@frigear-nu/oauth-server 0.1.1 → 0.1.2

package/dist/module.d.mts

@@ -1,6 +1,8 @@
 import * as _nuxt_schema from '@nuxt/schema';
 import { H3Event } from 'h3';
 
+/** `confidential` applications authenticate with a client secret; `public` ones (native apps, SPAs) rely on PKCE alone. */
+type ClientType = 'confidential' | 'public';
 type ModuleOptions = {
     /**
      * The `iss` claim and the discovery issuer, e.g. `https://id.example.com`. Defaults to the origin of the
@@ -19,6 +21,14 @@ type ModuleOptions = {
     callbackPath?: string;
     /** Extra scopes advertised and accepted next to `openid profile email`. Enrich their claims with `oauth:claims`. */
     scopes?: string[];
+    /**
+     * Browser apps on another origin (for example the webview of a Capacitor app at `capacitor://localhost`) may call the
+     * token, revocation, userinfo and discovery endpoints. Exact origins only, never `*`. The authorization endpoint is
+     * never opened up: it is a top-level navigation. Cookies are not allowed cross-origin either.
+     */
+    cors?: {
+        origins?: string[];
+    };
     settings?: {
         mcp?: boolean;
         pages?: {
@@ -52,6 +62,8 @@ type OAuthServerRuntimeConfig = {
     codeTtl: number;
     callbackPath: string;
     scopes: string[];
+    /** Allowed CORS origins (`NUXT_OAUTH_SERVER_CORS_ORIGINS` takes a comma separated list). */
+    corsOrigins: string[] | string;
     authorizePath: string;
     signInPath?: string;
 };
@@ -73,6 +85,8 @@ type OAuthUser = {
 type OAuthApplication = {
     /** `app_` + random id; it is the OAuth `client_id`. */
     id: string;
+    /** `public` applications have no client secret; they must use PKCE and may register native redirect URIs. */
+    clientType: ClientType;
     name: string;
     description: string | null;
     icon: string | null;
@@ -80,7 +94,7 @@ type OAuthApplication = {
     websiteUrl: string;
     loginUrl: string | null;
     previewUrlPattern: string | null;
-    /** Extra exact redirect URIs next to the derived `websiteUrl + callbackPath`. */
+    /** Extra exact redirect URIs next to the derived `websiteUrl + callbackPath`. Public clients may list native (custom scheme) URIs. */
     redirectUris: string[];
     /** Roles allowed to sign in. Empty = every signed-in user. */
     allowedRoles: string[];
@@ -95,6 +109,8 @@ type UserApplicationDto = Pick<OAuthApplication, 'id' | 'name' | 'description' |
     loginUrl: string;
 };
 type ApplicationInput = {
+    /** Fixed at creation. Defaults to `confidential`. */
+    clientType?: ClientType;
     name: string;
     websiteUrl: string;
     description?: string | null;
@@ -162,7 +178,8 @@ type AdminApplicationDto = Omit<OAuthApplication, 'createdAt' | 'updatedAt'> & {
 /** Returned once when an application is created. */
 type CreatedApplicationDto = AdminApplicationDto & {
     clientId: string;
-    clientSecret: string;
+    /** `null` for public clients: they have no secret. */
+    clientSecret: string | null;
 };
 type ConsentDto = {
     application: Pick<OAuthApplication, 'id' | 'name' | 'description' | 'icon' | 'websiteUrl'>;
@@ -204,4 +221,4 @@ declare module 'nitropack' {
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
 
 export { _default as default };
-export type { AdminApplicationDto, ApplicationAccessContext, ApplicationInput, AuthorizeContext, ClaimsContext, ConsentDto, CreatedApplicationDto, ModuleOptions, OAuthApplication, OAuthServerRuntimeConfig, OAuthUser, PublicModuleOptions, TokenIssuedContext, TokenRevokedContext, TokenType, UserApplicationDto, UserRolesContext };
+export type { AdminApplicationDto, ApplicationAccessContext, ApplicationInput, AuthorizeContext, ClaimsContext, ClientType, ConsentDto, CreatedApplicationDto, ModuleOptions, OAuthApplication, OAuthServerRuntimeConfig, OAuthUser, PublicModuleOptions, TokenIssuedContext, TokenRevokedContext, TokenType, UserApplicationDto, UserRolesContext };

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@frigear-nu/oauth-server",
   "configKey": "oauthServer",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -1,5 +1,5 @@
 import { defineNuxtModule, createResolver, hasNuxtModule, addServerHandler, addServerImportsDir, addImports } from '@nuxt/kit';
-import { registerModule, registerTailwindSource, registerLocales, resolvePagePath, registerDatabaseTable, inlineModuleRuntime, addModulePages, addOptionalMenuSource, moduleApiUrl } from '@frigear-nu/module-kit/utils';
+import { registerModule, registerTailwindSource, registerLocales, resolvePagePath, registerDatabaseTable, registerBootstrapProvider, inlineModuleRuntime, addModulePages, addOptionalMenuSource, moduleApiUrl } from '@frigear-nu/module-kit/utils';
 import { adminRoute } from '@frigear-nu/admin/utils';
 import { addAuthScope, addAuthResolver } from '@frigear-nu/auth/utils';
 import { addMcpDefinitions } from '@frigear-nu/mcp/utils';
@@ -15,6 +15,7 @@ const module$1 = defineNuxtModule({
     codeTtl: 600,
     callbackPath: "/auth/frigear",
     scopes: [],
+    cors: { origins: [] },
     settings: { pages: {} }
   },
   moduleDependencies: {
@@ -44,6 +45,13 @@ const module$1 = defineNuxtModule({
     const authorizePath = settings.pages?.authorize === false ? "/authorize" : resolvePagePath(settings.pages?.authorize ?? true, "/authorize");
     const adminPath = hasNuxtModule("@frigear-nu/admin") ? resolvePagePath(settings.pages?.admin, adminRoute(nuxt, "oauth")) : void 0;
     const applicationsPath = resolvePagePath(settings.pages?.applications, "/account/applications");
+    const corsOrigins = (options.cors?.origins ?? []).map((origin) => origin.trim()).filter(Boolean);
+    for (const origin of corsOrigins) {
+      const url = URL.canParse(origin) ? new URL(origin) : void 0;
+      if (!url || origin === "*" || origin !== `${url.protocol}//${url.host}`) {
+        throw new Error(`[${MODULE_NAME}] cors.origins must be exact origins such as "https://app.example.com" or "capacitor://localhost", got "${origin}".`);
+      }
+    }
     const existing = nuxt.options.runtimeConfig.oauthServer;
     nuxt.options.runtimeConfig.oauthServer = {
       privateKey: "",
@@ -57,6 +65,7 @@ const module$1 = defineNuxtModule({
       codeTtl: options.codeTtl ?? 600,
       callbackPath: options.callbackPath ?? "/auth/frigear",
       scopes: options.scopes ?? [],
+      corsOrigins,
       authorizePath,
       signInPath: settings.signInPath
     };
@@ -71,6 +80,7 @@ const module$1 = defineNuxtModule({
       resolver,
       schema: (dialect) => `./runtime/server/db/schema.${dialect}`
     });
+    addServerHandler({ middleware: true, handler: resolver.resolve("./runtime/server/middleware/oauth-cors") });
     const handler = (file) => resolver.resolve(`./runtime/server/routes/${file}`);
     addServerHandler({ route: "/.well-known/openid-configuration", method: "get", handler: handler("oidc/openid-configuration.get") });
     addServerHandler({ route: "/.well-known/jwks.json", method: "get", handler: handler("oidc/jwks.get") });
@@ -82,6 +92,11 @@ const module$1 = defineNuxtModule({
     const api = (method, path, file) => addServerHandler({ route: moduleApiUrl(API_NAME, path), method, handler: handler(file) });
     api("get", "consent", "api/consent.get");
     api("get", "me/applications", "api/me-applications.get");
+    registerBootstrapProvider(nuxt, {
+      scope: "account",
+      key: "oauth-server:mine",
+      handler: resolver.resolve("./runtime/server/bootstrap/my-applications")
+    });
     api("get", "admin/applications", "api/admin/applications.get");
     api("post", "admin/applications", "api/admin/applications.post");
     api("get", "admin/applications/:id", "api/admin/application.get");

