use-convex 1.3.0 → 2.0.0

package/dist/runtime/utils/context.d.ts

@@ -1,5 +1,6 @@
 import type { AuthTokenFetcher, ConvexClient, ConvexHttpClient } from 'convex/browser';
-import type { ComputedRef, InjectionKey, Ref } from 'vue';
+import type { FunctionReference } from 'convex/server';
+import type { ComputedRef, InjectionKey, Ref, ShallowRef } from 'vue';
 import type { CreateHttpClientOptions } from './http.js';
 export interface ConvexAuthContext {
     /**
@@ -19,6 +20,36 @@ export interface ConvexAuthContext {
     isAuthenticated: Ref<boolean>;
     isRefreshing: Ref<boolean>;
 }
+/** Snapshot of the Convex Auth client (`AuthState` in `@convex-dev/auth`). */
+export interface ConvexAuthSnapshot {
+    isLoading: boolean;
+    isAuthenticated: boolean;
+    token: string | null;
+}
+/**
+ * Runs a method's sign-in function. Direct to the deployment in SPA mode,
+ * through the Nitro auth proxy in SSR mode (which moves the refresh token
+ * into an httpOnly cookie).
+ */
+export interface ConvexAuthSignInApi {
+    mutation: (fn: FunctionReference<'mutation'>, args: Record<string, unknown>) => Promise<any>;
+    action: (fn: FunctionReference<'action'>, args: Record<string, unknown>) => Promise<any>;
+}
+/** First-party Convex Auth v2 binding, set by the auth client plugin. */
+export interface ConvexAuthBinding {
+    mode: 'ssr' | 'spa';
+    state: ShallowRef<ConvexAuthSnapshot>;
+    signInApi: ConvexAuthSignInApi;
+    /** Adopt a session returned by a method's sign-in function. */
+    setSession: (session: {
+        accessToken: string;
+        userId: string;
+        [key: string]: unknown;
+    }) => Promise<void>;
+    signOut: () => Promise<void>;
+    /** Values an ambient sign-in (e.g. OAuth) publishes, read reactively. */
+    ambientValue: <T>(id: string, key: string) => Readonly<Ref<T | undefined>>;
+}
 export interface ConvexNuxtContext {
     url: string;
     /**
@@ -26,14 +57,20 @@ export interface ConvexNuxtContext {
      */
     client: ConvexClient | null;
     /**
-     * JWT from the optional auth cookie. Reactive so sign-in/out updates
-     * HttpClient refreshes and `hasSsrSession`.
+     * JWT for HttpClient snapshots: the SSR session token (Convex Auth SSR
+     * mode or a BYO cookie), then the live Convex Auth access token on the
+     * client. Reactive so sign-in/out re-runs HttpClient fetches.
      */
     ssrToken: ComputedRef<string | undefined>;
     /**
      * Shared auth state for useConvexAuth.
      */
     auth: ConvexAuthContext;
+    /**
+     * Convex Auth v2 client binding (`convex.auth.provider: 'convex-auth'`,
+     * browser only). `null` on the server and for BYO providers.
+     */
+    convexAuth?: ConvexAuthBinding | null;
     /**
      * Create a fresh HttpClient for one-shot fetches (SSR / Nitro / refresh).
      * Prefer a new client per call — HttpClient is stateful.

package/dist/types.d.mts

@@ -4,7 +4,7 @@ declare module '@nuxt/schema' {
   interface PublicRuntimeConfig extends ModulePublicRuntimeConfig {}
 }
 
-export { type AuthTokens, type SignInResult, type UseAuthReturn } from '../dist/runtime/composables/useAuth.js'
+export { type ConvexAuthSession, type ConvexSignInResult, type OAuthCompleteResult, type OAuthFlowError, type OAuthProviderRefs, type OAuthSignInOptions, type OAuthStartResult, type UseAuthReturn } from '../dist/runtime/composables/useAuth.js'
 
 export { type ConvexQueryArgs, type UseConvexQueryOptions, type UseConvexQueryReturn } from '../dist/runtime/composables/useConvexQuery.js'
 
@@ -30,7 +30,9 @@ export { type ConnectionState } from '../dist/runtime/composables/useConvexConne
 
 export { type ConvexGate } from '../dist/runtime/composables/useConvexGate.js'
 
