nuxt-auth-utils 0.3.6 → 0.3.8

package/README.md

@@ -15,9 +15,9 @@ Add Authentication to Nuxt applications with secured & sealed cookies sessions.
 ## Features
 
 - [Hybrid Rendering](#hybrid-rendering) support (SSR / CSR / SWR / Prerendering)
-- [15+ OAuth Providers](#supported-oauth-providers)
-- [Vue composable](#vue-composable)
-- [Server utils](#server-utils)
+- [20+ OAuth Providers](#supported-oauth-providers)
+- [`useUserSession()` Vue composable](#vue-composable)
+- [Tree-shakable server utils](#server-utils)
 - [`<AuthState>` component](#authstate-component)
 - [Extendable with hooks](#extend-session)
 
@@ -105,6 +105,9 @@ interface UserSessionComposable {
 }
 ```
 
+> [!IMPORTANT]
+> Nuxt Auth Utils uses the `/api/_auth/session` route for session management. Ensure your API route middleware doesn't interfere with this path.
+
 ## Server Utils
 
 The following helpers are auto-imported in your `server/` directory.
@@ -114,13 +117,18 @@ The following helpers are auto-imported in your `server/` directory.
 ```ts
 // Set a user session, note that this data is encrypted in the cookie but can be decrypted with an API call
 // Only store the data that allow you to recognize a user, but do not store sensitive data
-// Merges new data with existing data using defu()
+// Merges new data with existing data using unjs/defu library
 await setUserSession(event, {
+  // User data
   user: {
-    // ... user data
+    login: 'atinux'
+  },
+  // Private data accessible on server/ routes
+  secure: {
+    apiToken: '1234567890'
   },
+  // Any extra fields for the session data
   loggedInAt: new Date()
-  // Any extra fields
 })
 
 // Replace a user session. Same behaviour as setUserSession, except it does not merge data with existing data
@@ -153,6 +161,9 @@ declare module '#auth-utils' {
 export {}
 ```
 
+> [!IMPORTANT]
+> Since we encrypt and store session data in cookies, we're constrained by the 4096-byte cookie size limit. Store only essential information.
+
 ### OAuth Event Handlers
 
 All handlers can be auto-imported and used in your server routes or API routes.
@@ -192,7 +203,9 @@ It can also be set using environment variables:
 - Discord
 - Facebook
 - GitHub
+- GitLab
 - Google
+- Instagram
 - Keycloak
 - LinkedIn
 - Microsoft
@@ -201,6 +214,7 @@ It can also be set using environment variables:
 - Steam
 - TikTok
 - Twitch
+- VK
 - X (Twitter)
 - XSUAA
 - Yandex
@@ -350,6 +364,14 @@ Our defaults are:
 }
 ```
 
+You can also overwrite the session config by passing it as 3rd argument of the `setUserSession` and `replaceUserSession` functions:
+
+```ts
+await setUserSession(event, { ... } , {
+  maxAge: 60 * 60 * 24 * 7 // 1 week
+})
+```
+
 Checkout the [`SessionConfig`](https://github.com/unjs/h3/blob/c04c458810e34eb15c1647e1369e7d7ef19f567d/src/utils/session.ts#L20) for all options.
 
 ## More

package/dist/module.json

@@ -1,9 +1,9 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "builder": {
-    "@nuxt/module-builder": "0.8.3",
+    "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"
   }
 }

