nuxt-auth-utils 0.0.12 → 0.0.14

package/README.md

@@ -154,6 +154,7 @@ It can also be set using environment variables:
 - Discord
 - GitHub
 - Google
+- Keycloak
 - LinkedIn
 - Microsoft
 - Spotify
@@ -195,12 +196,15 @@ We leverage hooks to let you extend the session data with your own data or to lo
 ```ts
 // server/plugins/session.ts
 export default defineNitroPlugin(() => {
-  sessionHooks.hook('verify', async (session, event) => {
+  // Called when the session is fetched during SSR for the Vue composable (/api/_auth/session)
+  // Or when we call useUserSession().fetch()
+  sessionHooks.hook('fetch', async (session, event) => {
     // extend User Session by calling your database
     // or
     // throw createError({ ... }) if session is invalid for example
   })
 
+  // Called when we call useServerSession().clear() or clearUserSession(event)
   sessionHooks.hook('clear', async (session, event) => {
     // Log that user logged out
   })

package/dist/module.json

@@ -1,5 +1,5 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.0.12"
+  "version": "0.0.14"
 }

package/dist/module.mjs

@@ -98,6 +98,12 @@ const module = defineNuxtModule({
       clientId: "",
       clientSecret: ""
     });
+    runtimeConfig.oauth.keycloak = defu(runtimeConfig.oauth.keycloak, {
+      clientId: "",
+      clientSecret: "",
+      serverUrl: "",
+      realm: ""
+    });
     runtimeConfig.oauth.linkedin = defu(runtimeConfig.oauth.linkedin, {
       clientId: "",
       clientSecret: ""

package/dist/runtime/server/api/session.get.mjs

@@ -2,6 +2,6 @@ import { eventHandler } from "h3";
 import { requireUserSession, sessionHooks } from "../utils/session.mjs";
 export default eventHandler(async (event) => {
   const session = await requireUserSession(event);
-  await sessionHooks.callHookParallel("verify", session, event);
+  await sessionHooks.callHookParallel("fetch", session, event);
   return session;
 });

package/dist/runtime/server/lib/oauth/keycloak.d.ts

@@ -0,0 +1,32 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthKeycloakConfig {
+    /**
+     * Keycloak OAuth Client ID
+     * @default process.env.NUXT_OAUTH_KEYCLOAK_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Keycloak OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_KEYCLOAK_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Keycloak OAuth Server URL
+     * @example http://192.168.1.10:8080/auth
+     * @default process.env.NUXT_OAUTH_KEYCLOAK_SERVER_URL
+     */
+    serverUrl?: string;
+    /**
+     * Keycloak OAuth Realm
+     * @default process.env.NUXT_OAUTH_KEYCLOAK_REALM
+     */
+    realm?: string;
+    /**
+     * Keycloak OAuth Scope
+     * @default []
+     * @see https://www.keycloak.org/docs/latest/authorization_services/
+     * @example ['openid']
+     */
+    scope?: string[];
+}
+export declare function keycloakEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthKeycloakConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/keycloak.mjs

@@ -0,0 +1,114 @@
+import {
+  eventHandler,
+  createError,
+  getQuery,
+  getRequestURL,
+  sendRedirect
+} from "h3";
+import { ofetch } from "ofetch";
+import { withQuery, parsePath } from "ufo";
+import { defu } from "defu";
+import { useRuntimeConfig } from "#imports";
+export function keycloakEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(
+      config,
+      // @ts-ignore
+      useRuntimeConfig(event).oauth?.keycloak
+    );
+    const query = getQuery(event);
+    const { code } = query;
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Keycloak login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret || !config.serverUrl || !config.realm) {
+      const error = createError({
+        statusCode: 500,
+        message: "Missing NUXT_OAUTH_KEYCLOAK_CLIENT_ID or NUXT_OAUTH_KEYCLOAK_CLIENT_SECRET or NUXT_OAUTH_KEYCLOAK_SERVER_URL or NUXT_OAUTH_KEYCLOAK_REALM env variables."