package/dist/runtime/app/components/OAuthApplicationSlideover.vue

@@ -1,5 +1,6 @@
 <script setup>
 import * as z from "zod";
+import { isNativeRedirectUri, isSecureOrigin } from "../../utils";
 defineOptions({ name: "OAuthApplicationSlideover" });
 const props = defineProps({
   application: { type: Object, required: false },
@@ -8,7 +9,14 @@ const props = defineProps({
 const emit = defineEmits(["close"]);
 const t = useModuleT("oauthServer");
 const { busy, run } = useAction();
+const isAllowedRedirect = (value, clientType) => {
+  if (!URL.canParse(value)) return false;
+  const url = new URL(value);
+  return !url.hash && (isSecureOrigin(url) || clientType === "public" && isNativeRedirectUri(url));
+};
 const schema = z.object({
+  clientType: z.enum(["confidential", "public"]),
+  redirectUris: z.array(z.string()),
   name: z.string().trim().min(1, t("form.nameRequired", "Enter a name.")),
   websiteUrl: z.url(t("form.websiteUrlInvalid", "Enter a full URL, for example https://app.example.com.")),
   loginUrl: z.string(),
@@ -20,6 +28,8 @@ const schema = z.object({
   tags: z.array(z.string())
 });
 const state = reactive({
+  clientType: props.application?.clientType ?? "confidential",
+  redirectUris: [...props.application?.redirectUris ?? []],
   name: props.application?.name ?? "",
   websiteUrl: props.application?.websiteUrl ?? "",
   loginUrl: props.application?.loginUrl ?? "",
@@ -31,9 +41,17 @@ const state = reactive({
   tags: [...props.application?.tags ?? []]
 });
 const formId = "oauth-application-form";
+const clientTypeItems = computed(() => [
+  { label: t("form.clientTypeConfidential", "Confidential (server-side, has a client secret)"), value: "confidential" },
+  { label: t("form.clientTypePublic", "Public (native or single-page app, no secret)"), value: "public" }
+]);
+const redirectUriError = computed(() => state.redirectUris.find((uri) => !isAllowedRedirect(uri, state.clientType)));
 async function onSubmit(event) {
   const value = event.data;
+  if (redirectUriError.value) return;
   const saved = await run(() => props.save({
+    clientType: value.clientType,
+    redirectUris: value.redirectUris,
     name: value.name,
     websiteUrl: value.websiteUrl,
     loginUrl: value.loginUrl || null,
@@ -64,6 +82,18 @@ async function onSubmit(event) {
       class="grid gap-4"
       @submit="onSubmit"
     >
+      <UFormField
+        name="clientType"
+        :label="t('form.clientType', 'Client type')"
+        :description="t('form.clientTypeHint', 'Cannot be changed later. Public clients sign in with PKCE only, so they never get a secret.')"
+      >
+        <USelect
+          v-model="state.clientType"
+          :items="clientTypeItems"
+          :disabled="!!application"
+          class="w-full"
+        />
+      </UFormField>
       <UFormField
         name="name"
         :label="t('form.name', 'Name')"
@@ -106,6 +136,17 @@ async function onSubmit(event) {
           class="w-full"
         />
       </UFormField>
+      <UFormField
+        name="redirectUris"
+        :label="t('form.redirectUris', 'Redirect URIs')"
+        :description="t('form.redirectUrisHint', 'Extra exact redirect URIs. Public clients may use custom-scheme URIs such as com.example.app:/callback.')"
+        :error="redirectUriError ? t('form.redirectUriInvalid', 'Enter a https URL or, for public clients, a custom-scheme URI.') : void 0"
+      >
+        <UInputTags
+          v-model="state.redirectUris"
+          class="w-full"
+        />
+      </UFormField>
       <UFormField
         name="allowedRoles"
         :label="t('form.allowedRoles', 'Allowed roles')"

package/dist/runtime/app/components/OAuthCredentialsModal.d.vue.ts

@@ -2,7 +2,8 @@
 type __VLS_Props = {
     name: string;
     clientId: string;
-    clientSecret: string;
+    /** `null` for a public client: it has no secret. */
+    clientSecret: string | null;
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;

package/dist/runtime/app/components/OAuthCredentialsModal.vue

@@ -3,7 +3,7 @@ defineOptions({ name: "OAuthCredentialsModal" });
 defineProps({
   name: { type: String, required: true },
   clientId: { type: String, required: true },
-  clientSecret: { type: String, required: true }
+  clientSecret: { type: [String, null], required: true }
 });
 const t = useModuleT("oauthServer");
 const { copy } = useCopyToClipboard();
@@ -12,7 +12,7 @@ const { copy } = useCopyToClipboard();
 <template>
   <UModal
     :title="t('credentials.title', 'Credentials for {name}', { name })"
-    :description="t('credentials.description', 'Copy the client secret now. It is only shown once.')"
+    :description="clientSecret ? t('credentials.description', 'Copy the client secret now. It is only shown once.') : t('credentials.publicDescription', 'This is a public client: it has no client secret and signs in with PKCE only.')"
   >
     <template #body>
       <DescriptionList
@@ -35,7 +35,14 @@ const { copy } = useCopyToClipboard();
           </div>
         </template>
         <template #clientSecret>
-          <div class="flex items-center gap-2">
+          <span
+            v-if="!clientSecret"
+            class="text-muted"
+          >{{ t("credentials.noSecret", "None (public client)") }}</span>
+          <div
+            v-else
+            class="flex items-center gap-2"
+          >
             <code class="min-w-0 break-all">{{ clientSecret }}</code>
             <UButton
               size="xs"

