nuxt-auth-utils 0.3.4 → 0.3.6

package/dist/runtime/server/lib/oauth/keycloak.js

@@ -1,13 +1,8 @@
-import {
-  eventHandler,
-  createError,
-  getQuery,
-  getRequestURL,
-  sendRedirect
-} from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { useRuntimeConfig } from "#imports";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
 export function oauthKeycloakEventHandler({
   config,
   onSuccess,
@@ -18,7 +13,6 @@ export function oauthKeycloakEventHandler({
       authorizationParams: {}
     });
     const query = getQuery(event);
-    const { code } = query;
     if (query.error) {
       const error = createError({
         statusCode: 401,
@@ -29,18 +23,13 @@ export function oauthKeycloakEventHandler({
       return onError(event, error);
     }
     if (!config.clientId || !config.clientSecret || !config.serverUrl || !config.realm) {
-      const error = createError({
-        statusCode: 500,
-        message: "Missing NUXT_OAUTH_KEYCLOAK_CLIENT_ID or NUXT_OAUTH_KEYCLOAK_CLIENT_SECRET or NUXT_OAUTH_KEYCLOAK_SERVER_URL or NUXT_OAUTH_KEYCLOAK_REALM env variables."
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleMissingConfiguration(event, "keycloak", ["clientId", "clientSecret", "serverUrl", "realm"], onError);
     }
     const realmURL = `${config.serverUrl}/realms/${config.realm}`;
     const authorizationURL = `${realmURL}/protocol/openid-connect/auth`;
     const tokenURL = `${realmURL}/protocol/openid-connect/token`;
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || ["openid"];
       return sendRedirect(
         event,
@@ -57,29 +46,17 @@ export function oauthKeycloakEventHandler({
     if (!config.scope.includes("openid")) {
       config.scope.push("openid");
     }
-    const tokens = await $fetch(tokenURL, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
+    const tokens = await requestAccessToken(tokenURL, {
+      body: {
+        grant_type: "authorization_code",
         client_id: config.clientId,
         client_secret: config.clientSecret,
-        grant_type: "authorization_code",
-        redirect_uri: parsePath(redirectURL).pathname,
-        code
-      }).toString()
-    }).catch((error) => {
-      return { error };
+        redirect_uri: redirectURL,
+        code: query.code
+      }
     });
     if (tokens.error) {
-      const error = createError({
-        statusCode: 401,
-        message: `Keycloak login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
-        data: tokens
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleAccessTokenErrorResponse(event, "keycloak", tokens, onError);
     }
     const accessToken = tokens.access_token;
     const user = await $fetch(

package/dist/runtime/server/lib/oauth/linkedin.d.ts

@@ -1,4 +1,4 @@
-import type { H3Event, H3Error } from 'h3';
+import type { OAuthConfig } from '#auth-utils';
 export interface OAuthLinkedInConfig {
     /**
      * LinkedIn OAuth Client ID
@@ -42,13 +42,4 @@ export interface OAuthLinkedInConfig {
      */
     redirectURL?: string;
 }
-interface OAuthConfig {
-    config?: OAuthLinkedInConfig;
-    onSuccess: (event: H3Event, result: {
-        user: any;
-        tokens: any;
-    }) => Promise<void> | void;
-    onError?: (event: H3Event, error: H3Error) => Promise<void> | void;
-}
-export declare function oauthLinkedInEventHandler({ config, onSuccess, onError }: OAuthConfig): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
-export {};
+export declare function oauthLinkedInEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinkedInConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/linkedin.js

