nuxt-auth-utils 0.3.5 → 0.3.7

package/dist/runtime/server/lib/oauth/microsoft.js

@@ -1,21 +1,21 @@
-import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration } from "../utils.js";
-import { useRuntimeConfig } from "#imports";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
 export function oauthMicrosoftEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.microsoft, {
       authorizationParams: {}
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId || !config.clientSecret || !config.tenant) {
       return handleMissingConfiguration(event, "microsoft", ["clientId", "clientSecret", "tenant"], onError);
     }
     const authorizationURL = config.authorizationURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/authorize`;
     const tokenURL = config.tokenURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/token`;
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       const scope = config.scope && config.scope.length > 0 ? config.scope : ["User.Read"];
       return sendRedirect(
         event,
@@ -28,23 +28,14 @@ export function oauthMicrosoftEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const data = new URLSearchParams();
-    data.append("grant_type", "authorization_code");
-    data.append("client_id", config.clientId);
-    data.append("client_secret", config.clientSecret);
-    data.append("redirect_uri", parsePath(redirectURL).pathname);
-    data.append("code", String(code));
-    const tokens = await $fetch(
-      tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: data
+    const tokens = await requestAccessToken(tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        code: query.code,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "microsoft", tokens, onError);

package/dist/runtime/server/lib/oauth/paypal.js

@@ -1,8 +1,8 @@
-import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration } from "../utils.js";
-import { useRuntimeConfig } from "#imports";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
 export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.paypal, {
@@ -11,7 +11,7 @@ export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
       tokenURL: "https://api-m.paypal.com/v1/oauth2/token",
       authorizationParams: {}
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId) {
       return handleMissingConfiguration(event, "paypal", ["clientId"], onError);
     }
@@ -21,8 +21,8 @@ export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
       config.authorizationURL = "https://www.sandbox.paypal.com/signin/authorize";
       config.tokenURL = `https://${paypalAPI}/v1/oauth2/token`;
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("openid")) {
         config.scope.push("openid");
@@ -42,23 +42,16 @@ export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const authCode = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
-    const tokens = await $fetch(
-      config.tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Authorization": `Basic ${authCode}`,
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        params: {
-          grant_type: "authorization_code",
-          redirect_uri: encodeURIComponent(parsePath(redirectURL).pathname),
-          code
-        }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`
+      },
+      params: {
+        grant_type: "authorization_code",
+        redirect_uri: encodeURIComponent(redirectURL),
+        // <- PayPal requires to be URL encoded
+        code: query.code
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "paypal", tokens, onError);

package/dist/runtime/server/lib/oauth/spotify.js

@@ -1,7 +1,7 @@
-import { eventHandler, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthSpotifyEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -10,12 +10,12 @@ export function oauthSpotifyEventHandler({ config, onSuccess, onError }) {
       tokenURL: "https://accounts.spotify.com/api/token",
       authorizationParams: {}
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId || !config.clientSecret) {
       return handleMissingConfiguration(event, "spotify", ["clientId", "clientSecret"], onError);
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user-read-email")) {
         config.scope.push("user-read-email");
@@ -31,23 +31,16 @@ export function oauthSpotifyEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const authCode = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
-    const tokens = await $fetch(
-      config.tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Authorization": `Basic ${authCode}`,
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        params: {
-          grant_type: "authorization_code",
-          redirect_uri: parsePath(redirectURL).pathname,
-          code
-        }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`
+      },
+      body: {
+        client_id: config.clientId,
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "spotify", tokens, onError);

package/dist/runtime/server/lib/oauth/tiktok.d.ts

@@ -0,0 +1,45 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthTikTokConfig {
+    /**
+     * TikTok Client Key
+     * @default process.env.NUXT_OAUTH_TIKTOK_CLIENT_KEY
+     */
+    clientKey?: string;
+    /**
+     * TikTok OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_TIKTOK_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * TikTok OAuth Scope
+     * @default []
+     * @see https://developers.tiktok.com/doc/tiktok-api-scopes/
+     * @example ['user.info.basic']
+     */
+    scope?: string[];
+    /**
+     * Use TikTok sandbox environment.
+     * If true it will use Login Kit for Desktop, if false it will use Login Kit for Web.
+     * This is because Login Kit for Web doesn't support localhost or IP addresses as redirect URIs.
+     * @see https://developers.tiktok.com/doc/login-kit-web/
+     * @see https://developers.tiktok.com/doc/login-kit-desktop/
+     * @default import.meta.dev // true in development, false in production
+     */
+    sandbox?: boolean;
+    /**
+     * TikTok OAuth Authorization URL
+     * @default 'https://www.tiktok.com/v2/auth/authorize/'
+     */
+    authorizationURL?: string;
+    /**
+     * TikTok OAuth Token URL
+     * @default 'https://open.tiktokapis.com/v2/oauth/token/'
+     */
+    tokenURL?: string;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_TIKTOK_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function oauthTikTokEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTikTokConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/tiktok.js

