,

package/dist/runtime/server/api/nuxt-users/auth/google/callback.get.js

@@ -1,4 +1,5 @@
-import { defineEventHandler, sendRedirect, getQuery, setCookie } from "h3";
+import crypto from "node:crypto";
+import { defineEventHandler, sendRedirect, getQuery, setCookie, getCookie, deleteCookie } from "h3";
 import { useRuntimeConfig } from "#imports";
 import {
   createGoogleOAuth2Client,
@@ -6,6 +7,7 @@ import {
   findOrCreateGoogleUser,
   createAuthTokenForUser
 } from "../../../../utils/index.js";
+import { OAUTH_STATE_COOKIE } from "../../../../../constants.js";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
   const options = nuxtUsers;
@@ -13,6 +15,13 @@ export default defineEventHandler(async (event) => {
   if (!options.auth.google) {
     return sendRedirect(event, "/login?error=oauth_not_configured");
   }
+  const expectedState = getCookie(event, OAUTH_STATE_COOKIE);
+  deleteCookie(event, OAUTH_STATE_COOKIE, { path: "/" });
+  if (!isValidState(expectedState, query.state)) {
+    console.error("[Nuxt Users] Invalid or missing OAuth state in callback");
+    const errorRedirect = options.auth.google.errorRedirect || "/login?error=oauth_failed";
+    return sendRedirect(event, errorRedirect);
+  }
   if (query.error) {
     console.error("[Nuxt Users] Google OAuth error:", query.error);
     const errorRedirect = options.auth.google.errorRedirect || "/login?error=oauth_failed";
@@ -60,6 +69,14 @@ export default defineEventHandler(async (event) => {
     return sendRedirect(event, errorRedirect);
   }
 });
+const isValidState = (expected, received) => {
+  if (!expected || typeof received !== "string") {
+    return false;
+  }
+  const expectedBuffer = Buffer.from(expected);
+  const receivedBuffer = Buffer.from(received);
+  return expectedBuffer.length === receivedBuffer.length && crypto.timingSafeEqual(expectedBuffer, receivedBuffer);
+};
 const getRequestURL = (event) => {
   const headers = event.node.req.headers;
   const host = headers.host || headers[":authority"];

package/dist/runtime/server/api/nuxt-users/auth/google/redirect.get.js

@@ -1,6 +1,8 @@
-import { defineEventHandler, sendRedirect, createError } from "h3";
+import crypto from "node:crypto";
+import { defineEventHandler, sendRedirect, createError, setCookie } from "h3";
 import { useRuntimeConfig } from "#imports";
 import { createGoogleOAuth2Client, getGoogleAuthUrl } from "../../../../utils/index.js";
+import { OAUTH_STATE_COOKIE } from "../../../../../constants.js";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
   const options = nuxtUsers;
@@ -21,7 +23,15 @@ export default defineEventHandler(async (event) => {
     const callbackPath = options.auth.google.callbackUrl || `${options.apiBasePath}/auth/google/callback`;
     const callbackUrl = `${baseUrl}${callbackPath}`;
     const oauth2Client = createGoogleOAuth2Client(options.auth.google, callbackUrl);
-    const authUrl = getGoogleAuthUrl(oauth2Client, options.auth.google);
+    const state = crypto.randomBytes(32).toString("hex");
+    setCookie(event, OAUTH_STATE_COOKIE, state, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      path: "/",
+      maxAge: 10 * 60
+    });
+    const authUrl = getGoogleAuthUrl(oauth2Client, options.auth.google, state);
     return sendRedirect(event, authUrl);
   } catch (error) {
     console.error("[Nuxt Users] Google OAuth redirect error:", error);

package/dist/runtime/server/api/nuxt-users/me.patch.js

@@ -4,7 +4,7 @@ import { updateUser } from "../../utils/index.js";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
   const options = nuxtUsers;
-  const user = event.context.user;
+  const user = event.context.nuxtUsers?.user;
   if (!user) {
     throw createError({
       statusCode: 401,
@@ -12,12 +12,8 @@ export default defineEventHandler(async (event) => {
     });
   }
   const body = await readBody(event);
-  if (body.role) {
-    delete body.role;
-  }
-  if (body.active) {
-    delete body.active;
-  }
+  delete body.role;
+  delete body.active;
   try {
     const updatedUser = await updateUser(user.id, body, options);
     return { user: updatedUser };

