nuxt-users 1.6.7 → 1.7.0

package/CHANGELOG.md

@@ -1,6 +1,39 @@
 # Changelog
 
 
+## v1.7.0
+
+[compare changes](https://github.com/rrd108/nuxt-users/compare/v1.6.7...v1.7.0)
+
+### 🚀 Enhancements
+
+- Implement RBAC closes #55 ([#55](https://github.com/rrd108/nuxt-users/issues/55))
+
+### 🩹 Fixes
+
+- Type errors ([c403645](https://github.com/rrd108/nuxt-users/commit/c403645))
+
+### 💅 Refactors
+
+- Token cleanup task and middleware ([d47a4a5](https://github.com/rrd108/nuxt-users/commit/d47a4a5))
+- Renames `useAuth` to `useAuthentication` ([e611e62](https://github.com/rrd108/nuxt-users/commit/e611e62))
+
+### 🏡 Chore
+
+- **release:** V1.6.7 ([def2d5c](https://github.com/rrd108/nuxt-users/commit/def2d5c))
+- Bump cli version number ([b4daec6](https://github.com/rrd108/nuxt-users/commit/b4daec6))
+- Fix for linter ([ce1db37](https://github.com/rrd108/nuxt-users/commit/ce1db37))
+
+### ✅ Tests
+
+- Remove unused test ([3dc23ad](https://github.com/rrd108/nuxt-users/commit/3dc23ad))
+- Fix response ([db3b03c](https://github.com/rrd108/nuxt-users/commit/db3b03c))
+- Fix mysql field type ([2faf0c6](https://github.com/rrd108/nuxt-users/commit/2faf0c6))
+
+### ❤️ Contributors
+
+- Rrd108 ([@rrd108](https://github.com/rrd108))
+
 ## v1.6.7
 
 [compare changes](https://github.com/rrd108/nuxt-users/compare/v1.6.6...v1.6.7)

package/dist/cli.mjs

@@ -247,7 +247,7 @@ const main = defineCommand({
   meta: {
     name: "nuxt-users",
     description: "CLI for Nuxt Users Module - Manage users, migrations, and database operations",
-    version: "1.6.6"
+    version: "1.6.7"
   },
   subCommands: {
     migrate,

package/dist/module.d.mts

@@ -9,6 +9,90 @@ type DatabaseConfig = {
     password?: string;
     database?: string;
 };
+interface RuntimeModuleOptions {
+    connector?: {
+        name: DatabaseType;
+        options: DatabaseConfig;
+    };
+    tables?: {
+        migrations?: string;
+        users?: string;
+        personalAccessTokens?: string;
+        passwordResetTokens?: string;
+    };
+    /**
+     * Mailer configuration options for sending emails (e.g., password resets)
+     * Uses nodemailer
+     */
+    mailer?: MailerOptions;
+    /**
+     * Base URL for password reset links
+     * @default 'http://localhost:3000' // Example, will be set in module defaults
+     */
+    passwordResetBaseUrl?: string;
+    /**
+     * Skip database checks during module setup to prevent hanging
+     * @default false
+     */
+    auth?: {
+        /**
+         * Whitelisted routes that do not require authentication
+         * @default ['/login']
+         * @example ['/login', '/register']
+         */
+        whitelist?: string[];
+        /**
+         * Token expiration time in minutes
+         * @default 1440
+         */
+        tokenExpiration?: number;
+        /**
+         * Role-based permissions configuration
+         * @default {}
+         * @example {
+         *   admin: ['*'], // admin can access everything
+         *   user: ['/profile', '/api/user/profile'],
+         *   moderator: ['/admin/*', '/api/admin/*']
+         * }
+         */
+        permissions?: Record<string, string[]>;
+    };
+    /**
+     * Password validation configuration
+     */
+    passwordValidation?: {
+        /**
+         * Minimum password length
+         * @default 8
+         */
+        minLength?: number;
+        /**
+         * Require uppercase letters
+         * @default true
+         */
+        requireUppercase?: boolean;
+        /**
+         * Require lowercase letters
+         * @default true
+         */
+        requireLowercase?: boolean;
+        /**
+         * Require numbers
+         * @default true
+         */
+        requireNumbers?: boolean;
+        /**
+         * Require special characters
+         * @default true
+         */
+        requireSpecialChars?: boolean;
+        /**
+         * Prevent common passwords
+         * @default true
+         */
+        preventCommonPasswords?: boolean;
+    };
+}
 interface ModuleOptions {
     connector: {
         name: DatabaseType;
@@ -25,6 +109,7 @@ interface ModuleOptions {
     auth: {
         whitelist: string[];
         tokenExpiration: number;
+        permissions: Record<string, string[]>;
     };
     passwordValidation: {
         minLength: number;
@@ -49,6 +134,6 @@ interface MailerOptions {
 }
 
