nuxt-users 1.6.6 → 1.7.0

package/CHANGELOG.md

@@ -1,6 +1,71 @@
 # Changelog
 
 
+## v1.7.0
+
+[compare changes](https://github.com/rrd108/nuxt-users/compare/v1.6.7...v1.7.0)
+
+### 🚀 Enhancements
+
+- Implement RBAC closes #55 ([#55](https://github.com/rrd108/nuxt-users/issues/55))
+
+### 🩹 Fixes
+
+- Type errors ([c403645](https://github.com/rrd108/nuxt-users/commit/c403645))
+
+### 💅 Refactors
+
+- Token cleanup task and middleware ([d47a4a5](https://github.com/rrd108/nuxt-users/commit/d47a4a5))
+- Renames `useAuth` to `useAuthentication` ([e611e62](https://github.com/rrd108/nuxt-users/commit/e611e62))
+
+### 🏡 Chore
+
+- **release:** V1.6.7 ([def2d5c](https://github.com/rrd108/nuxt-users/commit/def2d5c))
+- Bump cli version number ([b4daec6](https://github.com/rrd108/nuxt-users/commit/b4daec6))
+- Fix for linter ([ce1db37](https://github.com/rrd108/nuxt-users/commit/ce1db37))
+
+### ✅ Tests
+
+- Remove unused test ([3dc23ad](https://github.com/rrd108/nuxt-users/commit/3dc23ad))
+- Fix response ([db3b03c](https://github.com/rrd108/nuxt-users/commit/db3b03c))
+- Fix mysql field type ([2faf0c6](https://github.com/rrd108/nuxt-users/commit/2faf0c6))
+
+### ❤️ Contributors
+
+- Rrd108 ([@rrd108](https://github.com/rrd108))
+
+## v1.6.7
+
+[compare changes](https://github.com/rrd108/nuxt-users/compare/v1.6.6...v1.6.7)
+
+### 🩹 Fixes
+
+- Authentication middleware logic ([18a3bb5](https://github.com/rrd108/nuxt-users/commit/18a3bb5))
+- Password validation and UI ([07b44b3](https://github.com/rrd108/nuxt-users/commit/07b44b3))
+- Type errors ([c403645](https://github.com/rrd108/nuxt-users/commit/c403645))
+
+### 💅 Refactors
+
+- API routes ([3c7603f](https://github.com/rrd108/nuxt-users/commit/3c7603f))
+- Authentication components and logic ([4da544f](https://github.com/rrd108/nuxt-users/commit/4da544f))
+- Token cleanup task and middleware ([d47a4a5](https://github.com/rrd108/nuxt-users/commit/d47a4a5))
+
+### 🏡 Chore
+
+- **release:** V1.6.6 ([7b37694](https://github.com/rrd108/nuxt-users/commit/7b37694))
+
+### ✅ Tests
+
+- Fix mock ([791dc94](https://github.com/rrd108/nuxt-users/commit/791dc94))
+- Adds unit tests for auth API endpoints ([d844630](https://github.com/rrd108/nuxt-users/commit/d844630))
+- Remove unused test ([3dc23ad](https://github.com/rrd108/nuxt-users/commit/3dc23ad))
+- Fix response ([db3b03c](https://github.com/rrd108/nuxt-users/commit/db3b03c))
+- Fix mysql field type ([2faf0c6](https://github.com/rrd108/nuxt-users/commit/2faf0c6))
+
+### ❤️ Contributors
+
+- Rrd108 ([@rrd108](https://github.com/rrd108))
+
 ## v1.6.6
 
