nuxt-auth-utils 0.0.25 → 0.2.0

package/README.md

@@ -5,7 +5,7 @@
 [![License][license-src]][license-href]
 [![Nuxt][nuxt-src]][nuxt-href]
 
-Minimalist Authentication module for Nuxt exposing Vue composables and server utils.
+Add Authentication to Nuxt applications with secured & sealed cookies sessions.
 
 - [Release Notes](/CHANGELOG.md)
 - [Demo](https://github.com/atinux/nuxt-todos-edge)
@@ -14,12 +14,20 @@ Minimalist Authentication module for Nuxt exposing Vue composables and server ut
 
 ## Features
 
-- Secured & sealed cookies sessions
-- [OAuth Providers](#supported-oauth-providers)
+- [Hybrid Rendering](#hybrid-rendering) support (SSR / CSR / SWR / Prerendering)
+- [15+ OAuth Providers](#supported-oauth-providers)
+- [Vue composable](#vue-composable)
+- [Server utils](#server-utils)
+- [`<AuthState>` component](#authstate-component)
+- [Extendable with hooks](#extend-session)
 
 ## Requirements
 
-This module only works with SSR (server-side rendering) enabled as it uses server API routes. You cannot use this module with `nuxt generate`.
+This module only works with a Nuxt server running as it uses server API routes (`nuxt build`).
+
+This means that you cannot use this module with `nuxt generate`.
+
+You can anyway use [Hybrid Rendering](#hybrid-rendering) to pre-render pages of your application or disable server-side rendering completely.
 
 ## Quick Setup
 
@@ -40,7 +48,7 @@ Nuxt Auth Utils generates one for you when running Nuxt in development the first
 
 3. That's it! You can now add authentication to your Nuxt app ✨
 
-## Vue Composables
+## Vue Composable
 
 Nuxt Auth Utils automatically adds some plugins to fetch the current user session to let you access it from your Vue components.
 
@@ -72,7 +80,7 @@ The following helpers are auto-imported in your `server/` directory.
 
 ```ts
 // Set a user session, note that this data is encrypted in the cookie but can be decrypted with an API call
-// Only store the data that allow you to recognize an user, but do not store sensitive data
+// Only store the data that allow you to recognize a user, but do not store sensitive data
 // Merges new data with existing data using defu()
 await setUserSession(event, {
   user: {
@@ -118,7 +126,7 @@ All helpers are exposed from the `oauth` global variable and can be used in your
 
 The pattern is `oauth.<provider>EventHandler({ onSuccess, config?, onError? })`, example: `oauth.githubEventHandler`.
 
-The helper returns an event handler that automatically redirects to the provider authorization page and then call `onSuccess` or `onError` depending on the result.
+The helper returns an event handler that automatically redirects to the provider authorization page and then calls `onSuccess` or `onError` depending on the result.
 
 The `config` can be defined directly from the `runtimeConfig` in your `nuxt.config.ts`:
 
@@ -152,8 +160,12 @@ It can also be set using environment variables:
 - Keycloak
 - LinkedIn
 - Microsoft
+- PayPal
 - Spotify
+- Steam
 - Twitch
+- X (Twitter)
+- XSUAA
 
 You can add your favorite provider by creating a new file in [src/runtime/server/lib/oauth/](./src/runtime/server/lib/oauth/).
 
@@ -186,7 +198,7 @@ Make sure to set the callback URL in your OAuth app settings as `<your-domain>/a
 
 ### Extend Session
 
-We leverage hooks to let you extend the session data with your own data or to log when the user clear its session.
+We leverage hooks to let you extend the session data with your own data or log when the user clears the session.
 