package/dist/runtime/app/components/OAuthCredentialsModal.vue.d.ts

@@ -2,7 +2,8 @@
 type __VLS_Props = {
     name: string;
     clientId: string;
-    clientSecret: string;
+    /** `null` for a public client: it has no secret. */
+    clientSecret: string | null;
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;

package/dist/runtime/app/composables/useOAuthApplicationActions.js

@@ -108,9 +108,10 @@ export function useOAuthApplicationActions() {
         void toggle(application);
       }
     },
-    { label: t("admin.newSecret", "New client secret"), icon: "i-lucide-key-round", onSelect: () => {
+    // Public clients have no secret to replace.
+    ...application.clientType === "public" ? [] : [{ label: t("admin.newSecret", "New client secret"), icon: "i-lucide-key-round", onSelect: () => {
       void rotateSecret(application);
-    } },
+    } }],
     { label: t("admin.signOutEveryone", "Sign everyone out"), icon: "i-lucide-log-out", onSelect: () => {
       void signOutEveryone(application);
     } }

package/dist/runtime/app/composables/useOAuthApplications.d.ts

@@ -22,9 +22,8 @@ export declare function useOAuthApplications(): {
     rotateSecret: (id: string) => Promise<string>;
     revokeGrants: (id: string) => Promise<void>;
 };
-/** The applications the signed-in user may sign in to. */
-export declare function useMyApplications(): {
-    applications: any;
-    status: any;
-    refresh: any;
-};
+/**
+ * The applications the signed-in user may sign in to. Awaitable: `await useMyApplications()` in a page renders them on
+ * the server. `applications` is `[]` until loaded and after an error: check `loading` and `error` first.
+ */
+export declare function useMyApplications(): any;

package/dist/runtime/app/composables/useOAuthApplications.js

@@ -40,11 +40,17 @@ export function useOAuthApplications() {
 }
 export function useMyApplications() {
   const { loggedIn } = useUserSession();
-  const { data, status, refresh } = useFetch(`${BASE}/me/applications`, {
+  const fetched = useCachedFetch(`${BASE}/me/applications`, {
     key: "oauth-server:mine",
-    immediate: loggedIn.value,
-    watch: false,
-    default: () => []
+    ttl: 5 * 60 * 1e3,
+    watch: false
+  });
+  const { status, error, loading, refresh, clear } = fetched;
+  watch(loggedIn, (value) => {
+    if (value) refresh();
+    else clear();
   });
-  return { applications: data, status, refresh };
+  const applications = computed(() => fetched.data.value ?? []);
+  const api = { applications, status, error, loading, refresh };
+  return Object.assign(fetched.then(() => api), api);
 }

package/dist/runtime/app/pages/admin.vue

@@ -54,6 +54,13 @@ const columns = computed(() => [
             :avatar="{ icon: row.original.icon || 'i-lucide-globe' }"
           >
             <template #badges>
+              <UBadge
+                v-if="row.original.clientType === 'public'"
+                color="info"
+                variant="subtle"
+                size="sm"
+                :label="t('admin.public', 'Public')"
+              />
               <UBadge
                 v-if="!row.original.isActive"
                 color="neutral"

package/dist/runtime/app/pages/applications.vue

@@ -1,13 +1,31 @@
 <script setup>
 defineOptions({ name: "OAuthApplicationsPage" });
 const t = useModuleT("oauthServer");
-const { applications, status } = useMyApplications();
+const { applications, loading, error, refresh } = await useMyApplications();
 </script>
 
 <template>
   <div class="flex flex-col gap-4">
+    <div
+      v-if="loading"
+      class="grid gap-4 md:grid-cols-2"
+      aria-busy="true"
+    >
+      <SectionCard
+        v-for="index in 2"
+        :key="index"
+        loading
+      />
+    </div>
+    <UEmpty
+      v-else-if="error && !applications.length"
+      icon="i-lucide-circle-alert"
+      :title="t('applications.loadFailed', 'Your applications could not be loaded')"
+      :description="errorMessage(error, '')"
+      :actions="[{ label: t('applications.tryAgain', 'Try again'), icon: 'i-lucide-rotate-ccw', color: 'neutral', variant: 'outline', onClick: () => refresh() }]"
+    />
     <UEmpty
-      v-if="status !== 'pending' && !applications.length"
+      v-else-if="!applications.length"
       icon="i-lucide-layout-grid"
       :title="t('applications.emptyTitle', 'No applications yet')"
       :description="t('applications.emptyDescription', 'There are no applications you can sign in to yet.')"

package/dist/runtime/i18n/lang/da.json

@@ -19,6 +19,7 @@
       "application": "Applikation",
       "access": "Adgang",
       "signedIn": "Logget ind",
+      "public": "Offentlig",
       "disabled": "Deaktiveret",
       "callback": "Callback",
       "everyone": "Alle indloggede brugere",
@@ -66,7 +67,14 @@
       "tags": "Tags",
       "description": "Beskrivelse",
       "icon": "Ikon",
-      "priority": "Prioritet"
+      "priority": "Prioritet",
+      "clientType": "Klienttype",
+      "clientTypeConfidential": "Fortrolig (serverside, har en klienthemmelighed)",
+      "clientTypePublic": "Offentlig (native app eller single-page-app, ingen hemmelighed)",
+      "clientTypeHint": "Kan ikke ændres senere. Offentlige klienter logger kun ind med PKCE og får derfor aldrig en hemmelighed.",
+      "redirectUris": "Redirect-URI'er",
+      "redirectUrisHint": "Ekstra præcise redirect-URI'er. Offentlige klienter må bruge URI'er med eget skema, fx com.example.app:/callback.",
+      "redirectUriInvalid": "Angiv en https-URL eller, for offentlige klienter, en URI med eget skema."
     },
     "credentials": {
       "title": "Legitimationsoplysninger for {name}",
@@ -75,13 +83,17 @@
       "clientSecret": "Klienthemmelighed",
       "copy": "Kopiér",
       "copiedClientId": "Klient-id kopieret",
-      "copiedClientSecret": "Klienthemmelighed kopieret"
+      "copiedClientSecret": "Klienthemmelighed kopieret",
+      "publicDescription": "Dette er en offentlig klient: den har ingen klienthemmelighed og logger kun ind med PKCE.",
+      "noSecret": "Ingen (offentlig klient)"
     },
     "applications": {
       "open": "Åbn",
       "openApplication": "Åbn {name}",
       "emptyTitle": "Ingen applikationer endnu",
-      "emptyDescription": "Der er endnu ingen applikationer, du kan logge ind på."
+      "emptyDescription": "Der er endnu ingen applikationer, du kan logge ind på.",
+      "loadFailed": "Dine applikationer kunne ikke indlæses",
+      "tryAgain": "Prøv igen"
     },
     "authorize": {
       "title": "Log ind på {name}",