 [compare changes](https://github.com/rrd108/nuxt-users/compare/v1.6.5...v1.6.6)

package/dist/cli.mjs

@@ -247,7 +247,7 @@ const main = defineCommand({
   meta: {
     name: "nuxt-users",
     description: "CLI for Nuxt Users Module - Manage users, migrations, and database operations",
-    version: "1.6.5"
+    version: "1.6.7"
   },
   subCommands: {
     migrate,

package/dist/module.d.mts

@@ -41,6 +41,21 @@ interface RuntimeModuleOptions {
          * @example ['/login', '/register']
          */
         whitelist?: string[];
+        /**
+         * Token expiration time in minutes
+         * @default 1440
+         */
+        tokenExpiration?: number;
+        /**
+         * Role-based permissions configuration
+         * @default {}
+         * @example {
+         *   admin: ['*'], // admin can access everything
+         *   user: ['/profile', '/api/user/profile'],
+         *   moderator: ['/admin/*', '/api/admin/*']
+         * }
+         */
+        permissions?: Record<string, string[]>;
     };
     /**
      * Password validation configuration
@@ -78,7 +93,7 @@ interface RuntimeModuleOptions {
         preventCommonPasswords?: boolean;
     };
 }
-interface ModuleOptions extends Omit<RuntimeModuleOptions, 'tables' | 'auth' | 'passwordValidation'> {
+interface ModuleOptions {
     connector: {
         name: DatabaseType;
         options: DatabaseConfig;
@@ -89,8 +104,12 @@ interface ModuleOptions extends Omit<RuntimeModuleOptions, 'tables' | 'auth' | '
         personalAccessTokens: string;
         passwordResetTokens: string;
     };
+    mailer?: MailerOptions;
+    passwordResetBaseUrl?: string;
     auth: {
         whitelist: string[];
+        tokenExpiration: number;
+        permissions: Record<string, string[]>;
     };
     passwordValidation: {
         minLength: number;
@@ -115,6 +134,6 @@ interface MailerOptions {
 }
 
 declare const defaultOptions: ModuleOptions;
-declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
+declare const _default: _nuxt_schema.NuxtModule<RuntimeModuleOptions, RuntimeModuleOptions, false>;
 
 export { _default as default, defaultOptions };

package/dist/module.d.ts

@@ -41,6 +41,21 @@ interface RuntimeModuleOptions {
          * @example ['/login', '/register']
          */
         whitelist?: string[];
+        /**
+         * Token expiration time in minutes
+         * @default 1440
+         */
+        tokenExpiration?: number;
+        /**
+         * Role-based permissions configuration
+         * @default {}
+         * @example {
+         *   admin: ['*'], // admin can access everything
+         *   user: ['/profile', '/api/user/profile'],
+         *   moderator: ['/admin/*', '/api/admin/*']
+         * }
+         */
+        permissions?: Record<string, string[]>;
     };
     /**
      * Password validation configuration
@@ -78,7 +93,7 @@ interface RuntimeModuleOptions {
         preventCommonPasswords?: boolean;
     };
 }
-interface ModuleOptions extends Omit<RuntimeModuleOptions, 'tables' | 'auth' | 'passwordValidation'> {
+interface ModuleOptions {
     connector: {
         name: DatabaseType;
         options: DatabaseConfig;
@@ -89,8 +104,12 @@ interface ModuleOptions extends Omit<RuntimeModuleOptions, 'tables' | 'auth' | '
         personalAccessTokens: string;
         passwordResetTokens: string;
     };
+    mailer?: MailerOptions;
+    passwordResetBaseUrl?: string;
     auth: {
         whitelist: string[];
+        tokenExpiration: number;
+        permissions: Record<string, string[]>;
     };
     passwordValidation: {
         minLength: number;
@@ -115,6 +134,6 @@ interface MailerOptions {
 }
 
 declare const defaultOptions: ModuleOptions;
-declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
+declare const _default: _nuxt_schema.NuxtModule<RuntimeModuleOptions, RuntimeModuleOptions, false>;
 
 export { _default as default, defaultOptions };