 ```ts
 // server/plugins/session.ts
@@ -206,6 +218,69 @@ export default defineNitroPlugin(() => {
 })
 ```
 
+## Server-Side Rendering
+
+You can make authenticated requests both from the client and the server. However, you must use `useRequestFetch()` to make authenticated requests during SSR if you are not using `useFetch()`
+
+```vue
+<script setup lang="ts">
+// When using useAsyncData
+const { data } = await useAsyncData('team', () => useRequestFetch()('/api/protected-endpoint'))
+
+// useFetch will automatically use useRequestFetch during SSR
+const { data } = await useFetch('/api/protected-endpoint')
+</script>
+```
+
+> There's [an open issue](https://github.com/nuxt/nuxt/issues/24813) to include credentials in `$fetch` in Nuxt.
+
+## Hybrid Rendering
+
+When using [Nuxt `routeRules`](https://nuxt.com/docs/guide/concepts/rendering#hybrid-rendering) to prerender or cache your pages, Nuxt Auth Utils will not fetch the user session during prerendering but instead fetch it on the client-side (after hydration).
+
+This is because the user session is stored in a secure cookie and cannot be accessed during prerendering.
+
+**This means that you should not rely on the user session during prerendering.**
+
+### `<AuthState>` component
+
+You can use the `<AuthState>` component to safely display auth-related data in your components without worrying about the rendering mode.
+
+One common use case if the Login button in the header:
+
+```vue
+<template>
+  <header>
+    <AuthState v-slot="{ loggedIn, clear }">
+      <button v-if="loggedIn" @click="clear">Logout</button>
+      <NuxtLink v-else to="/login">Login</NuxtLink>
+    </AuthState>
+  </header>
+</template>
+```
+
+If the page is cached or prerendered, nothing will be rendered until the user session is fetched on the client-side.
+
+You can use the `placeholder` slot to show a placeholder on server-side and while the user session is being fetched on client-side for the prerendered pages:
+
+```vue
+<template>
+  <header>
+    <AuthState>
+      <template #default="{ loggedIn, clear }">
+        <button v-if="loggedIn" @click="clear">Logout</button>
+        <NuxtLink v-else to="/login">Login</NuxtLink>
+      </template>
+      <template #placeholder>
+        <button disabled>Loading...</button>
+      </template>
+    </AuthState>
+  </header>
+</template>
+```
+
+If you are caching your routes with `routeRules`, please make sure to use [`nitro-nightly`](https://nitro.unjs.io/guide/nightly) or Nitro >= `2.10.0` to support the client-side fetching of the user session.
+
 ## Configuration
 
 We leverage `runtimeConfig.session` to give the defaults option to [h3 `useSession`](https://h3.unjs.io/examples/handle-session).
@@ -237,6 +312,10 @@ Our defaults are:
 
 Checkout the [`SessionConfig`](https://github.com/unjs/h3/blob/c04c458810e34eb15c1647e1369e7d7ef19f567d/src/utils/session.ts#L20) for all options.
 
+## More
+
+- [nuxt-authorization](https://github.com/barbapapazes/nuxt-authorization): Authorization module for managing permissions inside a Nuxt app, compatible with `nuxt-auth-utils`
+
 ## Development
 
 ```bash

package/dist/module.json

@@ -1,9 +1,9 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.0.25",
+  "version": "0.2.0",
   "builder": {
-    "@nuxt/module-builder": "0.6.0",
+    "@nuxt/module-builder": "0.7.1",
     "unbuild": "2.0.0"
   }
 }