package/dist/runtime/i18n/lang/en.json

@@ -19,6 +19,7 @@
       "application": "Application",
       "access": "Access",
       "signedIn": "Signed in",
+      "public": "Public",
       "disabled": "Disabled",
       "callback": "Callback",
       "everyone": "Every signed-in user",
@@ -66,7 +67,14 @@
       "tags": "Tags",
       "description": "Description",
       "icon": "Icon",
-      "priority": "Priority"
+      "priority": "Priority",
+      "clientType": "Client type",
+      "clientTypeConfidential": "Confidential (server-side, has a client secret)",
+      "clientTypePublic": "Public (native or single-page app, no secret)",
+      "clientTypeHint": "Cannot be changed later. Public clients sign in with PKCE only, so they never get a secret.",
+      "redirectUris": "Redirect URIs",
+      "redirectUrisHint": "Extra exact redirect URIs. Public clients may use custom-scheme URIs such as com.example.app:/callback.",
+      "redirectUriInvalid": "Enter a https URL or, for public clients, a custom-scheme URI."
     },
     "credentials": {
       "title": "Credentials for {name}",
@@ -75,13 +83,17 @@
       "clientSecret": "Client secret",
       "copy": "Copy",
       "copiedClientId": "Client ID copied",
-      "copiedClientSecret": "Client secret copied"
+      "copiedClientSecret": "Client secret copied",
+      "publicDescription": "This is a public client: it has no client secret and signs in with PKCE only.",
+      "noSecret": "None (public client)"
     },
     "applications": {
       "open": "Open",
       "openApplication": "Open {name}",
       "emptyTitle": "No applications yet",
-      "emptyDescription": "There are no applications you can sign in to yet."
+      "emptyDescription": "There are no applications you can sign in to yet.",
+      "loadFailed": "Your applications could not be loaded",
+      "tryAgain": "Try again"
     },
     "authorize": {
       "title": "Sign in to {name}",

package/dist/runtime/server/bootstrap/my-applications.d.ts

@@ -0,0 +1,7 @@
+import type { H3Event } from 'h3';
+import type { UserApplicationDto } from '../../../types.js';
+/**
+ * The applications the signed-in user may sign in to: the body of `GET /api/oauth-server/me/applications` and the
+ * account bootstrap's `oauth-server:mine` (the key `useMyApplications()` reads), so both always return the same thing.
+ */
+export default function myApplications(event: H3Event): Promise<UserApplicationDto[]>;

package/dist/runtime/server/bootstrap/my-applications.js

@@ -0,0 +1,4 @@
+export default async function myApplications(event) {
+  const userId = await requireSessionUserId(event);
+  return listUserApplications(userId, event);
+}

package/dist/runtime/server/db/schema.postgresql.d.ts

@@ -20,6 +20,23 @@ export declare const oauthApplications: import("drizzle-orm/pg-core").PgTableWit
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        clientType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "clientType";
+            tableName: "oauth_applications";
+            dataType: "string";
+            columnType: "PgText";
+            data: "confidential" | "public";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["confidential", "public"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         secretHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "secretHash";
             tableName: "oauth_applications";

package/dist/runtime/server/db/schema.postgresql.js

@@ -2,7 +2,13 @@ import { pgTable, text, integer, boolean, jsonb, timestamp, index } from "drizzl
 export const oauthApplications = pgTable("oauth_applications", {
   /** `app_` + random id; it is the OAuth `client_id`. */
   id: text().primaryKey(),
-  /** SHA-256 hex of the client secret. The secret itself is only shown once. */
+  /** `confidential` clients authenticate with a secret; `public` ones (native apps, SPAs) rely on PKCE alone. */
+  clientType: text({ enum: ["confidential", "public"] }).notNull().default("confidential"),
+  /**
+   * SHA-256 hex of the client secret. The secret itself is only shown once. Public clients have none: they get the hash
+   * of a random value nobody ever sees, so the column stays `NOT NULL` (relaxing it would make SQLite rebuild this table,
+   * which can cascade-delete the refresh tokens that reference it) and `clientType` decides whether it is ever checked.
+   */
   secretHash: text().notNull(),
   name: text().notNull(),
   description: text(),

package/dist/runtime/server/db/schema.sqlite.d.ts

@@ -22,6 +22,25 @@ export declare const oauthApplications: import("drizzle-orm/sqlite-core").SQLite
         }, {}, {
             length: undefined;
         }>;
+        clientType: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "clientType";
+            tableName: "oauth_applications";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "confidential" | "public";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["confidential", "public"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
         secretHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "secretHash";
             tableName: "oauth_applications";

package/dist/runtime/server/db/schema.sqlite.js

@@ -2,7 +2,13 @@ import { sqliteTable, text, integer, index } from "drizzle-orm/sqlite-core";
 export const oauthApplications = sqliteTable("oauth_applications", {
   /** `app_` + random id; it is the OAuth `client_id`. */
   id: text().primaryKey(),
-  /** SHA-256 hex of the client secret. The secret itself is only shown once. */
+  /** `confidential` clients authenticate with a secret; `public` ones (native apps, SPAs) rely on PKCE alone. */
+  clientType: text({ enum: ["confidential", "public"] }).notNull().default("confidential"),
+  /**
+   * SHA-256 hex of the client secret. The secret itself is only shown once. Public clients have none: they get the hash
+   * of a random value nobody ever sees, so the column stays `NOT NULL` (relaxing it would make SQLite rebuild this table,
+   * which can cascade-delete the refresh tokens that reference it) and `clientType` decides whether it is ever checked.
+   */
   secretHash: text().notNull(),
   name: text().notNull(),
   description: text(),

package/dist/runtime/server/middleware/oauth-cors.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/middleware/oauth-cors.js