-export { type ConvexAuthClientOptions, type ConvexAuthStorageMode, type ConvexAuthTokenStorage, type configureConvexAuth } from '../dist/runtime/utils/authClientOptions.js'
+export { type ConvexAmbientSignIn, type ConvexAuthClientOptions, type ConvexAuthStorageMode, type ConvexAuthTokenStorage, type configureConvexAuth } from '../dist/runtime/utils/authClientOptions.js'
+
+export { type ConvexAuthServerRuntimeConfig } from '../dist/runtime/utils/authStorage.js'
 
 export { default } from './module.mjs'
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "use-convex",
-  "version": "1.3.0",
+  "version": "2.0.0",
   "description": "First-class Convex integration for Nuxt",
   "license": "MIT",
   "repository": {
@@ -44,13 +44,12 @@
     "h3": "^1.15.0"
   },
   "devDependencies": {
-    "@auth/core": "0.41.1",
-    "@convex-dev/auth": "^0.0.95",
+    "@convex-dev/auth": "^2.0.0",
     "@nuxt/module-builder": "^1.0.0",
     "@nuxt/schema": "^4.0.0",
     "@nuxt/test-utils": "^3.23.0",
     "@types/node": "^26.5.0",
-    "convex": "^1.46.0",
+    "convex": "^1.48.0",
     "convex-test": "^0.0.56",
     "happy-dom": "^20.14.0",
     "nitropack": "^2.13.0",
@@ -63,10 +62,16 @@
     "vue-tsc": "^3.0.0"
   },
   "peerDependencies": {
-    "convex": "^1.46.0",
+    "@convex-dev/auth": "^2.0.0",
+    "convex": "^1.48.0",
     "nuxt": "^4.0.0",
     "vue": "^3.5.0"
   },
+  "peerDependenciesMeta": {
+    "@convex-dev/auth": {
+      "optional": true
+    }
+  },
   "packageManager": "pnpm@10.0.0",
   "pnpm": {
     "overrides": {

package/dist/runtime/server/api/convex/auth/session.d.ts

@@ -1,36 +0,0 @@
-/**
- * Persist / read / refresh HttpOnly auth cookies.
- *
- * - GET → `{ hasSession }` only (no JWT in the response body)
- * - POST `{ getToken: true }` → `{ hasSession, token }` for ConvexClient.setAuth
- * - POST `{ refresh: true }` → refresh cookies, return `{ token }`
- * - POST `{ token, refreshToken }` → set cookies
- * - DELETE → clear cookies
- *
- * All methods require same-origin (fail-closed). Returning the JWT only via
- * POST reduces accidental leakage via prefetch/logs; XSS can still obtain a
- * token once ConvexClient needs it in memory — HttpOnly mitigates cookie theft,
- * not XSS session theft.
- */
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
-    hasSession: boolean;
-    ok?: undefined;
-    token?: undefined;
-} | {
-    ok: boolean;
-    hasSession?: undefined;
-    token?: undefined;
-} | {
-    hasSession: boolean;
-    token: string | null;
-    ok?: undefined;
-} | {
-    token: null;
-    hasSession?: undefined;
-    ok?: undefined;
-} | {
-    token: string;
-    hasSession?: undefined;
-    ok?: undefined;
-}>>;
-export default _default;

package/dist/runtime/server/api/convex/auth/session.js

@@ -1,90 +0,0 @@
-import { ConvexHttpClient } from "convex/browser";
-import { makeFunctionReference } from "convex/server";
-import { createError, defineEventHandler, readBody } from "h3";
-import { useRuntimeConfig } from "nitropack/runtime";
-import { readHttpOnlyJwt, readHttpOnlyRefresh, setAuthCookies } from "../../../authCookies.js";
-import { isHttpOnlyAuth } from "../../../../utils/authStorage.js";
-import { assertSameOrigin } from "../../../sameOrigin.js";
-import { MISSING_URL_HINT } from "../../../../utils/errors.js";
-const authSignIn = makeFunctionReference(
-  "auth:signIn"
-);
-function convexUrl(event) {
-  const config = useRuntimeConfig(event);
-  const url = config.public?.convex?.url ?? process.env.NUXT_PUBLIC_CONVEX_URL;
-  if (!url) {
-    throw createError({
-      statusCode: 500,
-      message: MISSING_URL_HINT
-    });
-  }
-  return url;
-}
-function requireHttpOnly(event) {
-  const config = useRuntimeConfig(event);
-  const auth = config.public?.convex?.auth;
-  if (!isHttpOnlyAuth(auth)) {
-    throw createError({
-      statusCode: 404,
-      message: "HttpOnly auth is not enabled"
-    });
-  }
-}
-export default defineEventHandler(async (event) => {
-  requireHttpOnly(event);
-  assertSameOrigin(event);
-  if (event.method === "GET") {
-    const token = readHttpOnlyJwt(event);
-    return {
-      hasSession: !!token
-    };
-  }
-  if (event.method === "DELETE") {
-    setAuthCookies(event, { token: null });
-    return { ok: true };
-  }
-  if (event.method === "POST") {
-    const body = await readBody(event);
-    if (body?.getToken) {
-      const token = readHttpOnlyJwt(event);
-      return {
-        hasSession: !!token,
-        token: token ?? null
-      };
-    }
-    if (body?.refresh) {
-      const refreshToken = readHttpOnlyRefresh(event);
-      if (!refreshToken) {
-        setAuthCookies(event, { token: null });
-        return { token: null };
-      }
-      const http = new ConvexHttpClient(convexUrl(event));
-      try {
-        const result = await http.action(authSignIn, { refreshToken });
-        const tokens = result.tokens ?? null;
-        if (!tokens) {
-          setAuthCookies(event, { token: null });
-          return { token: null };
-        }
-        setAuthCookies(event, {
-          token: tokens.token,
-          refreshToken: tokens.refreshToken
-        });
-        return { token: tokens.token };
-      } catch {
-        setAuthCookies(event, { token: null });
-        return { token: null };
-      }
-    }
-    if (!body?.token) {
-      setAuthCookies(event, { token: null });
-      return { ok: true };
-    }
-    setAuthCookies(event, {
-      token: body.token,
-      refreshToken: body.refreshToken ?? null
-    });
-    return { ok: true };
-  }
-  throw createError({ statusCode: 405, message: "Method not allowed" });
-});

