nuxt-auth-utils 0.3.2 → 0.3.4

package/README.md

@@ -233,6 +233,8 @@ export default oauthGitHubEventHandler({
 
 Make sure to set the callback URL in your OAuth app settings as `<your-domain>/auth/github`.
 
+If the redirect URL mismatch in production, this means that the module cannot guess the right redirect URL. You can set the `NUXT_OAUTH_<PROVIDER>_REDIRECT_URL` env variable to overwrite the default one.
+
 ### Extend Session
 
 We leverage hooks to let you extend the session data with your own data or log when the user clears the session.
@@ -316,7 +318,7 @@ You can use the `placeholder` slot to show a placeholder on server-side and whil
 </template>
 ```
 
-If you are caching your routes with `routeRules`, please make sure to use [`nitro-nightly`](https://nitro.unjs.io/guide/nightly) or Nitro >= `2.10.0` to support the client-side fetching of the user session.
+If you are caching your routes with `routeRules`, please make sure to use [Nitro](https://github.com/unjs/nitro) >= `2.9.7` to support the client-side fetching of the user session.
 
 ## Configuration
 

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "builder": {
     "@nuxt/module-builder": "0.8.1",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -32,9 +32,10 @@ const module = defineNuxtModule({
       method: "get"
     });
     const runtimeConfig = nuxt.options.runtimeConfig;
+    const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
     runtimeConfig.session = defu(runtimeConfig.session, {
       name: "nuxt-session",
-      password: process.env.NUXT_SESSION_PASSWORD || "",
+      password: process.env[envSessionPassword] || "",
       cookie: {
         sameSite: "lax"
       }
@@ -43,10 +44,10 @@ const module = defineNuxtModule({
       runtimeConfig.session.password = randomUUID().replace(/-/g, "");
       const envPath = join(nuxt.options.rootDir, ".env");
       const envContent = await readFile(envPath, "utf-8").catch(() => "");
-      if (!envContent.includes("NUXT_SESSION_PASSWORD")) {
+      if (!envContent.includes(envSessionPassword)) {
         await writeFile(
           envPath,
-          `${envContent ? envContent + "\n" : envContent}NUXT_SESSION_PASSWORD=${runtimeConfig.session.password}`,
+          `${envContent ? envContent + "\n" : envContent}${envSessionPassword}=${runtimeConfig.session.password}`,
           "utf-8"
         );
       }
@@ -54,25 +55,30 @@ const module = defineNuxtModule({
     runtimeConfig.oauth = defu(runtimeConfig.oauth, {});
     runtimeConfig.oauth.github = defu(runtimeConfig.oauth.github, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.spotify = defu(runtimeConfig.oauth.spotify, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.google = defu(runtimeConfig.oauth.google, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.twitch = defu(runtimeConfig.oauth.twitch, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.auth0 = defu(runtimeConfig.oauth.auth0, {
       clientId: "",
       clientSecret: "",
       domain: "",
-      audience: ""
+      audience: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.microsoft = defu(runtimeConfig.oauth.microsoft, {
       clientId: "",
@@ -81,55 +87,67 @@ const module = defineNuxtModule({
       scope: [],
       authorizationURL: "",
       tokenURL: "",
-      userURL: ""
+      userURL: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.discord = defu(runtimeConfig.oauth.discord, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.battledotnet = defu(runtimeConfig.oauth.battledotnet, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.keycloak = defu(runtimeConfig.oauth.keycloak, {
       clientId: "",
       clientSecret: "",
       serverUrl: "",
-      realm: ""
+      realm: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.linkedin = defu(runtimeConfig.oauth.linkedin, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.cognito = defu(runtimeConfig.oauth.cognito, {
       clientId: "",
       clientSecret: "",
       region: "",
-      userPoolId: ""
+      userPoolId: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.facebook = defu(runtimeConfig.oauth.facebook, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.paypal = defu(runtimeConfig.oauth.paypal, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.steam = defu(runtimeConfig.oauth.steam, {
-      apiKey: ""
+      apiKey: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.x = defu(runtimeConfig.oauth.x, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.xsuaa = defu(runtimeConfig.oauth.xsuaa, {
       clientId: "",
       clientSecret: "",
-      domain: ""
+      domain: "",
+      redirectURL: ""
     });
     runtimeConfig.oauth.yandex = defu(runtimeConfig.oauth.yandex, {
       clientId: "",
-      clientSecret: ""
+      clientSecret: "",
+      redirectURL: ""
     });
