@frigear-nu/oauth-server 0.0.6 → 0.0.8

package/README.md

@@ -39,7 +39,7 @@ export default defineNitroPlugin((nitro) => {
 })
 ```
 
-Full documentation with examples: `apps/docs/content/4.modules/500.oauth-server.md`.
+Full documentation with examples: `apps/docs/content/4.modules/12.oauth-server.md`.
 
 ## Development
 

package/dist/module.d.mts

@@ -20,6 +20,7 @@ type ModuleOptions = {
     /** Extra scopes advertised and accepted next to `openid profile email`. Enrich their claims with `oauth:claims`. */
     scopes?: string[];
     settings?: {
+        mcp?: boolean;
         pages?: {
             /** Consent screen. On by default (`/authorize`); pass `false` to provide your own page at that path. */
             authorize?: string | boolean;

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@frigear-nu/oauth-server",
   "configKey": "oauthServer",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -1,13 +1,11 @@
-import { defineNuxtModule, createResolver, hasNuxtModule, addServerHandler, addServerImportsDir, addImports, extendPages } from '@nuxt/kit';
-import { registerModule, registerDatabaseTable, defineModulePage, moduleApiUrl } from '@frigear-nu/module-kit/utils';
+import { defineNuxtModule, createResolver, hasNuxtModule, addServerHandler, addServerImportsDir, addImports } from '@nuxt/kit';
+import { registerModule, registerTailwindSource, registerLocales, resolvePagePath, registerDatabaseTable, addModulePages, addOptionalMenuSource, moduleApiUrl } from '@frigear-nu/module-kit/utils';
+import { adminRoute } from '@frigear-nu/admin/utils';
+import { addAuthScope, addAuthResolver } from '@frigear-nu/auth/utils';
+import { addMcpDefinitions } from '@frigear-nu/mcp/utils';
 
 const MODULE_NAME = "@frigear-nu/oauth-server";
 const API_NAME = "oauthServer";
-function resolvePagePath(setting, defaultPath) {
-  if (typeof setting === "string") return setting;
-  if (setting === true) return defaultPath;
-  return void 0;
-}
 const module$1 = defineNuxtModule({
   meta: { name: MODULE_NAME, configKey: "oauthServer" },
   defaults: {
@@ -22,16 +20,29 @@ const module$1 = defineNuxtModule({
   moduleDependencies: {
     "@nuxthub/core": { version: ">=0.10" },
     "@frigear-nu/module-kit": { version: ">=0.0.1" },
+    "@frigear-nu/auth": { version: ">=0.0.1" },
+    "@frigear-nu/mcp": { version: ">=0.0.1" },
     "@frigear-nu/users": { version: ">=0.0.1" },
+    "@frigear-nu/ui": { version: ">=0.0.1" },
+    // Provides the shared page components of the admin page (`AdminPage`, `AdminTable`, ...).
+    "@frigear-nu/admin": { version: ">=0.0.0", optional: true },
     "@frigear-nu/menu": { version: ">=0.0.1", optional: true }
   },
   async setup(options, nuxt) {
     registerModule(MODULE_NAME, nuxt);
+    addAuthScope(nuxt, { name: "oauth:read", description: "See which applications you can sign in to (MCP)" });
     const resolver = createResolver(import.meta.url);
+    addAuthResolver(nuxt, {
+      name: "oauth-access-token",
+      jwt: true,
+      order: 60,
+      resolver: resolver.resolve("./runtime/server/resolvers/access-token")
+    });
+    registerTailwindSource(nuxt, resolver.resolve("./runtime/app"));
     const settings = options.settings ?? {};
-    const withMenus = hasNuxtModule("@frigear-nu/menu");
+    registerLocales(nuxt, resolver.resolve("./runtime/i18n/lang"));
     const authorizePath = settings.pages?.authorize === false ? "/authorize" : resolvePagePath(settings.pages?.authorize ?? true, "/authorize");
-    const adminPath = resolvePagePath(settings.pages?.admin, "/admin/oauth");
