nuxt-users 1.49.3 → 1.50.1

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { defineCommand, runMain } from 'citty';
 import { readFileSync } from 'node:fs';
-import { d as defaultOptions } from './shared/nuxt-users.KrHIaTTL.mjs';
+import { d as defaultOptions } from './shared/nuxt-users.CcNeTWsL.mjs';
 import { defu } from 'defu';
 import { runMigrations, getAppliedMigrations } from '../dist/runtime/server/utils/migrate.js';
 import { createUser as createUser$1 } from '../dist/runtime/server/utils/user.js';

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=3.0.0"
   },
-  "version": "1.49.3",
+  "version": "1.50.1",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,6 +1,6 @@
 import { defineNuxtModule, createResolver, addPlugin, addImportsDir, addServerImportsDir, addServerScanDir, addServerHandler, addServerPlugin, addRouteMiddleware, addComponentsDir } from '@nuxt/kit';
 import { defu } from 'defu';
-import { d as defaultOptions } from './shared/nuxt-users.KrHIaTTL.mjs';
+import { d as defaultOptions } from './shared/nuxt-users.CcNeTWsL.mjs';
 export * from '../dist/runtime/server/internal/index.js';
 
 const module$1 = defineNuxtModule({

package/dist/runtime/constants.d.ts

@@ -1,3 +1,4 @@
+export declare const OAUTH_STATE_COOKIE = "nuxt_users_oauth_state";
 export declare const PUBLIC_PAGES: string[];
 export declare const PUBLIC_API_ENDPOINTS: {
     path: string;

package/dist/runtime/constants.js

@@ -1,3 +1,4 @@
+export const OAUTH_STATE_COOKIE = "nuxt_users_oauth_state";
 export const PUBLIC_PAGES = ["/login", "/reset-password"];
 export const PUBLIC_API_ENDPOINTS = [
   { path: "/password/forgot", methods: ["POST"] },

package/dist/runtime/server/api/nuxt-users/[id].patch.js

@@ -12,7 +12,7 @@ export default defineEventHandler(async (event) => {
     });
   }
   const body = await readBody(event);
-  const currentUser = event.context.user;
+  const currentUser = event.context.nuxtUsers?.user;
   if (currentUser && currentUser.id === userId && typeof body.active !== "undefined") {
     throw createError({
       statusCode: 403,

package/dist/runtime/server/api/nuxt-users/auth/google/callback.get.js

@@ -1,4 +1,5 @@
-import { defineEventHandler, sendRedirect, getQuery, setCookie } from "h3";
+import crypto from "node:crypto";
+import { defineEventHandler, sendRedirect, getQuery, setCookie, getCookie, deleteCookie } from "h3";
 import { useRuntimeConfig } from "#imports";
 import {
   createGoogleOAuth2Client,
@@ -6,6 +7,7 @@ import {
   findOrCreateGoogleUser,
   createAuthTokenForUser
 } from "../../../../utils/index.js";
+import { OAUTH_STATE_COOKIE } from "../../../../../constants.js";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
   const options = nuxtUsers;
@@ -13,6 +15,13 @@ export default defineEventHandler(async (event) => {
   if (!options.auth.google) {
     return sendRedirect(event, "/login?error=oauth_not_configured");
   }
+  const expectedState = getCookie(event, OAUTH_STATE_COOKIE);
+  deleteCookie(event, OAUTH_STATE_COOKIE, { path: "/" });
+  if (!isValidState(expectedState, query.state)) {
+    console.error("[Nuxt Users] Invalid or missing OAuth state in callback");
+    const errorRedirect = options.auth.google.errorRedirect || "/login?error=oauth_failed";
+    return sendRedirect(event, errorRedirect);
+  }
   if (query.error) {
     console.error("[Nuxt Users] Google OAuth error:", query.error);
     const errorRedirect = options.auth.google.errorRedirect || "/login?error=oauth_failed";
@@ -60,6 +69,14 @@ export default defineEventHandler(async (event) => {
     return sendRedirect(event, errorRedirect);
   }
 });
+const isValidState = (expected, received) => {
+  if (!expected || typeof received !== "string") {
+    return false;
+  }
+  const expectedBuffer = Buffer.from(expected);
+  const receivedBuffer = Buffer.from(received);
+  return expectedBuffer.length === receivedBuffer.length && crypto.timingSafeEqual(expectedBuffer, receivedBuffer);
+};
 const getRequestURL = (event) => {
   const headers = event.node.req.headers;
   const host = headers.host || headers[":authority"];

