nuxt-auth-utils 0.3.4 → 0.3.6

package/dist/runtime/server/lib/oauth/x.d.ts

@@ -17,11 +17,6 @@ export interface OAuthXConfig {
      * @example ['tweet.read', 'users.read', 'offline.access'],
      */
     scope?: string[];
-    /**
-     * Require email from user
-     * @default false
-     */
-    emailRequired?: boolean;
     /**
      * X OAuth Authorization URL
      * @default 'https://twitter.com/i/oauth2/authorize'
@@ -41,7 +36,7 @@ export interface OAuthXConfig {
      * Extra authorization parameters to provide to the authorization URL
      * @see https://developer.x.com/en/docs/authentication/oauth-2-0/user-access-token
      */
-    authorizationParams: Record<string, string>;
+    authorizationParams?: Record<string, string>;
     /**
      * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
      * @default process.env.NUXT_OAUTH_X_REDIRECT_URL or current URL

package/dist/runtime/server/lib/oauth/x.js

@@ -1,13 +1,12 @@
-import { randomUUID } from "node:crypto";
 import {
   eventHandler,
-  createError,
   getQuery,
-  getRequestURL,
   sendRedirect
 } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { withQuery } from "ufo";
 import { defu } from "defu";
+import { randomUUID } from "uncrypto";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthXEventHandler({
   config,
@@ -16,25 +15,20 @@ export function oauthXEventHandler({
 }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.x, {
-      authorizationURL: "https://twitter.com/i/oauth2/authorize",
-      tokenURL: "https://api.twitter.com/2/oauth2/token",
-      userURL: "https://api.twitter.com/2/users/me",
+      authorizationURL: "https://x.com/i/oauth2/authorize",
+      tokenURL: "https://api.x.com/2/oauth2/token",
+      userURL: "https://api.x.com/2/users/me",
       authorizationParams: {
         state: randomUUID(),
         code_challenge: randomUUID()
       }
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId) {
-      const error = createError({
-        statusCode: 500,
-        message: "Missing NUXT_OAUTH_X_CLIENT_ID env variables."
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleMissingConfiguration(event, "x", ["clientId"], onError);
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || ["tweet.read", "users.read", "offline.access"];
       return sendRedirect(
         event,
@@ -48,31 +42,19 @@ export function oauthXEventHandler({
         })
       );
     }
-    const params = {
-      grant_type: "authorization_code",
-      code_verifier: config.authorizationParams.code_challenge,
-      redirect_uri: parsePath(redirectURL).pathname,
-      code
-    };
-    const authCode = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
-    const tokens = await $fetch(config.tokenURL, {
-      method: "POST",
+    const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        "Authorization": `Basic ${authCode}`
+        Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`
       },
-      params
-    }).catch((error) => {
-      return { error };
+      params: {
+        grant_type: "authorization_code",
+        code_verifier: config.authorizationParams?.code_challenge,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
     });
     if (tokens.error) {
-      const error = createError({
-        statusCode: 401,
-        message: `X login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
-        data: tokens
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleAccessTokenErrorResponse(event, "x", tokens, onError);
     }
     const accessToken = tokens.access_token;
     const user = await $fetch(
@@ -88,29 +70,6 @@ export function oauthXEventHandler({
     ).catch((error) => {
       return error;
     });
-    if (config.emailRequired) {
-      const emailData = await $fetch("https://api.twitter.com/1.1/account/verify_credentials.json", {
-        headers: {
-          Authorization: `Bearer ${accessToken}`
-        },
-        query: {
-          include_email: "true",
-          skip_status: "true"
-        }
-      }).catch((error) => {
-        return error;
-      });
-      if (emailData && emailData.email) {
-        user.email = emailData.email;
-      } else {
-        const error = createError({
-          statusCode: 401,
-          message: "Twitter login failed: no user email found"
-        });
-        if (!onError) throw error;
-        return onError(event, error);
-      }
-    }
     return onSuccess(event, {
       tokens,
       user: user?.data

