nuxt-auth-utils 0.0.4 → 0.0.5

package/README.md

@@ -7,14 +7,15 @@
 
 Minimalist Authentication module for Nuxt exposing Vue composables and server utils.
 
-- [✨  Release Notes](/CHANGELOG.md)
+- [Release Notes](/CHANGELOG.md)
+- [Demo](https://github.com/atinux/nuxt-todos-edge)
 <!-- - [🏀 Online playground](https://stackblitz.com/github/your-org/nuxt-auth-utils?file=playground%2Fapp.vue) -->
 <!-- - [📖 &nbsp;Documentation](https://example.com) -->
 
 ## Features
 
 - Secured & sealed cookies sessions
-- OAuth Providers
+- [OAuth Providers](#supported-oauth-providers)
 
 ## Requirements
 
@@ -144,9 +145,15 @@ It can also be set using environment variables:
 - `NUXT_OAUTH_<PROVIDER>_CLIENT_ID`
 - `NUXT_OAUTH_<PROVIDER>_CLIENT_SECRET`
 
-Supported providers:
+#### Supported OAuth Providers
+
 - GitHub
 - Spotify
+- Google
+- Twitch
+- Auth0
+
+You can add your favorite provider by creating a new file in [src/runtime/server/lib/oauth/](./src/runtime/server/lib/oauth/).
 