+    const adminPath = hasNuxtModule("@frigear-nu/admin") ? resolvePagePath(settings.pages?.admin, adminRoute(nuxt, "oauth")) : void 0;
     const applicationsPath = resolvePagePath(settings.pages?.applications, "/account/applications");
     const existing = nuxt.options.runtimeConfig.oauthServer;
     nuxt.options.runtimeConfig.oauthServer = {
@@ -79,28 +90,17 @@ const module$1 = defineNuxtModule({
     api("post", "admin/applications/:id/secret", "api/admin/application-secret.post");
     api("post", "admin/applications/:id/revoke", "api/admin/application-revoke.post");
     addServerImportsDir(resolver.resolve("./runtime/server/utils"));
+    if (settings.mcp === true) addMcpDefinitions(nuxt, resolver.resolve("./runtime/server/mcp"));
     addImports([
       { name: "useOAuthApplications", from: resolver.resolve("./runtime/app/composables/useOAuthApplications") },
       { name: "useMyApplications", from: resolver.resolve("./runtime/app/composables/useOAuthApplications") }
     ]);
-    if (settings.pages?.authorize !== false || adminPath || applicationsPath) {
-      extendPages((pages) => {
-        const existingPaths = new Set(pages.map((page) => page.path));
-        if (settings.pages?.authorize !== false && !existingPaths.has(authorizePath)) {
-          pages.push(defineModulePage(MODULE_NAME, { name: "oauth-authorize", path: authorizePath, file: resolver.resolve("./runtime/app/pages/authorize.vue") }));
-        }
-        if (adminPath && !existingPaths.has(adminPath)) {
-          pages.push(defineModulePage(MODULE_NAME, { name: "oauth-admin", path: adminPath, file: resolver.resolve("./runtime/app/pages/admin.vue") }));
-        }
-        if (applicationsPath && !existingPaths.has(applicationsPath)) {
-          pages.push(defineModulePage(MODULE_NAME, { name: "oauth-applications", path: applicationsPath, file: resolver.resolve("./runtime/app/pages/applications.vue") }));
-        }
-      });
-    }
-    if (withMenus) {
-      const { registerMenuSource } = await import('@frigear-nu/menu/utils');
-      registerMenuSource(nuxt, { file: resolver.resolve("./runtime/menus"), menu: "dashboard.account" });
-    }
+    addModulePages(MODULE_NAME, resolver, [
+      { name: "oauth-authorize", path: settings.pages?.authorize !== false ? authorizePath : void 0, file: "./runtime/app/pages/authorize.vue" },
+      { name: "oauth-admin", path: adminPath, file: "./runtime/app/pages/admin.vue" },
+      { name: "oauth-applications", path: applicationsPath, file: "./runtime/app/pages/applications.vue" }
+    ]);
+    addOptionalMenuSource(nuxt, { file: resolver.resolve("./runtime/menus"), menu: "dashboard.account" });
   }
 });
 

package/dist/runtime/app/pages/admin.vue

@@ -1,5 +1,7 @@
 <script setup>
 defineOptions({ name: "OAuthAdminPage" });
+const t = useModuleT("oauthServer");
+const confirmAction = useConfirmDialog();
 const { applications, status, error, create, update, remove, rotateSecret, revokeGrants } = useOAuthApplications();
 const emptyForm = () => ({
   name: "",
@@ -77,7 +79,12 @@ function submit() {
   });
 }
 const rotate = (application) => run(async () => {
-  if (!confirm(`Replace the client secret of ${application.name}? The old secret stops working and users are signed out.`)) return;
+  if (!await confirmAction({
+    title: t("admin.rotateTitle", "Replace the client secret of {name}?", { name: application.name }),
+    description: t("admin.rotateDescription", "The old secret stops working and users are signed out."),
+    confirmText: t("admin.newSecret", "New secret"),
+    destructive: true
+  })) return;