package/dist/runtime/server/lib/oauth/xsuaa.js

@@ -1,23 +1,19 @@
-import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthXSUAAEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.xsuaa);
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId || !config.clientSecret || !config.domain) {
-      const error = createError({
-        statusCode: 500,
-        message: "Missing NUXT_OAUTH_XSUAA_CLIENT_ID or NUXT_OAUTH_XSUAA_CLIENT_SECRET or NUXT_OAUTH_XSUAA_DOMAIN env variables."
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleMissingConfiguration(event, "xsuaa", ["clientId", "clientSecret", "domain"], onError);
     }
     const authorizationURL = `https://${config.domain}/oauth/authorize`;
     const tokenURL = `https://${config.domain}/oauth/token`;
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       return sendRedirect(
         event,
@@ -29,32 +25,17 @@ export function oauthXSUAAEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const tokens = await $fetch(
-      tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: new URLSearchParams({
-          grant_type: "authorization_code",
-          client_id: config.clientId,
-          client_secret: config.clientSecret,
-          redirect_uri: parsePath(redirectURL).pathname,
-          code: `${code}`
-        })
+    const tokens = await requestAccessToken(tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
-      const error = createError({
-        statusCode: 401,
-        message: `XSUAA login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
-        data: tokens
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleAccessTokenErrorResponse(event, "auth0", tokens, onError);
     }
     const tokenType = tokens.token_type;
     const accessToken = tokens.access_token;

package/dist/runtime/server/lib/oauth/yandex.js

@@ -1,12 +1,7 @@
-import {
-  eventHandler,
-  createError,
-  getQuery,
-  getRequestURL,
-  sendRedirect
-} from "h3";
-import { withQuery, parseURL, stringifyParsedURL } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthYandexEventHandler({
   config,
@@ -19,17 +14,12 @@ export function oauthYandexEventHandler({
       tokenURL: "https://oauth.yandex.ru/token",
       userURL: "https://login.yandex.ru/info"
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId || !config.clientSecret) {
-      const error = createError({
-        statusCode: 500,
-        message: "Missing NUXT_OAUTH_YANDEX_CLIENT_ID or NUXT_OAUTH_YANDEX_CLIENT_SECRET env variables."
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleMissingConfiguration(event, "yandex", ["clientId", "clientSecret"], onError);
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("login:email")) {
         config.scope.push("login:email");
@@ -44,29 +34,17 @@ export function oauthYandexEventHandler({
         })
       );
     }
-    const tokens = await $fetch(config.tokenURL, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        code: query.code,
         client_id: config.clientId,
         client_secret: config.clientSecret,
-        grant_type: "authorization_code",
-        redirect_uri: stringifyParsedURL(parseURL(redirectURL)),
-        code
-      }).toString()
-    }).catch((error) => {
-      return { error };
+        redirect_uri: redirectURL
+      }
     });
     if (tokens.error) {
-      const error = createError({
-        statusCode: 401,
-        message: `Yandex login failed: ${tokens.error?.data?.error_description || "Unknown error"}`,
-        data: tokens
-      });
-      if (!onError) throw error;
-      return onError(event, error);
+      return handleAccessTokenErrorResponse(event, "yandex", tokens, onError);
     }
     const accessToken = tokens.access_token;
     const user = await $fetch(config.userURL, {

package/dist/runtime/server/lib/utils.d.ts

@@ -0,0 +1,36 @@
+import type { H3Event } from 'h3';
+import type { OAuthProvider, OnError } from '#auth-utils';
+export declare function getOAuthRedirectURL(event: H3Event): string;
+/**
+ * Request an access token body.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
+ */
+export interface RequestAccessTokenBody {
+    grant_type: 'authorization_code';
+    code: string;
+    redirect_uri: string;
+    client_id: string;
+    client_secret?: string;
+}
+interface RequestAccessTokenOptions {
+    body?: RequestAccessTokenBody;
+    params?: Record<string, string | undefined>;
+    headers?: Record<string, string>;
+}
+/**
+ * Request an access token from the OAuth provider.
+ *
+ * When an error occurs, only the error data is returned.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
+ */
+export declare function requestAccessToken(url: string, options: RequestAccessTokenOptions): Promise<any>;
+/**
+ * Handle OAuth access token error response
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+export declare function handleAccessTokenErrorResponse(event: H3Event, oauthProvider: OAuthProvider, oauthError: any, onError?: OnError): void | Promise<void>;
+export declare function handleMissingConfiguration(event: H3Event, provider: OAuthProvider, missingKeys: string[], onError?: OnError): void | Promise<void>;
+export {};