package/dist/runtime/server/api/nuxt-users/auth/google/redirect.get.js

@@ -1,6 +1,8 @@
-import { defineEventHandler, sendRedirect, createError } from "h3";
+import crypto from "node:crypto";
+import { defineEventHandler, sendRedirect, createError, setCookie } from "h3";
 import { useRuntimeConfig } from "#imports";
 import { createGoogleOAuth2Client, getGoogleAuthUrl } from "../../../../utils/index.js";
+import { OAUTH_STATE_COOKIE } from "../../../../../constants.js";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
   const options = nuxtUsers;
@@ -21,7 +23,15 @@ export default defineEventHandler(async (event) => {
     const callbackPath = options.auth.google.callbackUrl || `${options.apiBasePath}/auth/google/callback`;
     const callbackUrl = `${baseUrl}${callbackPath}`;
     const oauth2Client = createGoogleOAuth2Client(options.auth.google, callbackUrl);
-    const authUrl = getGoogleAuthUrl(oauth2Client, options.auth.google);
+    const state = crypto.randomBytes(32).toString("hex");
+    setCookie(event, OAUTH_STATE_COOKIE, state, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      path: "/",
+      maxAge: 10 * 60
+    });
+    const authUrl = getGoogleAuthUrl(oauth2Client, options.auth.google, state);
     return sendRedirect(event, authUrl);
   } catch (error) {
     console.error("[Nuxt Users] Google OAuth redirect error:", error);

package/dist/runtime/server/api/nuxt-users/me.patch.js

@@ -4,7 +4,7 @@ import { updateUser } from "../../utils/index.js";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
   const options = nuxtUsers;
-  const user = event.context.user;
+  const user = event.context.nuxtUsers?.user;
   if (!user) {
     throw createError({
       statusCode: 401,
@@ -12,12 +12,8 @@ export default defineEventHandler(async (event) => {
     });
   }
   const body = await readBody(event);
-  if (body.role) {
-    delete body.role;
-  }
-  if (body.active) {
-    delete body.active;
-  }
+  delete body.role;
+  delete body.active;
   try {
     const updatedUser = await updateUser(user.id, body, options);
     return { user: updatedUser };

package/dist/runtime/server/api/nuxt-users/password/forgot.post.js

@@ -1,5 +1,6 @@
-import { defineEventHandler, readBody, createError, getHeader } from "h3";
+import { defineEventHandler, readBody, createError } from "h3";
 import { sendPasswordResetLink } from "../../../services/password.js";
+import { getSiteUrl } from "../../../utils/site-url.js";
 import { useRuntimeConfig } from "#imports";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
@@ -13,9 +14,7 @@ export default defineEventHandler(async (event) => {
     });
   }
   try {
-    const host = getHeader(event, "host");
-    const protocol = getHeader(event, "x-forwarded-proto") || "http";
-    const baseUrl = host ? `${protocol}://${host}` : void 0;
+    const baseUrl = getSiteUrl(event, options);
     await sendPasswordResetLink(email, options, baseUrl);
     return { message: "If a user with that email exists, a password reset link has been sent." };
   } catch (error) {

package/dist/runtime/server/api/nuxt-users/password/index.patch.js

@@ -1,7 +1,7 @@
 import { createError, defineEventHandler, getCookie, readBody } from "h3";
 import bcrypt from "bcrypt";
 import { useRuntimeConfig } from "#imports";
-import { getCurrentUserFromToken, updateUserPassword } from "../../../utils/index.js";
+import { getCurrentUserFromToken, updateUserPassword, revokeUserTokens } from "../../../utils/index.js";
 import { validatePassword, getPasswordValidationOptions } from "../../../../../utils";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
@@ -56,5 +56,6 @@ export default defineEventHandler(async (event) => {
     });
   }
   await updateUserPassword(user.email, newPassword, options);
+  await revokeUserTokens(user.id, options, token);
   return { message: "Password updated successfully" };
 });

package/dist/runtime/server/api/nuxt-users/register.post.js

@@ -1,6 +1,7 @@
-import { createError, defineEventHandler, readBody, getHeader } from "h3";
+import { createError, defineEventHandler, readBody } from "h3";
 import { useRuntimeConfig } from "#imports";
 import { registerUser } from "../../services/registration.js";
+import { getSiteUrl } from "../../utils/site-url.js";
 export default defineEventHandler(async (event) => {
   try {
     const { nuxtUsers } = useRuntimeConfig();
@@ -25,9 +26,7 @@ export default defineEventHandler(async (event) => {
         statusMessage: "Name cannot be empty"
       });
     }
-    const host = getHeader(event, "host") || "localhost:3000";
-    const protocol = getHeader(event, "x-forwarded-proto") || "http";
-    const baseUrl = `${protocol}://${host}`;
+    const baseUrl = getSiteUrl(event, options);
     const result = await registerUser(
       {
         email: body.email.toLowerCase().trim(),

package/dist/runtime/server/plugins/validate-mailer-config.js

@@ -29,5 +29,8 @@ const plugin = () => {
     return;
   }
   validateMailerConfig(options);
+  if (process.env.NODE_ENV === "production" && !options.siteUrl) {
+    console.warn("[Nuxt Users] siteUrl is not configured: password reset and email confirmation requests will fail. Set nuxtUsers.siteUrl (or NUXT_NUXT_USERS_SITE_URL) to your public app URL.");
+  }
 };
 export default plugin;

package/dist/runtime/server/services/password.d.ts

@@ -8,7 +8,3 @@ export declare const sendPasswordResetLink: (email: string, options: ModuleOptio
  */
 export declare const resetPassword: (token: string, email: string, // Added email to quickly find the token
 newPassword: string, options: ModuleOptions) => Promise<boolean>;
-/**
- * Deletes expired password reset tokens from the database.
- */
-export declare const deleteExpiredPasswordResetTokens: (options: ModuleOptions) => Promise<void>;