package/dist/module.mjs

@@ -13,7 +13,9 @@ const module = defineNuxtModule({
   defaults: {},
   async setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
-    nuxt.options.alias["#auth-utils"] = resolver.resolve("./runtime/types/index");
+    nuxt.options.alias["#auth-utils"] = resolver.resolve(
+      "./runtime/types/index"
+    );
     addComponentsDir({ path: resolver.resolve("./runtime/app/components") });
     addImportsDir(resolver.resolve("./runtime/app/composables"));
     addPlugin(resolver.resolve("./runtime/app/plugins/session.server"));
@@ -58,6 +60,11 @@ const module = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.gitlab = defu(runtimeConfig.oauth.gitlab, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
     runtimeConfig.oauth.spotify = defu(runtimeConfig.oauth.spotify, {
       clientId: "",
       clientSecret: "",
@@ -124,6 +131,11 @@ const module = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.instagram = defu(runtimeConfig.oauth.instagram, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
     runtimeConfig.oauth.paypal = defu(runtimeConfig.oauth.paypal, {
       clientId: "",
       clientSecret: "",
@@ -144,6 +156,11 @@ const module = defineNuxtModule({
       domain: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.vk = defu(runtimeConfig.oauth.vk, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
     runtimeConfig.oauth.yandex = defu(runtimeConfig.oauth.yandex, {
       clientId: "",
       clientSecret: "",

package/dist/runtime/app/plugins/session.client.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+export default _default;

package/dist/runtime/app/plugins/session.server.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+export default _default;

package/dist/runtime/server/api/session.get.d.ts

@@ -1,2 +1,5 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<import("#auth-utils").UserSession>>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    [key: string]: unknown;
+    user?: import("#auth-utils").User;
+}>>;
 export default _default;

package/dist/runtime/server/api/session.get.js

@@ -5,5 +5,6 @@ export default eventHandler(async (event) => {
   if (session.user) {
     await sessionHooks.callHookParallel("fetch", session, event);
   }
-  return session;
+  const { secure, ...data } = session;
+  return data;
 });

package/dist/runtime/server/lib/oauth/gitlab.d.ts

@@ -0,0 +1,47 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthGitLabConfig {
+    /**
+     * GitLab OAuth Client ID
+     * @default process.env.NUXT_OAUTH_GITLAB_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * GitLab OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_GITLAB_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * GitLab OAuth Scope
+     * @default ['read_user']
+     * @see https://docs.gitlab.com/ee/integration/oauth_provider.html#view-all-authorized-applications
+     * @example ['read_user']
+     */
+    scope?: string[];
+    /**
+     * Require email from user, adds the ['email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+    /**
+     * GitLab OAuth Authorization URL
+     * @default 'https://gitlab.com/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * GitLab OAuth Token URL
+     * @default 'https://gitlab.com/oauth/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://docs.gitlab.com/ee/integration/oauth_provider.html#view-all-authorized-applications
+     * @example { allow_signup: 'true' }
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_GITLAB_REDIRECT_URL
+     */
+    redirectURL?: string;
+}
+export declare function oauthGitLabEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGitLabConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/gitlab.js

@@ -0,0 +1,83 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  handleMissingConfiguration,
+  handleAccessTokenErrorResponse,
+  getOAuthRedirectURL,
+  requestAccessToken
+} from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function oauthGitLabEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.gitlab, {
+      authorizationURL: "https://gitlab.com/oauth/authorize",
+      tokenURL: "https://gitlab.com/oauth/token",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `GitLab login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(
+        event,
+        "gitlab",
+        ["clientId", "clientSecret"],
+        onError
+      );
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (!config.scope.length) {
+        config.scope.push("read_user");
+      }
+      if (config.emailRequired && !config.scope.includes("email")) {
+        config.scope.push("email");
+      }
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          ...config.authorizationParams
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "gitlab", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch("https://gitlab.com/api/v4/user", {
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/instagram.d.ts

@@ -0,0 +1,48 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthInstagramConfig {
+    /**
+     * Instagram OAuth Client ID
+     * @default process.env.NUXT_OAUTH_INSTAGRAM_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Instagram OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_INSTAGRAM_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Instagram OAuth Scope
+     * @default [ 'user_profile' ]
+     * @see https://developers.facebook.com/docs/instagram-basic-display-api/overview#permissions
+     * @example [ 'user_profile', 'user_media' ],
+     */
+    scope?: string[];
+    /**
+     * Instagram OAuth User Fields
+     * @default [ 'id', 'username'],
+     * @see https://developers.facebook.com/docs/instagram-basic-display-api/reference/user#fields
+     * @example [ 'id', 'username', 'account_type', 'media_count' ],
+     */
+    fields?: string[];
+    /**
+     * Instagram OAuth Authorization URL
+     * @default 'https://api.instagram.com/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Instagram OAuth Token URL
+     * @default 'https://api.instagram.com/oauth/access_token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_INSTAGRAM_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function oauthInstagramEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthInstagramConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/instagram.js