   }
 });

package/dist/runtime/server/lib/oauth/auth0.d.ts

@@ -51,5 +51,10 @@ export interface OAuthAuth0Config {
      * @example { display: 'popup' }
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_AUTH0_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthAuth0EventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuth0Config>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/auth0.js

@@ -18,7 +18,7 @@ export function oauthAuth0EventHandler({ config, onSuccess, onError }) {
     }
     const authorizationURL = `https://${config.domain}/authorize`;
     const tokenURL = `https://${config.domain}/oauth/token`;
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || ["openid", "offline_access"];
       if (config.emailRequired && !config.scope.includes("email")) {
@@ -29,7 +29,7 @@ export function oauthAuth0EventHandler({ config, onSuccess, onError }) {
         withQuery(authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           audience: config.audience || "",
           max_age: config.maxAge || 0,
@@ -49,7 +49,7 @@ export function oauthAuth0EventHandler({ config, onSuccess, onError }) {
           grant_type: "authorization_code",
           client_id: config.clientId,
           client_secret: config.clientSecret,
-          redirect_uri: parsePath(redirectUrl).pathname,
+          redirect_uri: parsePath(redirectURL).pathname,
           code
         }
       }

package/dist/runtime/server/lib/oauth/battledotnet.d.ts

@@ -39,5 +39,10 @@ export interface OAuthBattledotnetConfig {
      * @see https://develop.battle.net/documentation/guides/using-oauth/authorization-code-flow
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_BATTLEDOTNET_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthBattledotnetEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBattledotnetConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/battledotnet.js

@@ -29,6 +29,7 @@ export function oauthBattledotnetEventHandler({ config, onSuccess, onError }) {
       if (!onError) throw error;
       return onError(event, error);
     }
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || ["openid"];
       config.region = config.region || "EU";
@@ -36,12 +37,11 @@ export function oauthBattledotnetEventHandler({ config, onSuccess, onError }) {
         config.authorizationURL = "https://oauth.battlenet.com.cn/authorize";
         config.tokenURL = "https://oauth.battlenet.com.cn/token";
       }
-      const redirectUrl2 = getRequestURL(event).href;
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {
           client_id: config.clientId,
-          redirect_uri: redirectUrl2,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           state: randomUUID(),
           // Todo: handle PKCE flow
@@ -50,7 +50,6 @@ export function oauthBattledotnetEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const redirectUrl = getRequestURL(event).href;
     config.scope = config.scope || [];
     if (!config.scope.includes("openid")) {
       config.scope.push("openid");
@@ -68,7 +67,7 @@ export function oauthBattledotnetEventHandler({ config, onSuccess, onError }) {
           code,
           grant_type: "authorization_code",
           scope: config.scope.join(" "),
-          redirect_uri: parsePath(redirectUrl).pathname
+          redirect_uri: parsePath(redirectURL).pathname
         }
       }
     ).catch((error) => {

package/dist/runtime/server/lib/oauth/cognito.d.ts

@@ -30,5 +30,10 @@ export interface OAuthCognitoConfig {
      * @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_COGNITO_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthCognitoEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthCognitoConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/cognito.js

@@ -18,14 +18,14 @@ export function oauthCognitoEventHandler({ config, onSuccess, onError }) {
     }
     const authorizationURL = `https://${config.userPoolId}.auth.${config.region}.amazoncognito.com/oauth2/authorize`;
     const tokenURL = `https://${config.userPoolId}.auth.${config.region}.amazoncognito.com/oauth2/token`;
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || ["openid", "profile"];
       return sendRedirect(
         event,
         withQuery(authorizationURL, {
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           response_type: "code",
           scope: config.scope.join(" "),
           ...config.authorizationParams
@@ -39,7 +39,7 @@ export function oauthCognitoEventHandler({ config, onSuccess, onError }) {
         headers: {
           "Content-Type": "application/x-www-form-urlencoded"
         },
-        body: `grant_type=authorization_code&client_id=${config.clientId}&client_secret=${config.clientSecret}&redirect_uri=${parsePath(redirectUrl).pathname}&code=${code}`