package/dist/runtime/server/services/password.js

@@ -1,7 +1,9 @@
 import { createTransport } from "nodemailer";
 import crypto from "node:crypto";
 import bcrypt from "bcrypt";
-import { findUserByEmail, updateUserPassword, useDb } from "../utils/index.js";
+import { findUserByEmail, updateUserPassword, revokeUserTokens, useDb } from "../utils/index.js";
+import { escapeHtml } from "../utils/escape-html.js";
+import { isTokenExpired, findTokenRecordsByEmail } from "../utils/token-expiry.js";
 const TOKEN_EXPIRATION_HOURS = 1;
 export const sendPasswordResetLink = async (email, options, baseUrl) => {
   const user = await findUserByEmail(email, options);
@@ -35,6 +37,7 @@ export const sendPasswordResetLink = async (email, options, baseUrl) => {
   resetUrl.searchParams.set("token", token);
   resetUrl.searchParams.set("email", email);
   const resetLink = resetUrl.toString();
+  const safeLink = escapeHtml(resetLink);
   try {
     await transporter.sendMail({
       from: options.mailer.defaults?.from || '"Nuxt Users" <noreply@example.com>',
@@ -51,7 +54,7 @@ If you did not request this password reset, please ignore this email.`,
           <p>You have requested to reset your password. Please click the button below to set a new password:</p>
           
           <div style="text-align: center; margin: 30px 0;">
-            <a href="${resetLink}" 
+            <a href="${safeLink}" 
                style="background-color: #007bff; color: white; padding: 12px 24px; text-decoration: none; border-radius: 5px; display: inline-block;">
               Reset Password
             </a>
@@ -59,7 +62,7 @@ If you did not request this password reset, please ignore this email.`,
           
           <p>Or copy and paste the following link into your browser:</p>
           <p style="word-break: break-all; background-color: #f8f9fa; padding: 10px; border-radius: 3px;">
-            <a href="${resetLink}">${resetLink}</a>
+            <a href="${safeLink}">${safeLink}</a>
           </p>
           
           <p style="color: #6c757d; font-size: 14px;">
@@ -80,17 +83,13 @@ If you did not request this password reset, please ignore this email.`,
 export const resetPassword = async (token, email, newPassword, options) => {
   const db = await useDb(options);
   const passwordResetTokensTable = options.tables.passwordResetTokens;
-  const tokenRecords = await db.sql`
-    SELECT * FROM {${passwordResetTokensTable}}
-    WHERE email = ${email}
-    ORDER BY created_at DESC
-  `;
-  if (tokenRecords.rows.length === 0) {
+  const tokenRecords = await findTokenRecordsByEmail(db, passwordResetTokensTable, email);
+  if (tokenRecords.length === 0) {
     console.log(`[Nuxt Users] No password reset tokens found for email: ${email}`);
     return false;
   }
   let validTokenRecord = null;
-  for (const record of tokenRecords.rows) {
+  for (const record of tokenRecords) {
     const tokenMatch = await bcrypt.compare(token, record.token);
     if (tokenMatch) {
       validTokenRecord = record;
@@ -101,48 +100,17 @@ export const resetPassword = async (token, email, newPassword, options) => {
     console.log(`[Nuxt Users] Invalid password reset token provided for email: ${email}`);
     return false;
   }
-  const now = /* @__PURE__ */ new Date();
-  const currentTimeString = now.toISOString().slice(0, 19).replace("T", " ");
-  const createdAtString = validTokenRecord.created_at instanceof Date ? validTokenRecord.created_at.toISOString().slice(0, 19).replace("T", " ") : String(validTokenRecord.created_at);
-  const [datePart, timePart] = createdAtString.split(/[ T]/);
-  if (!datePart || !timePart) {
-    console.log(`[Nuxt Users] Invalid timestamp format for token: ${createdAtString}`);
-    return false;
-  }
-  const [year, month, day] = datePart.split("-").map(Number);
-  const [hour, minute, second] = timePart.split(":").map(Number);
-  if (!year || !month || !day || hour === void 0 || minute === void 0 || second === void 0) {
-    console.log("[Nuxt Users] Invalid timestamp components");
-    return false;
-  }
-  let expirationHour = hour + TOKEN_EXPIRATION_HOURS;
-  let expirationDay = day;
-  const expirationMonth = month;
-  const expirationYear = year;
-  if (expirationHour >= 24) {
-    expirationHour -= 24;
-    expirationDay++;
-  }
-  const expirationTimeString = `${expirationYear.toString().padStart(4, "0")}-${expirationMonth.toString().padStart(2, "0")}-${expirationDay.toString().padStart(2, "0")} ${expirationHour.toString().padStart(2, "0")}:${minute.toString().padStart(2, "0")}:${second.toString().padStart(2, "0")}`;
-  if (currentTimeString > expirationTimeString) {
+  if (isTokenExpired(validTokenRecord.created_at, validTokenRecord.db_now, TOKEN_EXPIRATION_HOURS)) {
     console.log(`[Nuxt Users] Expired password reset token for email: ${email}`);
     await db.sql`DELETE FROM {${passwordResetTokensTable}} WHERE id = ${validTokenRecord.id}`;
     return false;
   }
   await updateUserPassword(email, newPassword, options);
+  const user = await findUserByEmail(email, options);
+  if (user) {
+    await revokeUserTokens(user.id, options);
+  }
   await db.sql`DELETE FROM {${passwordResetTokensTable}} WHERE email = ${email}`;
   console.log(`[Nuxt Users] Password reset successful for email: ${email}`);
   return true;
 };
-export const deleteExpiredPasswordResetTokens = async (options) => {
-  const db = await useDb(options);
-  const passwordResetTokensTable = options.tables.passwordResetTokens;
-  const expirationDate = /* @__PURE__ */ new Date();
-  expirationDate.setHours(expirationDate.getHours() - TOKEN_EXPIRATION_HOURS);
-  const expirationDateString = expirationDate.toISOString().slice(0, 19).replace("T", " ");
-  await db.sql`
-    DELETE FROM {${passwordResetTokensTable}}
-    WHERE created_at < ${expirationDateString}
-  `;
-  console.log(`[Nuxt Users] Expired password reset tokens older than ${expirationDateString} deleted.`);
-};