@@ -1,6 +1,7 @@
-import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parseURL, stringifyParsedURL } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthLinkedInEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -9,17 +10,12 @@ export function oauthLinkedInEventHandler({ config, onSuccess, onError }) {
       tokenURL: "https://www.linkedin.com/oauth/v2/accessToken",
       authorizationParams: {}
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId || !config.clientSecret) {
-      const error = createError({
-        statusCode: 500,
-        message: "Missing NUXT_OAUTH_LINKEDIN_CLIENT_ID or NUXT_OAUTH_LINKEDIN_CLIENT_SECRET env variables."
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleMissingConfiguration(event, "linkedin", ["clientId", "clientSecret"], onError);
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.length) {
         config.scope.push("profile", "openid", "email");
@@ -38,34 +34,17 @@ export function oauthLinkedInEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const parsedRedirectUrl = parseURL(redirectURL);
-    parsedRedirectUrl.search = "";
-    const tokens = await $fetch(
-      config.tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: new URLSearchParams({
-          grant_type: "authorization_code",
-          code,
-          client_id: config.clientId,
-          client_secret: config.clientSecret,
-          redirect_uri: stringifyParsedURL(parsedRedirectUrl)
-        }).toString()
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        code: query.code,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
-      const error = createError({
-        statusCode: 401,
-        message: `LinkedIn login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
-        data: tokens
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleAccessTokenErrorResponse(event, "linkedin", tokens, onError);
     }
     const accessToken = tokens.access_token;
     const user = await $fetch("https://api.linkedin.com/v2/userinfo", {

package/dist/runtime/server/lib/oauth/microsoft.d.ts

@@ -1,4 +1,4 @@
-import type { H3Event, H3Error } from 'h3';
+import type { OAuthConfig } from '#auth-utils';
 export interface OAuthMicrosoftConfig {
     /**
      * Microsoft OAuth Client ID
@@ -51,13 +51,4 @@ export interface OAuthMicrosoftConfig {
      */
     redirectURL?: string;
 }
-interface OAuthConfig {
-    config?: OAuthMicrosoftConfig;
-    onSuccess: (event: H3Event, result: {
-        user: any;
-        tokens: any;
-    }) => Promise<void> | void;
-    onError?: (event: H3Event, error: H3Error) => Promise<void> | void;
-}
-export declare function oauthMicrosoftEventHandler({ config, onSuccess, onError }: OAuthConfig): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
-export {};
+export declare function oauthMicrosoftEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthMicrosoftConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/microsoft.js

@@ -1,25 +1,21 @@
-import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { useRuntimeConfig } from "#imports";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
 export function oauthMicrosoftEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.microsoft, {
       authorizationParams: {}
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId || !config.clientSecret || !config.tenant) {
-      const error = createError({
-        statusCode: 500,
-        message: "Missing NUXT_OAUTH_MICROSOFT_CLIENT_ID or NUXT_OAUTH_MICROSOFT_CLIENT_SECRET or NUXT_OAUTH_MICROSOFT_TENANT env variables."
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleMissingConfiguration(event, "microsoft", ["clientId", "clientSecret", "tenant"], onError);
     }
     const authorizationURL = config.authorizationURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/authorize`;
     const tokenURL = config.tokenURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/token`;
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       const scope = config.scope && config.scope.length > 0 ? config.scope : ["User.Read"];
       return sendRedirect(
         event,
@@ -32,32 +28,17 @@ export function oauthMicrosoftEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const data = new URLSearchParams();
-    data.append("grant_type", "authorization_code");
-    data.append("client_id", config.clientId);
-    data.append("client_secret", config.clientSecret);
-    data.append("redirect_uri", parsePath(redirectURL).pathname);
-    data.append("code", String(code));
-    const tokens = await $fetch(
-      tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: data
+    const tokens = await requestAccessToken(tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        code: query.code,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
-      const error = createError({
-        statusCode: 401,
-        message: `Microsoft login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
-        data: tokens
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleAccessTokenErrorResponse(event, "microsoft", tokens, onError);
     }
     const tokenType = tokens.token_type;
     const accessToken = tokens.access_token;

