nuxt-users
Version:
A comprehensive user management module for Nuxt 3 and Nuxt 4 applications with authentication, authorization, database support, and CLI tools
66 lines (65 loc) • 3.02 kB
JavaScript
import { defineEventHandler, getCookie, createError } from "h3";
import { useRuntimeConfig } from "#imports";
import { getCurrentUserFromToken } from "../utils/index.js";
import { hasPermission, isWhitelisted } from "../../utils/permissions.js";
import { NO_AUTH_PATHS, NO_AUTH_API_PATHS } from "../../constants.js";
export default defineEventHandler(async (event) => {
const { nuxtUsers } = useRuntimeConfig();
const options = nuxtUsers;
const base = options.apiBasePath || "/api/nuxt-users";
const isPageOrApiRoute = !event.path.includes(".") && (event.path === "/" || event.path.startsWith("/api/") || !event.path.startsWith("/_"));
if (!isPageOrApiRoute) {
return;
}
const noAuthPaths = [...NO_AUTH_PATHS];
if (options.passwordResetUrl && options.passwordResetUrl !== "/reset-password") {
noAuthPaths.push(options.passwordResetUrl);
}
if (noAuthPaths.includes(event.path)) {
console.debug(`[Nuxt Users] authorization: NO_AUTH_PATH: ${event.path}`);
return;
}
const openApiPaths = NO_AUTH_API_PATHS.map((path) => `${base}${path}`);
if (openApiPaths.includes(event.path)) {
return;
}
if (isWhitelisted(event.path, options.auth.whitelist)) {
console.debug(`[Nuxt Users] authorization: whitelisted: ${event.path}`);
return;
}
const token = getCookie(event, "auth_token");
if (!token) {
if (event.path.startsWith("/api/")) {
console.warn(`[Nuxt Users] authorization: ${event.path} No token found - API request rejected`);
throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
} else {
console.debug(`[Nuxt Users] authorization: ${event.path} No token found - letting client handle page redirect`);
return;
}
}
const user = await getCurrentUserFromToken(token, options);
if (!user) {
if (event.path.startsWith("/api/")) {
console.warn(`[Nuxt Users] authorization: ${event.path} Invalid token - API request rejected`);
throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
} else {
console.debug(`[Nuxt Users] authorization: ${event.path} Invalid token - letting client handle page redirect`);
return;
}
}
if (event.path === `${base}/me`) {
console.debug(`[Nuxt Users] authorization: Auto-whitelisted /me endpoint for authenticated user ${user.id}`);
return;
}
if (!hasPermission(user.role, event.path, event.method, options.auth.permissions)) {
if (event.path.startsWith("/api/")) {
console.warn(`[Nuxt Users] authorization: ${event.path} User ${user.id} with role ${user.role} denied access - API request rejected`);
throw createError({ statusCode: 403, statusMessage: "Forbidden" });
} else {
console.debug(`[Nuxt Users] authorization: ${event.path} User ${user.id} with role ${user.role} denied access - letting client handle page redirect`);
return;
}
}
console.debug(`[Nuxt Users] authorization: Authenticated request to ${event.path} for ${user.id} with role ${user.role}`);
return;
});