+        body: `grant_type=authorization_code&client_id=${config.clientId}&client_secret=${config.clientSecret}&redirect_uri=${parsePath(redirectURL).pathname}&code=${code}`
       }
     ).catch((error) => {
       return { error };

package/dist/runtime/server/lib/oauth/discord.d.ts

@@ -44,5 +44,10 @@ export interface OAuthDiscordConfig {
      * @example { allow_signup: 'true' }
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_DISCORD_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthDiscordEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDiscordConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/discord.js

@@ -19,7 +19,7 @@ export function oauthDiscordEventHandler({ config, onSuccess, onError }) {
       if (!onError) throw error;
       return onError(event, error);
     }
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("email")) {
@@ -33,13 +33,13 @@ export function oauthDiscordEventHandler({ config, onSuccess, onError }) {
         withQuery(config.authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           ...config.authorizationParams
         })
       );
     }
-    const parsedRedirectUrl = parseURL(redirectUrl);
+    const parsedRedirectUrl = parseURL(redirectURL);
     parsedRedirectUrl.search = "";
     const tokens = await $fetch(
       config.tokenURL,

package/dist/runtime/server/lib/oauth/facebook.d.ts

@@ -39,5 +39,10 @@ export interface OAuthFacebookConfig {
      * @see https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_FACEBOOK_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthFacebookEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthFacebookConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/facebook.js

@@ -37,14 +37,14 @@ export function oauthFacebookEventHandler({
       if (!onError) throw error;
       return onError(event, error);
     }
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!query.code) {
       config.scope = config.scope || [];
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" ")
         })
       );
@@ -54,7 +54,7 @@ export function oauthFacebookEventHandler({
       body: {
         client_id: config.clientId,
         client_secret: config.clientSecret,
-        redirect_uri: redirectUrl,
+        redirect_uri: redirectURL,
         code: query.code
       }
     });

package/dist/runtime/server/lib/oauth/github.d.ts

@@ -38,5 +38,11 @@ export interface OAuthGitHubConfig {
      * @example { allow_signup: 'true' }
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_GITHUB_REDIRECT_URL
+     * @see https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps
+     */
+    redirectURL?: string;
 }
 export declare function oauthGitHubEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthGitHubConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/github.js

@@ -32,12 +32,12 @@ export function oauthGitHubEventHandler({ config, onSuccess, onError }) {
       if (config.emailRequired && !config.scope.includes("user:email")) {
         config.scope.push("user:email");
       }
-      const redirectUrl = getRequestURL(event).href;
+      const redirectURL = config.redirectURL || getRequestURL(event).href;
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           ...config.authorizationParams
         })

package/dist/runtime/server/lib/oauth/google.d.ts

@@ -38,5 +38,10 @@ export interface OAuthGoogleConfig {
      * @example { access_type: 'offline' }
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_GOOGLE_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthGoogleEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGoogleConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/google.js

@@ -29,7 +29,7 @@ export function oauthGoogleEventHandler({
       if (!onError) throw error;
       return onError(event, error);
     }
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || ["email", "profile"];
       return sendRedirect(
@@ -37,7 +37,7 @@ export function oauthGoogleEventHandler({
         withQuery(config.authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           ...config.authorizationParams
         })
@@ -45,7 +45,7 @@ export function oauthGoogleEventHandler({
     }
     const body = {
       grant_type: "authorization_code",
-      redirect_uri: parsePath(redirectUrl).pathname,
+      redirect_uri: parsePath(redirectURL).pathname,
       client_id: config.clientId,
       client_secret: config.clientSecret,
       code

package/dist/runtime/server/lib/oauth/keycloak.d.ts

@@ -32,5 +32,10 @@ export interface OAuthKeycloakConfig {
      * Extra authorization parameters to provide to the authorization URL
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_KEYCLOAK_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthKeycloakEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthKeycloakConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/keycloak.js