package/dist/runtime/server/api/nuxt-users/password/forgot.post.js

@@ -1,5 +1,6 @@
-import { defineEventHandler, readBody, createError, getHeader } from "h3";
+import { defineEventHandler, readBody, createError } from "h3";
 import { sendPasswordResetLink } from "../../../services/password.js";
+import { getSiteUrl } from "../../../utils/site-url.js";
 import { useRuntimeConfig } from "#imports";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
@@ -13,9 +14,7 @@ export default defineEventHandler(async (event) => {
     });
   }
   try {
-    const host = getHeader(event, "host");
-    const protocol = getHeader(event, "x-forwarded-proto") || "http";
-    const baseUrl = host ? `${protocol}://${host}` : void 0;
+    const baseUrl = getSiteUrl(event, options);
     await sendPasswordResetLink(email, options, baseUrl);
     return { message: "If a user with that email exists, a password reset link has been sent." };
   } catch (error) {

package/dist/runtime/server/api/nuxt-users/password/index.patch.js

@@ -1,7 +1,7 @@
 import { createError, defineEventHandler, getCookie, readBody } from "h3";
 import bcrypt from "bcrypt";
 import { useRuntimeConfig } from "#imports";
-import { getCurrentUserFromToken, updateUserPassword } from "../../../utils/index.js";
+import { getCurrentUserFromToken, updateUserPassword, revokeUserTokens } from "../../../utils/index.js";
 import { validatePassword, getPasswordValidationOptions } from "../../../../../utils";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
@@ -56,5 +56,6 @@ export default defineEventHandler(async (event) => {
     });
   }
   await updateUserPassword(user.email, newPassword, options);
+  await revokeUserTokens(user.id, options, token);
   return { message: "Password updated successfully" };
 });

package/dist/runtime/server/api/nuxt-users/register.post.js

@@ -1,6 +1,7 @@
-import { createError, defineEventHandler, readBody, getHeader } from "h3";
+import { createError, defineEventHandler, readBody } from "h3";
 import { useRuntimeConfig } from "#imports";
 import { registerUser } from "../../services/registration.js";
+import { getSiteUrl } from "../../utils/site-url.js";
 export default defineEventHandler(async (event) => {
   try {
     const { nuxtUsers } = useRuntimeConfig();
@@ -25,9 +26,7 @@ export default defineEventHandler(async (event) => {
         statusMessage: "Name cannot be empty"
       });
     }
-    const host = getHeader(event, "host") || "localhost:3000";
-    const protocol = getHeader(event, "x-forwarded-proto") || "http";
-    const baseUrl = `${protocol}://${host}`;
+    const baseUrl = getSiteUrl(event, options);
     const result = await registerUser(
       {
         email: body.email.toLowerCase().trim(),

