@nuxtagentic/identity

Identity

Desktop clients use the same deployed CloudConfig authentication. The module adds /desktop/connect, /desktop/connected, and POST /api/desktop/session for the native host's browser sign-in handoff. This transfers an existing signed session after explicit consent, encrypted to the native process's temporary public key; it does not create a separate identity store. The customer starter's desktop/README.md covers setup and distribution. GitHub/Google OAuth stays in the system browser, and desktop callbacks remain on the loopback interface.

@nuxtagentic/identity owns sign-in, the current account, organization selection, profile and avatar editing, organization logos, and security controls. It installs Nuxt UI and the CloudConfig Nuxt module. It can be installed independently of the workspace shell.

Add @nuxtagentic/identity to Nuxt's modules and include identityModels from @nuxtagentic/identity/schema in the host's cloud.config.ts. The schema owns identity image storage; CloudConfig's auth configuration owns users and sessions. Cloudflare avatar and logo uploads require an R2 bucket with the FILES binding. This starter declares it in deploy.r2 and deploy.r2Binding; local uploads use CloudConfig's development storage.

Configure GitHub and Google with the CloudConfig auth CLI for the supplied sign-in screens. Set auth.organizations: true for workspace management and auth.twoFactor: true for the supplied security controls. Account administration is a separate optional capability in auth.admin.

The package registers /sign-in, /sign-up, /two-factor, the default layout, and the auth route middleware. Identity also registers /dashboard/organizations. The root app consumes its optional profile-settings contribution. useCurrentUser, useAccountSession, useWorkspaceScope, and useWorkspaces expose session and organization state to dependent modules.

In Settings → Organization, choose Edit logo to upload, replace, or remove an organization's logo, then Save logo. Owners and admins can update logos; the auth API enforces these permissions. New organizations can include a logo when created. Supported formats are JPG, PNG, WebP, and GIF, up to 2 MB. Logos appear in the organization list and workspace switcher. Logo editing uses the organizationLogo URL parameter so direct links and browser Back/Forward work.

Identity image uploads share the existing avatar storage model and retain their uploaded asset when saving fails, so retries do not upload the same file again. useProfileNamePreview keeps live name previews within Identity's state ownership.

Directory provisioning

With auth.scim: true, Directory provisioning mints a SCIM token and shows the base URL to paste into Okta, Entra ID or Google Workspace. Provisioned people join the organization; deprovisioning removes the membership, which ends their access on the next request and revokes their personal integration connections. Owners are never removed by a directory.

Access rules see the active organization and role on user.organization; use orgRows, ownOrgRows and hasOrgRole from @cloudconfig/core.

See module installation for local package setup and schema composition.