 declare const defaultOptions: ModuleOptions;
-declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
+declare const _default: _nuxt_schema.NuxtModule<RuntimeModuleOptions, RuntimeModuleOptions, false>;
 
 export { _default as default, defaultOptions };

package/dist/module.d.ts

@@ -9,6 +9,90 @@ type DatabaseConfig = {
     password?: string;
     database?: string;
 };
+interface RuntimeModuleOptions {
+    connector?: {
+        name: DatabaseType;
+        options: DatabaseConfig;
+    };
+    tables?: {
+        migrations?: string;
+        users?: string;
+        personalAccessTokens?: string;
+        passwordResetTokens?: string;
+    };
+    /**
+     * Mailer configuration options for sending emails (e.g., password resets)
+     * Uses nodemailer
+     */
+    mailer?: MailerOptions;
+    /**
+     * Base URL for password reset links
+     * @default 'http://localhost:3000' // Example, will be set in module defaults
+     */
+    passwordResetBaseUrl?: string;
+    /**
+     * Skip database checks during module setup to prevent hanging
+     * @default false
+     */
+    auth?: {
+        /**
+         * Whitelisted routes that do not require authentication
+         * @default ['/login']
+         * @example ['/login', '/register']
+         */
+        whitelist?: string[];
+        /**
+         * Token expiration time in minutes
+         * @default 1440
+         */
+        tokenExpiration?: number;
+        /**
+         * Role-based permissions configuration
+         * @default {}
+         * @example {
+         *   admin: ['*'], // admin can access everything
+         *   user: ['/profile', '/api/user/profile'],
+         *   moderator: ['/admin/*', '/api/admin/*']
+         * }
+         */
+        permissions?: Record<string, string[]>;
+    };
+    /**
+     * Password validation configuration
+     */
+    passwordValidation?: {
+        /**
+         * Minimum password length
+         * @default 8
+         */
+        minLength?: number;
+        /**
+         * Require uppercase letters
+         * @default true
+         */
+        requireUppercase?: boolean;
+        /**
+         * Require lowercase letters
+         * @default true
+         */
+        requireLowercase?: boolean;
+        /**
+         * Require numbers
+         * @default true
+         */
+        requireNumbers?: boolean;
+        /**
+         * Require special characters
+         * @default true
+         */
+        requireSpecialChars?: boolean;
+        /**
+         * Prevent common passwords
+         * @default true
+         */
+        preventCommonPasswords?: boolean;
+    };
+}
 interface ModuleOptions {
     connector: {
         name: DatabaseType;
@@ -25,6 +109,7 @@ interface ModuleOptions {
     auth: {
         whitelist: string[];
         tokenExpiration: number;
+        permissions: Record<string, string[]>;
     };
     passwordValidation: {
         minLength: number;
@@ -49,6 +134,6 @@ interface MailerOptions {
 }
 
 declare const defaultOptions: ModuleOptions;
-declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
+declare const _default: _nuxt_schema.NuxtModule<RuntimeModuleOptions, RuntimeModuleOptions, false>;
 
 export { _default as default, defaultOptions };