@@ -39,14 +39,14 @@ export function oauthKeycloakEventHandler({
     const realmURL = `${config.serverUrl}/realms/${config.realm}`;
     const authorizationURL = `${realmURL}/protocol/openid-connect/auth`;
     const tokenURL = `${realmURL}/protocol/openid-connect/token`;
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || ["openid"];
       return sendRedirect(
         event,
         withQuery(authorizationURL, {
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           response_type: "code",
           ...config.authorizationParams
@@ -66,7 +66,7 @@ export function oauthKeycloakEventHandler({
         client_id: config.clientId,
         client_secret: config.clientSecret,
         grant_type: "authorization_code",
-        redirect_uri: parsePath(redirectUrl).pathname,
+        redirect_uri: parsePath(redirectURL).pathname,
         code
       }).toString()
     }).catch((error) => {

package/dist/runtime/server/lib/oauth/linkedin.d.ts

@@ -36,6 +36,11 @@ export interface OAuthLinkedInConfig {
      * @see https://docs.microsoft.com/en-us/linkedin/shared/authentication/authorization-code-flow?context=linkedin/context
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_LINKEDIN_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 interface OAuthConfig {
     config?: OAuthLinkedInConfig;

package/dist/runtime/server/lib/oauth/linkedin.js

@@ -18,7 +18,7 @@ export function oauthLinkedInEventHandler({ config, onSuccess, onError }) {
       if (!onError) throw error;
       return onError(event, error);
     }
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || [];
       if (!config.scope.length) {
@@ -32,13 +32,13 @@ export function oauthLinkedInEventHandler({ config, onSuccess, onError }) {
         withQuery(config.authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           ...config.authorizationParams
         })
       );
     }
-    const parsedRedirectUrl = parseURL(redirectUrl);
+    const parsedRedirectUrl = parseURL(redirectURL);
     parsedRedirectUrl.search = "";
     const tokens = await $fetch(
       config.tokenURL,

package/dist/runtime/server/lib/oauth/microsoft.d.ts

@@ -49,7 +49,7 @@ export interface OAuthMicrosoftConfig {
      * @default process.env.NUXT_OAUTH_MICROSOFT_REDIRECT_URL
      * @see https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow
      */
-    redirectUrl?: string;
+    redirectURL?: string;
 }
 interface OAuthConfig {
     config?: OAuthMicrosoftConfig;

package/dist/runtime/server/lib/oauth/microsoft.js

@@ -18,7 +18,7 @@ export function oauthMicrosoftEventHandler({ config, onSuccess, onError }) {
     }
     const authorizationURL = config.authorizationURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/authorize`;
     const tokenURL = config.tokenURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/token`;
-    const redirectUrl = config.redirectUrl || getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       const scope = config.scope && config.scope.length > 0 ? config.scope : ["User.Read"];
       return sendRedirect(
@@ -26,7 +26,7 @@ export function oauthMicrosoftEventHandler({ config, onSuccess, onError }) {
         withQuery(authorizationURL, {
           client_id: config.clientId,
           response_type: "code",
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: scope.join(" "),
           ...config.authorizationParams
         })
@@ -36,7 +36,7 @@ export function oauthMicrosoftEventHandler({ config, onSuccess, onError }) {
     data.append("grant_type", "authorization_code");
     data.append("client_id", config.clientId);
     data.append("client_secret", config.clientSecret);
-    data.append("redirect_uri", parsePath(redirectUrl).pathname);
+    data.append("redirect_uri", parsePath(redirectURL).pathname);
     data.append("code", String(code));
     const tokens = await $fetch(
       tokenURL,

package/dist/runtime/server/lib/oauth/paypal.d.ts

@@ -43,5 +43,10 @@ export interface OAuthPaypalConfig {
      * @example { flowEntry: 'static' }
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_PAYPAL_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthPaypalEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPaypalConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/paypal.js

@@ -25,7 +25,7 @@ export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
       config.authorizationURL = "https://www.sandbox.paypal.com/signin/authorize";
       config.tokenURL = `https://${paypalAPI}/v1/oauth2/token`;
     }
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("openid")) {
@@ -39,7 +39,7 @@ export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
         withQuery(config.authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           flowEntry: "static",