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-users",
   "configKey": "nuxtUsers",
-  "version": "1.6.6",
+  "version": "1.7.0",
   "builder": {
     "@nuxt/module-builder": "1.0.1",
     "unbuild": "3.6.0"

package/dist/module.mjs

@@ -1,4 +1,4 @@
-import { defineNuxtModule, createResolver, addPlugin, addImportsDir, addServerHandler, addRouteMiddleware, addComponent } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, addPlugin, addImportsDir, addRouteMiddleware, addServerHandler, addComponent } from '@nuxt/kit';
 import { defu } from 'defu';
 
 const defaultOptions = {
@@ -31,7 +31,11 @@ const defaultOptions = {
   },
   passwordResetBaseUrl: "http://localhost:3000",
   auth: {
-    whitelist: ["/login"]
+    whitelist: [],
+    tokenExpiration: 24 * 60,
+    // 24 hours
+    permissions: {}
+    // Empty by default - whitelist approach
   },
   passwordValidation: {
     minLength: 8,
@@ -61,7 +65,9 @@ const module = defineNuxtModule({
         passwordResetTokens: options.tables?.passwordResetTokens || defaultOptions.tables.passwordResetTokens
       },
       auth: {
-        whitelist: [...defaultOptions.auth?.whitelist || [], ...options.auth?.whitelist || []]
+        whitelist: [...defaultOptions.auth?.whitelist || [], ...options.auth?.whitelist || []],
+        tokenExpiration: options.auth?.tokenExpiration || defaultOptions.auth.tokenExpiration,
+        permissions: options.auth?.permissions || defaultOptions.auth.permissions
       }
     };
     nuxt.options.runtimeConfig.public = nuxt.options.runtimeConfig.public || {};
@@ -75,7 +81,8 @@ const module = defineNuxtModule({
         preventCommonPasswords: options.passwordValidation?.preventCommonPasswords ?? defaultOptions.passwordValidation.preventCommonPasswords
       },
       auth: {
-        whitelist: [...defaultOptions.auth?.whitelist || [], ...options.auth?.whitelist || []]
+        whitelist: [...defaultOptions.auth?.whitelist || [], ...options.auth?.whitelist || []],
+        permissions: options.auth?.permissions || defaultOptions.auth.permissions
       }
     };
     addPlugin({
@@ -83,13 +90,9 @@ const module = defineNuxtModule({
       mode: "server"
     });
     addImportsDir(resolver.resolve("./runtime/composables"));
-    addServerHandler({
-      middleware: true,
-      handler: resolver.resolve("./runtime/server/middleware/auth.server")
-    });
     addRouteMiddleware({
-      name: "auth.client",
-      path: resolver.resolve("./runtime/middleware/auth.client"),
+      name: "authorization.client",
+      path: resolver.resolve("./runtime/middleware/authorization.client"),
       global: true
     });
     addServerHandler({
@@ -122,6 +125,12 @@ const module = defineNuxtModule({
       method: "post",
       handler: resolver.resolve("./runtime/server/api/auth/update-password.post")
     });
+    nuxt.hook("nitro:config", async (nitroConfig) => {
+      nitroConfig.experimental = nitroConfig.experimental || {};
+      nitroConfig.experimental.tasks = true;
+      nitroConfig.scanDirs = nitroConfig.scanDirs || [];
+      nitroConfig.scanDirs.push(resolver.resolve("./runtime/server/tasks"));
+    });
     addComponent({
       name: "LoginForm",
       filePath: resolver.resolve("./runtime/components/LoginForm.vue")

package/dist/runtime/components/LogoutLink.vue

@@ -1,7 +1,7 @@
 <script setup>
 import { ref } from "vue";
 import { navigateTo } from "#app";
-import { useAuth } from "../composables/useAuth";
+import { useAuthentication } from "../composables/useAuthentication";
 const props = defineProps({
   redirectTo: { type: String, required: false, default: "/login" },
   linkText: { type: String, required: false, default: "Logout" },
@@ -16,7 +16,7 @@ const props = defineProps({
   containerStyle: { type: [String, Object], required: false }
 });
 const emit = defineEmits(["success", "click", "error"]);
-const { logout } = useAuth();
+const { logout } = useAuthentication();
 const isLoading = ref(false);
 const error = ref("");
 const handleLogout = async (event) => {

package/dist/runtime/components/ProfileInfo.vue

@@ -1,6 +1,6 @@
 <script setup>
-import { useAuth } from "../composables/useAuth";
-const { user } = useAuth();
+import { useAuthentication } from "../composables/useAuthentication";
+const { user } = useAuthentication();
 </script>
 