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-users",
   "configKey": "nuxtUsers",
-  "version": "1.6.7",
+  "version": "1.7.0",
   "builder": {
     "@nuxt/module-builder": "1.0.1",
     "unbuild": "3.6.0"

package/dist/module.mjs

@@ -31,9 +31,11 @@ const defaultOptions = {
   },
   passwordResetBaseUrl: "http://localhost:3000",
   auth: {
-    whitelist: ["/login"],
-    tokenExpiration: 24 * 60
+    whitelist: [],
+    tokenExpiration: 24 * 60,
     // 24 hours
+    permissions: {}
+    // Empty by default - whitelist approach
   },
   passwordValidation: {
     minLength: 8,
@@ -64,7 +66,8 @@ const module = defineNuxtModule({
       },
       auth: {
         whitelist: [...defaultOptions.auth?.whitelist || [], ...options.auth?.whitelist || []],
-        tokenExpiration: options.auth?.tokenExpiration || defaultOptions.auth.tokenExpiration
+        tokenExpiration: options.auth?.tokenExpiration || defaultOptions.auth.tokenExpiration,
+        permissions: options.auth?.permissions || defaultOptions.auth.permissions
       }
     };
     nuxt.options.runtimeConfig.public = nuxt.options.runtimeConfig.public || {};
@@ -78,7 +81,8 @@ const module = defineNuxtModule({
         preventCommonPasswords: options.passwordValidation?.preventCommonPasswords ?? defaultOptions.passwordValidation.preventCommonPasswords
       },
       auth: {
-        whitelist: [...defaultOptions.auth?.whitelist || [], ...options.auth?.whitelist || []]
+        whitelist: [...defaultOptions.auth?.whitelist || [], ...options.auth?.whitelist || []],
+        permissions: options.auth?.permissions || defaultOptions.auth.permissions
       }
     };
     addPlugin({
@@ -87,8 +91,8 @@ const module = defineNuxtModule({
     });
     addImportsDir(resolver.resolve("./runtime/composables"));
     addRouteMiddleware({
-      name: "auth.client",
-      path: resolver.resolve("./runtime/middleware/auth.client"),
+      name: "authorization.client",
+      path: resolver.resolve("./runtime/middleware/authorization.client"),
       global: true
     });
     addServerHandler({

package/dist/runtime/components/LogoutLink.vue

@@ -1,7 +1,7 @@
 <script setup>
 import { ref } from "vue";
 import { navigateTo } from "#app";
-import { useAuth } from "../composables/useAuth";
+import { useAuthentication } from "../composables/useAuthentication";
 const props = defineProps({
   redirectTo: { type: String, required: false, default: "/login" },
   linkText: { type: String, required: false, default: "Logout" },
@@ -16,7 +16,7 @@ const props = defineProps({
   containerStyle: { type: [String, Object], required: false }
 });
 const emit = defineEmits(["success", "click", "error"]);
-const { logout } = useAuth();
+const { logout } = useAuthentication();
 const isLoading = ref(false);
 const error = ref("");
 const handleLogout = async (event) => {

package/dist/runtime/components/ProfileInfo.vue

@@ -1,6 +1,6 @@
 <script setup>
-import { useAuth } from "../composables/useAuth";
-const { user } = useAuth();
+import { useAuthentication } from "../composables/useAuthentication";
+const { user } = useAuthentication();
 </script>
 
