@frigear-nu/oauth-server 0.1.1 → 0.1.3

package/dist/module.d.mts

@@ -1,6 +1,8 @@
 import * as _nuxt_schema from '@nuxt/schema';
 import { H3Event } from 'h3';
 
+/** `confidential` applications authenticate with a client secret; `public` ones (native apps, SPAs) rely on PKCE alone. */
+type ClientType = 'confidential' | 'public';
 type ModuleOptions = {
     /**
      * The `iss` claim and the discovery issuer, e.g. `https://id.example.com`. Defaults to the origin of the
@@ -19,6 +21,14 @@ type ModuleOptions = {
     callbackPath?: string;
     /** Extra scopes advertised and accepted next to `openid profile email`. Enrich their claims with `oauth:claims`. */
     scopes?: string[];
+    /**
+     * Browser apps on another origin (for example the webview of a Capacitor app at `capacitor://localhost`) may call the
+     * token, revocation, userinfo and discovery endpoints. Exact origins only, never `*`. The authorization endpoint is
+     * never opened up: it is a top-level navigation. Cookies are not allowed cross-origin either.
+     */
+    cors?: {
+        origins?: string[];
+    };
     settings?: {
         mcp?: boolean;
         pages?: {
@@ -52,6 +62,8 @@ type OAuthServerRuntimeConfig = {
     codeTtl: number;
     callbackPath: string;
     scopes: string[];
+    /** Allowed CORS origins (`NUXT_OAUTH_SERVER_CORS_ORIGINS` takes a comma separated list). */
+    corsOrigins: string[] | string;
     authorizePath: string;
     signInPath?: string;
 };
@@ -73,6 +85,8 @@ type OAuthUser = {
 type OAuthApplication = {
     /** `app_` + random id; it is the OAuth `client_id`. */
     id: string;
+    /** `public` applications have no client secret; they must use PKCE and may register native redirect URIs. */
+    clientType: ClientType;
     name: string;
     description: string | null;
     icon: string | null;
@@ -80,7 +94,7 @@ type OAuthApplication = {
     websiteUrl: string;
     loginUrl: string | null;
     previewUrlPattern: string | null;
-    /** Extra exact redirect URIs next to the derived `websiteUrl + callbackPath`. */
+    /** Extra exact redirect URIs next to the derived `websiteUrl + callbackPath`. Public clients may list native (custom scheme) URIs. */
     redirectUris: string[];
     /** Roles allowed to sign in. Empty = every signed-in user. */
     allowedRoles: string[];
@@ -95,6 +109,8 @@ type UserApplicationDto = Pick<OAuthApplication, 'id' | 'name' | 'description' |
     loginUrl: string;
 };
 type ApplicationInput = {
+    /** Fixed at creation. Defaults to `confidential`. */
+    clientType?: ClientType;
     name: string;
     websiteUrl: string;
     description?: string | null;
@@ -159,10 +175,18 @@ type AdminApplicationDto = Omit<OAuthApplication, 'createdAt' | 'updatedAt'> & {
     /** The redirect URI the application has to accept. */
     callbackUrl: string;
 };
+/** One page of `GET /api/admin/oauth-server/applications` (the shape `useTableQuery` speaks). */
+type AdminApplicationsPage = {
+    items: AdminApplicationDto[];
+    total: number;
+    page: number;
+    pageSize: number;
+};
 /** Returned once when an application is created. */
 type CreatedApplicationDto = AdminApplicationDto & {
     clientId: string;
-    clientSecret: string;
+    /** `null` for public clients: they have no secret. */
+    clientSecret: string | null;
 };
 type ConsentDto = {
     application: Pick<OAuthApplication, 'id' | 'name' | 'description' | 'icon' | 'websiteUrl'>;
@@ -204,4 +228,4 @@ declare module 'nitropack' {
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
 
 export { _default as default };
-export type { AdminApplicationDto, ApplicationAccessContext, ApplicationInput, AuthorizeContext, ClaimsContext, ConsentDto, CreatedApplicationDto, ModuleOptions, OAuthApplication, OAuthServerRuntimeConfig, OAuthUser, PublicModuleOptions, TokenIssuedContext, TokenRevokedContext, TokenType, UserApplicationDto, UserRolesContext };
+export type { AdminApplicationDto, AdminApplicationsPage, ApplicationAccessContext, ApplicationInput, AuthorizeContext, ClaimsContext, ClientType, ConsentDto, CreatedApplicationDto, ModuleOptions, OAuthApplication, OAuthServerRuntimeConfig, OAuthUser, PublicModuleOptions, TokenIssuedContext, TokenRevokedContext, TokenType, UserApplicationDto, UserRolesContext };