package/dist/runtime/server/middleware/authorization.server.js

@@ -7,28 +7,30 @@ export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
   const options = nuxtUsers;
   const base = options.apiBasePath || "/api/nuxt-users";
-  const isApiRoute = event.path.startsWith("/api/");
-  const isMeEndpoint = event.path === `${base}/me`;
-  const isPageOrApiRoute = !event.path.includes(".") && (event.path === "/" || isApiRoute || !event.path.startsWith("/_"));
-  if (!isPageOrApiRoute) {
+  const path = event.path.split("?")[0];
+  const isApiRoute = path.startsWith("/api/") || path === base || path.startsWith(`${base}/`);
+  const isMeEndpoint = path === `${base}/me`;
+  const isStaticFile = !isApiRoute && path.includes(".");
+  const isNuxtInternal = !isApiRoute && path.startsWith("/_");
+  if (isStaticFile || isNuxtInternal) {
     return;
   }
   const publicAuthPaths = [...PUBLIC_PAGES];
   if (options.passwordResetUrl && options.passwordResetUrl !== "/reset-password") {
     publicAuthPaths.push(options.passwordResetUrl);
   }
-  if (publicAuthPaths.includes(event.path)) {
-    console.debug(`[Nuxt Users] authorization: NO_AUTH_PATH: ${event.path}`);
+  if (publicAuthPaths.includes(path)) {
+    console.debug(`[Nuxt Users] authorization: NO_AUTH_PATH: ${path}`);
     return;
   }
   for (const endpoint of PUBLIC_API_ENDPOINTS) {
-    if (event.path === `${base}${endpoint.path}` && endpoint.methods.includes(event.method)) {
-      console.debug(`[Nuxt Users] authorization: Public API endpoint ${event.path} (${event.method})`);
+    if (path === `${base}${endpoint.path}` && endpoint.methods.includes(event.method)) {
+      console.debug(`[Nuxt Users] authorization: Public API endpoint ${path} (${event.method})`);
       return;
     }
   }
-  if (isWhitelisted(event.path, options.auth.whitelist)) {
-    console.debug(`[Nuxt Users] authorization: whitelisted: ${event.path}`);
+  if (isWhitelisted(path, options.auth.whitelist)) {
+    console.debug(`[Nuxt Users] authorization: whitelisted: ${path}`);
     return;
   }
   const token = getCookie(event, "auth_token");
@@ -45,14 +47,14 @@ export default defineEventHandler(async (event) => {
   event.context.nuxtUsers = event.context.nuxtUsers || {};
   event.context.nuxtUsers.user = user;
   for (const endpoint of AUTHENTICATED_AUTO_ACCESS_ENDPOINTS) {
-    if (event.path === `${base}${endpoint.path}` && endpoint.methods.includes(event.method)) {
-      console.debug(`[Nuxt Users] authorization: Auto-whitelisted endpoint ${event.path} for authenticated user ${user.id}`);
+    if (path === `${base}${endpoint.path}` && endpoint.methods.includes(event.method)) {
+      console.debug(`[Nuxt Users] authorization: Auto-whitelisted endpoint ${path} for authenticated user ${user.id}`);
       return;
     }
   }
-  if (!hasPermission(user.role, event.path, event.method, options.auth.permissions)) {
+  if (!hasPermission(user.role, path, event.method, options.auth.permissions)) {
     return handleUnauthorizedRequest(event, user, isApiRoute);
   }
-  console.debug(`[Nuxt Users] authorization: Authenticated request to ${event.path} for ${user.id} with role ${user.role}`);
+  console.debug(`[Nuxt Users] authorization: Authenticated request to ${path} for ${user.id} with role ${user.role}`);
   return;
 });

package/dist/runtime/server/plugins/validate-mailer-config.js

@@ -29,5 +29,8 @@ const plugin = () => {
     return;
   }
   validateMailerConfig(options);
+  if (process.env.NODE_ENV === "production" && !options.siteUrl) {
+    console.warn("[Nuxt Users] siteUrl is not configured: password reset and email confirmation requests will fail. Set nuxtUsers.siteUrl (or NUXT_NUXT_USERS_SITE_URL) to your public app URL.");
+  }
 };
 export default plugin;

package/dist/runtime/server/services/password.js

@@ -1,7 +1,8 @@
 import { createTransport } from "nodemailer";
 import crypto from "node:crypto";
 import bcrypt from "bcrypt";
-import { findUserByEmail, updateUserPassword, useDb } from "../utils/index.js";
+import { findUserByEmail, updateUserPassword, revokeUserTokens, useDb } from "../utils/index.js";
+import { escapeHtml } from "../utils/escape-html.js";
 const TOKEN_EXPIRATION_HOURS = 1;
 export const sendPasswordResetLink = async (email, options, baseUrl) => {
   const user = await findUserByEmail(email, options);
@@ -35,6 +36,7 @@ export const sendPasswordResetLink = async (email, options, baseUrl) => {
   resetUrl.searchParams.set("token", token);
   resetUrl.searchParams.set("email", email);
   const resetLink = resetUrl.toString();
+  const safeLink = escapeHtml(resetLink);
   try {
     await transporter.sendMail({
       from: options.mailer.defaults?.from || '"Nuxt Users" <noreply@example.com>',
@@ -51,7 +53,7 @@ If you did not request this password reset, please ignore this email.`,
           <p>You have requested to reset your password. Please click the button below to set a new password:</p>
           