   const clientSecret = await rotateSecret(application.id);
   secret.value = { name: application.name, clientId: application.id, clientSecret };
 });
@@ -85,146 +92,135 @@ const toggle = (application) => run(async () => {
   await update(application.id, { isActive: !application.isActive });
 });
 const signOutEveryone = (application) => run(async () => {
-  if (confirm(`Sign everyone out of ${application.name}?`)) await revokeGrants(application.id);
+  if (await confirmAction({
+    title: t("admin.signOutTitle", "Sign everyone out of {name}?", { name: application.name }),
+    confirmText: t("admin.signOutEveryone", "Sign everyone out"),
+    destructive: true
+  })) await revokeGrants(application.id);
 });
 const destroy = (application) => run(async () => {
-  if (confirm(`Delete ${application.name}? This cannot be undone.`)) await remove(application.id);
+  if (await confirmAction({
+    title: t("admin.deleteTitle", "Delete {name}?", { name: application.name }),
+    description: t("admin.deleteDescription", "This cannot be undone."),
+    confirmText: t("admin.delete", "Delete"),
+    destructive: true
+  })) await remove(application.id);
 });
+const columns = [
+  { accessorKey: "name", header: t("admin.application", "Application") },
+  { id: "access", header: t("admin.access", "Access") },
+  { id: "grants", header: t("admin.signedIn", "Signed in") },
+  { id: "actions", header: "" }
+];
+const rowActions = (application) => [[
+  { label: t("admin.edit", "Edit"), icon: "i-lucide-pencil", onSelect: () => openEdit(application) },
+  { label: application.isActive ? t("admin.disable", "Disable") : t("admin.enable", "Enable"), icon: application.isActive ? "i-lucide-pause" : "i-lucide-play", onSelect: () => toggle(application) },
+  { label: t("admin.newSecret", "New secret"), icon: "i-lucide-key-round", onSelect: () => rotate(application) },
+  { label: t("admin.signOutEveryone", "Sign everyone out"), icon: "i-lucide-log-out", onSelect: () => signOutEveryone(application) }
+], [
+  { label: t("admin.delete", "Delete"), icon: "i-lucide-trash", color: "error", onSelect: () => destroy(application) }
+]];
 const copy = (value) => navigator.clipboard?.writeText(value);
 </script>
 
 <template>
-  <UContainer class="py-10">
-    <div class="mb-6 flex items-center justify-between gap-4">
-      <h1 class="text-2xl font-semibold">
-        OAuth applications
-      </h1>
-      <UButton
-        v-if="!forbidden"
-        icon="i-lucide-plus"
-        @click="openCreate"
-      >
-        New application
-      </UButton>
-    </div>
+  <AdminPage>
+    <AdminPageHeader :title="t('admin.title', 'OAuth applications')">
+      <template #actions>
+        <UButton
+          v-if="!forbidden"
+          icon="i-lucide-plus"
+          :label="t('admin.new', 'New application')"
+          @click="openCreate"
+        />
+      </template>
+    </AdminPageHeader>
 
     <UAlert
       v-if="forbidden"
       color="error"
       variant="subtle"
-      title="You are not allowed to manage OAuth applications."
-    />
-    <UAlert
-      v-else-if="failure && !formOpen"
-      class="mb-4"
-      color="error"
-      variant="subtle"
-      :title="failure"
+      :title="t('admin.forbidden', 'You are not allowed to manage OAuth applications.')"
     />
+    <template v-else>
+      <UAlert
+        v-if="failure && !formOpen"
+        color="error"
+        variant="subtle"
+        :title="failure"
+      />
 
-    <p
-      v-if="!forbidden && status !== 'pending' && !applications.length"
-      class="text-muted"
-    >
-      No applications yet.