package/dist/module.mjs

@@ -1,5 +1,5 @@
 import { readFile, writeFile } from 'node:fs/promises';
-import { defineNuxtModule, createResolver, addImportsDir, addPlugin, addServerPlugin, addServerHandler } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, addComponentsDir, addImportsDir, addPlugin, addServerPlugin, addServerImportsDir, addServerHandler } from '@nuxt/kit';
 import { join } from 'pathe';
 import { defu } from 'defu';
 import { randomUUID } from 'uncrypto';
@@ -14,30 +14,12 @@ const module = defineNuxtModule({
   async setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
     nuxt.options.alias["#auth-utils"] = resolver.resolve("./runtime/types/index");
-    addImportsDir(resolver.resolve("./runtime/composables"));
-    addPlugin(resolver.resolve("./runtime/plugins/session.server"));
-    if (nuxt.options.nitro.imports !== false) {
-      nuxt.options.nitro.imports = defu(nuxt.options.nitro.imports, {
-        presets: [
-          {
-            from: resolver.resolve("./runtime/server/utils/oauth"),
-            imports: ["oauth"]
-          },
-          {
-            from: resolver.resolve("./runtime/server/utils/session"),
-            imports: [
-              "sessionHooks",
-              "getUserSession",
-              "setUserSession",
-              "replaceUserSession",
-              "clearUserSession",
-              "requireUserSession"
-            ]
-          }
-        ]
-      });
-    }
+    addComponentsDir({ path: resolver.resolve("./runtime/app/components") });
+    addImportsDir(resolver.resolve("./runtime/app/composables"));
+    addPlugin(resolver.resolve("./runtime/app/plugins/session.server"));
+    addPlugin(resolver.resolve("./runtime/app/plugins/session.client"));
     addServerPlugin(resolver.resolve("./runtime/server/plugins/oauth"));
+    addServerImportsDir(resolver.resolve("./runtime/server/utils"));
     addServerHandler({
       handler: resolver.resolve("./runtime/server/api/session.delete"),
       route: "/api/_auth/session",
@@ -124,6 +106,22 @@ const module = defineNuxtModule({
       clientId: "",
       clientSecret: ""
     });
+    runtimeConfig.oauth.paypal = defu(runtimeConfig.oauth.paypal, {
+      clientId: "",
+      clientSecret: ""
+    });
+    runtimeConfig.oauth.steam = defu(runtimeConfig.oauth.steam, {
+      apiKey: ""
+    });
+    runtimeConfig.oauth.x = defu(runtimeConfig.oauth.x, {
+      clientId: "",
+      clientSecret: ""
+    });
+    runtimeConfig.oauth.xsuaa = defu(runtimeConfig.oauth.xsuaa, {
+      clientId: "",
+      clientSecret: "",
+      domain: ""
+    });
   }
 });
 

package/dist/runtime/app/components/AuthState.vue

@@ -0,0 +1,17 @@
+<script setup>
+import { useUserSession } from '#imports'
+
+const userSession = useUserSession()
+const { ready } = userSession
+</script>
+
+<template>
+  <slot
+    v-if="ready"
+    v-bind="userSession"
+  />
+  <slot
+    v-else
+    name="placeholder"
+  />
+</template>

package/dist/runtime/{composables → app/composables}/session.d.ts

@@ -1,2 +1,6 @@
 import type { UserSessionComposable } from '#auth-utils';
+/**
+ * Composable to get back the user session and utils around it.
+ * @see https://github.com/atinux/nuxt-auth-utils
+ */
 export declare function useUserSession(): UserSessionComposable;

package/dist/runtime/{composables/session.mjs → app/composables/session.js}

@@ -1,8 +1,11 @@
 import { useState, computed, useRequestFetch } from "#imports";
 const useSessionState = () => useState("nuxt-session", () => ({}));
+const useAuthReadyState = () => useState("nuxt-auth-ready", () => false);
 export function useUserSession() {
   const sessionState = useSessionState();
+  const authReadyState = useAuthReadyState();
   return {
+    ready: computed(() => authReadyState.value),
     loggedIn: computed(() => Boolean(sessionState.value.user)),
     user: computed(() => sessionState.value.user || null),
     session: sessionState,
@@ -11,12 +14,16 @@ export function useUserSession() {
   };
 }
 async function fetch() {
+  const authReadyState = useAuthReadyState();
   useSessionState().value = await useRequestFetch()("/api/_auth/session", {
     headers: {
       Accept: "text/json"
     },
     retry: false
   }).catch(() => ({}));
+  if (!authReadyState.value) {
+    authReadyState.value = true;
+  }
 }
 async function clear() {
   await $fetch("/api/_auth/session", { method: "DELETE" });

package/dist/runtime/app/plugins/session.client.js

@@ -0,0 +1,8 @@
+import { defineNuxtPlugin, useUserSession } from "#imports";
+export default defineNuxtPlugin(async (nuxtApp) => {
+  if (!nuxtApp.payload.serverRendered || Boolean(nuxtApp.payload.prerenderedAt) || Boolean(nuxtApp.payload.isCached)) {
+    nuxtApp.hook("app:mounted", async () => {
+      await useUserSession().fetch();
+    });
+  }
+});