package/dist/runtime/server/services/registration.js

@@ -2,6 +2,8 @@ import { createTransport } from "nodemailer";
 import crypto from "node:crypto";
 import bcrypt from "bcrypt";
 import { findUserByEmail, useDb, USER_EMAIL_ALREADY_EXISTS_MESSAGE } from "../utils/index.js";
+import { escapeHtml } from "../utils/escape-html.js";
+import { isTokenExpired, findTokenRecordsByEmail } from "../utils/token-expiry.js";
 import { validatePassword, getPasswordValidationOptions } from "nuxt-users/utils";
 const TOKEN_EXPIRATION_HOURS = 24;
 export const registerUser = async (userData, options, baseUrl) => {
@@ -76,6 +78,8 @@ export const sendConfirmationEmail = async (email, name, token, options, baseUrl
   confirmationUrl.searchParams.set("token", token);
   confirmationUrl.searchParams.set("email", email);
   const confirmationLink = confirmationUrl.toString();
+  const safeName = escapeHtml(name);
+  const safeLink = escapeHtml(confirmationLink);
   try {
     await transporter.sendMail({
       from: options.mailer.defaults?.from || '"Nuxt Users" <noreply@example.com>',
@@ -92,11 +96,11 @@ This link will expire in ${TOKEN_EXPIRATION_HOURS} hours.
 If you did not create an account, please ignore this email.`,
       html: `
         <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
-          <h2>Welcome, ${name}!</h2>
+          <h2>Welcome, ${safeName}!</h2>
           <p>Thank you for registering! Please click the button below to confirm your email address and activate your account:</p>
           
           <div style="text-align: center; margin: 30px 0;">
-            <a href="${confirmationLink}" 
+            <a href="${safeLink}" 
                style="background-color: #28a745; color: white; padding: 12px 24px; text-decoration: none; border-radius: 5px; display: inline-block;">
               Confirm Email Address
             </a>
@@ -104,7 +108,7 @@ If you did not create an account, please ignore this email.`,
           
           <p>Or copy and paste the following link into your browser:</p>
           <p style="word-break: break-all; background-color: #f8f9fa; padding: 10px; border-radius: 3px;">
-            <a href="${confirmationLink}">${confirmationLink}</a>
+            <a href="${safeLink}">${safeLink}</a>
           </p>
           