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@frigear-nu/oauth-server",
   "configKey": "oauthServer",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -1,11 +1,11 @@
 import { defineNuxtModule, createResolver, hasNuxtModule, addServerHandler, addServerImportsDir, addImports } from '@nuxt/kit';
-import { registerModule, registerTailwindSource, registerLocales, resolvePagePath, registerDatabaseTable, inlineModuleRuntime, addModulePages, addOptionalMenuSource, moduleApiUrl } from '@frigear-nu/module-kit/utils';
+import { registerModule, registerTailwindSource, registerLocales, resolvePagePath, registerDatabaseTable, addModuleRoutes, registerBootstrapProvider, inlineModuleRuntime, addModulePages, addOptionalMenuSource } from '@frigear-nu/module-kit/utils';
 import { adminRoute } from '@frigear-nu/admin/utils';
 import { addAuthScope, addAuthResolver } from '@frigear-nu/auth/utils';
 import { addMcpDefinitions } from '@frigear-nu/mcp/utils';
+import { oidc } from '../dist/runtime/utils/api.js';
 
 const MODULE_NAME = "@frigear-nu/oauth-server";
-const API_NAME = "oauthServer";
 const module$1 = defineNuxtModule({
   meta: { name: MODULE_NAME, configKey: "oauthServer" },
   defaults: {
@@ -15,6 +15,7 @@ const module$1 = defineNuxtModule({
     codeTtl: 600,
     callbackPath: "/auth/frigear",
     scopes: [],
+    cors: { origins: [] },
     settings: { pages: {} }
   },
   moduleDependencies: {
@@ -44,6 +45,13 @@ const module$1 = defineNuxtModule({
     const authorizePath = settings.pages?.authorize === false ? "/authorize" : resolvePagePath(settings.pages?.authorize ?? true, "/authorize");
     const adminPath = hasNuxtModule("@frigear-nu/admin") ? resolvePagePath(settings.pages?.admin, adminRoute(nuxt, "oauth")) : void 0;
     const applicationsPath = resolvePagePath(settings.pages?.applications, "/account/applications");
+    const corsOrigins = (options.cors?.origins ?? []).map((origin) => origin.trim()).filter(Boolean);
+    for (const origin of corsOrigins) {
+      const url = URL.canParse(origin) ? new URL(origin) : void 0;
+      if (!url || origin === "*" || origin !== `${url.protocol}//${url.host}`) {
+        throw new Error(`[${MODULE_NAME}] cors.origins must be exact origins such as "https://app.example.com" or "capacitor://localhost", got "${origin}".`);
+      }
+    }
     const existing = nuxt.options.runtimeConfig.oauthServer;
     nuxt.options.runtimeConfig.oauthServer = {
       privateKey: "",
@@ -57,6 +65,7 @@ const module$1 = defineNuxtModule({
       codeTtl: options.codeTtl ?? 600,
       callbackPath: options.callbackPath ?? "/auth/frigear",
       scopes: options.scopes ?? [],
+      corsOrigins,
       authorizePath,
       signInPath: settings.signInPath
     };
@@ -71,24 +80,34 @@ const module$1 = defineNuxtModule({
       resolver,
       schema: (dialect) => `./runtime/server/db/schema.${dialect}`
     });
-    const handler = (file) => resolver.resolve(`./runtime/server/routes/${file}`);
-    addServerHandler({ route: "/.well-known/openid-configuration", method: "get", handler: handler("oidc/openid-configuration.get") });
-    addServerHandler({ route: "/.well-known/jwks.json", method: "get", handler: handler("oidc/jwks.get") });
-    addServerHandler({ route: "/oauth/authorize", method: "get", handler: handler("oidc/authorize.get") });