@@ -0,0 +1,24 @@
+const METHODS = {
+  "/oauth/token": "POST, OPTIONS",
+  "/oauth/revoke": "POST, OPTIONS",
+  "/oauth/userinfo": "GET, OPTIONS",
+  "/.well-known/openid-configuration": "GET, OPTIONS",
+  "/.well-known/jwks.json": "GET, OPTIONS"
+};
+export default defineEventHandler((event) => {
+  const methods = METHODS[getRequestURL(event).pathname];
+  if (!methods) return;
+  appendResponseHeader(event, "Vary", "Origin");
+  const origin = getRequestHeader(event, "origin");
+  if (!origin || !getOAuthCorsOrigins().includes(origin)) return;
+  setResponseHeaders(event, {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": methods,
+    "Access-Control-Allow-Headers": "authorization, content-type",
+    "Access-Control-Max-Age": "600"
+  });
+  if (event.method === "OPTIONS") {
+    setResponseStatus(event, 204);
+    return "";
+  }
+});

package/dist/runtime/server/routes/api/me-applications.get.js

@@ -1,4 +1,2 @@
-export default defineEventHandler(async (event) => {
-  const userId = await requireSessionUserId(event);
-  return listUserApplications(userId, event);
-});
+import myApplications from "../../bootstrap/my-applications.js";
+export default defineEventHandler(myApplications);

package/dist/runtime/server/routes/oidc/openid-configuration.get.js

@@ -14,7 +14,8 @@ export default defineEventHandler((event) => {
     subject_types_supported: ["public"],
     id_token_signing_alg_values_supported: ["RS256"],
     scopes_supported: getSupportedScopes(),
-    token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
+    // `none`: public clients (native apps, SPAs) identify with `client_id` and PKCE only.
+    token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post", "none"],
     code_challenge_methods_supported: ["S256"],
     claims_supported: ["sub", "iss", "aud", "exp", "iat", "auth_time", "nonce", "name", "picture", "email"]
   };

package/dist/runtime/server/routes/oidc/revoke.post.js

@@ -1,12 +1,12 @@
 import { readBody } from "h3";
 export default defineEventHandler(async (event) => {
   const body = await readBody(event).catch(() => void 0);
-  const credentials = readClientCredentials(event, body);
-  const row = credentials ? await getApplicationRow(credentials.clientId) : null;
-  if (!credentials || !row || !await verifyApplicationSecret(row, credentials.clientSecret)) {
-    if (credentials?.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
+  const client = await authenticateClient(event, body);
+  if (!("row" in client)) {
+    if (client.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
     return oauthError(event, 401, "invalid_client", "Client authentication failed.");
   }
+  const row = client.row;
   if (typeof body?.token === "string") await revokeRefreshToken(body.token, row.id);
   setResponseStatus(event, 200);
   return {};

package/dist/runtime/server/routes/oidc/token.post.js

@@ -3,12 +3,12 @@ export default defineEventHandler(async (event) => {
   setResponseHeader(event, "Cache-Control", "no-store");
   setResponseHeader(event, "Pragma", "no-cache");
   const body = await readBody(event).catch(() => void 0);
-  const credentials = readClientCredentials(event, body);
-  const row = credentials ? await getApplicationRow(credentials.clientId) : null;
-  if (!credentials || !row || !await verifyApplicationSecret(row, credentials.clientSecret)) {
-    if (credentials?.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
+  const client = await authenticateClient(event, body);
+  if (!("row" in client)) {
+    if (client.basic) setResponseHeader(event, "WWW-Authenticate", "Basic");
     return oauthError(event, 401, "invalid_client", "Client authentication failed.");
   }
+  const row = client.row;
   const application = toApplication(row);
   const grantType = body?.grant_type;
   let grant;

package/dist/runtime/server/utils/oauth-applications.d.ts

@@ -5,6 +5,10 @@ import type { ApplicationInput, OAuthApplication, UserApplicationDto } from '../
 type ApplicationRow = typeof schema.oauthApplications.$inferSelect;
 /** Validation shared by the admin API and `createApplication` / `updateApplication`. */
 export declare const applicationInputSchema: z.ZodObject<{
+    clientType: z.ZodOptional<z.ZodEnum<{
+        confidential: "confidential";
+        public: "public";
+    }>>;
     name: z.ZodString;
     websiteUrl: z.ZodString;
     description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -18,6 +22,10 @@ export declare const applicationInputSchema: z.ZodObject<{
     isActive: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export declare const applicationPatchSchema: z.ZodObject<{
+    clientType: z.ZodOptional<z.ZodOptional<z.ZodEnum<{
+        confidential: "confidential";
+        public: "public";
+    }>>>;
     name: z.ZodOptional<z.ZodString>;
     websiteUrl: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
@@ -35,10 +43,13 @@ export declare function toApplication(row: ApplicationRow): OAuthApplication;
 export declare function getApplicationRow(id: string): Promise<ApplicationRow | null>;
 export declare function getApplication(id: string): Promise<OAuthApplication | null>;
 export declare function listApplications(): Promise<OAuthApplication[]>;
-/** Creates an application. The returned `secret` is the only time the plain secret is available. */
+/**
+ * Creates an application. The returned `secret` is the only time the plain secret is available; it is `null` for
+ * `public` clients, which have none.
+ */
 export declare function createApplication(input: ApplicationInput, ownerId?: number | null): Promise<{
     application: OAuthApplication;
-    secret: string;
+    secret: string | null;
 }>;
 export declare function updateApplication(id: string, patch: Partial<ApplicationInput>): Promise<OAuthApplication>;
 /** Deletes the application with its authorization codes and refresh tokens. */
@@ -48,6 +59,16 @@ export declare function rotateApplicationSecret(id: string): Promise<{
     secret: string;
 }>;
 export declare function verifyApplicationSecret(row: ApplicationRow, secret: string): Promise<boolean>;
+/**
+ * Authenticates the client of a token or revocation request. Confidential clients must present their secret. Public
+ * clients are identified by `client_id` alone (their security is PKCE plus refresh token rotation); a secret sent to one
+ * is refused, as it can only mean the app was configured with the wrong kind of client.
+ */
+export declare function authenticateClient(event: H3Event, body: Record<string, unknown> | undefined): Promise<{
+    row: ApplicationRow;
+} | {
+    basic: boolean;
+}>;
 /** Revokes every refresh token of an application (e.g. after a secret leak). */
 export declare function revokeApplicationGrants(applicationId: string): Promise<void>;
 /**