package/dist/runtime/server/lib/utils.js

@@ -0,0 +1,46 @@
+import { getRequestURL } from "h3";
+import { FetchError } from "ofetch";
+import { snakeCase, upperFirst } from "scule";
+import { createError } from "#imports";
+export function getOAuthRedirectURL(event) {
+  const requestURL = getRequestURL(event);
+  return `${requestURL.protocol}//${requestURL.host}${requestURL.pathname}`;
+}
+export async function requestAccessToken(url, options) {
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    ...options.headers
+  };
+  const body = headers["Content-Type"] === "application/x-www-form-urlencoded" ? new URLSearchParams(
+    options.body || options.params || {}
+  ).toString() : options.body;
+  return $fetch(url, {
+    method: "POST",
+    headers,
+    body
+  }).catch((error) => {
+    if (error instanceof FetchError && error.status === 401) {
+      return error.data;
+    }
+    throw error;
+  });
+}
+export function handleAccessTokenErrorResponse(event, oauthProvider, oauthError, onError) {
+  const message = `${upperFirst(oauthProvider)} login failed: ${oauthError.error_description || oauthError.error || "Unknown error"}`;
+  const error = createError({
+    statusCode: 401,
+    message,
+    data: oauthError
+  });
+  if (!onError) throw error;
+  return onError(event, error);
+}
+export function handleMissingConfiguration(event, provider, missingKeys, onError) {
+  const environmentVariables = missingKeys.map((key) => `NUXT_OAUTH_${provider.toUpperCase()}_${snakeCase(key).toUpperCase()}`);
+  const error = createError({
+    statusCode: 500,
+    message: `Missing ${environmentVariables.join(" or ")} env ${missingKeys.length > 1 ? "variables" : "variable"}.`
+  });
+  if (!onError) throw error;
+  return onError(event, error);
+}

package/dist/runtime/types/index.d.ts

@@ -1,2 +1,2 @@
 export type { User, UserSession, UserSessionRequired, UserSessionComposable } from './session.js';
-export type { OAuthConfig } from './oauth-config.js';
+export type { OAuthConfig, OAuthProvider, OnError } from './oauth-config.js';

package/dist/runtime/types/oauth-config.d.ts

@@ -1,9 +1,11 @@
 import type { H3Event, H3Error } from 'h3';
+export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'facebook' | 'github' | 'google' | 'keycloak' | 'linkedin' | 'microsoft' | 'paypal' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'x' | 'xsuaa' | 'yandex' | (string & {});
+export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;
     onSuccess: (event: H3Event, result: {
         user: TUser;
         tokens: TTokens;
     }) => Promise<void> | void;
-    onError?: (event: H3Event, error: H3Error) => Promise<void> | void;
+    onError?: OnError;
 }

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Minimalist Auth module for Nuxt with SSR",
   "repository": "Atinux/nuxt-auth-utils",
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.7.0",
+  "packageManager": "pnpm@9.9.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.ts",
@@ -32,28 +32,29 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@nuxt/kit": "^3.12.4",
+    "@nuxt/kit": "^3.13.1",
     "defu": "^6.1.4",
     "hookable": "^5.5.3",
     "ofetch": "^1.3.4",
     "ohash": "^1.1.3",
     "pathe": "^1.1.2",
+    "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.1.113",
+    "@iconify-json/simple-icons": "^1.2.1",
     "@nuxt/devtools": "latest",
-    "@nuxt/eslint-config": "^0.5.0",
-    "@nuxt/module-builder": "^0.8.1",
-    "@nuxt/schema": "^3.12.4",
-    "@nuxt/test-utils": "^3.14.0",
+    "@nuxt/eslint-config": "^0.5.5",
+    "@nuxt/module-builder": "^0.8.3",
+    "@nuxt/schema": "^3.13.1",
+    "@nuxt/test-utils": "^3.14.1",
     "@nuxt/ui": "^2.18.4",
     "@nuxt/ui-pro": "^1.4.1",
     "changelogen": "^0.5.5",
-    "eslint": "^9.9.0",
-    "nuxt": "^3.12.4",
+    "eslint": "^9.9.1",
+    "nuxt": "^3.13.1",
     "typescript": "^5.5.4",
     "vitest": "^2.0.5",
-    "vue-tsc": "^2.0.29"
+    "vue-tsc": "^2.1.4"
   }
 }