           <div style="text-align: center; margin: 30px 0;">
-            <a href="${resetLink}" 
+            <a href="${safeLink}" 
                style="background-color: #007bff; color: white; padding: 12px 24px; text-decoration: none; border-radius: 5px; display: inline-block;">
               Reset Password
             </a>
@@ -59,7 +61,7 @@ If you did not request this password reset, please ignore this email.`,
           
           <p>Or copy and paste the following link into your browser:</p>
           <p style="word-break: break-all; background-color: #f8f9fa; padding: 10px; border-radius: 3px;">
-            <a href="${resetLink}">${resetLink}</a>
+            <a href="${safeLink}">${safeLink}</a>
           </p>
           
           <p style="color: #6c757d; font-size: 14px;">
@@ -130,6 +132,10 @@ export const resetPassword = async (token, email, newPassword, options) => {
     return false;
   }
   await updateUserPassword(email, newPassword, options);
+  const user = await findUserByEmail(email, options);
+  if (user) {
+    await revokeUserTokens(user.id, options);
+  }
   await db.sql`DELETE FROM {${passwordResetTokensTable}} WHERE email = ${email}`;
   console.log(`[Nuxt Users] Password reset successful for email: ${email}`);
   return true;

package/dist/runtime/server/services/registration.js

@@ -2,6 +2,7 @@ import { createTransport } from "nodemailer";
 import crypto from "node:crypto";
 import bcrypt from "bcrypt";
 import { findUserByEmail, useDb, USER_EMAIL_ALREADY_EXISTS_MESSAGE } from "../utils/index.js";
+import { escapeHtml } from "../utils/escape-html.js";
 import { validatePassword, getPasswordValidationOptions } from "nuxt-users/utils";
 const TOKEN_EXPIRATION_HOURS = 24;
 export const registerUser = async (userData, options, baseUrl) => {
@@ -76,6 +77,8 @@ export const sendConfirmationEmail = async (email, name, token, options, baseUrl
   confirmationUrl.searchParams.set("token", token);
   confirmationUrl.searchParams.set("email", email);
   const confirmationLink = confirmationUrl.toString();
+  const safeName = escapeHtml(name);
+  const safeLink = escapeHtml(confirmationLink);
   try {
     await transporter.sendMail({
       from: options.mailer.defaults?.from || '"Nuxt Users" <noreply@example.com>',
@@ -92,11 +95,11 @@ This link will expire in ${TOKEN_EXPIRATION_HOURS} hours.
 If you did not create an account, please ignore this email.`,
       html: `
         <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-          <h2>Welcome, ${name}!</h2>
+          <h2>Welcome, ${safeName}!</h2>
           <p>Thank you for registering! Please click the button below to confirm your email address and activate your account:</p>
           
           <div style="text-align: center; margin: 30px 0;">
-            <a href="${confirmationLink}" 
+            <a href="${safeLink}" 
                style="background-color: #28a745; color: white; padding: 12px 24px; text-decoration: none; border-radius: 5px; display: inline-block;">
               Confirm Email Address
             </a>
@@ -104,7 +107,7 @@ If you did not create an account, please ignore this email.`,
           
           <p>Or copy and paste the following link into your browser:</p>
           <p style="word-break: break-all; background-color: #f8f9fa; padding: 10px; border-radius: 3px;">
-            <a href="${confirmationLink}">${confirmationLink}</a>
+            <a href="${safeLink}">${safeLink}</a>
           </p>
           