 ### Example
 
@@ -154,6 +161,9 @@ Example: `~/server/routes/auth/github.get.ts`
 
 ```ts
 export default oauth.githubEventHandler({
+  config: {
+    emailRequired: true
+  },
   async onSuccess(event, { user, tokens }) {
     await setUserSession(event, {
       user: {

package/dist/module.json

@@ -1,5 +1,5 @@
 {
-  "name": "auth-core",
+  "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.0.4"
+  "version": "0.0.5"
 }

package/dist/module.mjs

@@ -4,20 +4,18 @@ import { defu } from 'defu';
 
 const module = defineNuxtModule({
   meta: {
-    name: "auth-core",
+    name: "auth-utils",
     configKey: "auth"
   },
   // Default configuration options of the Nuxt module
   defaults: {},
   setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
-    if (!process.env.NUXT_SESSION_PASSWORD) {
+    if (!process.env.NUXT_SESSION_PASSWORD && !nuxt.options._prepare) {
       const randomPassword = sha256(`${Date.now()}${Math.random()}`).slice(0, 32);
       process.env.NUXT_SESSION_PASSWORD = randomPassword;
-      if (!nuxt.options._prepare) {
-        console.warn("No session password set, using a random password, please set NUXT_SESSION_PASSWORD in your .env file with at least 32 chars");
-        console.log(`NUXT_SESSION_PASSWORD=${randomPassword}`);
-      }
+      console.warn("No session password set, using a random password, please set NUXT_SESSION_PASSWORD in your .env file with at least 32 chars");
+      console.log(`NUXT_SESSION_PASSWORD=${randomPassword}`);
     }
     nuxt.options.alias["#auth-utils"] = resolver.resolve("./runtime/types/auth-utils-session");
     addImportsDir(resolver.resolve("./runtime/composables"));
@@ -65,6 +63,19 @@ const module = defineNuxtModule({
       clientId: "",
       clientSecret: ""
     });
+    runtimeConfig.oauth.google = defu(runtimeConfig.oauth.google, {
+      clientId: "",
+      clientSecret: ""
+    });
+    runtimeConfig.oauth.twitch = defu(runtimeConfig.oauth.twitch, {
+      clientId: "",
+      clientSecret: ""
+    });
+    runtimeConfig.oauth.auth0 = defu(runtimeConfig.oauth.auth0, {
+      clientId: "",
+      clientSecret: "",
+      domain: ""
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/auth0.d.ts

@@ -0,0 +1,45 @@
+import type { H3Event, H3Error } from 'h3';
+export interface OAuthAuth0Config {
+    /**
+     * Auth0 OAuth Client ID
+     * @default process.env.NUXT_OAUTH_AUTH0_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Auth0 OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_AUTH0_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Auth0 OAuth Issuer
+     * @default process.env.NUXT_OAUTH_AUTH0_DOMAIN
+     */
+    domain?: string;
+    /**
+     * Auth0 OAuth Audience
+     * @default process.env.NUXT_OAUTH_AUTH0_AUDIENCE
+     */
+    audience?: string;
+    /**
+     * Auth0 OAuth Scope
+     * @default []
+     * @see https://auth0.com/docs/get-started/apis/scopes/openid-connect-scopes
+     * @example ['openid']
+     */
+    scope?: string[];
+    /**
+     * Require email from user, adds the ['email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+}
+interface OAuthConfig {
+    config?: OAuthAuth0Config;
+    onSuccess: (event: H3Event, result: {
+        user: any;
+        tokens: any;
+    }) => Promise<void> | void;
+    onError?: (event: H3Event, error: H3Error) => Promise<void> | void;
+}
+export declare function auth0EventHandler({ config, onSuccess, onError }: OAuthConfig): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export {};

package/dist/runtime/server/lib/oauth/auth0.mjs

@@ -0,0 +1,78 @@
+import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
+import { withQuery, parsePath } from "ufo";
+import { ofetch } from "ofetch";
+import { defu } from "defu";
+import { useRuntimeConfig } from "#imports";
+export function auth0EventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.auth0);
+    const { code } = getQuery(event);
+    if (!config.clientId || !config.clientSecret || !config.domain) {
+      const error = createError({
+        statusCode: 500,
+        message: "Missing NUXT_OAUTH_AUTH0_CLIENT_ID or NUXT_OAUTH_AUTH0_CLIENT_SECRET or NUXT_OAUTH_AUTH0_DOMAIN env variables."
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    const authorizationURL = `https://${config.domain}/authorize`;
+    const tokenURL = `https://${config.domain}/oauth/token`;
+    const redirectUrl = getRequestURL(event).href;
+    if (!code) {
+      config.scope = config.scope || ["openid", "offline_access"];
+      if (config.emailRequired && !config.scope.includes("email")) {
+        config.scope.push("email");
+      }
+      return sendRedirect(
+        event,
+        withQuery(authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectUrl,
+          scope: config.scope.join(" "),
+          audience: config.audience || ""
+        })
+      );
+    }
+    const tokens = await ofetch(
+      tokenURL,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: {
+          grant_type: "authorization_code",
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          redirect_uri: parsePath(redirectUrl).pathname,
+          code
+        }
+      }
+    ).catch((error) => {
+      return { error };
+    });
+    if (tokens.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Auth0 login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
+        data: tokens
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    const tokenType = tokens.token_type;
+    const accessToken = tokens.access_token;
+    const user = await ofetch(`https://${config.domain}/userinfo`, {
+      headers: {
+        Authorization: `${tokenType} ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/google.d.ts

@@ -0,0 +1,45 @@
+import type { H3Event, H3Error } from 'h3';
+export interface OAuthGoogleConfig {
+    /**
+     * Google OAuth Client ID
+     * @default process.env.NUXT_OAUTH_GOOGLE_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Google OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_GOOGLE_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Google OAuth Scope
+     * @default []
+     * @see https://developers.google.com/identity/protocols/oauth2/scopes#google-sign-in
+     * @example ['email', 'openid', 'profile']
+     */
+    scope?: string[];
+    /**
+     * Google OAuth Authorization URL
+     * @default 'https://accounts.google.com/o/oauth2/v2/auth'
+     */
+    authorizationURL?: string;
+    /**
+     * Google OAuth Token URL
+     * @default 'https://oauth2.googleapis.com/token'
+     */
+    tokenURL?: string;
+    /**
+     * Redirect URL post authenticating via google
+     * @default '/auth/google'
+     */
+    redirectUrl: '/auth/google';
+}
+interface OAuthConfig {
+    config?: OAuthGoogleConfig;
+    onSuccess: (event: H3Event, result: {
+        user: any;
+        tokens: any;
+    }) => Promise<void> | void;
+    onError?: (event: H3Event, error: H3Error) => Promise<void> | void;
+}
+export declare function googleEventHandler({ config, onSuccess, onError, }: OAuthConfig): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export {};