 <template>

package/dist/runtime/composables/{useAuth.d.ts → useAuthentication.d.ts}

@@ -1,5 +1,5 @@
 import type { User, UserWithoutPassword } from '../../types.js';
-export declare const useAuth: () => {
+export declare const useAuthentication: () => {
     user: Readonly<import("vue").Ref<{
         readonly id: number;
         readonly email: string;

package/dist/runtime/composables/{useAuth.js → useAuthentication.js}

@@ -1,6 +1,6 @@
 import { useState } from "#app";
 import { computed, readonly } from "vue";
-export const useAuth = () => {
+export const useAuthentication = () => {
   const user = useState("user", () => null);
   const isAuthenticated = computed(() => !!user.value);
   const login = (userData) => {

package/dist/runtime/constants.d.ts

@@ -0,0 +1 @@
+export declare const NO_AUTH_PATHS: string[];

package/dist/runtime/constants.js

@@ -0,0 +1 @@
+export const NO_AUTH_PATHS = ["/login", "/api/auth/login", "/api/auth/forgot-password"];

package/dist/runtime/middleware/authorization.client.js

@@ -0,0 +1,30 @@
+import { defineNuxtRouteMiddleware, navigateTo, useRuntimeConfig } from "#app";
+import { useAuthentication } from "../composables/useAuthentication.js";
+import { hasPermission, isWhitelisted } from "../utils/permissions.js";
+import { NO_AUTH_PATHS } from "../constants.js";
+export default defineNuxtRouteMiddleware((to) => {
+  const { public: { nuxtUsers: publicNuxtUsers } } = useRuntimeConfig();
+  const publicOptions = publicNuxtUsers;
+  if (NO_AUTH_PATHS.includes(to.path)) {
+    console.log(`[Nuxt Users] client.middleware.auth.global: ${to.path}`);
+    return;
+  }
+  if (isWhitelisted(to.path, publicOptions.auth.whitelist)) {
+    console.log(`[Nuxt Users] client.middleware.auth.global: Whitelisted: ${to.path}`);
+    return;
+  }
+  const { isAuthenticated, user } = useAuthentication();
+  if (!isAuthenticated.value) {
+    console.log(`[Nuxt Users] client.middleware.auth.global: Unauthenticated ${to.path}, redirecting to /login`);
+    return navigateTo("/login");
+  }
+  if (!user.value || !hasPermission(user.value.role, to.path, publicOptions.auth.permissions)) {
+    console.log(`[Nuxt Users] client.middleware.auth.global: User with role ${user.value?.role} denied access to ${to.path}`);
+    return navigateTo("/login");
+  }
+  console.log("[Nuxt Users] client.middleware.auth.global", {
+    isAuthenticated: isAuthenticated.value,
+    userRole: user.value?.role,
+    to: to.path
+  });
+});

package/dist/runtime/server/api/auth/login.post.js

@@ -35,9 +35,11 @@ export default defineEventHandler(async (event) => {
   }
   const token = crypto.randomBytes(64).toString("hex");
   const tokenName = "auth_token";
+  const expiresAt = /* @__PURE__ */ new Date();
+  expiresAt.setMinutes(expiresAt.getMinutes() + options.auth.tokenExpiration);
   await db.sql`
-    INSERT INTO {${personalAccessTokensTable}} (tokenable_type, tokenable_id, name, token, created_at, updated_at)
-    VALUES ('user', ${user.id}, ${tokenName}, ${token}, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+    INSERT INTO {${personalAccessTokensTable}} (tokenable_type, tokenable_id, name, token, expires_at, created_at, updated_at)
+    VALUES ('user', ${user.id}, ${tokenName}, ${token}, ${expiresAt.toISOString().slice(0, 19).replace("T", " ")}, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
   `;
   setCookie(event, "auth_token", token, {
     httpOnly: true,

package/dist/runtime/server/middleware/{auth.server.js → authorization.server.js}