           <p style="color: #6c757d; font-size: 14px;">
@@ -127,17 +131,13 @@ export const confirmUserEmail = async (token, email, options) => {
   const db = await useDb(options);
   const passwordResetTokensTable = options.tables.passwordResetTokens;
   const usersTable = options.tables.users;
-  const tokenRecords = await db.sql`
-    SELECT * FROM {${passwordResetTokensTable}}
-    WHERE email = ${email}
-    ORDER BY created_at DESC
-  `;
-  if (tokenRecords.rows.length === 0) {
+  const tokenRecords = await findTokenRecordsByEmail(db, passwordResetTokensTable, email);
+  if (tokenRecords.length === 0) {
     console.log(`[Nuxt Users] No confirmation tokens found for email: ${email}`);
     return false;
   }
   let validTokenRecord = null;
-  for (const record of tokenRecords.rows) {
+  for (const record of tokenRecords) {
     const tokenMatch = await bcrypt.compare(token, record.token);
     if (tokenMatch) {
       validTokenRecord = record;
@@ -148,44 +148,7 @@ export const confirmUserEmail = async (token, email, options) => {
     console.log(`[Nuxt Users] Invalid confirmation token provided for email: ${email}`);
     return false;
   }
-  const now = /* @__PURE__ */ new Date();
-  const currentTimeString = now.toISOString().slice(0, 19).replace("T", " ");
-  const createdAtString = validTokenRecord.created_at instanceof Date ? validTokenRecord.created_at.toISOString().slice(0, 19).replace("T", " ") : String(validTokenRecord.created_at);
-  const [datePart, timePart] = createdAtString.split(/[ T]/);
-  if (!datePart || !timePart) {
-    console.log(`[Nuxt Users] Invalid timestamp format for token: ${createdAtString}`);
-    return false;
-  }
-  const [year, month, day] = datePart.split("-").map(Number);
-  const [hour, minute, second] = timePart.split(":").map(Number);
-  if (!year || !month || !day || hour === void 0 || minute === void 0 || second === void 0) {
-    console.log("[Nuxt Users] Invalid timestamp components");
-    return false;
-  }
-  let expirationHour = hour + TOKEN_EXPIRATION_HOURS;
-  let expirationDay = day;
-  let expirationMonth = month;
-  let expirationYear = year;
-  if (expirationHour >= 24) {
-    expirationHour -= 24;
-    expirationDay++;
-    const daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-    if (expirationYear % 4 === 0 && (expirationYear % 100 !== 0 || expirationYear % 400 === 0)) {
-      daysInMonth[1] = 29;
-    }
-    const monthIndex = expirationMonth - 1;
-    const daysInCurrentMonth = daysInMonth[monthIndex];
-    if (daysInCurrentMonth && expirationDay > daysInCurrentMonth) {
-      expirationDay = 1;
-      expirationMonth++;
-      if (expirationMonth > 12) {
-        expirationMonth = 1;
-        expirationYear++;
-      }
-    }
-  }
-  const expirationTimeString = `${expirationYear.toString().padStart(4, "0")}-${expirationMonth.toString().padStart(2, "0")}-${expirationDay.toString().padStart(2, "0")} ${expirationHour.toString().padStart(2, "0")}:${minute.toString().padStart(2, "0")}:${second.toString().padStart(2, "0")}`;
-  if (currentTimeString > expirationTimeString) {
+  if (isTokenExpired(validTokenRecord.created_at, validTokenRecord.db_now, TOKEN_EXPIRATION_HOURS)) {
     console.log(`[Nuxt Users] Expired confirmation token for email: ${email}`);
     await db.sql`DELETE FROM {${passwordResetTokensTable}} WHERE id = ${validTokenRecord.id}`;
     return false;

package/dist/runtime/server/utils/escape-html.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Escapes a value for safe interpolation into HTML (text content and quoted attributes).
+ */
+export declare const escapeHtml: (value: string) => string;

package/dist/runtime/server/utils/escape-html.js

@@ -0,0 +1,8 @@
+const HTML_ESCAPES = {
+  "&": "&",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+export const escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => HTML_ESCAPES[char]);

package/dist/runtime/server/utils/google-oauth.d.ts

@@ -14,7 +14,7 @@ export declare function createGoogleOAuth2Client(options: GoogleOAuthOptions, ca
 /**
  * Generate authorization URL for Google OAuth
  */
-export declare function getGoogleAuthUrl(oauth2Client: OAuth2Client, options: GoogleOAuthOptions): string;
+export declare function getGoogleAuthUrl(oauth2Client: OAuth2Client, options: GoogleOAuthOptions, state?: string): string;
 /**
  * Exchange authorization code for tokens and get user info
  */

package/dist/runtime/server/utils/google-oauth.js

@@ -9,12 +9,13 @@ export function createGoogleOAuth2Client(options, callbackUrl) {
     callbackUrl
   );
 }
-export function getGoogleAuthUrl(oauth2Client, options) {
+export function getGoogleAuthUrl(oauth2Client, options, state) {
   const scopes = options.scopes || ["openid", "profile", "email"];
   return oauth2Client.generateAuthUrl({
     access_type: "offline",
     scope: scopes,
-    include_granted_scopes: true
+    include_granted_scopes: true,
+    ...state && { state }
   });
 }
 export async function getGoogleUserFromCode(oauth2Client, code) {

package/dist/runtime/server/utils/index.d.ts

@@ -8,3 +8,4 @@ export { createMigrationsTable } from './create-migrations-table.js';
 export { runMigrations, getAppliedMigrations } from './migrate.js';
 export { createGoogleOAuth2Client, getGoogleAuthUrl, getGoogleUserFromCode, findOrCreateGoogleUser, createAuthTokenForUser, generateSecurePassword } from './google-oauth.js';
 export { handleUnauthenticatedRequest, handleInvalidToken, handleUnauthorizedRequest } from './authorization.js';
+export { getSiteUrl, SITE_URL_REQUIRED_MESSAGE } from './site-url.js';

package/dist/runtime/server/utils/index.js

@@ -8,3 +8,4 @@ export { createMigrationsTable } from "./create-migrations-table.js";
 export { runMigrations, getAppliedMigrations } from "./migrate.js";
 export { createGoogleOAuth2Client, getGoogleAuthUrl, getGoogleUserFromCode, findOrCreateGoogleUser, createAuthTokenForUser, generateSecurePassword } from "./google-oauth.js";
 export { handleUnauthenticatedRequest, handleInvalidToken, handleUnauthorizedRequest } from "./authorization.js";
+export { getSiteUrl, SITE_URL_REQUIRED_MESSAGE } from "./site-url.js";