package/dist/runtime/server/lib/oauth/paypal.js

@@ -1,7 +1,8 @@
-import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { useRuntimeConfig } from "#imports";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
 export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.paypal, {
@@ -10,14 +11,9 @@ export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
       tokenURL: "https://api-m.paypal.com/v1/oauth2/token",
       authorizationParams: {}
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId) {
-      const error = createError({
-        statusCode: 500,
-        message: "Missing NUXT_OAUTH_PAYPAL_CLIENT_ID env variables."
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleMissingConfiguration(event, "paypal", ["clientId"], onError);
     }
     let paypalAPI = "api-m.paypal.com";
     if (config.sandbox) {
@@ -25,8 +21,8 @@ export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
       config.authorizationURL = "https://www.sandbox.paypal.com/signin/authorize";
       config.tokenURL = `https://${paypalAPI}/v1/oauth2/token`;
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("openid")) {
         config.scope.push("openid");
@@ -46,32 +42,18 @@ export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const authCode = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
-    const tokens = await $fetch(
-      config.tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Authorization": `Basic ${authCode}`,
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        params: {
-          grant_type: "authorization_code",
-          redirect_uri: encodeURIComponent(parsePath(redirectURL).pathname),
-          code
-        }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`
+      },
+      params: {
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
-      const error = createError({
-        statusCode: 401,
-        message: `PayPal login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
-        data: tokens
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleAccessTokenErrorResponse(event, "paypal", tokens, onError);
     }
     const accessToken = tokens.access_token;
     const users = await $fetch(`https://${paypalAPI}/v1/identity/openidconnect/userinfo`, {

package/dist/runtime/server/lib/oauth/spotify.js

@@ -1,6 +1,7 @@
-import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthSpotifyEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -9,17 +10,12 @@ export function oauthSpotifyEventHandler({ config, onSuccess, onError }) {
       tokenURL: "https://accounts.spotify.com/api/token",
       authorizationParams: {}
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId || !config.clientSecret) {
-      const error = createError({
-        statusCode: 500,
-        message: "Missing NUXT_OAUTH_SPOTIFY_CLIENT_ID or NUXT_OAUTH_SPOTIFY_CLIENT_SECRET env variables."
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleMissingConfiguration(event, "spotify", ["clientId", "clientSecret"], onError);
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user-read-email")) {
         config.scope.push("user-read-email");
@@ -35,32 +31,19 @@ export function oauthSpotifyEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const authCode = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
-    const tokens = await $fetch(
-      config.tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Authorization": `Basic ${authCode}`,
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        params: {
-          grant_type: "authorization_code",
-          redirect_uri: parsePath(redirectURL).pathname,
-          code
-        }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`
+      },
+      body: {
+        client_id: config.clientId,
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
-      const error = createError({
-        statusCode: 401,
-        message: `Spotify login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
-        data: tokens
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleAccessTokenErrorResponse(event, "spotify", tokens, onError);
     }
     const accessToken = tokens.access_token;
     const user = await $fetch("https://api.spotify.com/v1/me", {

package/dist/runtime/server/lib/oauth/steam.js

@@ -1,6 +1,7 @@
 import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
+import { handleMissingConfiguration } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthSteamEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -9,12 +10,7 @@ export function oauthSteamEventHandler({ config, onSuccess, onError }) {
     });
     const query = getQuery(event);
     if (!config.apiKey) {
-      const error = createError({
-        statusCode: 500,
-        message: "Missing NUXT_OAUTH_STEAM_API_KEY env variable."
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleMissingConfiguration(event, "steam", ["apiKey"], onError);
     }
     if (!query["openid.claimed_id"]) {
       const redirectURL = config.redirectURL || getRequestURL(event).href;

package/dist/runtime/server/lib/oauth/tiktok.d.ts

@@ -0,0 +1,45 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthTikTokConfig {
+    /**
+     * TikTok Client Key
+     * @default process.env.NUXT_OAUTH_TIKTOK_CLIENT_KEY
+     */
+    clientKey?: string;
+    /**
+     * TikTok OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_TIKTOK_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * TikTok OAuth Scope
+     * @default []
+     * @see https://developers.tiktok.com/doc/tiktok-api-scopes/
+     * @example ['user.info.basic']
+     */
+    scope?: string[];
+    /**
+     * Use TikTok sandbox environment.
+     * If true it will use Login Kit for Desktop, if false it will use Login Kit for Web.
+     * This is because Login Kit for Web doesn't support localhost or IP addresses as redirect URIs.
+     * @see https://developers.tiktok.com/doc/login-kit-web/
+     * @see https://developers.tiktok.com/doc/login-kit-desktop/
+     * @default import.meta.dev // true in development, false in production
+     */
+    sandbox?: boolean;
+    /**
+     * TikTok OAuth Authorization URL
+     * @default 'https://www.tiktok.com/v2/auth/authorize/'
+     */
+    authorizationURL?: string;
+    /**
+     * TikTok OAuth Token URL
+     * @default 'https://open.tiktokapis.com/v2/oauth/token/'
+     */
+    tokenURL?: string;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_TIKTOK_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function oauthTikTokEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTikTokConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/tiktok.js