@@ -1,7 +1,8 @@
 import { defineEventHandler, getCookie, sendRedirect } from "h3";
 import { useRuntimeConfig } from "#imports";
 import { getCurrentUserFromToken } from "../utils/index.js";
-const noAuthPaths = ["/login", "/api/auth/login", "/api/auth/forgot-password"];
+import { hasPermission, isWhitelisted } from "../../utils/permissions.js";
+import { NO_AUTH_PATHS } from "../../constants.js";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
   const options = nuxtUsers;
@@ -9,11 +10,11 @@ export default defineEventHandler(async (event) => {
   if (!isPageOrApiRoute) {
     return;
   }
-  if (noAuthPaths.includes(event.path)) {
+  if (NO_AUTH_PATHS.includes(event.path)) {
     console.log("[Nuxt Users] server.middleware.auth.global: /login");
     return;
   }
-  if (options.auth.whitelist.includes(event.path)) {
+  if (isWhitelisted(event.path, options.auth.whitelist)) {
     console.log(`[Nuxt Users] server.middleware.auth.global: whitelisted: ${event.path}`);
     return;
   }
@@ -27,6 +28,10 @@ export default defineEventHandler(async (event) => {
     console.log(`[Nuxt Users] server.middleware.auth.global: ${event.path} No user found redirecting to login`);
     return sendRedirect(event, "/login");
   }
-  console.log(`[Nuxt Users] server.middleware.auth.global: Authenticated request to ${event.path} for ${user.id}`);
+  if (!hasPermission(user.role, event.path, options.auth.permissions)) {
+    console.log(`[Nuxt Users] server.middleware.auth.global: ${event.path} User ${user.id} with role ${user.role} denied access`);
+    return sendRedirect(event, "/login");
+  }
+  console.log(`[Nuxt Users] server.middleware.auth.global: Authenticated request to ${event.path} for ${user.id} with role ${user.role}`);
   return;
 });

package/dist/runtime/server/services/password.js

@@ -30,13 +30,46 @@ export const sendPasswordResetLink = async (email, options) => {
       pass: options.mailer.auth.pass
     }
   });
+  const resetUrl = new URL("/reset-password", options.passwordResetBaseUrl || "http://localhost:3000");
+  resetUrl.searchParams.set("token", token);
+  resetUrl.searchParams.set("email", email);
+  const resetLink = resetUrl.toString();
   try {
     await transporter.sendMail({
       from: options.mailer.defaults?.from || '"Nuxt Users" <noreply@example.com>',
       to: email,
       subject: "Password Reset Request",
-      text: `Please click the following link to reset your password: ${options.passwordResetBaseUrl}`,
-      html: `<p>Please click the following link to reset your password:</p><p><a href="${options.passwordResetBaseUrl}">${options.passwordResetBaseUrl}</a></p><p>This link will expire in ${TOKEN_EXPIRATION_HOURS} hour(s).</p>`
+      text: `Please click the following link to reset your password: ${resetLink}
+
+This link will expire in ${TOKEN_EXPIRATION_HOURS} hour(s).
+
+If you did not request this password reset, please ignore this email.`,
+      html: `
+        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
+          <h2>Password Reset Request</h2>
+          <p>You have requested to reset your password. Please click the button below to set a new password:</p>
+          
+          <div style="text-align: center; margin: 30px 0;">
+            <a href="${resetLink}" 
+               style="background-color: #007bff; color: white; padding: 12px 24px; text-decoration: none; border-radius: 5px; display: inline-block;">
+              Reset Password
+            </a>
+          </div>
+          
+          <p>Or copy and paste the following link into your browser:</p>
+          <p style="word-break: break-all; background-color: #f8f9fa; padding: 10px; border-radius: 3px;">
+            <a href="${resetLink}">${resetLink}</a>
+          </p>
+          
+          <p style="color: #6c757d; font-size: 14px;">
+            This link will expire in ${TOKEN_EXPIRATION_HOURS} hour(s).
+          </p>
+          
+          <p style="color: #6c757d; font-size: 14px;">
+            If you did not request this password reset, please ignore this email. Your password will remain unchanged.
+          </p>
+        </div>
+      `
     });
     console.log(`[Nuxt Users] Password reset email sent to ${email}`);
   } catch (error) {

package/dist/runtime/server/tasks/cleanup-tokens.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nitropack").Task<"success">;
+export default _default;