package/dist/runtime/server/utils/oauth-applications.js

@@ -1,7 +1,7 @@
 import { and, desc, eq, inArray } from "drizzle-orm";
 import { db, schema } from "@nuxthub/db";
 import { z } from "zod";
-import { isSecureOrigin, matchesAllowedRoles, newId, normalizeWebsiteUrl } from "../../utils/index.js";
+import { CLIENT_TYPES, isNativeRedirectUri, isSecureOrigin, matchesAllowedRoles, newId, normalizeWebsiteUrl } from "../../utils/index.js";
 const fail = (statusCode, statusMessage) => createError({ statusCode, statusMessage });
 const httpsUrl = z.string().trim().max(2048).refine((value) => {
   try {
@@ -10,8 +10,17 @@ const httpsUrl = z.string().trim().max(2048).refine((value) => {
     return false;
   }
 }, "Must be a https URL (http is only allowed for localhost).");
+const redirectUri = z.string().trim().max(2048).refine((value) => {
+  try {
+    const url = new URL(value);
+    return !url.hash && (isSecureOrigin(url) || isNativeRedirectUri(url));
+  } catch {
+    return false;
+  }
+}, "Must be a https URL (http is only allowed for localhost) or, for public clients, a custom-scheme URI.");
 const names = z.array(z.string().trim().min(1).max(64)).max(50);
 export const applicationInputSchema = z.object({
+  clientType: z.enum(CLIENT_TYPES).optional(),
   name: z.string().trim().min(1).max(120),
   websiteUrl: z.string().trim().max(2048),
   description: z.string().trim().max(1e3).nullish(),
@@ -19,7 +28,7 @@ export const applicationInputSchema = z.object({
   priority: z.number().int().min(-1e3).max(1e3).optional(),
   loginUrl: httpsUrl.nullish(),
   previewUrlPattern: z.string().trim().max(2048).startsWith("https://").nullish(),
-  redirectUris: z.array(httpsUrl).max(20).optional(),
+  redirectUris: z.array(redirectUri).max(20).optional(),
   allowedRoles: names.optional(),
   tags: names.optional(),
   isActive: z.boolean().optional()
@@ -38,10 +47,15 @@ function normalizeInput(input) {
       throw fail(400, error.message);
     }
   }
+  if (next.redirectUris) next.redirectUris = [...new Set(next.redirectUris)];
   if (next.allowedRoles) next.allowedRoles = [...new Set(next.allowedRoles)].sort();
   if (next.tags) next.tags = [...new Set(next.tags)];
   return next;
 }
+function assertRedirectUris(uris, clientType) {
+  if (clientType === "public" || !uris) return;
+  if (uris.some((uri) => !isSecureOrigin(new URL(uri)))) throw fail(400, "Only public clients may use custom-scheme redirect URIs.");
+}
 export async function getApplicationRow(id) {
   const [row] = await db.select().from(schema.oauthApplications).where(eq(schema.oauthApplications.id, id)).limit(1);
   return row ?? null;
@@ -56,20 +70,28 @@ export async function listApplications() {
 }
 export async function createApplication(input, ownerId) {
   const data = normalizeInput(applicationInputSchema.parse(input));
-  const secret = generateSecret();
+  const clientType = data.clientType ?? "confidential";
+  assertRedirectUris(data.redirectUris, clientType);
+  const secret = clientType === "public" ? null : generateSecret();
   const [row] = await db.insert(schema.oauthApplications).values({
     id: newId("app"),
-    secretHash: await sha256Hex(secret),
     ownerId: ownerId ?? null,
-    ...data
+    ...data,
+    clientType,
+    // A public client has no secret to hash; see `secretHash` in the schema.
+    secretHash: await sha256Hex(secret ?? generateSecret())
   }).returning();
   return { application: toApplication(row), secret };
 }
 export async function updateApplication(id, patch) {
-  const data = normalizeInput(applicationPatchSchema.parse(patch));
-  const [row] = Object.keys(data).length ? await db.update(schema.oauthApplications).set(data).where(eq(schema.oauthApplications.id, id)).returning() : [await getApplicationRow(id)];
-  if (!row) throw fail(404, "Application not found.");
-  return toApplication(row);
+  const { clientType, ...data } = normalizeInput(applicationPatchSchema.parse(patch));
+  const existing = await getApplicationRow(id);
+  if (!existing) throw fail(404, "Application not found.");
+  if (clientType && clientType !== existing.clientType) throw fail(400, "The client type cannot be changed.");
+  assertRedirectUris(data.redirectUris, existing.clientType);
+  if (!Object.keys(data).length) return toApplication(existing);
+  const [row] = await db.update(schema.oauthApplications).set(data).where(eq(schema.oauthApplications.id, id)).returning();
+  return toApplication(row ?? existing);
 }
 export async function deleteApplication(id) {
   await db.delete(schema.oauthRefreshTokens).where(eq(schema.oauthRefreshTokens.applicationId, id));
@@ -78,6 +100,8 @@ export async function deleteApplication(id) {
   if (!deleted.length) throw fail(404, "Application not found.");
 }
 export async function rotateApplicationSecret(id) {
+  const existing = await getApplicationRow(id);
+  if (existing?.clientType === "public") throw fail(400, "Public clients have no client secret.");
   const secret = generateSecret();
   const updated = await db.update(schema.oauthApplications).set({ secretHash: await sha256Hex(secret) }).where(eq(schema.oauthApplications.id, id)).returning({ id: schema.oauthApplications.id });
   if (!updated.length) throw fail(404, "Application not found.");
@@ -87,6 +111,15 @@ export async function rotateApplicationSecret(id) {
 export async function verifyApplicationSecret(row, secret) {
   return safeEqual(await sha256Hex(secret), row.secretHash);
 }
+export async function authenticateClient(event, body) {
+  const auth = readClientAuth(event, body);
+  const row = auth ? await getApplicationRow(auth.clientId) : null;
+  const basic = auth?.basic ?? false;
+  if (!auth || !row) return { basic };
+  if (row.clientType === "public") return auth.clientSecret ? { basic } : { row };
+  if (!auth.clientSecret || !await verifyApplicationSecret(row, auth.clientSecret)) return { basic };
+  return { row };
+}
 export async function revokeApplicationGrants(applicationId) {
   await db.update(schema.oauthRefreshTokens).set({ revokedAt: /* @__PURE__ */ new Date() }).where(eq(schema.oauthRefreshTokens.applicationId, applicationId));
   await useNitroApp().hooks.callHook("oauth:token:revoked", { applicationId, userId: null, reason: "revoked" });

