@thecodeorigin/auth 0.0.5 → 0.0.7

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@thecodeorigin/auth",
   "configKey": "auth",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/app/composables/useAuth.d.ts

@@ -1,4 +1,5 @@
 import type { ImpersonationCandidate, RpOrganization } from '../../../contract/index.js';
+export type SignInPrompt = 'login' | 'select_account' | 'consent' | 'none';
 export declare function useAuth(): {
     session: import("vue").Ref<{
         user: {
@@ -100,7 +101,9 @@ export declare function useAuth(): {
     }>;
     impersonate: (userId: string) => Promise<void>;
     stopImpersonating: () => Promise<void>;
-    signIn: (redirect?: string) => string | false | void | import("vue-router").RouteLocationAsRelativeGeneric | import("vue-router").RouteLocationAsPathGeneric | Promise<false | void | import("vue-router").NavigationFailure>;
+    signIn: (redirect?: string, options?: {
+        prompt?: SignInPrompt;
+    }) => string | false | void | import("vue-router").RouteLocationAsRelativeGeneric | import("vue-router").RouteLocationAsPathGeneric | Promise<false | void | import("vue-router").NavigationFailure>;
     signOut: () => Promise<void>;
     refresh: () => Promise<void>;
 };

package/dist/runtime/app/composables/useAuth.js

@@ -32,11 +32,14 @@ export function useAuth() {
   async function stopImpersonating() {
     session.value = await $fetch("/api/_auth/stop-impersonating", { method: "POST" });
   }
-  function signIn(redirect) {
-    return navigateTo(
-      redirect ? `${routes.signIn}?redirect=${encodeURIComponent(redirect)}` : routes.signIn,
-      { external: true }
-    );
+  function signIn(redirect, options) {
+    const params = new URLSearchParams();
+    if (redirect)
+      params.set("redirect", redirect);
+    if (options?.prompt)
+      params.set("prompt", options.prompt);
+    const qs = params.toString();
+    return navigateTo(qs ? `${routes.signIn}?${qs}` : routes.signIn, { external: true });
   }
   async function signOut() {
     await $fetch("/api/_auth/sign-out", { method: "POST" }).catch(() => {

package/dist/runtime/server/routes/sign-in.get.js

@@ -1,25 +1,29 @@
 import { createError, defineEventHandler, getQuery, sendRedirect, setCookie } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { withQuery } from "ufo";
-import { callbackRedirectUri, pkceChallenge, randomString, safePath } from "../utils/oidc.js";
+import { callbackRedirectUri, idpBaseUrl, pkceChallenge, randomString, safePath } from "../utils/oidc.js";
+const ALLOWED_PROMPTS = /* @__PURE__ */ new Set(["login", "select_account", "consent", "none"]);
 export default defineEventHandler(async (event) => {
   const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   if (!publicRuntimeConfig.domain || !publicRuntimeConfig.clientId || !runtimeConfig.clientSecret)
     throw createError({ statusCode: 503, statusMessage: "Auth not configured" });
+  const query = getQuery(event);
   const state = randomString(32);
   const verifier = randomString(64);
-  const redirectTo = safePath(getQuery(event).redirect, publicRuntimeConfig.routes.home);
+  const redirectTo = safePath(query.redirect, publicRuntimeConfig.routes.home);
+  const prompt = typeof query.prompt === "string" && ALLOWED_PROMPTS.has(query.prompt) ? query.prompt : void 0;
   const opts = { httpOnly: true, secure: !import.meta.dev, sameSite: "lax", maxAge: 600, path: publicRuntimeConfig.routes.callback };
   setCookie(event, "tco_state", state, opts);
   setCookie(event, "tco_verifier", verifier, opts);
   setCookie(event, "tco_redirect", redirectTo, opts);
-  return sendRedirect(event, withQuery(`https://${publicRuntimeConfig.domain}/api/auth/oauth2/authorize`, {
+  return sendRedirect(event, withQuery(`${idpBaseUrl()}/api/auth/oauth2/authorize`, {
     client_id: publicRuntimeConfig.clientId,
     redirect_uri: callbackRedirectUri(event),
     response_type: "code",
     scope: publicRuntimeConfig.scopes.join(" "),
     state,
     code_challenge: await pkceChallenge(verifier),
-    code_challenge_method: "S256"
+    code_challenge_method: "S256",
+    ...prompt ? { prompt } : {}
   }));
 });

package/dist/runtime/server/utils/idp.js

@@ -1,6 +1,7 @@
 import { createError } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { $fetch } from "ofetch";
+import { idpBaseUrl } from "./oidc.js";
 import { readSessionRecordById, writeSessionRecord } from "./session.js";
 const SKEW_MS = 6e4;
 async function refresh(rec) {
@@ -9,7 +10,7 @@ async function refresh(rec) {
   const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   try {
     const t = await $fetch(
-      `https://${publicRuntimeConfig.domain}/api/auth/oauth2/token`,
+      `${idpBaseUrl()}/api/auth/oauth2/token`,
       {
         method: "POST",
         headers: {
@@ -28,12 +29,11 @@ async function refresh(rec) {
   }
 }
 export async function idpFetch(event, id, rec, path, opts = {}) {
-  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   if (!rec.isImpersonation && Date.now() > rec.accessExpiresAt - SKEW_MS) {
     if (await refresh(rec))
       await writeSessionRecord(id, rec);
   }
-  const call = () => $fetch(`https://${publicRuntimeConfig.domain}${path}`, {
+  const call = () => $fetch(`${idpBaseUrl()}${path}`, {
     method: opts.method,
     body: opts.body,
     query: opts.query,

package/dist/runtime/server/utils/oidc.d.ts

@@ -25,6 +25,8 @@ declare module 'nitropack' {
 export declare function randomString(len?: number): string;
 export declare function pkceChallenge(verifier: string): Promise<string>;
 export declare function callbackRedirectUri(event: H3Event): string;
+/** IdP origin. `domain` may already carry a scheme (e.g. `http://localhost:3000`); otherwise assume https. */
+export declare function idpBaseUrl(): string;
 export declare function exchangeCode(code: string, verifier: string, redirectUri: string): Promise<{
     access_token: string;
     refresh_token?: string;

package/dist/runtime/server/utils/oidc.js

@@ -16,10 +16,15 @@ export function callbackRedirectUri(event) {
   const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   return `${getRequestProtocol(event)}://${getRequestHost(event)}${publicRuntimeConfig.routes.callback}`;
 }
+export function idpBaseUrl() {
+  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
+  const domain = publicRuntimeConfig.domain;
+  return /^https?:\/\//.test(domain) ? domain : `https://${domain}`;
+}
 export async function exchangeCode(code, verifier, redirectUri) {
   const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   return $fetch(
-    `https://${publicRuntimeConfig.domain}/api/auth/oauth2/token`,
+    `${idpBaseUrl()}/api/auth/oauth2/token`,
     {
       method: "POST",
       headers: {
@@ -36,8 +41,7 @@ export async function exchangeCode(code, verifier, redirectUri) {
   );
 }
 export async function fetchUserinfo(accessToken) {
-  const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
-  return $fetch(`https://${publicRuntimeConfig.domain}/api/auth/oauth2/userinfo`, {
+  return $fetch(`${idpBaseUrl()}/api/auth/oauth2/userinfo`, {
     headers: { Authorization: `Bearer ${accessToken}` }
   });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@thecodeorigin/auth",
   "type": "module",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "private": false,
   "description": "THECODEORIGIN Authentication Portal client module",
   "repository": "https://github.com/thecodeorigin/auth",