           ...config.authorizationParams
@@ -57,7 +57,7 @@ export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
         },
         params: {
           grant_type: "authorization_code",
-          redirect_uri: encodeURIComponent(parsePath(redirectUrl).pathname),
+          redirect_uri: encodeURIComponent(parsePath(redirectURL).pathname),
           code
         }
       }

package/dist/runtime/server/lib/oauth/spotify.d.ts

@@ -38,5 +38,10 @@ export interface OAuthSpotifyConfig {
      * @example { show_dialog: 'true' }
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_SPOTIFY_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthSpotifyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSpotifyConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/spotify.js

@@ -18,7 +18,7 @@ export function oauthSpotifyEventHandler({ config, onSuccess, onError }) {
       if (!onError) throw error;
       return onError(event, error);
     }
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user-read-email")) {
@@ -29,7 +29,7 @@ export function oauthSpotifyEventHandler({ config, onSuccess, onError }) {
         withQuery(config.authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           ...config.authorizationParams
         })
@@ -46,7 +46,7 @@ export function oauthSpotifyEventHandler({ config, onSuccess, onError }) {
         },
         params: {
           grant_type: "authorization_code",
-          redirect_uri: parsePath(redirectUrl).pathname,
+          redirect_uri: parsePath(redirectURL).pathname,
           code
         }
       }

package/dist/runtime/server/lib/oauth/steam.d.ts

@@ -11,5 +11,10 @@ export interface OAuthSteamConfig {
      * @default 'https://steamcommunity.com/openid/login'
      */
     authorizationURL?: string;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_STEAM_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthSteamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSteamConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/steam.js

@@ -17,11 +17,11 @@ export function oauthSteamEventHandler({ config, onSuccess, onError }) {
       return onError(event, error);
     }
     if (!query["openid.claimed_id"]) {
-      const redirectUrl = getRequestURL(event).href;
+      const redirectURL = config.redirectURL || getRequestURL(event).href;
       const steamOpenIdParams = {
         "openid.ns": "http://specs.openid.net/auth/2.0",
         "openid.mode": "checkid_setup",
-        "openid.return_to": redirectUrl,
+        "openid.return_to": redirectURL,
         "openid.identity": "http://specs.openid.net/auth/2.0/identifier_select",
         "openid.claimed_id": "http://specs.openid.net/auth/2.0/identifier_select"
       };

package/dist/runtime/server/lib/oauth/twitch.d.ts

@@ -38,5 +38,10 @@ export interface OAuthTwitchConfig {
      * @example { force_verify: 'true' }
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_TWITCH_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/twitch.js

@@ -18,7 +18,7 @@ export function oauthTwitchEventHandler({ config, onSuccess, onError }) {
       if (!onError) throw error;
       return onError(event, error);
     }
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user:read:email")) {
@@ -29,7 +29,7 @@ export function oauthTwitchEventHandler({ config, onSuccess, onError }) {
         withQuery(config.authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           ...config.authorizationParams
         })
@@ -44,7 +44,7 @@ export function oauthTwitchEventHandler({ config, onSuccess, onError }) {
         },
         params: {
           grant_type: "authorization_code",
-          redirect_uri: parsePath(redirectUrl).pathname,
+          redirect_uri: parsePath(redirectURL).pathname,
           client_id: config.clientId,
           client_secret: config.clientSecret,
           code

package/dist/runtime/server/lib/oauth/x.d.ts

@@ -42,5 +42,10 @@ export interface OAuthXConfig {
      * @see https://developer.x.com/en/docs/authentication/oauth-2-0/user-access-token
      */
     authorizationParams: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_X_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthXEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthXConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/x.js

@@ -33,7 +33,7 @@ export function oauthXEventHandler({
       if (!onError) throw error;
       return onError(event, error);
     }
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || ["tweet.read", "users.read", "offline.access"];
       return sendRedirect(
@@ -42,7 +42,7 @@ export function oauthXEventHandler({
           response_type: "code",
           client_id: config.clientId,
           code_challenge_method: "plain",
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           ...config.authorizationParams