package/dist/runtime/app/plugins/session.server.js

@@ -0,0 +1,11 @@
+import { defineNuxtPlugin, useRequestEvent, useUserSession } from "#imports";
+export default defineNuxtPlugin({
+  name: "session-fetch-plugin",
+  enforce: "pre",
+  async setup(nuxtApp) {
+    nuxtApp.payload.isCached = Boolean(useRequestEvent()?.context.cache);
+    if (nuxtApp.payload.serverRendered && !nuxtApp.payload.prerenderedAt && !nuxtApp.payload.isCached) {
+      await useUserSession().fetch();
+    }
+  }
+});

package/dist/runtime/server/api/{session.delete.mjs → session.delete.js}

@@ -1,5 +1,5 @@
 import { eventHandler } from "h3";
-import { clearUserSession } from "../utils/session.mjs";
+import { clearUserSession } from "../utils/session.js";
 export default eventHandler(async (event) => {
   await clearUserSession(event);
   return { loggedOut: true };

package/dist/runtime/server/api/{session.get.mjs → session.get.js}

@@ -1,5 +1,5 @@
 import { eventHandler } from "h3";
-import { requireUserSession, sessionHooks } from "../utils/session.mjs";
+import { requireUserSession, sessionHooks } from "../utils/session.js";
 export default eventHandler(async (event) => {
   const session = await requireUserSession(event);
   await sessionHooks.callHookParallel("fetch", session, event);

package/dist/runtime/server/lib/oauth/{auth0.mjs → auth0.js}

@@ -1,6 +1,5 @@
 import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
 import { withQuery, parsePath } from "ufo";
-import { ofetch } from "ofetch";
 import { defu } from "defu";
 import { useRuntimeConfig } from "#imports";
 export function auth0EventHandler({ config, onSuccess, onError }) {
@@ -40,7 +39,7 @@ export function auth0EventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const tokens = await ofetch(
+    const tokens = await $fetch(
       tokenURL,
       {
         method: "POST",
@@ -70,7 +69,7 @@ export function auth0EventHandler({ config, onSuccess, onError }) {
     }
     const tokenType = tokens.token_type;
     const accessToken = tokens.access_token;
-    const user = await ofetch(`https://${config.domain}/userinfo`, {
+    const user = await $fetch(`https://${config.domain}/userinfo`, {
       headers: {
         Authorization: `${tokenType} ${accessToken}`
       }

package/dist/runtime/server/lib/oauth/{battledotnet.mjs → battledotnet.js}

@@ -1,6 +1,5 @@
 import { randomUUID } from "node:crypto";
 import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { ofetch } from "ofetch";
 import { withQuery, parsePath } from "ufo";
 import { defu } from "defu";
 import { useRuntimeConfig } from "#imports";
@@ -88,7 +87,7 @@ export function battledotnetEventHandler({ config, onSuccess, onError }) {
       return onError(event, error);
     }
     const accessToken = tokens.access_token;
-    const user = await ofetch("https://oauth.battle.net/userinfo", {
+    const user = await $fetch("https://oauth.battle.net/userinfo", {
       headers: {
         "User-Agent": `Battledotnet-OAuth-${config.clientId}`,
         "Authorization": `Bearer ${accessToken}`

package/dist/runtime/server/lib/oauth/{cognito.mjs → cognito.js}

@@ -1,6 +1,5 @@
 import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
 import { withQuery, parsePath } from "ufo";
-import { ofetch } from "ofetch";
 import { defu } from "defu";
 import { useRuntimeConfig } from "#imports";
 export function cognitoEventHandler({ config, onSuccess, onError }) {
@@ -34,7 +33,7 @@ export function cognitoEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const tokens = await ofetch(
+    const tokens = await $fetch(
       tokenURL,
       {
         method: "POST",
@@ -58,7 +57,7 @@ export function cognitoEventHandler({ config, onSuccess, onError }) {
     }
     const tokenType = tokens.token_type;
     const accessToken = tokens.access_token;
-    const user = await ofetch(`https://${config.userPoolId}.auth.${config.region}.amazoncognito.com/oauth2/userInfo`, {
+    const user = await $fetch(`https://${config.userPoolId}.auth.${config.region}.amazoncognito.com/oauth2/userInfo`, {
       headers: {
         Authorization: `${tokenType} ${accessToken}`
       }