 <template>

package/dist/runtime/composables/{useAuth.d.ts → useAuthentication.d.ts}

@@ -1,5 +1,5 @@
 import type { User, UserWithoutPassword } from '../../types.js';
-export declare const useAuth: () => {
+export declare const useAuthentication: () => {
     user: Readonly<import("vue").Ref<{
         readonly id: number;
         readonly email: string;

package/dist/runtime/composables/{useAuth.js → useAuthentication.js}

@@ -1,6 +1,6 @@
 import { useState } from "#app";
 import { computed, readonly } from "vue";
-export const useAuth = () => {
+export const useAuthentication = () => {
   const user = useState("user", () => null);
   const isAuthenticated = computed(() => !!user.value);
   const login = (userData) => {

package/dist/runtime/constants.d.ts

@@ -0,0 +1 @@
+export declare const NO_AUTH_PATHS: string[];

package/dist/runtime/constants.js

@@ -0,0 +1 @@
+export const NO_AUTH_PATHS = ["/login", "/api/auth/login", "/api/auth/forgot-password"];

package/dist/runtime/middleware/authorization.client.js

@@ -0,0 +1,30 @@
+import { defineNuxtRouteMiddleware, navigateTo, useRuntimeConfig } from "#app";
+import { useAuthentication } from "../composables/useAuthentication.js";
+import { hasPermission, isWhitelisted } from "../utils/permissions.js";
+import { NO_AUTH_PATHS } from "../constants.js";
+export default defineNuxtRouteMiddleware((to) => {
+  const { public: { nuxtUsers: publicNuxtUsers } } = useRuntimeConfig();
+  const publicOptions = publicNuxtUsers;
+  if (NO_AUTH_PATHS.includes(to.path)) {
+    console.log(`[Nuxt Users] client.middleware.auth.global: ${to.path}`);
+    return;
+  }
+  if (isWhitelisted(to.path, publicOptions.auth.whitelist)) {
+    console.log(`[Nuxt Users] client.middleware.auth.global: Whitelisted: ${to.path}`);
+    return;
+  }
+  const { isAuthenticated, user } = useAuthentication();
+  if (!isAuthenticated.value) {
+    console.log(`[Nuxt Users] client.middleware.auth.global: Unauthenticated ${to.path}, redirecting to /login`);
+    return navigateTo("/login");
+  }
+  if (!user.value || !hasPermission(user.value.role, to.path, publicOptions.auth.permissions)) {
+    console.log(`[Nuxt Users] client.middleware.auth.global: User with role ${user.value?.role} denied access to ${to.path}`);
+    return navigateTo("/login");
+  }
+  console.log("[Nuxt Users] client.middleware.auth.global", {
+    isAuthenticated: isAuthenticated.value,
+    userRole: user.value?.role,
+    to: to.path
+  });
+});

package/dist/runtime/server/middleware/{auth.server.js → authorization.server.js}

@@ -1,7 +1,8 @@
 import { defineEventHandler, getCookie, sendRedirect } from "h3";
 import { useRuntimeConfig } from "#imports";
 import { getCurrentUserFromToken } from "../utils/index.js";
-const noAuthPaths = ["/login", "/api/auth/login", "/api/auth/forgot-password"];
+import { hasPermission, isWhitelisted } from "../../utils/permissions.js";
+import { NO_AUTH_PATHS } from "../../constants.js";
 export default defineEventHandler(async (event) => {
   const { nuxtUsers } = useRuntimeConfig();
   const options = nuxtUsers;
@@ -9,11 +10,11 @@ export default defineEventHandler(async (event) => {
   if (!isPageOrApiRoute) {
     return;
   }
-  if (noAuthPaths.includes(event.path)) {
+  if (NO_AUTH_PATHS.includes(event.path)) {
     console.log("[Nuxt Users] server.middleware.auth.global: /login");
     return;
   }
-  if (options.auth.whitelist.includes(event.path)) {
+  if (isWhitelisted(event.path, options.auth.whitelist)) {
     console.log(`[Nuxt Users] server.middleware.auth.global: whitelisted: ${event.path}`);
     return;
   }
@@ -27,6 +28,10 @@ export default defineEventHandler(async (event) => {
     console.log(`[Nuxt Users] server.middleware.auth.global: ${event.path} No user found redirecting to login`);
     return sendRedirect(event, "/login");
   }
-  console.log(`[Nuxt Users] server.middleware.auth.global: Authenticated request to ${event.path} for ${user.id}`);
+  if (!hasPermission(user.role, event.path, options.auth.permissions)) {
+    console.log(`[Nuxt Users] server.middleware.auth.global: ${event.path} User ${user.id} with role ${user.role} denied access`);
+    return sendRedirect(event, "/login");
+  }
+  console.log(`[Nuxt Users] server.middleware.auth.global: Authenticated request to ${event.path} for ${user.id} with role ${user.role}`);
   return;
 });