@@ -0,0 +1,84 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { sha256 } from "ohash";
+import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function oauthTikTokEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.tiktok, {
+      sandbox: import.meta.dev,
+      authorizationURL: "https://www.tiktok.com/v2/auth/authorize/",
+      tokenURL: "https://open.tiktokapis.com/v2/oauth/token/"
+    });
+    const query = getQuery(event);
+    if (!config.clientKey || !config.clientSecret) {
+      return handleMissingConfiguration(event, "tiktok", ["clientKey", "clientSecret"], onError);
+    }
+    const codeVerifier = "verify";
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (!config.scope.includes("user.info.basic")) {
+        config.scope.push("user.info.basic");
+      }
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_key: config.clientKey,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(","),
+          ...config.sandbox ? {
+            code_verifier: codeVerifier,
+            code_challenge: sha256(codeVerifier),
+            code_challenge_method: "S256"
+          } : {}
+        })
+      );
+    }
+    const tokens = await requestAccessToken(
+      config.tokenURL,
+      {
+        body: {
+          grant_type: "authorization_code",
+          redirect_uri: redirectURL,
+          client_key: config.clientKey,
+          client_secret: config.clientSecret,
+          code: query.code,
+          ...config.sandbox ? { code_verifier: codeVerifier } : {}
+        }
+      }
+    );
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "tiktok", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const userInfoFieldsByScope = {
+      "user.info.basic": ["open_id", "union_id", "avatar_url", "avatar_url_100", "avatar_large_url", "display_name"],
+      "user.info.profile": ["bio_description", "profile_deep_link", "is_verified", "username"],
+      "user.info.stats": ["follower_count", "following_count", "likes_count", "video_count"]
+    };
+    const userInfo = await $fetch(withQuery("https://open.tiktokapis.com/v2/user/info/", {
+      fields: config.scope?.map((scope) => userInfoFieldsByScope[scope]).flat().join(",")
+    }), {
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    const user = userInfo?.data?.user;
+    if (!user) {
+      const error = createError({
+        statusCode: 500,
+        message: "Could not get TikTok user",
+        data: tokens
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/twitch.js

@@ -1,8 +1,8 @@
-import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration } from "../utils.js";
-import { useRuntimeConfig } from "#imports";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
 export function oauthTwitchEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.twitch, {
@@ -10,12 +10,12 @@ export function oauthTwitchEventHandler({ config, onSuccess, onError }) {
       tokenURL: "https://id.twitch.tv/oauth2/token",
       authorizationParams: {}
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId) {
       return handleMissingConfiguration(event, "twitch", ["clientId"], onError);
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user:read:email")) {
         config.scope.push("user:read:email");
@@ -31,23 +31,14 @@ export function oauthTwitchEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const tokens = await $fetch(
-      config.tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        params: {
-          grant_type: "authorization_code",
-          redirect_uri: parsePath(redirectURL).pathname,
-          client_id: config.clientId,
-          client_secret: config.clientSecret,
-          code
-        }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code: query.code
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "twitch", tokens, onError);

package/dist/runtime/server/lib/oauth/x.js

@@ -1,13 +1,12 @@
-import { randomUUID } from "node:crypto";
 import {
   eventHandler,
   getQuery,
-  getRequestURL,
   sendRedirect
 } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration } from "../utils.js";
+import { randomUUID } from "uncrypto";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthXEventHandler({
   config,
@@ -24,12 +23,12 @@ export function oauthXEventHandler({
         code_challenge: randomUUID()
       }
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId) {
       return handleMissingConfiguration(event, "x", ["clientId"], onError);
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || ["tweet.read", "users.read", "offline.access"];
       return sendRedirect(
         event,
@@ -43,22 +42,16 @@ export function oauthXEventHandler({
         })
       );
     }
-    const params = {
-      grant_type: "authorization_code",
-      code_verifier: config.authorizationParams?.code_challenge,
-      redirect_uri: parsePath(redirectURL).pathname,
-      code
-    };
-    const authCode = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
-    const tokens = await $fetch(config.tokenURL, {
-      method: "POST",
+    const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        "Authorization": `Basic ${authCode}`
+        Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`
       },
-      params
-    }).catch((error) => {
-      return { error };
+      params: {
+        grant_type: "authorization_code",
+        code_verifier: config.authorizationParams?.code_challenge,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "x", tokens, onError);

package/dist/runtime/server/lib/oauth/xsuaa.js

@@ -1,19 +1,19 @@
-import { eventHandler, getQuery, getRequestURL, sendRedirect } from "h3";
-import { withQuery, parsePath } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthXSUAAEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.xsuaa);
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId || !config.clientSecret || !config.domain) {
       return handleMissingConfiguration(event, "xsuaa", ["clientId", "clientSecret", "domain"], onError);
     }
     const authorizationURL = `https://${config.domain}/oauth/authorize`;
     const tokenURL = `https://${config.domain}/oauth/token`;
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       return sendRedirect(
         event,
@@ -25,23 +25,14 @@ export function oauthXSUAAEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    const tokens = await $fetch(
-      tokenURL,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: new URLSearchParams({
-          grant_type: "authorization_code",
-          client_id: config.clientId,
-          client_secret: config.clientSecret,
-          redirect_uri: parsePath(redirectURL).pathname,
-          code: `${code}`
-        })
+    const tokens = await requestAccessToken(tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
       }
-    ).catch((error) => {
-      return { error };
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "auth0", tokens, onError);