package/dist/runtime/server/authCookies.d.ts

@@ -1,9 +0,0 @@
-import type { H3Event } from 'h3';
-export interface AuthCookieSet {
-    token: string | null;
-    refreshToken?: string | null;
-}
-/** Persist or clear HttpOnly auth cookies + readable presence marker. */
-export declare function setAuthCookies(event: H3Event, tokens: AuthCookieSet): void;
-export declare function readHttpOnlyJwt(event: H3Event): string | undefined;
-export declare function readHttpOnlyRefresh(event: H3Event): string | undefined;

package/dist/runtime/server/authCookies.js

@@ -1,64 +0,0 @@
-import { deleteCookie, getCookie, getRequestHeader, setCookie } from "h3";
-import {
-  AUTH_JWT_COOKIE_MAX_AGE,
-  isHttpOnlyAuth,
-  resolveAuthCookieName,
-  resolveAuthPresentCookieName,
-  resolveAuthRefreshCookieName
-} from "../utils/authStorage.js";
-import { readConvexConfig } from "./convexConfig.js";
-function readAuthConfig(event) {
-  return readConvexConfig(event)?.auth;
-}
-function isLocalHost(event) {
-  const host = getRequestHeader(event, "host") ?? "";
-  return host.startsWith("localhost") || host.startsWith("127.0.0.1") || host.startsWith("[::1]");
-}
-function cookieOptions(event, httpOnly) {
-  const local = isLocalHost(event);
-  return {
-    httpOnly,
-    secure: !local,
-    sameSite: "lax",
-    path: "/",
-    maxAge: AUTH_JWT_COOKIE_MAX_AGE
-  };
-}
-export function setAuthCookies(event, tokens) {
-  const auth = readAuthConfig(event);
-  if (!isHttpOnlyAuth(auth)) {
-    throw new Error("[use-convex] setAuthCookies requires convex.auth.httpOnly: true");
-  }
-  const jwtName = resolveAuthCookieName(auth);
-  const refreshName = resolveAuthRefreshCookieName(auth);
-  const presentName = resolveAuthPresentCookieName(auth);
-  const httpOpts = cookieOptions(event, true);
-  const presentOpts = cookieOptions(event, false);
-  if (!tokens.token) {
-    deleteCookie(event, jwtName, httpOpts);
-    deleteCookie(event, refreshName, httpOpts);
-    deleteCookie(event, presentName, presentOpts);
-    return;
-  }
-  setCookie(event, jwtName, tokens.token, httpOpts);
-  if (tokens.refreshToken) {
-    setCookie(event, refreshName, tokens.refreshToken, httpOpts);
-  }
-  setCookie(event, presentName, "1", presentOpts);
-}
-export function readHttpOnlyJwt(event) {
-  const auth = readAuthConfig(event);
-  const name = resolveAuthCookieName(auth);
-  if (!name) {
-    return void 0;
-  }
-  return getCookie(event, name) || void 0;
-}
-export function readHttpOnlyRefresh(event) {
-  const auth = readAuthConfig(event);
-  const name = resolveAuthRefreshCookieName(auth);
-  if (!name) {
-    return void 0;
-  }
-  return getCookie(event, name) || void 0;
-}

package/dist/runtime/server/sameOrigin.d.ts

@@ -1,14 +0,0 @@
-import { type H3Event } from 'h3';
-/**
- * Fail-closed same-origin guard for cookie-bearing auth routes.
- *
- * Accepts the request when:
- * - `Sec-Fetch-Site` is `same-origin` or `none` (user-initiated / same origin), or
- * - `Origin` matches the trusted request origin (scheme + host), using
- *   `Host` and `getRequestProtocol` (honors `X-Forwarded-Proto` behind proxies).
- *
- * Rejects when `Sec-Fetch-Site` is `cross-site` / `same-site`, or when neither
- * signal can confirm same-origin. Missing both headers is rejected.
- * Scheme-mismatched Origins (e.g. `http://` vs HTTPS request) are rejected.
- */
-export declare function assertSameOrigin(event: H3Event): void;