package/dist/runtime/server/lib/oauth/{discord.mjs → discord.js}

@@ -1,6 +1,5 @@
 import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
 import { withQuery, parseURL, stringifyParsedURL } from "ufo";
-import { ofetch } from "ofetch";
 import { defu } from "defu";
 import { useRuntimeConfig } from "#imports";
 export function discordEventHandler({ config, onSuccess, onError }) {
@@ -43,7 +42,7 @@ export function discordEventHandler({ config, onSuccess, onError }) {
     }
     const parsedRedirectUrl = parseURL(redirectUrl);
     parsedRedirectUrl.search = "";
-    const tokens = await ofetch(
+    const tokens = await $fetch(
       config.tokenURL,
       {
         method: "POST",
@@ -72,7 +71,7 @@ export function discordEventHandler({ config, onSuccess, onError }) {
       return onError(event, error);
     }
     const accessToken = tokens.access_token;
-    const user = await ofetch("https://discord.com/api/users/@me", {
+    const user = await $fetch("https://discord.com/api/users/@me", {
       headers: {
         "user-agent": "Nuxt Auth Utils",
         "Authorization": `Bearer ${accessToken}`

package/dist/runtime/server/lib/oauth/{facebook.mjs → facebook.js}

@@ -5,7 +5,6 @@ import {
   getRequestURL,
   sendRedirect
 } from "h3";
-import { ofetch } from "ofetch";
 import { withQuery } from "ufo";
 import { defu } from "defu";
 import { useRuntimeConfig } from "#imports";
@@ -74,7 +73,7 @@ export function facebookEventHandler({
     const accessToken = tokens.access_token;
     config.fields = config.fields || ["id", "name"];
     const fields = config.fields.join(",");
-    const user = await ofetch(
+    const user = await $fetch(
       `https://graph.facebook.com/v19.0/me?fields=${fields}&access_token=${accessToken}`
     );
     if (!user) {

package/dist/runtime/server/lib/oauth/{github.mjs → github.js}

@@ -1,5 +1,4 @@
 import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { ofetch } from "ofetch";
 import { withQuery } from "ufo";
 import { defu } from "defu";
 import { useRuntimeConfig } from "#imports";
@@ -68,14 +67,14 @@ export function githubEventHandler({ config, onSuccess, onError }) {
       return onError(event, error);
     }
     const accessToken = tokens.access_token;
-    const user = await ofetch("https://api.github.com/user", {
+    const user = await $fetch("https://api.github.com/user", {
       headers: {
         "User-Agent": `Github-OAuth-${config.clientId}`,
         "Authorization": `token ${accessToken}`
       }
     });
     if (!user.email && config.emailRequired) {
-      const emails = await ofetch("https://api.github.com/user/emails", {
+      const emails = await $fetch("https://api.github.com/user/emails", {
         headers: {
           "User-Agent": `Github-OAuth-${config.clientId}`,
           "Authorization": `token ${accessToken}`

package/dist/runtime/server/lib/oauth/{google.mjs → google.js}

@@ -6,7 +6,6 @@ import {
   sendRedirect
 } from "h3";
 import { withQuery, parsePath } from "ufo";
-import { ofetch } from "ofetch";
 import { defu } from "defu";
 import { useRuntimeConfig } from "#imports";
 export function googleEventHandler({
@@ -52,7 +51,7 @@ export function googleEventHandler({
       client_secret: config.clientSecret,
       code
     };
-    const tokens = await ofetch(config.tokenURL, {
+    const tokens = await $fetch(config.tokenURL, {
       method: "POST",
       body
     }).catch((error) => {
@@ -69,7 +68,7 @@ export function googleEventHandler({
       return onError(event, error);
     }
     const accessToken = tokens.access_token;
-    const user = await ofetch(
+    const user = await $fetch(
       config.userURL,
       {
         headers: {

