nuxt-auth-utils 0.3.8 → 0.4.0

package/README.md

@@ -16,6 +16,8 @@ Add Authentication to Nuxt applications with secured & sealed cookies sessions.
 
 - [Hybrid Rendering](#hybrid-rendering) support (SSR / CSR / SWR / Prerendering)
 - [20+ OAuth Providers](#supported-oauth-providers)
+- [Password hasing](#password-hashing)
+- [WebAuthn (passkey)](#webauthn-passkey)
 - [`useUserSession()` Vue composable](#vue-composable)
 - [Tree-shakable server utils](#server-utils)
 - [`<AuthState>` component](#authstate-component)
@@ -156,6 +158,10 @@ declare module '#auth-utils' {
   interface UserSession {
     // Add your own fields
   }
+
+  interface SecureSessionData {
+    // Add your own fields
+  }
 }
 
 export {}
@@ -168,7 +174,7 @@ export {}
 
 All handlers can be auto-imported and used in your server routes or API routes.
 
-The pattern is `oauth<Provider>EventHandler({ onSuccess, config?, onError? })`, example: `oauthGitHubEventHandler`.
+The pattern is `defineOAuth<Provider>EventHandler({ onSuccess, config?, onError? })`, example: `defineOAuthGitHubEventHandler`.
 
 The helper returns an event handler that automatically redirects to the provider authorization page and then calls `onSuccess` or `onError` depending on the result.
 
@@ -201,6 +207,7 @@ It can also be set using environment variables:
 - AWS Cognito
 - Battle.net
 - Discord
+- Dropbox
 - Facebook
 - GitHub
 - GitLab
@@ -221,12 +228,12 @@ It can also be set using environment variables:
 
 You can add your favorite provider by creating a new file in [src/runtime/server/lib/oauth/](./src/runtime/server/lib/oauth/).
 