-    </p>
-
-    <div class="grid gap-4">
-      <UCard
-        v-for="application in applications"
-        :key="application.id"
+      <AdminTable
+        :data="applications"
+        :columns="columns"
+        :loading="status === 'pending'"
       >
-        <div class="flex flex-wrap items-start justify-between gap-4">
+        <template #name-cell="{ row }">
           <div class="flex min-w-0 items-start gap-3">
             <UIcon
-              :name="application.icon || 'i-lucide-globe'"
-              class="mt-1 size-6 shrink-0"
+              :name="row.original.icon || 'i-lucide-globe'"
+              class="mt-0.5 size-5 shrink-0"
             />
             <div class="min-w-0">
-              <h2 class="flex items-center gap-2 font-medium">
-                {{ application.name }}
+              <p class="flex items-center gap-2 font-medium">
+                {{ row.original.name }}
                 <UBadge
-                  v-if="!application.isActive"
+                  v-if="!row.original.isActive"
                   color="neutral"
                   variant="subtle"
-                >
-                  Disabled
-                </UBadge>
-              </h2>
+                  :label="t('admin.disabled', 'Disabled')"
+                />
+              </p>
               <p class="truncate text-sm text-muted">
-                {{ application.websiteUrl }} · {{ application.activeGrants ?? 0 }} signed in
+                {{ row.original.websiteUrl }}
               </p>
               <p class="truncate text-xs text-muted">
-                Callback: {{ application.callbackUrl }}
+                {{ t("admin.callback", "Callback") }}: {{ row.original.callbackUrl }}
               </p>
-              <div class="mt-2 flex flex-wrap gap-1">
-                <UBadge
-                  v-for="role in application.allowedRoles"
-                  :key="role"
-                  variant="subtle"
-                >
-                  {{ role }}
-                </UBadge>
-                <UBadge
-                  v-if="!application.allowedRoles.length"
-                  color="neutral"
-                  variant="subtle"
-                >
-                  Every signed-in user
-                </UBadge>
-              </div>
             </div>
           </div>
-          <div class="flex flex-wrap gap-2">
-            <UButton
-              size="sm"
-              color="neutral"
-              variant="outline"
-              :disabled="busy"
-              @click="openEdit(application)"
-            >
-              Edit
-            </UButton>
-            <UButton
-              size="sm"
-              color="neutral"
-              variant="outline"
-              :disabled="busy"
-              @click="toggle(application)"
-            >
-              {{ application.isActive ? "Disable" : "Enable" }}
-            </UButton>
-            <UButton
-              size="sm"
-              color="neutral"
-              variant="outline"
-              :disabled="busy"
-              @click="rotate(application)"
-            >
-              New secret
-            </UButton>
-            <UButton
-              size="sm"
+        </template>
+        <template #access-cell="{ row }">
+          <div class="flex flex-wrap gap-1">
+            <UBadge
+              v-for="role in row.original.allowedRoles"
+              :key="role"
+              variant="subtle"
+              :label="role"
+            />
+            <UBadge
+              v-if="!row.original.allowedRoles.length"
               color="neutral"
-              variant="outline"
-              :disabled="busy"
-              @click="signOutEveryone(application)"
-            >
-              Sign everyone out
-            </UButton>
-            <UButton
-              size="sm"
-              color="error"
-              variant="outline"
-              :disabled="busy"
-              @click="destroy(application)"
-            >
-              Delete
-            </UButton>
+              variant="subtle"
+              :label="t('admin.everyone', 'Every signed-in user')"
+            />
           </div>
-        </div>
-      </UCard>
-    </div>
+        </template>
+        <template #grants-cell="{ row }">
+          {{ row.original.activeGrants ?? 0 }}
+        </template>
+        <template #actions-cell="{ row }">
+          <div class="flex justify-end">
+            <UDropdownMenu :items="rowActions(row.original)">
+              <UButton
+                icon="i-lucide-ellipsis"
+                color="neutral"
+                variant="ghost"
+                size="sm"
+                :disabled="busy"
+                :aria-label="t('admin.actions', 'Actions')"
+              />
+            </UDropdownMenu>
+          </div>
+        </template>
+        <template #empty>
+          <AdminEmpty
+            icon="i-lucide-app-window"
+            :title="t('admin.empty', 'No applications yet.')"
+          />
+        </template>
+      </AdminTable>
+    </template>
 
     <UModal
       v-model:open="formOpen"
@@ -248,7 +244,7 @@ const copy = (value) => navigator.clipboard?.writeText(value);
           </UFormField>
           <UFormField
             label="Website URL"
-            help="The origin of the application, without a path. The callback is the website URL plus the configured callback path."
+            description="The origin of the application, without a path. The callback is the website URL plus the configured callback path."
             required
           >
             <UInput
@@ -260,7 +256,7 @@ const copy = (value) => navigator.clipboard?.writeText(value);
           </UFormField>
           <UFormField
             label="Login URL"
-            help="Where the Open button goes. Defaults to the website URL."
+            description="Where the Open button goes. Defaults to the website URL."
           >
             <UInput
               v-model="form.loginUrl"
@@ -269,7 +265,7 @@ const copy = (value) => navigator.clipboard?.writeText(value);
           </UFormField>
           <UFormField
             label="Preview URL pattern"
-            help="Optional, e.g. https://*.vercel.app, for preview deployments."