@@ -0,0 +1,70 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function oauthInstagramEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.instagram, {
+      scope: ["user_profile"],
+      authorizationURL: "https://api.instagram.com/oauth/authorize",
+      tokenURL: "https://api.instagram.com/oauth/access_token",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Instagram login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId) {
+      return handleMissingConfiguration(event, "instagram", ["clientId"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          response_type: "code"
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "instagram", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    config.fields = config.fields || ["id", "username"];
+    const fields = config.fields.join(",");
+    const user = await $fetch(
+      `https://graph.instagram.com/v20.0/me?fields=${fields}&access_token=${accessToken}`
+    );
+    if (!user) {
+      throw new Error("Instagram login failed: no user found");
+    }
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/paypal.js

@@ -48,7 +48,8 @@ export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
       },
       params: {
         grant_type: "authorization_code",
-        redirect_uri: redirectURL,
+        redirect_uri: encodeURIComponent(redirectURL),
+        // <- PayPal requires to be URL encoded
         code: query.code
       }
     });

package/dist/runtime/server/lib/oauth/vk.d.ts

@@ -0,0 +1,46 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthVKConfig {
+    /**
+     * VK OAuth Client ID
+     * @default process.env.NUXT_OAUTH_VK_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * VK OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_VK_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * VK OAuth Scope
+     * @default []
+     * @see https://id.vk.com/about/business/go/docs/en/vkid/latest/vk-id/connection/api-integration/api-description#App-access-to-user-data
+     * @example ["email", "phone"]
+     */
+    scope?: string[];
+    /**
+     * Require email from user, adds the ['login:email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+    /**
+     * VK OAuth Authorization URL
+     * @default 'https://id.vk.com/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * VK OAuth Token URL
+     * @default 'https://id.vk.com/oauth2/auth'
+     */
+    tokenURL?: string;
+    /**
+     * VK OAuth User URL
+     * @default 'https://id.vk.com/oauth2/user_info'
+     */
+    userURL?: string;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_VK_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function oauthVKEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthVKConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/vk.js

@@ -0,0 +1,87 @@
+import crypto from "node:crypto";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  handleMissingConfiguration,
+  handleAccessTokenErrorResponse,
+  getOAuthRedirectURL,
+  requestAccessToken
+} from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function oauthVKEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.vk, {
+      authorizationURL: "https://id.vk.com/authorize",
+      tokenURL: "https://id.vk.com/oauth2/auth",
+      userURL: "https://id.vk.com/oauth2/user_info"
+    });
+    const query = getQuery(event);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(
+        event,
+        "vk",
+        ["clientId", "clientSecret"],
+        onError
+      );
+    }
+    const codeVerifier = "verify";
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (config.emailRequired && !config.scope.includes("email")) {
+        config.scope.push("email");
+      }
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          code_challenge: crypto.createHash("sha256").update(codeVerifier).digest("base64url"),
+          code_challenge_method: "s256",
+          state: crypto.randomUUID(),
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" ")
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        code: query.code,
+        code_verifier: codeVerifier,
+        client_id: config.clientId,
+        device_id: query.device_id,
+        redirect_uri: redirectURL
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "vk", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(config.userURL, {
+      method: "POST",
+      body: {
+        access_token: accessToken,
+        client_id: config.clientId
+      }
+    });
+    if (!user) {
+      const error = createError({
+        statusCode: 500,
+        message: "Could not get VK user",
+        data: tokens
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/x.js