           <p style="color: #6c757d; font-size: 14px;">

package/dist/runtime/server/utils/escape-html.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Escapes a value for safe interpolation into HTML (text content and quoted attributes).
+ */
+export declare const escapeHtml: (value: string) => string;

package/dist/runtime/server/utils/escape-html.js

@@ -0,0 +1,8 @@
+const HTML_ESCAPES = {
+  "&": "&",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+export const escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => HTML_ESCAPES[char]);

package/dist/runtime/server/utils/google-oauth.d.ts

@@ -14,7 +14,7 @@ export declare function createGoogleOAuth2Client(options: GoogleOAuthOptions, ca
 /**
  * Generate authorization URL for Google OAuth
  */
-export declare function getGoogleAuthUrl(oauth2Client: OAuth2Client, options: GoogleOAuthOptions): string;
+export declare function getGoogleAuthUrl(oauth2Client: OAuth2Client, options: GoogleOAuthOptions, state?: string): string;
 /**
  * Exchange authorization code for tokens and get user info
  */

package/dist/runtime/server/utils/google-oauth.js

@@ -9,12 +9,13 @@ export function createGoogleOAuth2Client(options, callbackUrl) {
     callbackUrl
   );
 }
-export function getGoogleAuthUrl(oauth2Client, options) {
+export function getGoogleAuthUrl(oauth2Client, options, state) {
   const scopes = options.scopes || ["openid", "profile", "email"];
   return oauth2Client.generateAuthUrl({
     access_type: "offline",
     scope: scopes,
-    include_granted_scopes: true
+    include_granted_scopes: true,
+    ...state && { state }
   });
 }
 export async function getGoogleUserFromCode(oauth2Client, code) {

package/dist/runtime/server/utils/index.d.ts

@@ -8,3 +8,4 @@ export { createMigrationsTable } from './create-migrations-table.js';
 export { runMigrations, getAppliedMigrations } from './migrate.js';
 export { createGoogleOAuth2Client, getGoogleAuthUrl, getGoogleUserFromCode, findOrCreateGoogleUser, createAuthTokenForUser, generateSecurePassword } from './google-oauth.js';
 export { handleUnauthenticatedRequest, handleInvalidToken, handleUnauthorizedRequest } from './authorization.js';
+export { getSiteUrl, SITE_URL_REQUIRED_MESSAGE } from './site-url.js';

package/dist/runtime/server/utils/index.js

@@ -8,3 +8,4 @@ export { createMigrationsTable } from "./create-migrations-table.js";
 export { runMigrations, getAppliedMigrations } from "./migrate.js";
 export { createGoogleOAuth2Client, getGoogleAuthUrl, getGoogleUserFromCode, findOrCreateGoogleUser, createAuthTokenForUser, generateSecurePassword } from "./google-oauth.js";
 export { handleUnauthenticatedRequest, handleInvalidToken, handleUnauthorizedRequest } from "./authorization.js";
+export { getSiteUrl, SITE_URL_REQUIRED_MESSAGE } from "./site-url.js";

package/dist/runtime/server/utils/site-url.d.ts

@@ -0,0 +1,10 @@
+import { type H3Event } from 'h3';
+import type { ModuleOptions } from 'nuxt-users/utils';
+export declare const SITE_URL_REQUIRED_MESSAGE = "[Nuxt Users] siteUrl is not configured. Set nuxtUsers.siteUrl (or NUXT_NUXT_USERS_SITE_URL) to your public app URL, e.g. https://example.com, so email links are not built from the untrusted Host header.";
+/**
+ * Resolves the base URL used for links in emails (password reset, email confirmation).
+ *
+ * The request's Host / X-Forwarded-Proto headers are attacker-controlled, so they are only
+ * used as a fallback outside production. In production `siteUrl` must be configured.
+ */
+export declare const getSiteUrl: (event: H3Event, options: ModuleOptions) => string;

package/dist/runtime/server/utils/site-url.js

@@ -0,0 +1,13 @@
+import { getHeader } from "h3";
+export const SITE_URL_REQUIRED_MESSAGE = "[Nuxt Users] siteUrl is not configured. Set nuxtUsers.siteUrl (or NUXT_NUXT_USERS_SITE_URL) to your public app URL, e.g. https://example.com, so email links are not built from the untrusted Host header.";
+export const getSiteUrl = (event, options) => {
+  if (options.siteUrl) {
+    return options.siteUrl.replace(/\/+$/, "");
+  }
+  if (process.env.NODE_ENV === "production") {
+    throw new Error(SITE_URL_REQUIRED_MESSAGE);
+  }
+  const host = getHeader(event, "host") || "localhost:3000";
+  const protocol = getHeader(event, "x-forwarded-proto") || "http";
+  return `${protocol}://${host}`;
+};