-    addServerHandler({ route: "/oauth/authorize", method: "post", handler: handler("oidc/authorize.post") });
-    addServerHandler({ route: "/oauth/token", method: "post", handler: handler("oidc/token.post") });
-    addServerHandler({ route: "/oauth/revoke", method: "post", handler: handler("oidc/revoke.post") });
-    addServerHandler({ route: "/oauth/userinfo", method: "get", handler: handler("oidc/userinfo.get") });
-    const api = (method, path, file) => addServerHandler({ route: moduleApiUrl(API_NAME, path), method, handler: handler(file) });
-    api("get", "consent", "api/consent.get");
-    api("get", "me/applications", "api/me-applications.get");
-    api("get", "admin/applications", "api/admin/applications.get");
-    api("post", "admin/applications", "api/admin/applications.post");
-    api("get", "admin/applications/:id", "api/admin/application.get");
-    api("patch", "admin/applications/:id", "api/admin/application.patch");
-    api("delete", "admin/applications/:id", "api/admin/application.delete");
-    api("post", "admin/applications/:id/secret", "api/admin/application-secret.post");
-    api("post", "admin/applications/:id/revoke", "api/admin/application-revoke.post");
+    addServerHandler({ middleware: true, handler: resolver.resolve("./runtime/server/middleware/oauth-cors") });
+    addModuleRoutes(resolver, [
+      { method: "get", path: oidc.configuration, file: "oidc/openid-configuration.get" },
+      { method: "get", path: oidc.jwks, file: "oidc/jwks.get" },
+      { method: "get", path: oidc.authorize, file: "oidc/authorize.get" },
+      { method: "post", path: oidc.authorize, file: "oidc/authorize.post" },
+      { method: "post", path: oidc.token, file: "oidc/token.post" },
+      { method: "post", path: oidc.revoke, file: "oidc/revoke.post" },
+      { method: "get", path: oidc.userinfo, file: "oidc/userinfo.get" }
+    ], { base: "/" });
+    addModuleRoutes(resolver, [
+      { method: "get", path: "consent", file: "api/consent.get" },
+      { method: "get", path: "me/applications", file: "api/me-applications.get" }
+    ], { base: "/api/oauth-server" });
+    registerBootstrapProvider(nuxt, {
+      scope: "account",
+      key: "oauth-server:mine",
+      handler: resolver.resolve("./runtime/server/bootstrap/my-applications")
+    });
+    addModuleRoutes(resolver, [
+      { method: "get", path: "applications", file: "api/admin/applications.get" },
+      { method: "post", path: "applications", file: "api/admin/applications.post" },
+      { method: "get", path: "applications/:id", file: "api/admin/application.get" },
+      { method: "patch", path: "applications/:id", file: "api/admin/application.patch" },
+      { method: "delete", path: "applications/:id", file: "api/admin/application.delete" },
+      { method: "post", path: "applications/:id/secret", file: "api/admin/application-secret.post" },
+      { method: "post", path: "applications/:id/revoke", file: "api/admin/application-revoke.post" }
+    ], { base: "/api/admin/oauth-server" });
     addServerImportsDir(resolver.resolve("./runtime/server/utils"));
     inlineModuleRuntime(nuxt, resolver);
     if (settings.mcp === true) addMcpDefinitions(nuxt, resolver.resolve("./runtime/server/mcp"));