package/dist/runtime/server/utils/oauth-authorize.js

@@ -17,7 +17,7 @@ export async function validateAuthorizeRequest(input) {
   const request = parsed.data;
   const application = await getApplication(request.client_id);
   if (!application || !application.isActive) throw fail(400, "Unknown or disabled application.");
-  const valid = validateRedirectUri(request.redirect_uri, { ...application, callbackPath: useOAuthConfig().callbackPath });
+  const valid = validateRedirectUri(request.redirect_uri, { ...application, callbackPath: useOAuthConfig().callbackPath, allowNativeRedirects: application.clientType === "public" });
   if (!valid) throw fail(400, "The redirect_uri is not allowed for this application.");
   const scope = resolveScope(request.scope, getSupportedScopes());
   if (scope.length === 0) throw fail(400, "None of the requested scopes is supported.");

package/dist/runtime/server/utils/oauth-config.d.ts

@@ -1,5 +1,7 @@
 import type { H3Event } from 'h3';
 export declare function useOAuthConfig(): any;
+/** Origins allowed to call the token, revocation, userinfo and discovery endpoints from a browser. Never `*`. */
+export declare function getOAuthCorsOrigins(): string[];
 /** The configured issuer, or the origin the request came in on (honouring `x-forwarded-*`). */
 export declare function getOAuthIssuer(event: H3Event): string;
 /**

package/dist/runtime/server/utils/oauth-config.js

@@ -2,6 +2,11 @@ import { scopes as apiScopes } from "#auth/scopes";
 export function useOAuthConfig() {
   return useRuntimeConfig().oauthServer;
 }
+export function getOAuthCorsOrigins() {
+  const configured = useOAuthConfig().corsOrigins;
+  const list = Array.isArray(configured) ? configured : String(configured ?? "").split(",");
+  return list.map((origin) => origin.trim()).filter((origin) => origin && origin !== "*");
+}
 export function getOAuthIssuer(event) {
   const configured = useOAuthConfig().issuer;
   const issuer = configured || getRequestURL(event, { xForwardedHost: true, xForwardedProto: true }).origin;

package/dist/runtime/server/utils/oauth-crypto.d.ts

@@ -8,9 +8,16 @@ export declare function safeEqual(a: string, b: string): boolean;
 export declare function computeCodeChallenge(verifier: string): Promise<string>;
 export declare function verifyCodeChallenge(verifier: string, challenge: string): Promise<boolean>;
 /**
- * Client credentials from the `Authorization: Basic` header (id and secret are form-urlencoded and
- * split on the *first* colon, RFC 6749 §2.3.1) or from the request body.
+ * Client authentication data from the `Authorization: Basic` header (id and secret are form-urlencoded and split on
+ * the *first* colon, RFC 6749 §2.3.1) or from the request body. The secret is empty when none was sent, which is what
+ * public clients do. Whether that is acceptable depends on the application (see `authenticateClient`).
  */
+export declare function readClientAuth(event: H3Event, body: Record<string, unknown> | undefined): {
+    clientId: string;
+    clientSecret: string;
+    basic: boolean;
+} | null;
+/** Client credentials that include a secret, or `null`. Confidential clients only; see `readClientAuth`. */
 export declare function readClientCredentials(event: H3Event, body: Record<string, unknown> | undefined): {
     clientId: string;
     clientSecret: string;

package/dist/runtime/server/utils/oauth-crypto.js

@@ -26,15 +26,17 @@ export async function computeCodeChallenge(verifier) {
 export async function verifyCodeChallenge(verifier, challenge) {
   return safeEqual(await computeCodeChallenge(verifier), challenge);
 }
-export function readClientCredentials(event, body) {
+export function readClientAuth(event, body) {
   const header = getHeader(event, "authorization");
   if (header?.toLowerCase().startsWith("basic ")) {
     try {
       const decoded = atob(header.slice(6).trim());
       const index = decoded.indexOf(":");
       if (index === -1) return null;
+      const clientId2 = decodeURIComponent(decoded.slice(0, index).replace(/\+/g, " "));
+      if (!clientId2) return null;
       return {
-        clientId: decodeURIComponent(decoded.slice(0, index).replace(/\+/g, " ")),
+        clientId: clientId2,
         clientSecret: decodeURIComponent(decoded.slice(index + 1).replace(/\+/g, " ")),
         basic: true
       };
@@ -43,6 +45,10 @@ export function readClientCredentials(event, body) {
     }
   }
   const clientId = typeof body?.client_id === "string" ? body.client_id : "";
-  const clientSecret = typeof body?.client_secret === "string" ? body.client_secret : "";
-  return clientId && clientSecret ? { clientId, clientSecret, basic: false } : null;
+  if (!clientId) return null;
+  return { clientId, clientSecret: typeof body?.client_secret === "string" ? body.client_secret : "", basic: false };
+}
+export function readClientCredentials(event, body) {
+  const auth = readClientAuth(event, body);
+  return auth?.clientSecret ? auth : null;
 }

package/dist/runtime/utils/index.d.ts

@@ -1,6 +1,8 @@
 export type * from '../../types';
 export declare const DEFAULT_SCOPES: readonly ["openid", "profile", "email"];
 export declare const DEFAULT_CALLBACK_PATH = "/auth/frigear";
+/** `confidential` clients hold a secret; `public` clients (native and single-page apps) cannot and rely on PKCE alone. */
+export declare const CLIENT_TYPES: readonly ["confidential", "public"];
 /** Whether a user holding `roles` may use an application restricted to `allowedRoles`. Empty = everyone. */
 export declare function matchesAllowedRoles(allowedRoles: readonly string[] | null | undefined, roles: readonly string[]): boolean;
 /** Splits a space separated scope string and drops duplicates and blanks. */
@@ -9,6 +11,12 @@ export declare function parseScope(scope: string | null | undefined): string[];
 export declare function resolveScope(requested: string | null | undefined, supported: readonly string[]): string[];
 /** HTTPS is required, except for `localhost` / loopback development hosts. */
 export declare function isSecureOrigin(url: URL): boolean;
+/**
+ * A redirect URI that opens a native app: a private-use scheme such as `com.example.app:/callback` (RFC 8252 §7.1) or a
+ * webview origin such as `capacitor://localhost/callback`. No web or dangerous schemes, credentials, fragments or
+ * wildcards. Only meaningful for `public` clients, and always matched exactly.
+ */
+export declare function isNativeRedirectUri(value: string | URL): boolean;
 export declare function normalizeWebsiteUrl(value: string): string;
 /** `https://*.vercel.app` -> a regex matching one host label in place of `*`. Everything else is matched literally. */
 export declare function previewPatternToRegExp(pattern: string, callbackPath: string): RegExp;
@@ -17,8 +25,13 @@ export type RedirectUriRules = {
     previewUrlPattern?: string | null;
     redirectUris?: readonly string[] | null;
     callbackPath?: string;
+    /** Public clients only: also accept the native redirect URIs listed in `redirectUris`. */
+    allowNativeRedirects?: boolean;
 };
-/** Exact match on `websiteUrl + callbackPath`, an explicit extra redirect URI, or the preview pattern. */
+/**
+ * Exact match on `websiteUrl + callbackPath`, an explicit extra redirect URI, or the preview pattern. Native redirect URIs
+ * (see `isNativeRedirectUri`) are only accepted for public clients, and only when listed in `redirectUris`.
+ */
 export declare function validateRedirectUri(redirectUri: string, rules: RedirectUriRules): boolean;
 /** Prefixed random id, e.g. `newId('app')` -> `app_3f9c…`. */
 export declare function newId(prefix: string): string;