package/dist/runtime/server/lib/oauth/google.mjs

@@ -0,0 +1,82 @@
+import {
+  eventHandler,
+  createError,
+  getQuery,
+  getRequestURL,
+  sendRedirect
+} from "h3";
+import { withQuery, parsePath } from "ufo";
+import { ofetch } from "ofetch";
+import { defu } from "defu";
+import { useRuntimeConfig } from "#imports";
+export function googleEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.google, {
+      authorizationURL: "https://accounts.google.com/o/oauth2/v2/auth",
+      tokenURL: "https://oauth2.googleapis.com/token"
+    });
+    const { code } = getQuery(event);
+    if (!config.clientId) {
+      const error = createError({
+        statusCode: 500,
+        message: "Missing NUXT_OAUTH_GOOGLE_CLIENT_ID env variables."
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    const redirectUrl = getRequestURL(event).href;
+    if (!code) {
+      config.scope = config.scope || ["email", "profile"];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectUrl,
+          scope: config.scope.join(" ")
+        })
+      );
+    }
+    const body = {
+      grant_type: "authorization_code",
+      redirect_uri: parsePath(redirectUrl).pathname,
+      client_id: config.clientId,
+      client_secret: config.clientSecret,
+      code
+    };
+    const tokens = await ofetch(config.tokenURL, {
+      method: "POST",
+      body
+    }).catch((error) => {
+      return { error };
+    });
+    if (tokens.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Google login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
+        data: tokens
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    const accessToken = tokens.access_token;
+    const user = await ofetch(
+      "https://www.googleapis.com/oauth2/v3/userinfo",
+      {
+        headers: {
+          Authorization: `Bearer ${accessToken}`
+        }
+      }
+    );
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/twitch.d.ts

@@ -0,0 +1,45 @@
+import type { H3Event, H3Error } from 'h3';
+export interface OAuthTwitchConfig {
+    /**
+     * Twitch Client ID
+     * @default process.env.NUXT_OAUTH_TWITCH_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+    * Twitch OAuth Client Secret
+    * @default process.env.NUXT_OAUTH_TWITCH_CLIENT_SECRET
+    */
+    clientSecret?: string;
+    /**
+     * Twitch OAuth Scope
+     * @default []
+     * @see https://dev.twitch.tv/docs/authentication/scopes
+     * @example ['user:read:email']
+     */
+    scope?: string[];
+    /**
+     * Require email from user, adds the ['user:read:email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+    /**
+     * Twitch OAuth Authorization URL
+     * @default 'https://id.twitch.tv/oauth2/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Twitch OAuth Token URL
+     * @default 'https://id.twitch.tv/oauth2/token'
+     */
+    tokenURL?: string;
+}
+interface OAuthConfig {
+    config?: OAuthTwitchConfig;
+    onSuccess: (event: H3Event, result: {
+        user: any;
+        tokens: any;
+    }) => Promise<void> | void;
+    onError?: (event: H3Event, error: H3Error) => Promise<void> | void;
+}
+export declare function twitchEventHandler({ config, onSuccess, onError }: OAuthConfig): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export {};

package/dist/runtime/server/lib/oauth/twitch.mjs

@@ -0,0 +1,89 @@
+import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
+import { withQuery, parsePath } from "ufo";
+import { ofetch } from "ofetch";
+import { defu } from "defu";
+import { useRuntimeConfig } from "#imports";
+export function twitchEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.twitch, {
+      authorizationURL: "https://id.twitch.tv/oauth2/authorize",
+      tokenURL: "https://id.twitch.tv/oauth2/token"
+    });
+    const { code } = getQuery(event);
+    if (!config.clientId) {
+      const error = createError({
+        statusCode: 500,
+        message: "Missing NUXT_OAUTH_TWITCH_CLIENT_ID env variables."
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    const redirectUrl = getRequestURL(event).href;
+    if (!code) {
+      config.scope = config.scope || [];
+      if (config.emailRequired && !config.scope.includes("user:read:email")) {
+        config.scope.push("user:read:email");
+      }
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectUrl,
+          scope: config.scope.join("%20")
+        })
+      );
+    }
+    const tokens = await ofetch(
+      config.tokenURL,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        params: {
+          grant_type: "authorization_code",
+          redirect_uri: parsePath(redirectUrl).pathname,
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          code
+        }
+      }
+    ).catch((error) => {
+      return { error };
+    });
+    if (tokens.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Twitch login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
+        data: tokens
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    const accessToken = tokens.access_token;
+    const users = await ofetch("https://api.twitch.tv/helix/users", {
+      headers: {
+        "Client-ID": config.clientId,
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    const user = users.data?.[0];
+    if (!user) {
+      const error = createError({
+        statusCode: 500,
+        message: "Could not get Twitch user",
+        data: tokens
+      });
+      if (!onError)
+        throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/utils/oauth.d.ts

@@ -1,6 +1,12 @@
 import { githubEventHandler } from '../lib/oauth/github';
+import { googleEventHandler } from '../lib/oauth/google';
 import { spotifyEventHandler } from '../lib/oauth/spotify';
+import { twitchEventHandler } from '../lib/oauth/twitch';
+import { auth0EventHandler } from '../lib/oauth/auth0';
 export declare const oauth: {
     githubEventHandler: typeof githubEventHandler;
     spotifyEventHandler: typeof spotifyEventHandler;
+    googleEventHandler: typeof googleEventHandler;
+    twitchEventHandler: typeof twitchEventHandler;
+    auth0EventHandler: typeof auth0EventHandler;
 };

package/dist/runtime/server/utils/oauth.mjs

@@ -1,6 +1,12 @@
 import { githubEventHandler } from "../lib/oauth/github.mjs";
+import { googleEventHandler } from "../lib/oauth/google.mjs";
 import { spotifyEventHandler } from "../lib/oauth/spotify.mjs";
+import { twitchEventHandler } from "../lib/oauth/twitch.mjs";
+import { auth0EventHandler } from "../lib/oauth/auth0.mjs";
 export const oauth = {
   githubEventHandler,
-  spotifyEventHandler
+  spotifyEventHandler,
+  googleEventHandler,
+  twitchEventHandler,
+  auth0EventHandler
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Minimalist Auth module for Nuxt with SSR",
   "repository": "Atinux/nuxt-auth-utils",
   "license": "MIT",
@@ -32,6 +32,7 @@
   "dependencies": {
     "@nuxt/kit": "^3.8.1",
     "defu": "^6.1.3",
+    "ofetch": "^1.3.3",
     "ohash": "^1.1.3"
   },
   "devDependencies": {