package/dist/runtime/app/components/OAuthApplicationSlideover.vue

@@ -1,5 +1,6 @@
 <script setup>
 import * as z from "zod";
+import { isNativeRedirectUri, isSecureOrigin } from "../../utils";
 defineOptions({ name: "OAuthApplicationSlideover" });
 const props = defineProps({
   application: { type: Object, required: false },
@@ -8,7 +9,14 @@ const props = defineProps({
 const emit = defineEmits(["close"]);
 const t = useModuleT("oauthServer");
 const { busy, run } = useAction();
+const isAllowedRedirect = (value, clientType) => {
+  if (!URL.canParse(value)) return false;
+  const url = new URL(value);
+  return !url.hash && (isSecureOrigin(url) || clientType === "public" && isNativeRedirectUri(url));
+};
 const schema = z.object({
+  clientType: z.enum(["confidential", "public"]),
+  redirectUris: z.array(z.string()),
   name: z.string().trim().min(1, t("form.nameRequired", "Enter a name.")),
   websiteUrl: z.url(t("form.websiteUrlInvalid", "Enter a full URL, for example https://app.example.com.")),
   loginUrl: z.string(),
@@ -20,6 +28,8 @@ const schema = z.object({
   tags: z.array(z.string())
 });
 const state = reactive({
+  clientType: props.application?.clientType ?? "confidential",
+  redirectUris: [...props.application?.redirectUris ?? []],
   name: props.application?.name ?? "",
   websiteUrl: props.application?.websiteUrl ?? "",
   loginUrl: props.application?.loginUrl ?? "",
@@ -31,9 +41,17 @@ const state = reactive({
   tags: [...props.application?.tags ?? []]
 });
 const formId = "oauth-application-form";
+const clientTypeItems = computed(() => [
+  { label: t("form.clientTypeConfidential", "Confidential (server-side, has a client secret)"), value: "confidential" },
+  { label: t("form.clientTypePublic", "Public (native or single-page app, no secret)"), value: "public" }
+]);
+const redirectUriError = computed(() => state.redirectUris.find((uri) => !isAllowedRedirect(uri, state.clientType)));
 async function onSubmit(event) {
   const value = event.data;
+  if (redirectUriError.value) return;
   const saved = await run(() => props.save({
+    clientType: value.clientType,
+    redirectUris: value.redirectUris,
     name: value.name,
     websiteUrl: value.websiteUrl,
     loginUrl: value.loginUrl || null,
@@ -64,6 +82,18 @@ async function onSubmit(event) {
       class="grid gap-4"
       @submit="onSubmit"
     >
+      <UFormField
+        name="clientType"
+        :label="t('form.clientType', 'Client type')"
+        :description="t('form.clientTypeHint', 'Cannot be changed later. Public clients sign in with PKCE only, so they never get a secret.')"
+      >
+        <USelect
+          v-model="state.clientType"
+          :items="clientTypeItems"
+          :disabled="!!application"
+          class="w-full"
+        />
+      </UFormField>
       <UFormField
         name="name"
         :label="t('form.name', 'Name')"
@@ -106,6 +136,17 @@ async function onSubmit(event) {
           class="w-full"
         />
       </UFormField>
+      <UFormField
+        name="redirectUris"
+        :label="t('form.redirectUris', 'Redirect URIs')"
+        :description="t('form.redirectUrisHint', 'Extra exact redirect URIs. Public clients may use custom-scheme URIs such as com.example.app:/callback.')"
+        :error="redirectUriError ? t('form.redirectUriInvalid', 'Enter a https URL or, for public clients, a custom-scheme URI.') : void 0"
+      >
+        <UInputTags
+          v-model="state.redirectUris"
+          class="w-full"
+        />
+      </UFormField>
       <UFormField
         name="allowedRoles"
         :label="t('form.allowedRoles', 'Allowed roles')"

package/dist/runtime/app/components/OAuthCredentialsModal.d.vue.ts

@@ -2,7 +2,8 @@
 type __VLS_Props = {
     name: string;
     clientId: string;
-    clientSecret: string;
+    /** `null` for a public client: it has no secret. */
+    clientSecret: string | null;
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;