package/dist/runtime/utils/index.js

@@ -1,5 +1,24 @@
 export const DEFAULT_SCOPES = ["openid", "profile", "email"];
 export const DEFAULT_CALLBACK_PATH = "/auth/frigear";
+export const CLIENT_TYPES = ["confidential", "public"];
+const NON_NATIVE_SCHEMES = /* @__PURE__ */ new Set([
+  "http:",
+  "https:",
+  "ws:",
+  "wss:",
+  "ftp:",
+  "file:",
+  "javascript:",
+  "data:",
+  "blob:",
+  "vbscript:",
+  "about:",
+  "mailto:",
+  "tel:",
+  "sms:",
+  "chrome:",
+  "view-source:"
+]);
 export function matchesAllowedRoles(allowedRoles, roles) {
   if (!allowedRoles || allowedRoles.length === 0) return true;
   return allowedRoles.some((role) => roles.includes(role));
@@ -16,6 +35,17 @@ export function isSecureOrigin(url) {
   if (url.protocol === "https:") return true;
   return url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
 }
+export function isNativeRedirectUri(value) {
+  let url;
+  try {
+    url = typeof value === "string" ? new URL(value) : value;
+  } catch {
+    return false;
+  }
+  if (!/^[a-z][a-z0-9+.-]*:$/.test(url.protocol) || NON_NATIVE_SCHEMES.has(url.protocol)) return false;
+  if (url.username || url.password || url.hash) return false;
+  return !url.href.includes("*");
+}
 export function normalizeWebsiteUrl(value) {
   let url;
   try {
@@ -40,7 +70,8 @@ export function validateRedirectUri(redirectUri, rules) {
   } catch {
     return false;
   }
-  if (url.hash || !isSecureOrigin(url)) return false;
+  if (url.hash) return false;
+  if (!isSecureOrigin(url)) return rules.allowNativeRedirects === true && isNativeRedirectUri(url) && !!rules.redirectUris?.includes(redirectUri);
   if (redirectUri === `${rules.websiteUrl.replace(/\/+$/, "")}${callbackPath}`) return true;
   if (rules.redirectUris?.includes(redirectUri)) return true;
   if (rules.previewUrlPattern) return previewPatternToRegExp(rules.previewUrlPattern, callbackPath).test(redirectUri);

package/dist/types.d.mts

@@ -1,3 +1,3 @@
 export { default } from './module.mjs'
 
-export { type AdminApplicationDto, type ApplicationAccessContext, type ApplicationInput, type AuthorizeContext, type ClaimsContext, type ConsentDto, type CreatedApplicationDto, type ModuleOptions, type OAuthApplication, type OAuthServerRuntimeConfig, type OAuthUser, type PublicModuleOptions, type TokenIssuedContext, type TokenRevokedContext, type TokenType, type UserApplicationDto, type UserRolesContext } from './module.mjs'
+export { type AdminApplicationDto, type ApplicationAccessContext, type ApplicationInput, type AuthorizeContext, type ClaimsContext, type ClientType, type ConsentDto, type CreatedApplicationDto, type ModuleOptions, type OAuthApplication, type OAuthServerRuntimeConfig, type OAuthUser, type PublicModuleOptions, type TokenIssuedContext, type TokenRevokedContext, type TokenType, type UserApplicationDto, type UserRolesContext } from './module.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frigear-nu/oauth-server",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "OAuth 2.0 / OpenID Connect server for the frigear ecosystem: register applications that users with certain roles may sign in to.",
   "url": "https://docs.frigear.dev/modules/oauth-server",
   "author": {
@@ -37,12 +37,12 @@
     "playground"
   ],
   "dependencies": {
-    "@frigear-nu/admin": "0.1.1",
-    "@frigear-nu/module-kit": "1.1.1",
-    "@frigear-nu/ui": "0.1.1",
-    "@frigear-nu/auth": "0.1.2",
-    "@frigear-nu/mcp": "0.1.1",
-    "@frigear-nu/users": "1.1.2",
+    "@frigear-nu/admin": "0.1.2",
+    "@frigear-nu/module-kit": "1.1.2",
+    "@frigear-nu/ui": "0.1.2",
+    "@frigear-nu/auth": "0.1.3",
+    "@frigear-nu/mcp": "0.1.2",
+    "@frigear-nu/users": "1.1.3",
     "@libsql/client": "^0.18.0",
     "@nuxt/kit": "^4.6.1",
     "drizzle-kit": "^0.31.11",
@@ -52,8 +52,8 @@
     "zod": "^4.6.5"
   },
   "peerDependencies": {
-    "@frigear-nu/menu": "0.1.1",
-    "@nuxt/ui": "^4.11.2",
+    "@frigear-nu/menu": "0.1.2",
+    "@nuxt/ui": "^4.12.0",
     "@nuxthub/core": "^0.10.8"
   },
   "peerDependenciesMeta": {
@@ -65,13 +65,13 @@
     }
   },
   "devDependencies": {
-    "@frigear-nu/menu": "0.1.1",
+    "@frigear-nu/menu": "0.1.2",
     "@nuxt/devtools": "^3.4.2",
     "@nuxt/eslint-config": "^1.17.0",
     "@nuxt/module-builder": "^1.0.3",
     "@nuxt/schema": "^4.6.1",
     "@nuxt/test-utils": "^4.3.2",
-    "@nuxt/ui": "^4.11.2",
+    "@nuxt/ui": "^4.12.0",
     "@nuxthub/core": "^0.10.8",
     "@types/node": "^26.6.5",
     "changelogen": "^0.6.2",