+            description="Optional, e.g. https://*.vercel.app, for preview deployments."
           >
             <UInput
               v-model="form.previewUrlPattern"
@@ -278,7 +274,7 @@ const copy = (value) => navigator.clipboard?.writeText(value);
           </UFormField>
           <UFormField
             label="Allowed roles"
-            help="Leave empty to allow every signed-in user."
+            description="Leave empty to allow every signed-in user."
           >
             <UInputTags
               v-model="form.allowedRoles"
@@ -380,5 +376,5 @@ const copy = (value) => navigator.clipboard?.writeText(value);
         </div>
       </template>
     </UModal>
-  </UContainer>
+  </AdminPage>
 </template>

package/dist/runtime/app/pages/authorize.vue

@@ -1,7 +1,7 @@
 <script setup>
 defineOptions({ name: "OAuthAuthorizePage" });
 const route = useRoute();
-const signInPath = useRuntimeConfig().public.users?.pages?.login || "/login";
+const signInPath = useAuthPages().login;
 const { data: consent, error } = await useFetch("/api/oauth-server/consent", {
   query: route.query,
   key: `oauth-server:consent:${route.fullPath}`

package/dist/runtime/i18n/lang/da.json

@@ -0,0 +1,14 @@
+{
+  "oauthServer": {
+    "menu": {
+      "applications": {
+        "label": "Applikationer",
+        "description": "Applikationer du kan logge ind på."
+      },
+      "admin": {
+        "label": "OAuth-applikationer",
+        "description": "Administrer de applikationer, brugere kan logge ind på."
+      }
+    }
+  }
+}

package/dist/runtime/i18n/lang/en.json

@@ -0,0 +1,14 @@
+{
+  "oauthServer": {
+    "menu": {
+      "applications": {
+        "label": "Applications",
+        "description": "Applications you can sign in to."
+      },
+      "admin": {
+        "label": "OAuth applications",
+        "description": "Manage the applications users can sign in to."
+      }
+    }
+  }
+}

package/dist/runtime/menus.js

@@ -5,7 +5,9 @@ export default defineMenuSource(() => {
     const item = defineMenuItem({
       id: "oauth-applications",
       label: "Applications",
+      labelKey: "oauthServer.menu.applications.label",
       description: "Applications you can sign in to.",
+      descriptionKey: "oauthServer.menu.applications.description",
       icon: "i-lucide-layout-grid",
       to: config.pages.applications,
       order: 50
@@ -17,11 +19,23 @@ export default defineMenuSource(() => {
     extendMenuItem("dashboard.account", defineMenuItem({
       id: "oauth-admin",
       label: "OAuth applications",
+      labelKey: "oauthServer.menu.admin.label",
       description: "Manage the applications users can sign in to.",
+      descriptionKey: "oauthServer.menu.admin.description",
       icon: "i-lucide-key-round",
       to: config.pages.admin,
       order: 90,
       tags: ["admin"]
     }));
+    extendMenuItem("admin.nav", defineMenuItem({
+      id: "oauth-admin",
+      label: "OAuth applications",
+      labelKey: "oauthServer.menu.admin.label",
+      description: "Manage the applications users can sign in to.",
+      descriptionKey: "oauthServer.menu.admin.description",
+      icon: "i-lucide-key-round",
+      to: config.pages.admin,
+      order: 40
+    }));
   }
 });

package/dist/runtime/server/mcp/tools/my-oauth-applications.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/mcp/tools/my-oauth-applications.js

@@ -0,0 +1,6 @@
+export default defineScopedMcpTool({
+  description: "List the applications you can sign in to with your frigear account.",
+  scopes: ["oauth:read"],
+  annotations: { readOnlyHint: true },
+  handler: (_args, { event, user }) => listUserApplications(user.id, event)
+});

package/dist/runtime/server/resolvers/access-token.d.ts

@@ -0,0 +1,12 @@
+import type { H3Event } from 'h3';
+import type { AuthPrincipal } from '@frigear-nu/auth/utils';
+/**
+ * Lets an application call the API as the user who signed in to it: resolves an OAuth access
+ * token (`at+jwt`) into a principal carrying the application (`client_id`) and the granted scopes.