package/dist/runtime/server/utils/site-url.d.ts

@@ -0,0 +1,10 @@
+import { type H3Event } from 'h3';
+import type { ModuleOptions } from 'nuxt-users/utils';
+export declare const SITE_URL_REQUIRED_MESSAGE = "[Nuxt Users] siteUrl is not configured. Set nuxtUsers.siteUrl (or NUXT_NUXT_USERS_SITE_URL) to your public app URL, e.g. https://example.com, so email links are not built from the untrusted Host header.";
+/**
+ * Resolves the base URL used for links in emails (password reset, email confirmation).
+ *
+ * The request's Host / X-Forwarded-Proto headers are attacker-controlled, so they are only
+ * used as a fallback outside production. In production `siteUrl` must be configured.
+ */
+export declare const getSiteUrl: (event: H3Event, options: ModuleOptions) => string;

package/dist/runtime/server/utils/site-url.js

@@ -0,0 +1,13 @@
+import { getHeader } from "h3";
+export const SITE_URL_REQUIRED_MESSAGE = "[Nuxt Users] siteUrl is not configured. Set nuxtUsers.siteUrl (or NUXT_NUXT_USERS_SITE_URL) to your public app URL, e.g. https://example.com, so email links are not built from the untrusted Host header.";
+export const getSiteUrl = (event, options) => {
+  if (options.siteUrl) {
+    return options.siteUrl.replace(/\/+$/, "");
+  }
+  if (process.env.NODE_ENV === "production") {
+    throw new Error(SITE_URL_REQUIRED_MESSAGE);
+  }
+  const host = getHeader(event, "host") || "localhost:3000";
+  const protocol = getHeader(event, "x-forwarded-proto") || "http";
+  return `${protocol}://${host}`;
+};

package/dist/runtime/server/utils/token-expiry.d.ts

@@ -0,0 +1,27 @@
+import type { Database } from 'db0';
+/**
+ * A DB timestamp as returned by the driver: a Date (MySQL, PostgreSQL)
+ * or a 'YYYY-MM-DD HH:MM:SS' string (SQLite).
+ */
+export type DbTimestamp = Date | string;
+/**
+ * Decides whether a token is older than `hours`.
+ *
+ * `dbNow` must be the database's own CURRENT_TIMESTAMP, read in the same query as `createdAt`:
+ * both values then share the database's and the driver's time zone handling, so the difference
+ * is correct whatever time zones the database and the Node process use.
+ */
+export declare const isTokenExpired: (createdAt: DbTimestamp, dbNow: DbTimestamp, hours: number) => boolean;
+/** A row of the password reset / confirmation token table, with the database's own clock alongside */
+export interface TokenRecord {
+    id: number;
+    email: string;
+    token: string;
+    created_at: DbTimestamp;
+    db_now: DbTimestamp;
+}
+/**
+ * Finds the tokens for an email, newest first. `db_now` is read in the same query so that
+ * expiry can be judged on the database's own clock with `isTokenExpired` (issue #220).
+ */
+export declare const findTokenRecordsByEmail: (db: Database, table: string, email: string) => Promise<TokenRecord[]>;

package/dist/runtime/server/utils/token-expiry.js

@@ -0,0 +1,24 @@
+const toMilliseconds = (value) => {
+  if (value instanceof Date) {
+    return value.getTime();
+  }
+  if (typeof value !== "string") {
+    return Number.NaN;
+  }
+  return Date.parse(`${value.replace(" ", "T")}Z`);
+};
+export const isTokenExpired = (createdAt, dbNow, hours) => {
+  const ageMs = toMilliseconds(dbNow) - toMilliseconds(createdAt);
+  if (Number.isNaN(ageMs)) {
+    return true;
+  }
+  return ageMs > hours * 60 * 60 * 1e3;
+};
+export const findTokenRecordsByEmail = async (db, table, email) => {
+  const result = await db.sql`
+    SELECT *, CURRENT_TIMESTAMP AS db_now FROM {${table}}
+    WHERE email = ${email}
+    ORDER BY created_at DESC
+  `;
+  return result.rows;
+};

package/dist/runtime/server/utils/user.d.ts

@@ -59,8 +59,9 @@ export declare const cleanupPersonalAccessTokens: (options: ModuleOptions, inclu
 }>;
 /**
  * Revokes all tokens for a specific user.
+ * Pass `exceptToken` to keep one session (e.g. the one that just changed the password).
  */
-export declare const revokeUserTokens: (userId: number, options: ModuleOptions) => Promise<void>;
+export declare const revokeUserTokens: (userId: number, options: ModuleOptions, exceptToken?: string) => Promise<void>;
 /**
  * Gets the last login time for a user based on their most recent personal access token creation.
  * This represents when the user last successfully logged in.