package/dist/runtime/server/utils/user.d.ts

@@ -59,8 +59,9 @@ export declare const cleanupPersonalAccessTokens: (options: ModuleOptions, inclu
 }>;
 /**
  * Revokes all tokens for a specific user.
+ * Pass `exceptToken` to keep one session (e.g. the one that just changed the password).
  */
-export declare const revokeUserTokens: (userId: number, options: ModuleOptions) => Promise<void>;
+export declare const revokeUserTokens: (userId: number, options: ModuleOptions, exceptToken?: string) => Promise<void>;
 /**
  * Gets the last login time for a user based on their most recent personal access token creation.
  * This represents when the user last successfully logged in.

package/dist/runtime/server/utils/user.js

@@ -226,9 +226,17 @@ export const cleanupPersonalAccessTokens = async (options, includeNoExpiration =
   console.log(`[Nuxt Users] Token cleanup completed: ${expiredCount} expired + ${noExpirationCount} without expiration = ${totalCount} total tokens removed.`);
   return { expiredCount, noExpirationCount, totalCount };
 };
-export const revokeUserTokens = async (userId, options) => {
+export const revokeUserTokens = async (userId, options, exceptToken) => {
   const db = await useDb(options);
   const personalAccessTokensTable = options.tables.personalAccessTokens;
+  if (exceptToken) {
+    await db.sql`
+      DELETE FROM {${personalAccessTokensTable}}
+      WHERE tokenable_type = 'user' AND tokenable_id = ${userId} AND token <> ${exceptToken}
+    `;
+    console.log(`[Nuxt Users] Other tokens revoked for user ID: ${userId}`);
+    return;
+  }
   await db.sql`
     DELETE FROM {${personalAccessTokensTable}}
     WHERE tokenable_type = 'user' AND tokenable_id = ${userId}

package/dist/runtime/utils/permissions.js

@@ -1,3 +1,8 @@
+const patternToRegexSource = (pattern) => pattern.split(/(\*\*|\*)/).map((part) => {
+  if (part === "**") return ".*";
+  if (part === "*") return "[^/]*";
+  return part.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+}).join("");
 export const pathMatchesPattern = (path, pattern) => {
   if (path === pattern) {
     return true;
@@ -5,21 +10,13 @@ export const pathMatchesPattern = (path, pattern) => {
   if (pattern === "*") {
     return true;
   }
-  if ((pattern.match(/\*/g) || []).length > 1) {
-    const regexPattern = pattern.replace(/\*/g, "[^/]*");
-    const regex = new RegExp(`^${regexPattern}`);
-    return regex.test(path);
-  }
-  if (pattern.endsWith("/*")) {
-    const basePattern = pattern.slice(0, -2);
-    return path === basePattern || path.startsWith(basePattern + "/");
+  if (!pattern.includes("*")) {
+    return false;
   }
-  if (pattern.includes("*")) {
-    const regexPattern = pattern.replace(/\*/g, "[^/]*");
-    const regex = new RegExp(`^${regexPattern}`);
-    return regex.test(path);
+  if (pattern.endsWith("/*") && !pattern.endsWith("/**")) {
+    return new RegExp(`^${patternToRegexSource(pattern.slice(0, -2))}(?:/.*)?$`).test(path);
   }
-  return false;
+  return new RegExp(`^${patternToRegexSource(pattern)}$`).test(path);
 };
 export const hasPermission = (userRole, path, method, permissions) => {
   const safeMethods = ["OPTIONS", "HEAD", "TRACE"];

package/dist/shared/{nuxt-users.DtwPhils.d.mts → nuxt-users.Bday8snh.d.mts}

@@ -98,6 +98,12 @@ interface RuntimeModuleOptions {
      * Uses nodemailer
      */
     mailer?: MailerOptions;
+    /**
+     * Public base URL of the app (e.g. 'https://example.com'), used to build links in emails
+     * (password reset, email confirmation). Required in production: the request Host header
+     * is attacker-controlled and is only used as a fallback in development.
+     */
+    siteUrl?: string;
     /**
      * URL path for password reset page
      * @default '/reset-password'
@@ -225,6 +231,7 @@ interface ModuleOptions {
         passwordResetTokens: string;
     };
     mailer?: MailerOptions;
+    siteUrl?: string;
     passwordResetUrl: string;
     emailConfirmationUrl: string;
     auth: {