         })
@@ -51,7 +51,7 @@ export function oauthXEventHandler({
     const params = {
       grant_type: "authorization_code",
       code_verifier: config.authorizationParams.code_challenge,
-      redirect_uri: parsePath(redirectUrl).pathname,
+      redirect_uri: parsePath(redirectURL).pathname,
       code
     };
     const authCode = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");

package/dist/runtime/server/lib/oauth/xsuaa.d.ts

@@ -22,5 +22,10 @@ export interface OAuthXSUAAConfig {
      * @example ['openid']
      */
     scope?: string[];
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_XSUAA_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthXSUAAEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthXSUAAConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/xsuaa.js

@@ -16,7 +16,7 @@ export function oauthXSUAAEventHandler({ config, onSuccess, onError }) {
     }
     const authorizationURL = `https://${config.domain}/oauth/authorize`;
     const tokenURL = `https://${config.domain}/oauth/token`;
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || [];
       return sendRedirect(
@@ -24,7 +24,7 @@ export function oauthXSUAAEventHandler({ config, onSuccess, onError }) {
         withQuery(authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" ")
         })
       );
@@ -40,7 +40,7 @@ export function oauthXSUAAEventHandler({ config, onSuccess, onError }) {
           grant_type: "authorization_code",
           client_id: config.clientId,
           client_secret: config.clientSecret,
-          redirect_uri: parsePath(redirectUrl).pathname,
+          redirect_uri: parsePath(redirectURL).pathname,
           code: `${code}`
         })
       }

package/dist/runtime/server/lib/oauth/yandex.d.ts

@@ -37,5 +37,10 @@ export interface OAuthYandexConfig {
      * @default 'https://login.yandex.ru/info'
      */
     userURL?: string;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_YANDEX_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
 }
 export declare function oauthYandexEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthYandexConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/yandex.js

@@ -28,7 +28,7 @@ export function oauthYandexEventHandler({
       if (!onError) throw error;
       return onError(event, error);
     }
-    const redirectUrl = getRequestURL(event).href;
+    const redirectURL = config.redirectURL || getRequestURL(event).href;
     if (!code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("login:email")) {
@@ -39,7 +39,7 @@ export function oauthYandexEventHandler({
         withQuery(config.authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          redirect_uri: redirectUrl,
+          redirect_uri: redirectURL,
           scope: config.scope.join(" ")
         })
       );
@@ -53,7 +53,7 @@ export function oauthYandexEventHandler({
         client_id: config.clientId,
         client_secret: config.clientSecret,
         grant_type: "authorization_code",
-        redirect_uri: stringifyParsedURL(parseURL(redirectUrl)),
+        redirect_uri: stringifyParsedURL(parseURL(redirectURL)),
         code
       }).toString()
     }).catch((error) => {

package/dist/runtime/server/utils/session.js

@@ -36,7 +36,9 @@ export async function requireUserSession(event, opts = {}) {
 let sessionConfig;
 function _useSession(event) {
   if (!sessionConfig) {
-    sessionConfig = defu({ password: process.env.NUXT_SESSION_PASSWORD }, useRuntimeConfig(event).session);
+    const runtimeConfig = useRuntimeConfig(event);
+    const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
+    sessionConfig = defu({ password: process.env[envSessionPassword] }, runtimeConfig.session);
   }
   return useSession(event, sessionConfig);
 }

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Minimalist Auth module for Nuxt with SSR",
   "repository": "Atinux/nuxt-auth-utils",
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.1.3",
+  "packageManager": "pnpm@9.7.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.ts",
@@ -41,20 +41,19 @@
     "uncrypto": "^0.1.3"
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.1.111",
+    "@iconify-json/simple-icons": "^1.1.113",
     "@nuxt/devtools": "latest",
-    "@nuxt/eslint-config": "^0.4.0",
+    "@nuxt/eslint-config": "^0.5.0",
     "@nuxt/module-builder": "^0.8.1",
     "@nuxt/schema": "^3.12.4",
     "@nuxt/test-utils": "^3.14.0",
-    "@nuxt/ui": "^2.18.2",
-    "@nuxt/ui-pro": "^1.3.1",
-    "@types/node": "^22.0.0",
+    "@nuxt/ui": "^2.18.4",
+    "@nuxt/ui-pro": "^1.4.1",
     "changelogen": "^0.5.5",
-    "eslint": "^9.8.0",
+    "eslint": "^9.9.0",
     "nuxt": "^3.12.4",
     "typescript": "^5.5.4",
-    "vitest": "^2.0.4",
+    "vitest": "^2.0.5",
     "vue-tsc": "^2.0.29"
   }
-}
+}