package/dist/runtime/server/tasks/cleanup-tokens.js

@@ -0,0 +1,30 @@
+import { defineTask } from "nitropack/runtime/task";
+export default defineTask({
+  meta: {
+    name: "nuxt-users:cleanup-tokens",
+    description: "Clean up expired personal access tokens and tokens without expiration"
+  },
+  async run({ payload }) {
+    const { useRuntimeConfig } = await import("#imports");
+    const { cleanupPersonalAccessTokens } = await import("../utils/index.js");
+    const { nuxtUsers } = useRuntimeConfig();
+    const options = nuxtUsers;
+    if (!options) {
+      throw new Error("Nuxt Users module not configured");
+    }
+    const includeNoExpiration = payload?.includeNoExpiration ?? true;
+    try {
+      const result = await cleanupPersonalAccessTokens(options, includeNoExpiration);
+      return {
+        result: "success",
+        expiredTokensRemoved: result.expiredCount,
+        noExpirationTokensRemoved: result.noExpirationCount,
+        totalTokensCleaned: result.totalCount,
+        includeNoExpiration
+      };
+    } catch (error) {
+      console.error("[Nuxt Users] Token cleanup failed:", error);
+      throw error;
+    }
+  }
+});

package/dist/runtime/server/utils/index.d.ts

@@ -1,5 +1,5 @@
 export { useDb, checkTableExists } from './db.js';
-export { createUser, findUserByEmail, updateUserPassword, getCurrentUserFromToken, hasAnyUsers } from './user.js';
+export { createUser, findUserByEmail, updateUserPassword, getCurrentUserFromToken, hasAnyUsers, deleteExpiredPersonalAccessTokens, deleteTokensWithoutExpiration, cleanupPersonalAccessTokens, revokeUserTokens } from './user.js';
 export { createUsersTable } from './create-users-table.js';
 export { createPersonalAccessTokensTable } from './create-personal-access-tokens-table.js';
 export { createPasswordResetTokensTable } from './create-password-reset-tokens-table.js';

package/dist/runtime/server/utils/index.js

@@ -1,5 +1,5 @@
 export { useDb, checkTableExists } from "./db.js";
-export { createUser, findUserByEmail, updateUserPassword, getCurrentUserFromToken, hasAnyUsers } from "./user.js";
+export { createUser, findUserByEmail, updateUserPassword, getCurrentUserFromToken, hasAnyUsers, deleteExpiredPersonalAccessTokens, deleteTokensWithoutExpiration, cleanupPersonalAccessTokens, revokeUserTokens } from "./user.js";
 export { createUsersTable } from "./create-users-table.js";
 export { createPersonalAccessTokensTable } from "./create-personal-access-tokens-table.js";
 export { createPasswordResetTokensTable } from "./create-password-reset-tokens-table.js";

package/dist/runtime/server/utils/user.d.ts

@@ -24,4 +24,24 @@ export declare const hasAnyUsers: (options: ModuleOptions) => Promise<boolean>;
  * Gets the current user from an authentication token.
  */
 export declare const getCurrentUserFromToken: <T extends boolean = false>(token: string, options: ModuleOptions, withPass?: T) => Promise<T extends true ? User | null : UserWithoutPassword | null>;
+/**
+ * Deletes expired personal access tokens from the database.
+ */
+export declare const deleteExpiredPersonalAccessTokens: (options: ModuleOptions) => Promise<number>;
+/**
+ * Deletes tokens without expiration dates (legacy tokens or security cleanup).
+ */
+export declare const deleteTokensWithoutExpiration: (options: ModuleOptions) => Promise<number>;
+/**
+ * Comprehensive token cleanup: removes expired tokens and optionally tokens without expiration.
+ */
+export declare const cleanupPersonalAccessTokens: (options: ModuleOptions, includeNoExpiration?: boolean) => Promise<{
+    expiredCount: number;
+    noExpirationCount: number;
+    totalCount: number;
+}>;
+/**
+ * Revokes all tokens for a specific user.
+ */
+export declare const revokeUserTokens: (userId: number, options: ModuleOptions) => Promise<void>;
 export {};