package/dist/shared/{nuxt-users.DtwPhils.d.ts → nuxt-users.Bday8snh.d.ts}

@@ -98,6 +98,12 @@ interface RuntimeModuleOptions {
      * Uses nodemailer
      */
     mailer?: MailerOptions;
+    /**
+     * Public base URL of the app (e.g. 'https://example.com'), used to build links in emails
+     * (password reset, email confirmation). Required in production: the request Host header
+     * is attacker-controlled and is only used as a fallback in development.
+     */
+    siteUrl?: string;
     /**
      * URL path for password reset page
      * @default '/reset-password'
@@ -225,6 +231,7 @@ interface ModuleOptions {
         passwordResetTokens: string;
     };
     mailer?: MailerOptions;
+    siteUrl?: string;
     passwordResetUrl: string;
     emailConfirmationUrl: string;
     auth: {

package/dist/shared/{nuxt-users.KrHIaTTL.mjs → nuxt-users.CcNeTWsL.mjs}

@@ -24,6 +24,9 @@ const defaultOptions = {
       from: '"Nuxt Users Module" <noreply@example.com>'
     }
   },
+  // Empty by default so NUXT_NUXT_USERS_SITE_URL can override it (Nuxt only applies env vars to existing keys);
+  // empty falls back to the request host in development and is rejected in production
+  siteUrl: "",
   passwordResetUrl: "/reset-password",
   emailConfirmationUrl: "/email-confirmation",
   auth: {

package/dist/utils.d.mts

@@ -1,5 +1,5 @@
-import { P as Permission } from './shared/nuxt-users.DtwPhils.mjs';
-export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, f as PasswordResetToken, g as PersonalAccessToken, h as ResetPasswordFormProps, R as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.DtwPhils.mjs';
+import { P as Permission } from './shared/nuxt-users.Bday8snh.mjs';
+export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, f as PasswordResetToken, g as PersonalAccessToken, h as ResetPasswordFormProps, R as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.Bday8snh.mjs';
 export { defaultLocaleMessages, en, hu, huFormal } from '../dist/runtime/locales/index.js';
 export { getNestedValue, getTranslation } from '../dist/runtime/utils/locale.js';
 export { deepMerge } from '../dist/runtime/utils/deep-merge.js';