package/dist/runtime/server/services/password.js

@@ -30,13 +30,46 @@ export const sendPasswordResetLink = async (email, options) => {
       pass: options.mailer.auth.pass
     }
   });
+  const resetUrl = new URL("/reset-password", options.passwordResetBaseUrl || "http://localhost:3000");
+  resetUrl.searchParams.set("token", token);
+  resetUrl.searchParams.set("email", email);
+  const resetLink = resetUrl.toString();
   try {
     await transporter.sendMail({
       from: options.mailer.defaults?.from || '"Nuxt Users" <noreply@example.com>',
       to: email,
       subject: "Password Reset Request",
-      text: `Please click the following link to reset your password: ${options.passwordResetBaseUrl}`,
-      html: `<p>Please click the following link to reset your password:</p><p><a href="${options.passwordResetBaseUrl}">${options.passwordResetBaseUrl}</a></p><p>This link will expire in ${TOKEN_EXPIRATION_HOURS} hour(s).</p>`
+      text: `Please click the following link to reset your password: ${resetLink}
+
+This link will expire in ${TOKEN_EXPIRATION_HOURS} hour(s).
+
+If you did not request this password reset, please ignore this email.`,
+      html: `
+        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
+          <h2>Password Reset Request</h2>
+          <p>You have requested to reset your password. Please click the button below to set a new password:</p>
+          
+          <div style="text-align: center; margin: 30px 0;">
+            <a href="${resetLink}" 
+               style="background-color: #007bff; color: white; padding: 12px 24px; text-decoration: none; border-radius: 5px; display: inline-block;">
+              Reset Password
+            </a>
+          </div>
+          
+          <p>Or copy and paste the following link into your browser:</p>
+          <p style="word-break: break-all; background-color: #f8f9fa; padding: 10px; border-radius: 3px;">
+            <a href="${resetLink}">${resetLink}</a>
+          </p>
+          
+          <p style="color: #6c757d; font-size: 14px;">
+            This link will expire in ${TOKEN_EXPIRATION_HOURS} hour(s).
+          </p>
+          
+          <p style="color: #6c757d; font-size: 14px;">
+            If you did not request this password reset, please ignore this email. Your password will remain unchanged.
+          </p>
+        </div>
+      `
     });
     console.log(`[Nuxt Users] Password reset email sent to ${email}`);
   } catch (error) {

package/dist/runtime/utils/permissions.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Checks if a path matches a pattern (supports wildcards)
+ * @param path - The path to check
+ * @param pattern - The pattern to match against (supports * wildcard)
+ * @returns true if the path matches the pattern
+ */
+export declare const pathMatchesPattern: (path: string, pattern: string) => boolean;
+/**
+ * Checks if a user has permission to access a specific path
+ * @param userRole - The user's role
+ * @param path - The path being accessed
+ * @param permissions - The permissions configuration
+ * @returns true if the user has permission to access the path
+ */
+export declare const hasPermission: (userRole: string, path: string, permissions: Record<string, string[]>) => boolean;
+/**
+ * Checks if a path is accessible without authentication
+ * @param path - The path being accessed
+ * @param whitelist - Array of whitelisted paths
+ * @returns true if the path is whitelisted
+ */
+export declare const isWhitelisted: (path: string, whitelist: string[]) => boolean;