+ *
+ * The token's audience is the application, so it is deliberately not matched against this server:
+ * the application is the one holding the token. Everything else is re-checked on every request
+ * (the application is still active, the user still exists and may still use it), so disabling an
+ * application or removing a role takes effect immediately instead of when the token expires.
+ */
+export default function resolveAccessToken(event: H3Event, token: string): Promise<AuthPrincipal | null>;

package/dist/runtime/server/resolvers/access-token.js

@@ -0,0 +1,14 @@
+import { parseScopeString } from "@frigear-nu/auth/utils";
+export default async function resolveAccessToken(event, token) {
+  const payload = await verifyAccessToken(event, token);
+  if (!payload) return null;
+  const [application, oauthUser] = await Promise.all([
+    getApplication(payload.client_id),
+    getOAuthUser(Number(payload.sub))
+  ]);
+  if (!application || !oauthUser) return null;
+  if (!(await checkApplicationAccess(oauthUser, application, event)).allowed) return null;
+  const user = await loadAuthUser(oauthUser.id);
+  if (!user) return null;
+  return { kind: "oauth", user, scopes: parseScopeString(payload.scope), client: { id: application.id } };
+}

package/dist/runtime/server/utils/oauth-access.d.ts

@@ -1,17 +1,11 @@
 import type { H3Event } from 'h3';
 import type { OAuthApplication, OAuthUser, TokenType } from '../../../types.js';
-/**
- * Gate for the admin routes. This repo has no shared permission system, so the host decides through
- * the `oauth:authorize` Nitro hook. Denied by default:
- *
- *     nitroApp.hooks.hook('oauth:authorize', (ctx) => { ctx.allowed = isStaff(ctx.userId) })
- */
 export declare function requireOAuthAdmin(event: H3Event): Promise<{
     userId: number;
 }>;
 /** The user's roles as reported by the `oauth:user:roles` hook listeners (none without a listener). */
 export declare function resolveUserRoles(userId: number, event?: H3Event): Promise<string[]>;
-/** The user row without the password hash; includes columns the host added to `users`. */
+/** The stored user without the password hash; includes columns the host added to `users`. */
 export declare function getOAuthUser(userId: number): Promise<OAuthUser | null>;
 export type ApplicationAccess = {
     allowed: boolean;

package/dist/runtime/server/utils/oauth-access.js

@@ -1,11 +1,8 @@
-import { eq } from "drizzle-orm";
-import { db, schema } from "@nuxthub/db";
 import { matchesAllowedRoles } from "../../utils/index.js";
+const adminGate = definePolicyGate("oauth:authorize");
 export async function requireOAuthAdmin(event) {
   const userId = await requireSessionUserId(event);
-  const ctx = { event, userId, allowed: false };
-  await useNitroApp().hooks.callHook("oauth:authorize", ctx);
-  if (!ctx.allowed) throw createError({ statusCode: 403, statusMessage: "You are not allowed to manage OAuth applications." });
+  await adminGate.assert(event, userId, "You are not allowed to manage OAuth applications.");
   return { userId };
 }
 export async function resolveUserRoles(userId, event) {
@@ -14,7 +11,7 @@ export async function resolveUserRoles(userId, event) {
   return [...new Set(ctx.roles)];
 }
 export async function getOAuthUser(userId) {
-  const [row] = await db.select().from(schema.users).where(eq(schema.users.id, userId)).limit(1);
+  const row = await useAuthUserStore().findById(userId);
   if (!row) return null;
   const { password: _password, ...user } = row;
   return user;

package/dist/runtime/server/utils/oauth-authorize.d.ts

@@ -25,5 +25,5 @@ export declare function validateAuthorizeRequest(input: unknown): Promise<{
 }>;
 /** Throws 403 unless the user may use the application (role check, active, `oauth:application:access`). */
 export declare function assertApplicationAccess(event: H3Event, user: OAuthUser, application: OAuthApplication): Promise<void>;
-/** Where to send people who are not signed in: the configured path or the `@frigear-nu/users` login page. */
+/** Where to send people who are not signed in: the configured path or the `@frigear-nu/auth` login page. */
 export declare function getSignInPath(): string;

package/dist/runtime/server/utils/oauth-authorize.js

@@ -29,5 +29,5 @@ export async function assertApplicationAccess(event, user, application) {
 }
 export function getSignInPath() {
   const config = useRuntimeConfig();
-  return config.oauthServer.signInPath || config.public.users?.pages?.login || "/login";
+  return config.oauthServer.signInPath || getLoginPath();
 }

package/dist/runtime/server/utils/oauth-config.d.ts

@@ -2,7 +2,10 @@ import type { H3Event } from 'h3';
 export declare function useOAuthConfig(): any;
 /** The configured issuer, or the origin the request came in on (honouring `x-forwarded-*`). */
 export declare function getOAuthIssuer(event: H3Event): string;
-/** Scopes this server accepts: the defaults plus whatever the host configured. */
+/**
+ * Scopes this server accepts: the OIDC defaults, whatever the host configured, and the API scopes
+ * modules register with `@frigear-nu/auth` (what an access token may do against the API).