package/dist/utils.d.ts

@@ -1,5 +1,5 @@
-import { P as Permission } from './shared/nuxt-users.DtwPhils.js';
-export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, f as PasswordResetToken, g as PersonalAccessToken, h as ResetPasswordFormProps, R as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.DtwPhils.js';
+import { P as Permission } from './shared/nuxt-users.Bday8snh.js';
+export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, f as PasswordResetToken, g as PersonalAccessToken, h as ResetPasswordFormProps, R as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.Bday8snh.js';
 export { defaultLocaleMessages, en, hu, huFormal } from '../dist/runtime/locales/index.js';
 export { getNestedValue, getTranslation } from '../dist/runtime/utils/locale.js';
 export { deepMerge } from '../dist/runtime/utils/deep-merge.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-users",
-  "version": "1.49.2",
+  "version": "1.50.0",
   "description": "A comprehensive user management module for Nuxt applications with authentication, authorization, database support, and CLI tools",
   "keywords": [
     "nuxt",
@@ -55,7 +55,7 @@
   "scripts": {
     "prepack": "nuxt-module-build build && node scripts/post-build.js",
     "postinstall": "node -e \"try { require('fs').chmodSync('./dist/cli.mjs', '755') } catch(e) {}\" && node scripts/check-peer-dependencies.js",
-    "predev": "node -v | grep -q 'v22' || (echo 'Please use Node.js v22 for development' && exit 1)",
+    "predev": "node -v | grep -qE '^v(22|24)\\.' || (echo 'Please use Node.js v22 or v24 for development' && exit 1)",
     "dev": "yarn dev:prepare && nuxi dev playground",
     "dev:build": "nuxi build playground",
     "dev:prepare": "yarn nuxt-module-build build --stub && yarn nuxt-module-build prepare && nuxi prepare playground",
@@ -65,13 +65,13 @@
     "check:locale-consistency": "tsx scripts/check-locale-consistency.ts",
     "check:npm_token": "dotenv -- sh -c 'if [ -z \"$NPM_TOKEN\" ]; then echo \"❌ NPM_TOKEN environment variable is not set in .env file. Please set it to your npm token.\"; exit 1; fi'",
     "check:npm_auth": "dotenv -- sh -c 'npm whoami --registry https://registry.npmjs.org/ --//registry.npmjs.org/:_authToken=$NPM_TOKEN'",
-    "release:publish:dry": "dotenv -- sh -c 'npm publish --dry-run --ignore-scripts --registry https://registry.npmjs.org/ --//registry.npmjs.org/:_authToken=$NPM_TOKEN'",
+    "release:publish:dry": "npm pack --dry-run --ignore-scripts",
     "release:preflight": "yarn prerelease && yarn check:npm_token && yarn check:npm_auth && sh scripts/release-preflight.sh",
-    "prerelease": "node -v | grep -q 'v22' || (echo 'Please use Node.js v22 for deployment' && exit 1)",
+    "prerelease": "node -v | grep -qE '^v(22|24)\\.' || (echo 'Please use Node.js v22 or v24 for deployment' && exit 1)",
     "release": "yarn release:preflight && yarn lint && yarn check:translations && yarn check:locale-consistency && yarn test && yarn prepack && yarn release:publish:dry && dotenv -- changelogen --release && dotenv -- sh -c 'npm publish --//registry.npmjs.org/:_authToken=$NPM_TOKEN --registry https://registry.npmjs.org/' && git push --follow-tags",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "pretest": "node -v | grep -q 'v22' || (echo 'Please use Node.js v22 for testing' && exit 1)",
+    "pretest": "node -v | grep -qE '^v(22|24)\\.' || (echo 'Please use Node.js v22 or v24 for testing' && exit 1)",
     "test:quick": "yarn test:unit && yarn test:sqlite",
     "test:release": "yarn test && yarn build && yarn lint:fix",
     "test:types": "yarn dev:prepare && vue-tsc --noEmit --project tsconfig.vitest.json && cd playground && vue-tsc --noEmit",

package/scripts/deploy-docs.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
 
 # Configuration
-SERVER_HOST="sravanam"
-REMOTE_DOCS_PATH="/var/www/nuxt-users.webmania.cc"
+SERVER_HOST="root_balarama"
+REMOTE_DOCS_PATH="/var/www/nuxt-users.webmania.cc/web/"
 LOCAL_BUILD_PATH="docs/.vitepress/dist"
 
 # Colors for output
@@ -65,4 +65,4 @@ EOF
 rm "$TEMP_TAR"
 
 echo -e "${GREEN}✅ Documentation deployment completed!${NC}"
-echo -e "${YELLOW}🌐 Your docs should now be available on your server${NC}" 
+echo -e "${YELLOW}🌐 Your docs should now be available on your server${NC}" 

package/scripts/test-integration.sh

@@ -84,6 +84,17 @@ else
     exit 1
 fi
 
+# Test 1b: A dot in the query string must not skip authentication
+print_status $YELLOW "🔐 Testing user creation with a dot in the query string requires authentication..."
+response=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:3000/api/nuxt-users?x=a.b" -X POST -H "Content-Type: application/json" -d '{"email":"bypass@example.com","name":"Bypass","password":"Bypass-123456","role":"admin"}' || echo "000")
+
+if [ "$response" = "401" ]; then
+    print_status $GREEN "✅ Query string with a dot does not bypass authentication (401)"
+else
+    print_status $RED "❌ POST /api/nuxt-users?x=a.b should return 401, got $response - authentication bypass!"
+    exit 1
+fi
+
 # Test 2: Session endpoint should be accessible (not 401)
 print_status $YELLOW "📝 Testing session endpoint /api/nuxt-users/session..."
 response=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:3000/api/nuxt-users/session" -X POST || echo "000")