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    const realmURL = `${config.serverUrl}/realms/${config.realm}`;
+    const authorizationURL = `${realmURL}/protocol/openid-connect/auth`;
+    const tokenURL = `${realmURL}/protocol/openid-connect/token`;
+    const redirectUrl = getRequestURL(event).href;
+    if (!code) {
+      config.scope = config.scope || ["openid"];
+      return sendRedirect(
+        event,
+        withQuery(authorizationURL, {
+          client_id: config.clientId,
+          redirect_uri: redirectUrl,
+          scope: config.scope.join(" "),
+          response_type: "code"
+        })
+      );
+    }
+    config.scope = config.scope || [];
+    if (!config.scope.includes("openid")) {
+      config.scope.push("openid");
+    }
+    const tokens = await ofetch(tokenURL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: "authorization_code",
+        redirect_uri: parsePath(redirectUrl).pathname,
+        code
+      }).toString()
+    }).catch((error) => {
+      return { error };
+    });
+    if (tokens.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Keycloak login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
+        data: tokens
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    const accessToken = tokens.access_token;
+    const user = await ofetch(
+      `${realmURL}/protocol/openid-connect/userinfo`,
+      {
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          Accept: "application/json"
+        }
+      }
+    );
+    if (!user) {
+      const error = createError({
+        statusCode: 500,
+        message: "Could not get Keycloak user",
+        data: tokens
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/utils/oauth.d.ts

@@ -6,6 +6,7 @@ import { auth0EventHandler } from '../lib/oauth/auth0';
 import { microsoftEventHandler } from '../lib/oauth/microsoft';
 import { discordEventHandler } from '../lib/oauth/discord';
 import { battledotnetEventHandler } from '../lib/oauth/battledotnet';
+import { keycloakEventHandler } from '../lib/oauth/keycloak';
 import { linkedinEventHandler } from '../lib/oauth/linkedin';
 export declare const oauth: {
     githubEventHandler: typeof githubEventHandler;
@@ -16,5 +17,6 @@ export declare const oauth: {
     microsoftEventHandler: typeof microsoftEventHandler;
     discordEventHandler: typeof discordEventHandler;
     battledotnetEventHandler: typeof battledotnetEventHandler;
+    keycloakEventHandler: typeof keycloakEventHandler;
     linkedinEventHandler: typeof linkedinEventHandler;
 };

package/dist/runtime/server/utils/oauth.mjs

@@ -6,6 +6,7 @@ import { auth0EventHandler } from "../lib/oauth/auth0.mjs";
 import { microsoftEventHandler } from "../lib/oauth/microsoft.mjs";
 import { discordEventHandler } from "../lib/oauth/discord.mjs";
 import { battledotnetEventHandler } from "../lib/oauth/battledotnet.mjs";
+import { keycloakEventHandler } from "../lib/oauth/keycloak.mjs";
 import { linkedinEventHandler } from "../lib/oauth/linkedin.mjs";
 export const oauth = {
   githubEventHandler,
@@ -16,5 +17,6 @@ export const oauth = {
   microsoftEventHandler,
   discordEventHandler,
   battledotnetEventHandler,
+  keycloakEventHandler,
   linkedinEventHandler
 };

package/dist/runtime/server/utils/session.d.ts

@@ -6,7 +6,7 @@ export interface SessionHooks {
      * - Add extra properties to the session
      * - Throw an error if the session could not be verified (with a database for example)
      */
-    'verify': (session: UserSession, event: H3Event) => void | Promise<void>;
+    'fetch': (session: UserSession, event: H3Event) => void | Promise<void>;
     /**
      * Called before clearing the session
      */

package/dist/types.d.mts

@@ -1,5 +1,5 @@
 
-import type { ModuleOptions } from './module'
+import type { ModuleOptions } from './module.js'
 
 
 declare module '@nuxt/schema' {
@@ -13,4 +13,4 @@ declare module 'nuxt/schema' {
 }
 
 
-export type { ModuleOptions, default } from './module'
+export type { ModuleOptions, default } from './module.js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "description": "Minimalist Auth module for Nuxt with SSR",
   "repository": "Atinux/nuxt-auth-utils",
   "license": "MIT",
@@ -30,27 +30,27 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@nuxt/kit": "^3.8.2",
+    "@nuxt/kit": "^3.9.0",
     "defu": "^6.1.3",
     "hookable": "^5.5.3",
     "ofetch": "^1.3.3",
     "ohash": "^1.1.3"
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.1.82",
+    "@iconify-json/simple-icons": "^1.1.86",
     "@nuxt/devtools": "latest",
     "@nuxt/eslint-config": "^0.2.0",
-    "@nuxt/module-builder": "^0.5.4",
-    "@nuxt/schema": "^3.8.2",
-    "@nuxt/test-utils": "^3.8.1",
-    "@nuxt/ui": "^2.11.0",
-    "@nuxt/ui-pro": "^0.5.0",
-    "@types/node": "^20.10.4",
+    "@nuxt/module-builder": "^0.5.5",
+    "@nuxt/schema": "^3.9.0",
+    "@nuxt/test-utils": "^3.9.0",
+    "@nuxt/ui": "^2.11.1",
+    "@nuxt/ui-pro": "^0.6.1",
+    "@types/node": "^20.10.6",
     "changelogen": "^0.5.5",
-    "eslint": "^8.55.0",
-    "nuxt": "^3.8.2",
+    "eslint": "^8.56.0",
+    "nuxt": "^3.9.0",
     "typescript": "^5.3.3",
-    "vitest": "^1.0.2",
-    "vue-tsc": "^1.8.25"
+    "vitest": "^1.1.3",
+    "vue-tsc": "^1.8.27"
   }
 }