package/dist/runtime/app/components/OAuthCredentialsModal.vue

@@ -3,7 +3,7 @@ defineOptions({ name: "OAuthCredentialsModal" });
 defineProps({
   name: { type: String, required: true },
   clientId: { type: String, required: true },
-  clientSecret: { type: String, required: true }
+  clientSecret: { type: [String, null], required: true }
 });
 const t = useModuleT("oauthServer");
 const { copy } = useCopyToClipboard();
@@ -12,7 +12,7 @@ const { copy } = useCopyToClipboard();
 <template>
   <UModal
     :title="t('credentials.title', 'Credentials for {name}', { name })"
-    :description="t('credentials.description', 'Copy the client secret now. It is only shown once.')"
+    :description="clientSecret ? t('credentials.description', 'Copy the client secret now. It is only shown once.') : t('credentials.publicDescription', 'This is a public client: it has no client secret and signs in with PKCE only.')"
   >
     <template #body>
       <DescriptionList
@@ -35,7 +35,14 @@ const { copy } = useCopyToClipboard();
           </div>
         </template>
         <template #clientSecret>
-          <div class="flex items-center gap-2">
+          <span
+            v-if="!clientSecret"
+            class="text-muted"
+          >{{ t("credentials.noSecret", "None (public client)") }}</span>
+          <div
+            v-else
+            class="flex items-center gap-2"
+          >
             <code class="min-w-0 break-all">{{ clientSecret }}</code>
             <UButton
               size="xs"

package/dist/runtime/app/components/OAuthCredentialsModal.vue.d.ts

@@ -2,7 +2,8 @@
 type __VLS_Props = {
     name: string;
     clientId: string;
-    clientSecret: string;
+    /** `null` for a public client: it has no secret. */
+    clientSecret: string | null;
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;

package/dist/runtime/app/composables/useOAuthApplicationActions.d.ts

@@ -5,6 +5,9 @@ type SavedApplication = AdminApplicationDto | CreatedApplicationDto | false | un
  * Everything you can do to an application: `create` / `edit` (a `FormSlideover`), `remove`, `toggle`, `rotateSecret`,
  * `signOutEveryone`, `copyClientId` and `menu(application)` for the row menu. Toasts, confirmations and the refresh
  * of the admin list are handled here.
+ *
+ * `edit` owns the `?application=<id>` query parameter of the page it is opened from: it is set while the form is open
+ * and cleared when it closes, so an edit can be linked to and survives a reload (the admin page opens it again).
  */
 export declare function useOAuthApplicationActions(): {
     busy: any;

package/dist/runtime/app/composables/useOAuthApplicationActions.js

@@ -8,7 +8,14 @@ export function useOAuthApplicationActions() {
   const toast = useToast();
   const { busy, run } = useAction();
   const { copy } = useCopyToClipboard();
+  const route = useRoute();
+  const router = useRouter();
+  const editing = ref(null);
   const refresh = () => refreshNuxtData(OAUTH_APPLICATIONS_KEY);
+  function setQuery(id) {
+    const { application: _previous, ...rest } = route.query;
+    return router.replace({ query: id ? { ...rest, application: id } : rest });
+  }
   function showCredentials(credentials) {
     overlay.create(OAuthCredentialsModal, { destroyOnClose: true, props: credentials }).open();
   }
@@ -30,19 +37,28 @@ export function useOAuthApplicationActions() {
     return saved;
   }
   async function edit(application) {
-    const saved = await overlay.create(OAuthApplicationSlideover, {
-      destroyOnClose: true,
-      props: {
-        application,
-        save: async (input) => {
-          const updated = await oauthApplicationsApi.update(application.id, input);
-          await refresh();
-          return updated;
+    if (editing.value === application.id) return void 0;
+    editing.value = application.id;
+    const path = route.path;
+    await setQuery(application.id);
+    try {
+      const saved = await overlay.create(OAuthApplicationSlideover, {
+        destroyOnClose: true,
+        props: {
+          application,
+          save: async (input) => {
+            const updated = await oauthApplicationsApi.update(application.id, input);
+            await refresh();
+            return updated;
+          }
         }
-      }
-    }).open();
-    if (saved) toast.add({ title: t("admin.updated", "Application updated"), description: saved.name, color: "success", icon: "i-lucide-check" });
-    return saved;
+      }).open();
+      if (saved) toast.add({ title: t("admin.updated", "Application updated"), description: saved.name, color: "success", icon: "i-lucide-check" });
+      return saved;
+    } finally {
+      editing.value = null;
+      if (route.path === path && route.query.application === application.id) await setQuery(null);
+    }
   }
   async function remove(application) {
     const confirmed = await confirm({
@@ -108,14 +124,15 @@ export function useOAuthApplicationActions() {
         void toggle(application);
       }
     },
-    { label: t("admin.newSecret", "New client secret"), icon: "i-lucide-key-round", onSelect: () => {
+    // Public clients have no secret to replace.
+    ...application.clientType === "public" ? [] : [{ label: t("admin.newSecret", "New client secret"), icon: "i-lucide-key-round", onSelect: () => {
       void rotateSecret(application);
-    } },
+    } }],
     { label: t("admin.signOutEveryone", "Sign everyone out"), icon: "i-lucide-log-out", onSelect: () => {
       void signOutEveryone(application);
     } }
   ], [
-    { label: t("admin.delete", "Delete application"), icon: "i-lucide-trash", color: "error", onSelect: () => {
+    { label: t("admin.delete", "Delete application"), icon: "i-lucide-trash-2", color: "error", onSelect: () => {
       void remove(application);
     } }
   ]];