package/dist/runtime/server/lib/oauth/yandex.js

@@ -1,12 +1,7 @@
-import {
-  eventHandler,
-  getQuery,
-  getRequestURL,
-  sendRedirect
-} from "h3";
-import { withQuery, parseURL, stringifyParsedURL } from "ufo";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthYandexEventHandler({
   config,
@@ -19,12 +14,12 @@ export function oauthYandexEventHandler({
       tokenURL: "https://oauth.yandex.ru/token",
       userURL: "https://login.yandex.ru/info"
     });
-    const { code } = getQuery(event);
+    const query = getQuery(event);
     if (!config.clientId || !config.clientSecret) {
       return handleMissingConfiguration(event, "yandex", ["clientId", "clientSecret"], onError);
     }
-    const redirectURL = config.redirectURL || getRequestURL(event).href;
-    if (!code) {
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("login:email")) {
         config.scope.push("login:email");
@@ -39,20 +34,14 @@ export function oauthYandexEventHandler({
         })
       );
     }
-    const tokens = await $fetch(config.tokenURL, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        code: query.code,
         client_id: config.clientId,
         client_secret: config.clientSecret,
-        grant_type: "authorization_code",
-        redirect_uri: stringifyParsedURL(parseURL(redirectURL)),
-        code
-      }).toString()
-    }).catch((error) => {
-      return { error };
+        redirect_uri: redirectURL
+      }
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "yandex", tokens, onError);

package/dist/runtime/server/lib/utils.d.ts

@@ -1,5 +1,31 @@
 import type { H3Event } from 'h3';
-import type { OnError, OAuthProvider } from '#auth-utils';
+import type { OAuthProvider, OnError } from '#auth-utils';
+export declare function getOAuthRedirectURL(event: H3Event): string;
+/**
+ * Request an access token body.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
+ */
+export interface RequestAccessTokenBody {
+    grant_type: 'authorization_code';
+    code: string;
+    redirect_uri: string;
+    client_id: string;
+    client_secret?: string;
+}
+interface RequestAccessTokenOptions {
+    body?: RequestAccessTokenBody;
+    params?: Record<string, string | undefined>;
+    headers?: Record<string, string>;
+}
+/**
+ * Request an access token from the OAuth provider.
+ *
+ * When an error occurs, only the error data is returned.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
+ */
+export declare function requestAccessToken(url: string, options: RequestAccessTokenOptions): Promise<any>;
 /**
  * Handle OAuth access token error response
  *
@@ -7,3 +33,4 @@ import type { OnError, OAuthProvider } from '#auth-utils';
  */
 export declare function handleAccessTokenErrorResponse(event: H3Event, oauthProvider: OAuthProvider, oauthError: any, onError?: OnError): void | Promise<void>;
 export declare function handleMissingConfiguration(event: H3Event, provider: OAuthProvider, missingKeys: string[], onError?: OnError): void | Promise<void>;
+export {};

package/dist/runtime/server/lib/utils.js

@@ -1,5 +1,30 @@
+import { getRequestURL } from "h3";
+import { FetchError } from "ofetch";
 import { snakeCase, upperFirst } from "scule";
 import { createError } from "#imports";
+export function getOAuthRedirectURL(event) {
+  const requestURL = getRequestURL(event);
+  return `${requestURL.protocol}//${requestURL.host}${requestURL.pathname}`;
+}
+export async function requestAccessToken(url, options) {
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    ...options.headers
+  };
+  const body = headers["Content-Type"] === "application/x-www-form-urlencoded" ? new URLSearchParams(
+    options.body || options.params || {}
+  ).toString() : options.body;
+  return $fetch(url, {
+    method: "POST",
+    headers,
+    body
+  }).catch((error) => {
+    if (error instanceof FetchError && error.status === 401) {
+      return error.data;
+    }
+    throw error;
+  });
+}
 export function handleAccessTokenErrorResponse(event, oauthProvider, oauthError, onError) {
   const message = `${upperFirst(oauthProvider)} login failed: ${oauthError.error_description || oauthError.error || "Unknown error"}`;
   const error = createError({

package/dist/runtime/types/oauth-config.d.ts

@@ -1,5 +1,5 @@
 import type { H3Event, H3Error } from 'h3';
-export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'facebook' | 'github' | 'google' | 'keycloak' | 'linkedin' | 'microsoft' | 'paypal' | 'spotify' | 'steam' | 'twitch' | 'x' | 'xsuaa' | 'yandex' | (string & {});
+export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'facebook' | 'github' | 'google' | 'keycloak' | 'linkedin' | 'microsoft' | 'paypal' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'x' | 'xsuaa' | 'yandex' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;