package/dist/runtime/server/utils/user.js

@@ -226,9 +226,17 @@ export const cleanupPersonalAccessTokens = async (options, includeNoExpiration =
   console.log(`[Nuxt Users] Token cleanup completed: ${expiredCount} expired + ${noExpirationCount} without expiration = ${totalCount} total tokens removed.`);
   return { expiredCount, noExpirationCount, totalCount };
 };
-export const revokeUserTokens = async (userId, options) => {
+export const revokeUserTokens = async (userId, options, exceptToken) => {
   const db = await useDb(options);
   const personalAccessTokensTable = options.tables.personalAccessTokens;
+  if (exceptToken) {
+    await db.sql`
+      DELETE FROM {${personalAccessTokensTable}}
+      WHERE tokenable_type = 'user' AND tokenable_id = ${userId} AND token <> ${exceptToken}
+    `;
+    console.log(`[Nuxt Users] Other tokens revoked for user ID: ${userId}`);
+    return;
+  }
   await db.sql`
     DELETE FROM {${personalAccessTokensTable}}
     WHERE tokenable_type = 'user' AND tokenable_id = ${userId}

package/dist/runtime/utils/permissions.js

@@ -1,3 +1,8 @@
+const patternToRegexSource = (pattern) => pattern.split(/(\*\*|\*)/).map((part) => {
+  if (part === "**") return ".*";
+  if (part === "*") return "[^/]*";
+  return part.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+}).join("");
 export const pathMatchesPattern = (path, pattern) => {
   if (path === pattern) {
     return true;
@@ -5,21 +10,13 @@ export const pathMatchesPattern = (path, pattern) => {
   if (pattern === "*") {
     return true;
   }
-  if ((pattern.match(/\*/g) || []).length > 1) {
-    const regexPattern = pattern.replace(/\*/g, "[^/]*");
-    const regex = new RegExp(`^${regexPattern}`);
-    return regex.test(path);
-  }
-  if (pattern.endsWith("/*")) {
-    const basePattern = pattern.slice(0, -2);
-    return path === basePattern || path.startsWith(basePattern + "/");
+  if (!pattern.includes("*")) {
+    return false;
   }
-  if (pattern.includes("*")) {
-    const regexPattern = pattern.replace(/\*/g, "[^/]*");
-    const regex = new RegExp(`^${regexPattern}`);
-    return regex.test(path);
+  if (pattern.endsWith("/*") && !pattern.endsWith("/**")) {
+    return new RegExp(`^${patternToRegexSource(pattern.slice(0, -2))}(?:/.*)?$`).test(path);
   }
-  return false;
+  return new RegExp(`^${patternToRegexSource(pattern)}$`).test(path);
 };
 export const hasPermission = (userRole, path, method, permissions) => {
   const safeMethods = ["OPTIONS", "HEAD", "TRACE"];

package/dist/shared/{nuxt-users.DtwPhils.d.mts → nuxt-users.Bday8snh.d.mts}

@@ -98,6 +98,12 @@ interface RuntimeModuleOptions {
      * Uses nodemailer
      */
     mailer?: MailerOptions;
+    /**
+     * Public base URL of the app (e.g. 'https://example.com'), used to build links in emails
+     * (password reset, email confirmation). Required in production: the request Host header
+     * is attacker-controlled and is only used as a fallback in development.
+     */
+    siteUrl?: string;
     /**
      * URL path for password reset page
      * @default '/reset-password'
@@ -225,6 +231,7 @@ interface ModuleOptions {
         passwordResetTokens: string;
     };
     mailer?: MailerOptions;
+    siteUrl?: string;
     passwordResetUrl: string;
     emailConfirmationUrl: string;
     auth: {

package/dist/shared/{nuxt-users.DtwPhils.d.ts → nuxt-users.Bday8snh.d.ts}

@@ -98,6 +98,12 @@ interface RuntimeModuleOptions {
      * Uses nodemailer
      */
     mailer?: MailerOptions;
+    /**
+     * Public base URL of the app (e.g. 'https://example.com'), used to build links in emails
+     * (password reset, email confirmation). Required in production: the request Host header
+     * is attacker-controlled and is only used as a fallback in development.
+     */
+    siteUrl?: string;
     /**
      * URL path for password reset page
      * @default '/reset-password'
@@ -225,6 +231,7 @@ interface ModuleOptions {
         passwordResetTokens: string;
     };
     mailer?: MailerOptions;
+    siteUrl?: string;
     passwordResetUrl: string;
     emailConfirmationUrl: string;
     auth: {

package/dist/shared/{nuxt-users.KrHIaTTL.mjs → nuxt-users.CcNeTWsL.mjs}

@@ -24,6 +24,9 @@ const defaultOptions = {
       from: '"Nuxt Users Module" <noreply@example.com>'
     }
   },
+  // Empty by default so NUXT_NUXT_USERS_SITE_URL can override it (Nuxt only applies env vars to existing keys);
+  // empty falls back to the request host in development and is rejected in production
+  siteUrl: "",
   passwordResetUrl: "/reset-password",
   emailConfirmationUrl: "/email-confirmation",
   auth: {

package/dist/utils.d.mts

@@ -1,5 +1,5 @@
-import { P as Permission } from './shared/nuxt-users.DtwPhils.mjs';
-export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, f as PasswordResetToken, g as PersonalAccessToken, h as ResetPasswordFormProps, R as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.DtwPhils.mjs';
+import { P as Permission } from './shared/nuxt-users.Bday8snh.mjs';
+export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, f as PasswordResetToken, g as PersonalAccessToken, h as ResetPasswordFormProps, R as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.Bday8snh.mjs';
 export { defaultLocaleMessages, en, hu, huFormal } from '../dist/runtime/locales/index.js';
 export { getNestedValue, getTranslation } from '../dist/runtime/utils/locale.js';
 export { deepMerge } from '../dist/runtime/utils/deep-merge.js';