+ */
 export declare function getSupportedScopes(): string[];
 /** The signed-in user's numeric id (the `users` table uses integer ids). Responds 401 when nobody is signed in. */
 export declare function requireSessionUserId(event: H3Event): Promise<number>;

package/dist/runtime/server/utils/oauth-config.js

@@ -1,3 +1,4 @@
+import { scopes as apiScopes } from "#auth/scopes";
 export function useOAuthConfig() {
   return useRuntimeConfig().oauthServer;
 }
@@ -7,10 +8,10 @@ export function getOAuthIssuer(event) {
   return issuer.replace(/\/+$/, "");
 }
 export function getSupportedScopes() {
-  return [.../* @__PURE__ */ new Set(["openid", "profile", "email", ...useOAuthConfig().scopes])];
+  return [.../* @__PURE__ */ new Set(["openid", "profile", "email", ...useOAuthConfig().scopes, ...apiScopes.map((scope) => scope.name)])];
 }
 export async function requireSessionUserId(event) {
-  const { user } = await requireUserSession(event);
+  const user = await requireUser(event, { sessionOnly: true });
   return Number(user.id);
 }
 export function oauthError(event, statusCode, error, description) {

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@frigear-nu/oauth-server",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "OAuth 2.0 / OpenID Connect server for the frigear ecosystem: register applications that users with certain roles may sign in to.",
-  "url": "https://docs.frigear.nu/modules/oauth-server",
+  "url": "https://docs.frigear.dev/modules/oauth-server",
   "author": {
     "name": "Frigear",
     "email": "kontakt@frigear.nu",
     "url": "https://frigear.nu"
   },
+  "homepage": "https://docs.frigear.dev/modules/oauth-server",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/frigear-nu/frigear-nu.git",
@@ -36,9 +37,12 @@
     "playground"
   ],
   "dependencies": {
-    "@frigear-nu/menu": "0.0.7",
-    "@frigear-nu/module-kit": "0.1.5",
-    "@frigear-nu/users": "1.0.7",
+    "@frigear-nu/admin": "0.0.2",
+    "@frigear-nu/module-kit": "0.1.7",
+    "@frigear-nu/ui": "0.0.7",
+    "@frigear-nu/auth": "0.0.3",
+    "@frigear-nu/mcp": "0.0.3",
+    "@frigear-nu/users": "1.0.9",
     "@libsql/client": "^0.18.0",
     "@nuxt/kit": "^4.6.0",
     "drizzle-kit": "^0.31.11",
@@ -48,15 +52,20 @@
     "zod": "^4.6.5"
   },
   "peerDependencies": {
+    "@frigear-nu/menu": "0.0.9",
     "@nuxt/ui": "^4.10.0",
     "@nuxthub/core": "^0.10.8"
   },
   "peerDependenciesMeta": {
+    "@frigear-nu/menu": {
+      "optional": true
+    },
     "@nuxt/ui": {
       "optional": true
     }
   },
   "devDependencies": {
+    "@frigear-nu/menu": "0.0.9",
     "@nuxt/devtools": "^3.4.2",
     "@nuxt/eslint-config": "^1.17.0",
     "@nuxt/module-builder": "^1.0.3",