package/dist/runtime/server/lib/oauth/{keycloak.mjs → keycloak.js}

@@ -5,7 +5,6 @@ import {
   getRequestURL,
   sendRedirect
 } from "h3";
-import { ofetch } from "ofetch";
 import { withQuery, parsePath } from "ufo";
 import { defu } from "defu";
 import { useRuntimeConfig } from "#imports";
@@ -60,7 +59,7 @@ export function keycloakEventHandler({
     if (!config.scope.includes("openid")) {
       config.scope.push("openid");
     }
-    const tokens = await ofetch(tokenURL, {
+    const tokens = await $fetch(tokenURL, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
@@ -86,7 +85,7 @@ export function keycloakEventHandler({
       return onError(event, error);
     }
     const accessToken = tokens.access_token;
-    const user = await ofetch(
+    const user = await $fetch(
       `${realmURL}/protocol/openid-connect/userinfo`,
       {
         headers: {

package/dist/runtime/server/lib/oauth/{linkedin.mjs → linkedin.js}

@@ -1,6 +1,5 @@
 import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
 import { withQuery, parseURL, stringifyParsedURL } from "ufo";
-import { ofetch } from "ofetch";
 import { defu } from "defu";
 import { useRuntimeConfig } from "#imports";
 export function linkedinEventHandler({ config, onSuccess, onError }) {
@@ -42,7 +41,7 @@ export function linkedinEventHandler({ config, onSuccess, onError }) {
     }
     const parsedRedirectUrl = parseURL(redirectUrl);
     parsedRedirectUrl.search = "";
-    const tokens = await ofetch(
+    const tokens = await $fetch(
       config.tokenURL,
       {
         method: "POST",
@@ -71,7 +70,7 @@ export function linkedinEventHandler({ config, onSuccess, onError }) {
       return onError(event, error);
     }
     const accessToken = tokens.access_token;
-    const user = await ofetch("https://api.linkedin.com/v2/userinfo", {
+    const user = await $fetch("https://api.linkedin.com/v2/userinfo", {
       headers: {
         "user-agent": "Nuxt Auth Utils",
         "Authorization": `Bearer ${accessToken}`

package/dist/runtime/server/lib/oauth/{microsoft.mjs → microsoft.js}

@@ -1,6 +1,5 @@
 import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
 import { withQuery, parsePath } from "ufo";
-import { ofetch } from "ofetch";
 import { defu } from "defu";
 import { useRuntimeConfig } from "#imports";
 export function microsoftEventHandler({ config, onSuccess, onError }) {
@@ -40,7 +39,7 @@ export function microsoftEventHandler({ config, onSuccess, onError }) {
     data.append("client_secret", config.clientSecret);
     data.append("redirect_uri", parsePath(redirectUrl).pathname);
     data.append("code", String(code));
-    const tokens = await ofetch(
+    const tokens = await $fetch(
       tokenURL,
       {
         method: "POST",
@@ -65,7 +64,7 @@ export function microsoftEventHandler({ config, onSuccess, onError }) {
     const tokenType = tokens.token_type;
     const accessToken = tokens.access_token;
     const userURL = config.userURL || "https://graph.microsoft.com/v1.0/me";
-    const user = await ofetch(userURL, {
+    const user = await $fetch(userURL, {
       headers: {
         Authorization: `${tokenType} ${accessToken}`
       }

package/dist/runtime/server/lib/oauth/paypal.d.ts

@@ -0,0 +1,47 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthPaypalConfig {
+    /**
+     * PayPal Client ID
+     * @default process.env.NUXT_OAUTH_PAYPAL_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * PayPal OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_PAYPAL_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * PayPal OAuth Scope
+     * @default []
+     * @see https://developer.paypal.com/docs/log-in-with-paypal/integrate/reference/#scope-attributes
+     * @example ['email', 'profile']
+     */
+    scope?: string[];
+    /**
+     * Require email from user, adds the ['email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+    /**
+     * Use PayPal sandbox environment
+     * @default import.meta.dev // true in development, false in production
+     */
+    sandbox?: boolean;
+    /**
+     * PayPal OAuth Authorization URL
+     * @default 'https://www.paypal.com/signin/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * PayPal OAuth Token URL
+     * @default 'https://api-m.paypal.com/v1/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://developer.paypal.com/docs/log-in-with-paypal/integrate/build-button/#link-constructauthorizationendpoint
+     * @example { flowEntry: 'static' }
+     */
+    authorizationParams?: Record<string, string>;
+}
+export declare function paypalEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPaypalConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;