useAccAuth

// nuxt.config.ts
export default defineNuxtConfig({
  ...,
  levarneAcc: {
    auth: {
      enabled: true,
      cookieSecret: process.env.COOKIE_SECRET, // required
      loginPage: '/login',                     // optional — redirect on 401/403
    },
  }
})

const {
  signUp,
  signInWithPassword,
  verify,
  signOut,
  signOutAll,
  switchSession,
  refreshActiveSession,
  syncAuthState,
  getCurrentUser,
  requestPasswordReset,
  confirmPasswordReset,
  changePassword,
  setup2FA,
  verify2FA,
  signInWith2FA,
} = useAccAuth()

const sessions = useAccAuthSessions()           // Ref<AccSession[]>
const activeSessionId = useAccAuthActiveSessionId() // Ref<string | null>
const authUser = useAccAuthUser()               // Ref<Record<string, unknown> | null>

const result = await signUp({
  username: 'user@example.com',
  password: 'secret',
  captchaAction: 'sign_up', // triggers automatic reCAPTCHA
  baseUrl: 'https://your-origin.com', // optional — used to build links in emails
  frontendPath: 'auth/confirm', // optional — path segment in verification/reset email links
})

// result: { success: boolean, errorCode?: AuthErrorCode }

const result = await signInWithPassword({
  username: 'user@example.com',
  password: 'secret',
  sessionDuration: 'long', // 'short' | 'long' — defaults to 'short'
  baseUrl: 'https://your-origin.com', // optional
  frontendPath: 'auth/confirm', // optional — used if user is UNCONFIRMED and a verification email is sent
})

// result: { success: boolean, sessionId?: string, errorCode?: AuthErrorCode }

// nuxt.config.ts — override session and token TTLs
levarneAcc: {
  auth: {
    sessionTtlShortSeconds: 60 * 60,         // default: 1 hour
    sessionTtlLongSeconds: 60 * 60 * 24 * 30, // default: 30 days
    accessTokenTtlSeconds: 60 * 15,          // default: 15 minutes
  },
}

const result = await verify({
  token: 'verification-token-from-email',
  sessionDuration: 'long', // 'short' | 'long' — defaults to 'short'
  baseUrl: 'https://your-origin.com', // optional — used if token is expired and a new email is sent
  frontendPath: 'auth/confirm', // optional — path segment in the re-sent verification email link
})

// result: { success: boolean, sessionId?: string, errorCode?: AuthErrorCode }

// Sign out the active session
await signOut()

// Sign out a specific session by ID
await signOut({ sessionId: 'session_abc123' })

// Sign out all sessions for the current user
await signOutAll()

// Switch to a different session (e.g. a second logged-in account)
const result = await switchSession('session_abc123')

// result: { success: boolean, activeSessionId?: string, errorCode?: AuthErrorCode }

const result = await refreshActiveSession()

// result: { success: boolean, errorCode?: AuthErrorCode }

// Fetch and apply the current auth state from the server
const authState = await syncAuthState()

// authState: { activeSessionId: string | null, sessions: AccSession[], activeUser: ... | null }

// Fetch just the user object and update useAccAuthUser()
const user = await getCurrentUser()

// Step 1 — request a reset email
await requestPasswordReset({
  username: 'user@example.com',
  captchaAction: 'forgot_password', // triggers automatic reCAPTCHA
  baseUrl: 'https://your-origin.com', // optional — used to build the reset link in the email
  frontendPath: 'auth/reset-password', // optional — path segment in the reset email link
})

// Step 2 — confirm with the token from the email
await confirmPasswordReset({
  token: 'reset-token-from-email',
  newPassword: 'new-secret',
  baseUrl: 'https://your-origin.com', // optional — used if token is expired and a new email is sent
  frontendPath: 'auth/reset-password', // optional — used if token is expired and a new email is sent
})

const result = await changePassword({
  currentPassword: 'old-secret',
  newPassword: 'new-secret',
})

// result: { success: boolean, errorCode?: AuthErrorCode }

const { secret, uri } = await setup2FA()

// secret: 'TO3Y45KKXTZR4RYQ' — 16-char base32 key for manual entry
// uri:    'otpauth://totp/user?secret=…&algorithm=SHA1&digits=6&period=30' — render as QR code

const result = await verify2FA({
  totp: '123456', // 6-digit code from the user's authenticator app
})

// result: { success: boolean, sessionId?: string, errorCode?: AuthErrorCode }

// Step 1: normal sign in — returns MFA_REQUIRED when 2FA is enabled
const { success, errorCode, challengeToken } = await signInWithPassword({
  username: 'user@example.com',
  password: 'secret',
})

if (errorCode === 'MFA_REQUIRED' && challengeToken) {
  // Step 2: complete login with TOTP code
  const result = await signInWith2FA({
    challengeToken,
    totp: '123456', // 6-digit code from authenticator app
  })
}

// nuxt.config.ts — default, no extra config needed
levarneAcc: {
  auth: {
    enabled: true,
    storageDriver: { type: 'memory' },
  },
}

// nuxt.config.ts
// Use Nitro's devStorage to mount a file-system store under the acc-sessions key.
// The module skips registering its own driver when this mount already exists,
// so this takes precedence automatically. Sessions are written to .data/.acc-sessions.
export default defineNuxtConfig({
  levarneAcc: {
    auth: {
      enabled: true,
      cookieSecret: process.env.COOKIE_SECRET,
      // no storageDriver needed — the devStorage mount below takes over
    },
  },

  nitro: {
    devStorage: {
      'acc-sessions': {
        driver: 'fs-lite',
        base: '.data/.acc-sessions',
      },
    },
  },
})

// nuxt.config.ts
levarneAcc: {
  auth: {
    enabled: true,
    cookieSecret: process.env.COOKIE_SECRET,
    storageDriver: {
      type: 'dynamodb',
      region: 'eu-west-1',
      table: 'sessions',
      namespace: 'my-app',
      endpoint: 'http://localhost:8000', // optional — for local DynamoDB
    },
  },
}

// nuxt.config.ts
levarneAcc: {
  auth: {
    enabled: true,
    cookieSecret: process.env.COOKIE_SECRET,
    storageDriver: {
      type: 'postgresql',
      url: process.env.DATABASE_URL,
      namespace: 'my-app',
      // tableName: 'acc_sessions', // optional — defaults to 'acc_sessions'
    },
  },
}