package/dist/utils.d.ts

@@ -1,5 +1,5 @@
-import { P as Permission } from './shared/nuxt-users.DtwPhils.js';
-export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, f as PasswordResetToken, g as PersonalAccessToken, h as ResetPasswordFormProps, R as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.DtwPhils.js';
+import { P as Permission } from './shared/nuxt-users.Bday8snh.js';
+export { D as DatabaseConfig, a as DatabaseType, b as DisplayFieldsProps, G as GoogleOAuthOptions, L as LocaleMessages, c as LocaleOptions, d as LoginFormData, e as LoginFormProps, M as ModuleOptions, f as PasswordResetToken, g as PersonalAccessToken, h as ResetPasswordFormProps, R as RuntimeModuleOptions, U as User, i as UserWithoutPassword, j as defaultDisplayFields, k as defaultFieldLabels } from './shared/nuxt-users.Bday8snh.js';
 export { defaultLocaleMessages, en, hu, huFormal } from '../dist/runtime/locales/index.js';
 export { getNestedValue, getTranslation } from '../dist/runtime/utils/locale.js';
 export { deepMerge } from '../dist/runtime/utils/deep-merge.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-users",
-  "version": "1.49.3",
+  "version": "1.50.1",
   "description": "A comprehensive user management module for Nuxt applications with authentication, authorization, database support, and CLI tools",
   "keywords": [
     "nuxt",
@@ -55,7 +55,7 @@
   "scripts": {
     "prepack": "nuxt-module-build build && node scripts/post-build.js",
     "postinstall": "node -e \"try { require('fs').chmodSync('./dist/cli.mjs', '755') } catch(e) {}\" && node scripts/check-peer-dependencies.js",
-    "predev": "node -v | grep -q 'v22' || (echo 'Please use Node.js v22 for development' && exit 1)",
+    "predev": "node -v | grep -qE '^v(22|24)\\.' || (echo 'Please use Node.js v22 or v24 for development' && exit 1)",
     "dev": "yarn dev:prepare && nuxi dev playground",
     "dev:build": "nuxi build playground",
     "dev:prepare": "yarn nuxt-module-build build --stub && yarn nuxt-module-build prepare && nuxi prepare playground",
@@ -65,13 +65,13 @@
     "check:locale-consistency": "tsx scripts/check-locale-consistency.ts",
     "check:npm_token": "dotenv -- sh -c 'if [ -z \"$NPM_TOKEN\" ]; then echo \"❌ NPM_TOKEN environment variable is not set in .env file. Please set it to your npm token.\"; exit 1; fi'",
     "check:npm_auth": "dotenv -- sh -c 'npm whoami --registry https://registry.npmjs.org/ --//registry.npmjs.org/:_authToken=$NPM_TOKEN'",
-    "release:publish:dry": "dotenv -- sh -c 'npm publish --dry-run --ignore-scripts --registry https://registry.npmjs.org/ --//registry.npmjs.org/:_authToken=$NPM_TOKEN'",
+    "release:publish:dry": "npm pack --dry-run --ignore-scripts",
     "release:preflight": "yarn prerelease && yarn check:npm_token && yarn check:npm_auth && sh scripts/release-preflight.sh",
-    "prerelease": "node -v | grep -q 'v22' || (echo 'Please use Node.js v22 for deployment' && exit 1)",
-    "release": "yarn release:preflight && yarn lint && yarn check:translations && yarn check:locale-consistency && yarn test && yarn prepack && yarn release:publish:dry && dotenv -- changelogen --release && dotenv -- sh -c 'npm publish --//registry.npmjs.org/:_authToken=$NPM_TOKEN --registry https://registry.npmjs.org/' && git push --follow-tags",
+    "prerelease": "node -v | grep -qE '^v(22|24)\\.' || (echo 'Please use Node.js v22 or v24 for deployment' && exit 1)",
+    "release": "yarn release:preflight && yarn lint && yarn check:translations && yarn check:locale-consistency && yarn test && yarn prepack && yarn release:publish:dry && dotenv -- changelogen --release --no-github && dotenv -- sh -c 'npm publish --//registry.npmjs.org/:_authToken=$NPM_TOKEN --registry https://registry.npmjs.org/' && git push --follow-tags && dotenv -- changelogen gh release",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "pretest": "node -v | grep -q 'v22' || (echo 'Please use Node.js v22 for testing' && exit 1)",
+    "pretest": "node -v | grep -qE '^v(22|24)\\.' || (echo 'Please use Node.js v22 or v24 for testing' && exit 1)",
     "test:quick": "yarn test:unit && yarn test:sqlite",
     "test:release": "yarn test && yarn build && yarn lint:fix",
     "test:types": "yarn dev:prepare && vue-tsc --noEmit --project tsconfig.vitest.json && cd playground && vue-tsc --noEmit",