package/dist/runtime/server/utils/user.js

@@ -76,13 +76,19 @@ export const getCurrentUserFromToken = async (token, options, withPass = false)
   const personalAccessTokensTable = options.tables.personalAccessTokens;
   const usersTable = options.tables.users;
   const tokenResult = await db.sql`
-    SELECT tokenable_id FROM {${personalAccessTokensTable}}
+    SELECT tokenable_id, expires_at FROM {${personalAccessTokensTable}}
     WHERE token = ${token}
+    AND (expires_at IS NULL OR expires_at > CURRENT_TIMESTAMP)
   `;
   if (tokenResult.rows.length === 0) {
     return null;
   }
   const userId = tokenResult.rows[0].tokenable_id;
+  await db.sql`
+    UPDATE {${personalAccessTokensTable}}
+    SET last_used_at = CURRENT_TIMESTAMP
+    WHERE token = ${token}
+  `;
   const userResult = await db.sql`
     SELECT * FROM {${usersTable}}
     WHERE id = ${userId}
@@ -97,3 +103,41 @@ export const getCurrentUserFromToken = async (token, options, withPass = false)
   const { password: _, ...userWithoutPassword } = user;
   return userWithoutPassword;
 };
+export const deleteExpiredPersonalAccessTokens = async (options) => {
+  const db = await useDb(options);
+  const personalAccessTokensTable = options.tables.personalAccessTokens;
+  const result = await db.sql`
+    DELETE FROM {${personalAccessTokensTable}}
+    WHERE expires_at IS NOT NULL AND expires_at <= CURRENT_TIMESTAMP
+  `;
+  const deletedCount = result.rows?.length || 0;
+  console.log(`[Nuxt Users] ${deletedCount} expired personal access tokens deleted.`);
+  return deletedCount;
+};
+export const deleteTokensWithoutExpiration = async (options) => {
+  const db = await useDb(options);
+  const personalAccessTokensTable = options.tables.personalAccessTokens;
+  const result = await db.sql`
+    DELETE FROM {${personalAccessTokensTable}}
+    WHERE expires_at IS NULL
+  `;
+  const deletedCount = result.rows?.length || 0;
+  console.log(`[Nuxt Users] ${deletedCount} tokens without expiration deleted.`);
+  return deletedCount;
+};
+export const cleanupPersonalAccessTokens = async (options, includeNoExpiration = true) => {
+  const expiredCount = await deleteExpiredPersonalAccessTokens(options);
+  const noExpirationCount = includeNoExpiration ? await deleteTokensWithoutExpiration(options) : 0;
+  const totalCount = expiredCount + noExpirationCount;
+  console.log(`[Nuxt Users] Token cleanup completed: ${expiredCount} expired + ${noExpirationCount} without expiration = ${totalCount} total tokens removed.`);
+  return { expiredCount, noExpirationCount, totalCount };
+};
+export const revokeUserTokens = async (userId, options) => {
+  const db = await useDb(options);
+  const personalAccessTokensTable = options.tables.personalAccessTokens;
+  await db.sql`
+    DELETE FROM {${personalAccessTokensTable}}
+    WHERE tokenable_type = 'user' AND tokenable_id = ${userId}
+  `;
+  console.log(`[Nuxt Users] All tokens revoked for user ID: ${userId}`);
+};

package/dist/runtime/utils/permissions.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Checks if a path matches a pattern (supports wildcards)
+ * @param path - The path to check
+ * @param pattern - The pattern to match against (supports * wildcard)
+ * @returns true if the path matches the pattern
+ */
+export declare const pathMatchesPattern: (path: string, pattern: string) => boolean;
+/**
+ * Checks if a user has permission to access a specific path
+ * @param userRole - The user's role
+ * @param path - The path being accessed
+ * @param permissions - The permissions configuration
+ * @returns true if the user has permission to access the path
+ */
+export declare const hasPermission: (userRole: string, path: string, permissions: Record<string, string[]>) => boolean;
+/**
+ * Checks if a path is accessible without authentication
+ * @param path - The path being accessed
+ * @param whitelist - Array of whitelisted paths
+ * @returns true if the path is whitelisted
+ */
+export declare const isWhitelisted: (path: string, whitelist: string[]) => boolean;