@@ -1,12 +1,13 @@
-import {
-  eventHandler,
-  getQuery,
-  sendRedirect
-} from "h3";
+import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
 import { randomUUID } from "uncrypto";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import {
+  handleMissingConfiguration,
+  handleAccessTokenErrorResponse,
+  getOAuthRedirectURL,
+  requestAccessToken
+} from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthXEventHandler({
   config,
@@ -29,7 +30,11 @@ export function oauthXEventHandler({
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {
-      config.scope = config.scope || ["tweet.read", "users.read", "offline.access"];
+      config.scope = config.scope || [
+        "tweet.read",
+        "users.read",
+        "offline.access"
+      ];
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {
@@ -44,7 +49,9 @@ export function oauthXEventHandler({
     }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
-        Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`
+        Authorization: `Basic ${Buffer.from(
+          `${config.clientId}:${config.clientSecret}`
+        ).toString("base64")}`
       },
       params: {
         grant_type: "authorization_code",
@@ -57,17 +64,14 @@ export function oauthXEventHandler({
       return handleAccessTokenErrorResponse(event, "x", tokens, onError);
     }
     const accessToken = tokens.access_token;
-    const user = await $fetch(
-      config.userURL,
-      {
-        headers: {
-          Authorization: `Bearer ${accessToken}`
-        },
-        query: {
-          "user.fields": "description,id,name,profile_image_url,username,verified,verified_type"
-        }
+    const user = await $fetch(config.userURL, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      },
+      query: {
+        "user.fields": "description,id,name,profile_image_url,username,verified,verified_type"
       }
-    ).catch((error) => {
+    }).catch((error) => {
       return error;
     });
     return onSuccess(event, {

package/dist/runtime/server/lib/oauth/yandex.js

@@ -1,7 +1,12 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import {
+  handleMissingConfiguration,
+  handleAccessTokenErrorResponse,
+  getOAuthRedirectURL,
+  requestAccessToken
+} from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function oauthYandexEventHandler({
   config,
@@ -16,7 +21,12 @@ export function oauthYandexEventHandler({
     });
     const query = getQuery(event);
     if (!config.clientId || !config.clientSecret) {
-      return handleMissingConfiguration(event, "yandex", ["clientId", "clientSecret"], onError);
+      return handleMissingConfiguration(
+        event,
+        "yandex",
+        ["clientId", "clientSecret"],
+        onError
+      );
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {

package/dist/runtime/server/plugins/oauth.js

@@ -1,6 +1,6 @@
 import { defineNitroPlugin } from "nitropack/runtime";
 export default defineNitroPlugin((nitroApp) => {
-  if (process.env.NUXT_OAUTH_FACEBOOK_CLIENT_ID && process.env.NUXT_OAUTH_FACEBOOK_CLIENT_SECRET) {
+  if (process.env.NUXT_OAUTH_FACEBOOK_CLIENT_ID && process.env.NUXT_OAUTH_FACEBOOK_CLIENT_SECRET || process.env.NUXT_OAUTH_INSTAGRAM_CLIENT_ID && process.env.NUXT_OAUTH_INSTAGRAM_CLIENT_SECRET) {
     nitroApp.hooks.hook("render:html", (html) => {
       html.head.unshift(`
       <script>

package/dist/runtime/server/utils/session.d.ts

@@ -1,4 +1,4 @@
-import type { H3Event } from 'h3';
+import type { H3Event, SessionConfig } from 'h3';
 import type { UserSession, UserSessionRequired } from '#auth-utils';
 export interface SessionHooks {
     /**
@@ -25,13 +25,13 @@ export declare function getUserSession(event: H3Event): Promise<UserSession>;
  * @param data User session data, please only store public information since it can be decoded with API calls
  * @see https://github.com/atinux/nuxt-auth-utils
  */
-export declare function setUserSession(event: H3Event, data: UserSession): Promise<UserSession>;
+export declare function setUserSession(event: H3Event, data: UserSession, config?: Partial<SessionConfig>): Promise<UserSession>;
 /**
  * Replace a user session
  * @param event The Request (h3) event
  * @param data User session data, please only store public information since it can be decoded with API calls
  */
-export declare function replaceUserSession(event: H3Event, data: UserSession): Promise<UserSession>;
+export declare function replaceUserSession(event: H3Event, data: UserSession, config?: Partial<SessionConfig>): Promise<UserSession>;
 /**
  * Clear the user session and removing the session cookie
  * @param event The Request (h3) event