@@ -0,0 +1,84 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { sha256 } from "ohash";
+import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function oauthTikTokEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.tiktok, {
+      sandbox: import.meta.dev,
+      authorizationURL: "https://www.tiktok.com/v2/auth/authorize/",
+      tokenURL: "https://open.tiktokapis.com/v2/oauth/token/"
+    });
+    const query = getQuery(event);
+    if (!config.clientKey || !config.clientSecret) {
+      return handleMissingConfiguration(event, "tiktok", ["clientKey", "clientSecret"], onError);
+    }
+    const codeVerifier = "verify";
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (!config.scope.includes("user.info.basic")) {
+        config.scope.push("user.info.basic");
+      }
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_key: config.clientKey,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(","),
+          ...config.sandbox ? {
+            code_verifier: codeVerifier,
+            code_challenge: sha256(codeVerifier),
+            code_challenge_method: "S256"
+          } : {}
+        })
+      );
+    }
+    const tokens = await requestAccessToken(
+      config.tokenURL,
+      {
+        body: {
+          grant_type: "authorization_code",
+          redirect_uri: redirectURL,
+          client_key: config.clientKey,
+          client_secret: config.clientSecret,
+          code: query.code,
+          ...config.sandbox ? { code_verifier: codeVerifier } : {}
+        }
+      }
+    );
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "tiktok", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const userInfoFieldsByScope = {
+      "user.info.basic": ["open_id", "union_id", "avatar_url", "avatar_url_100", "avatar_large_url", "display_name"],
+      "user.info.profile": ["bio_description", "profile_deep_link", "is_verified", "username"],
+      "user.info.stats": ["follower_count", "following_count", "likes_count", "video_count"]
+    };
+    const userInfo = await $fetch(withQuery("https://open.tiktokapis.com/v2/user/info/", {
+      fields: config.scope?.map((scope) => userInfoFieldsByScope[scope]).flat().join(",")
+    }), {
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    const user = userInfo?.data?.user;
+    if (!user) {
+      const error = createError({
+        statusCode: 500,
+        message: "Could not get TikTok user",
+        data: tokens
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/twitch.js

@@ -1,7 +1,8 @@
-import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { useRuntimeConfig } from "#imports";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
 export function oauthTwitchEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.twitch, {
@@ -9,17 +10,12 @@ export function oauthTwitchEventHandler({ config, onSuccess, onError }) {
       tokenURL: "https://id.twitch.tv/oauth2/token",
       authorizationParams: {}
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId) {
-      const error = createError({
-        statusCode: 500,
-        message: "Missing NUXT_OAUTH_TWITCH_CLIENT_ID env variables."
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleMissingConfiguration(event, "twitch", ["clientId"], onError);
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user:read:email")) {
         config.scope.push("user:read:email");
@@ -35,32 +31,17 @@ export function oauthTwitchEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const tokens = await $fetch(
-      config.tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        params: {
-          grant_type: "authorization_code",
-          redirect_uri: parsePath(redirectURL).pathname,
-          client_id: config.clientId,
-          client_secret: config.clientSecret,
-          code
-        }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code: query.code
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
-      const error = createError({
-        statusCode: 401,
-        message: `Twitch login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
-        data: tokens
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleAccessTokenErrorResponse(event, "twitch", tokens, onError);
     }
     const accessToken = tokens.access_token;
     const users = await $fetch("https://api.twitch.tv/helix/users", {