package/dist/runtime/utils/permissions.js

@@ -0,0 +1,36 @@
+export const pathMatchesPattern = (path, pattern) => {
+  if (path === pattern) {
+    return true;
+  }
+  if (pattern === "*") {
+    return true;
+  }
+  if ((pattern.match(/\*/g) || []).length > 1) {
+    const regexPattern = pattern.replace(/\*/g, "[^/]*");
+    const regex = new RegExp(`^${regexPattern}$`);
+    return regex.test(path);
+  }
+  if (pattern.endsWith("/*")) {
+    const basePattern = pattern.slice(0, -2);
+    return path === basePattern || path.startsWith(basePattern + "/");
+  }
+  if (pattern.includes("*")) {
+    const regexPattern = pattern.replace(/\*/g, "[^/]*");
+    const regex = new RegExp(`^${regexPattern}$`);
+    return regex.test(path);
+  }
+  return false;
+};
+export const hasPermission = (userRole, path, permissions) => {
+  if (!permissions || Object.keys(permissions).length === 0) {
+    return false;
+  }
+  const rolePermissions = permissions[userRole];
+  if (!rolePermissions) {
+    return false;
+  }
+  return rolePermissions.some((pattern) => pathMatchesPattern(path, pattern));
+};
+export const isWhitelisted = (path, whitelist) => {
+  return whitelist.some((whitelistedPath) => pathMatchesPattern(path, whitelistedPath));
+};

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "nuxt-users",
-  "version": "1.6.6",
-  "description": "A comprehensive user management module for Nuxt 3 applications with authentication, database support, and CLI tools",
+  "version": "1.7.0",
+  "description": "A comprehensive user management module for Nuxt 3 and Nuxt 4 applications with authentication, authorization, database support, and CLI tools",
   "keywords": [
     "nuxt",
     "nuxt3",
     "nuxt-module",
     "users",
     "authentication",
+    "authorization",
     "auth",
     "user-management",
     "sqlite",
@@ -82,7 +83,7 @@
     "docs:dev": "vitepress dev docs",
     "docs:build": "vitepress build docs",
     "docs:preview": "vitepress preview docs",
-    "docs:deploy": "yarn docs:build && ./scripts/deploy-docs.sh"
+    "docs:release": "yarn docs:build && ./scripts/deploy-docs.sh"
   },
   "dependencies": {
     "bcrypt": "^6.0.0",
@@ -98,7 +99,13 @@
   "peerDependencies": {
     "@nuxt/kit": "^3.17.6",
     "bcrypt": "^6.0.0",
-    "nodemailer": "^7.0.5"
+    "nodemailer": "^7.0.5",
+    "nuxt-api-shield": "^0.1.0 || ^0.8.0"
+  },
+  "peerDependenciesMeta": {
+    "nuxt-api-shield": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@nuxt/devtools": "^2.6.2",

package/dist/runtime/middleware/auth.client.js

@@ -1,20 +0,0 @@
-import { defineNuxtRouteMiddleware, navigateTo, useRuntimeConfig } from "#app";
-import { useAuth } from "../composables/useAuth.js";
-export default defineNuxtRouteMiddleware((to) => {
-  const { public: { nuxtUsers: publicNuxtUsers } } = useRuntimeConfig();
-  const publicOptions = publicNuxtUsers;
-  if (to.path === "/login") {
-    console.log("[Nuxt Users] client.middleware.auth.global: /login");
-    return;
-  }
-  if (publicOptions.auth.whitelist.includes(to.path)) {
-    console.log(`[Nuxt Users] client.middleware.auth.global: Whitelisted: ${to.path}`);
-    return;
-  }
-  const { isAuthenticated } = useAuth();
-  if (!isAuthenticated.value) {
-    console.log(`[Nuxt Users] client.middleware.auth.global: Unauthenticated ${to.path}, redirecting to /login`);
-    return navigateTo("/login");
-  }
-  console.log("[Nuxt Users] client.middleware.auth.global", { isAuthenticated: isAuthenticated.value, to: to.path });
-});