package/dist/runtime/server/utils/session.js

@@ -6,13 +6,13 @@ export const sessionHooks = createHooks();
 export async function getUserSession(event) {
   return (await _useSession(event)).data;
 }
-export async function setUserSession(event, data) {
-  const session = await _useSession(event);
+export async function setUserSession(event, data, config) {
+  const session = await _useSession(event, config);
   await session.update(defu(data, session.data));
   return session.data;
 }
-export async function replaceUserSession(event, data) {
-  const session = await _useSession(event);
+export async function replaceUserSession(event, data, config) {
+  const session = await _useSession(event, config);
   await session.clear();
   await session.update(data);
   return session.data;
@@ -34,11 +34,12 @@ export async function requireUserSession(event, opts = {}) {
   return userSession;
 }
 let sessionConfig;
-function _useSession(event) {
+function _useSession(event, config = {}) {
   if (!sessionConfig) {
     const runtimeConfig = useRuntimeConfig(event);
     const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
     sessionConfig = defu({ password: process.env[envSessionPassword] }, runtimeConfig.session);
   }
-  return useSession(event, sessionConfig);
+  const finalConfig = defu(config, sessionConfig);
+  return useSession(event, finalConfig);
 }

package/dist/runtime/types/oauth-config.d.ts

@@ -1,5 +1,5 @@
 import type { H3Event, H3Error } from 'h3';
-export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'facebook' | 'github' | 'google' | 'keycloak' | 'linkedin' | 'microsoft' | 'paypal' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'x' | 'xsuaa' | 'yandex' | (string & {});
+export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linkedin' | 'microsoft' | 'paypal' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'x' | 'xsuaa' | 'yandex' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/dist/runtime/types/session.d.ts

@@ -2,7 +2,18 @@ import type { ComputedRef, Ref } from 'vue';
 export interface User {
 }
 export interface UserSession {
+    /**
+     * User session data, available on client and server
+     */
     user?: User;
+    /**
+     * Private session data, only available on server/ code
+     */
+    secure?: Record<string, unknown>;
+    /**
+     * Extra session data, available on client and server
+     */
+    [key: string]: unknown;
 }
 export interface UserSessionRequired extends UserSession {
     user: User;

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Minimalist Auth module for Nuxt with SSR",
   "repository": "Atinux/nuxt-auth-utils",
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.9.0",
+  "packageManager": "pnpm@9.10.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.ts",
@@ -42,19 +42,19 @@
     "uncrypto": "^0.1.3"
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.1",
+    "@iconify-json/simple-icons": "^1.2.2",
     "@nuxt/devtools": "latest",
-    "@nuxt/eslint-config": "^0.5.5",
-    "@nuxt/module-builder": "^0.8.3",
+    "@nuxt/eslint-config": "^0.5.7",
+    "@nuxt/module-builder": "^0.8.4",
     "@nuxt/schema": "^3.13.1",
-    "@nuxt/test-utils": "^3.14.1",
+    "@nuxt/test-utils": "^3.14.2",
     "@nuxt/ui": "^2.18.4",
-    "@nuxt/ui-pro": "^1.4.1",
+    "@nuxt/ui-pro": "^1.4.2",
     "changelogen": "^0.5.5",
-    "eslint": "^9.9.1",
+    "eslint": "^9.10.0",
     "nuxt": "^3.13.1",
-    "typescript": "^5.5.4",
+    "typescript": "^5.6.2",
     "vitest": "^2.0.5",
-    "vue-tsc": "^2.1.4"
+    "vue-tsc": "^2.1.6"
   }
 }