package/dist/runtime/utils/permissions.js

@@ -0,0 +1,36 @@
+export const pathMatchesPattern = (path, pattern) => {
+  if (path === pattern) {
+    return true;
+  }
+  if (pattern === "*") {
+    return true;
+  }
+  if ((pattern.match(/\*/g) || []).length > 1) {
+    const regexPattern = pattern.replace(/\*/g, "[^/]*");
+    const regex = new RegExp(`^${regexPattern}$`);
+    return regex.test(path);
+  }
+  if (pattern.endsWith("/*")) {
+    const basePattern = pattern.slice(0, -2);
+    return path === basePattern || path.startsWith(basePattern + "/");
+  }
+  if (pattern.includes("*")) {
+    const regexPattern = pattern.replace(/\*/g, "[^/]*");
+    const regex = new RegExp(`^${regexPattern}$`);
+    return regex.test(path);
+  }
+  return false;
+};
+export const hasPermission = (userRole, path, permissions) => {
+  if (!permissions || Object.keys(permissions).length === 0) {
+    return false;
+  }
+  const rolePermissions = permissions[userRole];
+  if (!rolePermissions) {
+    return false;
+  }
+  return rolePermissions.some((pattern) => pathMatchesPattern(path, pattern));
+};
+export const isWhitelisted = (path, whitelist) => {
+  return whitelist.some((whitelistedPath) => pathMatchesPattern(path, whitelistedPath));
+};

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "nuxt-users",
-  "version": "1.6.7",
-  "description": "A comprehensive user management module for Nuxt 3 applications with authentication, database support, and CLI tools",
+  "version": "1.7.0",
+  "description": "A comprehensive user management module for Nuxt 3 and Nuxt 4 applications with authentication, authorization, database support, and CLI tools",
   "keywords": [
     "nuxt",
     "nuxt3",
     "nuxt-module",
     "users",
     "authentication",
+    "authorization",
     "auth",
     "user-management",
     "sqlite",
@@ -82,7 +83,7 @@
     "docs:dev": "vitepress dev docs",
     "docs:build": "vitepress build docs",
     "docs:preview": "vitepress preview docs",
-    "docs:deploy": "yarn docs:build && ./scripts/deploy-docs.sh"
+    "docs:release": "yarn docs:build && ./scripts/deploy-docs.sh"
   },
   "dependencies": {
     "bcrypt": "^6.0.0",
@@ -98,7 +99,13 @@
   "peerDependencies": {
     "@nuxt/kit": "^3.17.6",
     "bcrypt": "^6.0.0",
-    "nodemailer": "^7.0.5"
+    "nodemailer": "^7.0.5",
+    "nuxt-api-shield": "^0.1.0 || ^0.8.0"
+  },
+  "peerDependenciesMeta": {
+    "nuxt-api-shield": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@nuxt/devtools": "^2.6.2",

package/dist/runtime/middleware/auth.client.js

@@ -1,20 +0,0 @@
-import { defineNuxtRouteMiddleware, navigateTo, useRuntimeConfig } from "#app";
-import { useAuth } from "../composables/useAuth.js";
-export default defineNuxtRouteMiddleware((to) => {
-  const { public: { nuxtUsers: publicNuxtUsers } } = useRuntimeConfig();
-  const publicOptions = publicNuxtUsers;
-  if (to.path === "/login") {
-    console.log("[Nuxt Users] client.middleware.auth.global: /login");
-    return;
-  }
-  if (publicOptions.auth.whitelist.includes(to.path)) {
-    console.log(`[Nuxt Users] client.middleware.auth.global: Whitelisted: ${to.path}`);
-    return;
-  }
-  const { isAuthenticated } = useAuth();
-  if (!isAuthenticated.value) {
-    console.log(`[Nuxt Users] client.middleware.auth.global: Unauthenticated ${to.path}, redirecting to /login`);
-    return navigateTo("/login");
-  }
-  console.log("[Nuxt Users] client.middleware.auth.global", { isAuthenticated: isAuthenticated.value, to: to.path });
-});