package/dist/runtime/server/sameOrigin.js

@@ -1,29 +0,0 @@
-import { createError, getRequestHeader, getRequestProtocol } from "h3";
-export function assertSameOrigin(event) {
-  const secFetchSite = getRequestHeader(event, "sec-fetch-site");
-  if (secFetchSite === "same-origin" || secFetchSite === "none") {
-    return;
-  }
-  if (secFetchSite === "cross-site" || secFetchSite === "same-site") {
-    throw createError({
-      statusCode: 403,
-      message: "Forbidden"
-    });
-  }
-  const origin = getRequestHeader(event, "origin");
-  const host = getRequestHeader(event, "host");
-  if (origin && host) {
-    try {
-      const originUrl = new URL(origin);
-      const protocol = getRequestProtocol(event, { xForwardedProto: true });
-      if (originUrl.protocol === `${protocol}:` && originUrl.host === host) {
-        return;
-      }
-    } catch {
-    }
-  }
-  throw createError({
-    statusCode: 403,
-    message: "Forbidden"
-  });
-}

package/dist/runtime/utils/authMutex.d.ts

@@ -1,15 +0,0 @@
-/**
- * Single-flight mutex for token refresh (mirrors @convex-dev/auth/react).
- * Prefers `navigator.locks` when available; falls back to an in-memory queue.
- */
-type MutexState = {
-    currentlyRunning: Promise<void> | null;
-    waiting: Array<() => Promise<void>>;
-};
-declare global {
-    var __convexNuxtAuthMutexes: Record<string, MutexState> | undefined;
-}
-export declare function withRefreshMutex<T>(key: string, callback: () => Promise<T>): Promise<T>;
-/** Test helper — clear in-memory mutex state between tests. */
-export declare function resetAuthMutexesForTests(): void;
-export {};

package/dist/runtime/utils/authMutex.js

@@ -1,47 +0,0 @@
-export async function withRefreshMutex(key, callback) {
-  const lockManager = typeof navigator !== "undefined" ? navigator.locks : void 0;
-  if (lockManager !== void 0) {
-    return await lockManager.request(key, callback);
-  }
-  return await manualMutex(key, callback);
-}
-async function manualMutex(key, callback) {
-  return await new Promise((resolve, reject) => {
-    const wrapped = () => callback().then(resolve).catch(reject).then(() => void 0);
-    void enqueueCallbackForMutex(key, wrapped);
-  });
-}
-function getMutexValue(key) {
-  if (globalThis.__convexNuxtAuthMutexes === void 0) {
-    globalThis.__convexNuxtAuthMutexes = {};
-  }
-  let mutex = globalThis.__convexNuxtAuthMutexes[key];
-  if (mutex === void 0) {
-    mutex = { currentlyRunning: null, waiting: [] };
-    globalThis.__convexNuxtAuthMutexes[key] = mutex;
-  }
-  return mutex;
-}
-async function enqueueCallbackForMutex(key, callback) {
-  const mutex = getMutexValue(key);
-  if (mutex.currentlyRunning === null) {
-    globalThis.__convexNuxtAuthMutexes[key] = {
-      currentlyRunning: callback().finally(() => {
-        const next = getMutexValue(key).waiting.shift();
-        getMutexValue(key).currentlyRunning = null;
-        if (next !== void 0) {
-          void enqueueCallbackForMutex(key, next);
-        }
-      }),
-      waiting: []
-    };
-  } else {
-    globalThis.__convexNuxtAuthMutexes[key] = {
-      ...mutex,
-      waiting: [...mutex.waiting, callback]
-    };
-  }
-}
-export function resetAuthMutexesForTests() {
-  globalThis.__convexNuxtAuthMutexes = void 0;
-}

package/dist/runtime/utils/oauthRedirect.d.ts

@@ -1,5 +0,0 @@
-/**
- * Validate an OAuth redirect from Convex `auth:signIn`.
- * Only http(s) absolute URLs are allowed (blocks javascript:/data: etc.).
- */
-export declare function parseOAuthRedirect(redirect: string): URL;

package/dist/runtime/utils/oauthRedirect.js

@@ -1,13 +0,0 @@
-import { useConvexError } from "./errors.js";
-export function parseOAuthRedirect(redirect) {
-  let url;
-  try {
-    url = new URL(redirect);
-  } catch {
-    throw useConvexError("Invalid OAuth redirect URL");
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw useConvexError("OAuth redirect must be http(s)");
-  }
-  return url;
-}