package/dist/runtime/app/composables/useOAuthApplications.d.ts

@@ -1,30 +1,30 @@
+import type { MaybeRefOrGetter } from 'vue';
 import type { AdminApplicationDto, ApplicationInput, CreatedApplicationDto } from '../../../types.js';
 /** The `useFetch` key of the admin list; `refreshNuxtData(OAUTH_APPLICATIONS_KEY)` reloads it from anywhere. */
 export declare const OAUTH_APPLICATIONS_KEY = "oauth-server:applications";
 /** The admin endpoints as plain calls (no refresh). Every call needs the host's `oauth:authorize` hook to allow the user. */
 export declare const oauthApplicationsApi: {
+    get: (id: string) => Promise<AdminApplicationDto>;
     create: (input: ApplicationInput) => Promise<CreatedApplicationDto>;
     update: (id: string, patch: Partial<ApplicationInput>) => Promise<AdminApplicationDto>;
-    remove: (id: string) => Promise<unknown>;
+    /** 204: resolves with `null`. */
+    remove: (id: string) => Promise<null>;
     /** Returns the new client secret; the old one stops working. */
     rotateSecret: (id: string) => Promise<string>;
-    revokeGrants: (id: string) => Promise<unknown>;
-};
-/** Admin CRUD for applications. Every call needs the host's `oauth:authorize` hook to allow the user. */
-export declare function useOAuthApplications(): {
-    applications: any;
-    status: any;
-    error: any;
-    refresh: any;
-    create: (input: ApplicationInput) => Promise<CreatedApplicationDto>;
-    update: (id: string, patch: Partial<ApplicationInput>) => Promise<AdminApplicationDto>;
-    remove: (id: string) => Promise<void>;
-    rotateSecret: (id: string) => Promise<string>;
-    revokeGrants: (id: string) => Promise<void>;
-};
-/** The applications the signed-in user may sign in to. */
-export declare function useMyApplications(): {
-    applications: any;
-    status: any;
-    refresh: any;
+    /** Signs everyone out of the application; resolves with the application. */
+    revokeGrants: (id: string) => Promise<AdminApplicationDto>;
 };
+/** The list query: `page`, `pageSize`, `q` (name or client id), `sort` (`createdAt`, `name`, `priority`) and `order`. */
+export type OAuthApplicationsQuery = Record<string, string | number | undefined>;
+/**
+ * Admin CRUD for applications, with one page of the list. Awaitable: `await useOAuthApplications(query)` in a page
+ * renders the list on the server; pass `useTableQuery().query` to page, search and sort it. `applications` is `[]`
+ * until loaded and after an error: check `loading` and `error` first. Every call needs the host's `oauth:authorize`
+ * hook to allow the user.
+ */
+export declare function useOAuthApplications(query?: MaybeRefOrGetter<OAuthApplicationsQuery>): any;
+/**
+ * The applications the signed-in user may sign in to. Awaitable: `await useMyApplications()` in a page renders them on
+ * the server. `applications` is `[]` until loaded and after an error: check `loading` and `error` first.
+ */
+export declare function useMyApplications(): any;

package/dist/runtime/app/composables/useOAuthApplications.js

@@ -1,18 +1,26 @@
-const BASE = "/api/oauth-server";
+import { oauthServerApi } from "../../utils/api.js";
 export const OAUTH_APPLICATIONS_KEY = "oauth-server:applications";
 export const oauthApplicationsApi = {
-  create: (input) => $fetch(`${BASE}/admin/applications`, { method: "POST", body: input }),
-  update: (id, patch) => $fetch(`${BASE}/admin/applications/${id}`, { method: "PATCH", body: patch }),
-  remove: (id) => $fetch(`${BASE}/admin/applications/${id}`, { method: "DELETE" }),
+  get: (id) => $fetch(oauthServerApi.admin.application(id)),
+  create: (input) => $fetch(oauthServerApi.admin.applications, { method: "POST", body: input }),
+  update: (id, patch) => $fetch(oauthServerApi.admin.application(id), { method: "PATCH", body: patch }),
+  /** 204: resolves with `null`. */
+  remove: async (id) => {
+    await $fetch(oauthServerApi.admin.application(id), { method: "DELETE" });
+    return null;
+  },
   /** Returns the new client secret; the old one stops working. */
-  rotateSecret: async (id) => (await $fetch(`${BASE}/admin/applications/${id}/secret`, { method: "POST" })).clientSecret,
-  revokeGrants: (id) => $fetch(`${BASE}/admin/applications/${id}/revoke`, { method: "POST" })
+  rotateSecret: async (id) => (await $fetch(oauthServerApi.admin.rotateSecret(id), { method: "POST" })).clientSecret,
+  /** Signs everyone out of the application; resolves with the application. */
+  revokeGrants: (id) => $fetch(oauthServerApi.admin.revoke(id), { method: "POST" })
 };
-export function useOAuthApplications() {
-  const { data, status, error, refresh } = useFetch(`${BASE}/admin/applications`, {
-    key: OAUTH_APPLICATIONS_KEY,
-    default: () => []
-  });
+export function useOAuthApplications(query = {}) {
+  const fetched = useFetch(oauthServerApi.admin.applications, { key: OAUTH_APPLICATIONS_KEY, query });
+  const { data, status, error, refresh } = fetched;
+  const applications = computed(() => data.value?.items ?? []);
+  const total = computed(() => data.value?.total ?? 0);
+  const loading = computed(() => status.value === "pending" && !data.value);
+  const refreshing = computed(() => status.value === "pending" && !!data.value);
   async function create(input) {
     const created = await oauthApplicationsApi.create(input);
     await refresh();
@@ -26,6 +34,7 @@ export function useOAuthApplications() {
   async function remove(id) {
     await oauthApplicationsApi.remove(id);
     await refresh();
+    return null;
   }
   async function rotateSecret(id) {
     const clientSecret = await oauthApplicationsApi.rotateSecret(id);
@@ -33,18 +42,26 @@ export function useOAuthApplications() {
     return clientSecret;
   }
   async function revokeGrants(id) {
-    await oauthApplicationsApi.revokeGrants(id);
+    const application = await oauthApplicationsApi.revokeGrants(id);
     await refresh();
+    return application;
   }
-  return { applications: data, status, error, refresh, create, update, remove, rotateSecret, revokeGrants };
+  const api = { applications, total, data, status, error, loading, refreshing, refresh, create, update, remove, rotateSecret, revokeGrants };
+  return Object.assign(fetched.then(() => api), api);
 }
 export function useMyApplications() {
   const { loggedIn } = useUserSession();
-  const { data, status, refresh } = useFetch(`${BASE}/me/applications`, {
+  const fetched = useCachedFetch(oauthServerApi.me.applications, {
     key: "oauth-server:mine",
-    immediate: loggedIn.value,
-    watch: false,
-    default: () => []
+    ttl: 5 * 60 * 1e3,
+    watch: false
+  });
+  const { status, error, loading, refresh, clear } = fetched;
+  watch(loggedIn, (value) => {
+    if (value) refresh();
+    else clear();
   });
-  return { applications: data, status, refresh };
+  const applications = computed(() => fetched.data.value ?? []);
+  const api = { applications, status, error, loading, refresh };
+  return Object.assign(fetched.then(() => api), api);
 }