-### Example
+#### Example
 
 Example: `~/server/routes/auth/github.get.ts`
 
 ```ts
-export default oauthGitHubEventHandler({
+export default defineOAuthGitHubEventHandler({
   config: {
     emailRequired: true
   },
@@ -250,6 +257,238 @@ Make sure to set the callback URL in your OAuth app settings as `<your-domain>/a
 
 If the redirect URL mismatch in production, this means that the module cannot guess the right redirect URL. You can set the `NUXT_OAUTH_<PROVIDER>_REDIRECT_URL` env variable to overwrite the default one.
 
+### Password Hashing
+
+Nuxt Auth Utils provides password hashing utilities like `hashPassword` and `verifyPassword` to hash and verify passwords by using [scrypt](https://en.wikipedia.org/wiki/Scrypt) as it is supported in many JS runtime.
+
+```ts
+const hashedPassword = await hashPassword('user_password')
+
+if (await verifyPassword(hashedPassword, 'user_password')) {
+  // Password is valid
+}
+```
+
+You can configure the scrypt options in your `nuxt.config.ts`:
+
+```ts
+export default defineNuxtConfig({
+  modules: ['nuxt-auth-utils'],
+  auth: {
+    hash: {
+      scrypt: {
+        // See https://github.com/adonisjs/hash/blob/94637029cd526783ac0a763ec581306d98db2036/src/types.ts#L144
+      }
+    }
+  }
+})
+```
+
+### WebAuthn (passkey)
+
+WebAuthn (Web Authentication) is a web standard that enhances security by replacing passwords with passkeys using public key cryptography. Users can authenticate with biometric data (like fingerprints or facial recognition) or physical devices (like USB keys), reducing the risk of phishing and password breaches. This approach offers a more secure and user-friendly authentication method, supported by major browsers and platforms.
+
+To enable WebAuthn you need to:
+
+1. Install the peer dependencies:
+
+```bash
+npx nypm i @simplewebauthn/server @simplewebauthn/browser
+```
+
+2. Enable it in your `nuxt.config.ts`
+
+```ts
+export default defineNuxtConfig({
+  auth: {
+    webAuthn: true
+  }
+})
+```
+
+#### Example
+
+In this example we will implement the very basic steps to register and authenticate a credential.
+
+The full code can be found in the [playground](https://github.com/atinux/nuxt-auth-utils/blob/main/playground/server/api/webauthn). The example uses a SQLite database with the following minimal tables:
+
+```sql
+CREATE TABLE users (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  email TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS credentials (
+  userId INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE ON UPDATE CASCADE,
+  id TEXT UNIQUE NOT NULL,
+  publicKey TEXT NOT NULL,
+  counter INTEGER NOT NULL,
+  backedUp INTEGER NOT NULL,
+  transports TEXT NOT NULL,
+  PRIMARY KEY ("userId", "id")
+);
+```
+
+- For the `users` table it is important to have a unique identifier such as a username or email (here we use email). When creating a new credential, this identifier is required and stored with the passkey on the user's device, password manager, or authenticator.
+- The `credentials` table stores:
+  - The `userId` from the `users` table.
+  - The credential `id` (as unique index)
+  - The credential `publicKey`
+  - A `counter`. Each time a credential is used, the counter is incremented. We can use this value to perform extra security checks. More about `counter` can be read [here](https://simplewebauthn.dev/docs/packages/server#3-post-registration-responsibilities). For this example, we won't be using the counter. But you should update the counter in your database with the new value.
+  - A `backedUp` flag. Normally, credentials are stored on the generating device. When you use a password manager or authenticator, the credential is "backed up" because it can be used on multiple devices. See [this section](https://arc.net/l/quote/ugaemxot) for more details.
+  - The credential `transports`. It is an array of strings that indicate how the credential communicates with the client. It is used to show the correct UI for the user to utilize the credential. Again, see [this section](https://arc.net/l/quote/ycxtiorp) for more details.
+
+The following code does not include the actual database queries, but shows the general steps to follow. The full example can be found in the playground: [registration](https://github.com/atinux/nuxt-auth-utils/blob/main/playground/server/api/webauthn/register.post.ts), [authentication](https://github.com/atinux/nuxt-auth-utils/blob/main/playground/server/api/webauthn/authenticate.post.ts) and the [database setup](https://github.com/atinux/nuxt-auth-utils/blob/main/playground/server/plugins/database.ts).
+
+```ts
+// server/api/webauthn/register.post.ts
+import { z } from 'zod'
+export default defineWebAuthnRegisterEventHandler({
+  // optional
+  validateUser: z.object({
+    // we want the userName to be a valid email
+    userName: z.string().email() 
+  }).parse,
+  async onSuccess(event, { credential, user }) {
+    // The credential creation has been successful
+    // We need to create a user if it does not exist
+    const db = useDatabase()
+
+    // Get the user from the database
+    let dbUser = await db.sql`...`
+    if (!dbUser) {
+      // Store new user in database & its credentials
+      dbUser = await db.sql`...`
+    }
+
+    // we now need to store the credential in our database and link it to the user
+    await db.sql`...`
+
+    // Set the user session
+    await setUserSession(event, {
+      user: {
+        id: dbUser.id
+      },
+      loggedInAt: Date.now(),
+    })
+  },
+})
+```
+
+```ts
+// server/api/webauthn/authenticate.post.ts
+export default defineWebAuthnAuthenticateEventHandler({
+  // Optionally, we can prefetch the credentials if the user gives their userName during login
+  async allowCredentials(event, userName) {
+    const credentials = await useDatabase().sql`...`
+    // If no credentials are found, the authentication cannot be completed
+    if (!credentials.length)
+      throw createError({ statusCode: 400, message: 'User not found' })
+
+    // If user is found, only allow credentials that are registered
+    // The browser will automatically try to use the credential that it knows about
+    // Skipping the step for the user to select a credential for a better user experience
+    return credentials
+    // example: [{ id: '...' }]
+  },
+  async getCredential(event, credentialId) {
+    // Look for the credential in our database
+    const credential = await useDatabase().sql`...`
+
+    // If the credential is not found, there is no account to log in to
+    if (!credential)
+      throw createError({ statusCode: 400, message: 'Credential not found' })
+
+    return credential
+  },
+  async onSuccess(event, { credential, authenticationInfo }) {
+    // The credential authentication has been successful
+    // We can look it up in our database and get the corresponding user
+    const db = useDatabase()
+    const user = await db.sql`...`
+
+    // Update the counter in the database (authenticationInfo.newCounter)
+    await db.sql`...`
+
+    // Set the user session
+    await setUserSession(event, {
+      user: {
+        id: user.id
+      },
+      loggedInAt: Date.now(),
+    })
+  },
+})
+```
+
+> [!IMPORTANT]
+> By default, the webauthn event handlers will store the challenge in a short lived, encrypted session cookie. This is not recommended for applications that require strong security guarantees. On a secure connection (https) it is highly unlikely for this to cause problems. However, if the connection is not secure, there is a possibility of a man-in-the-middle attack. To prevent this, you should use a database or KV store to store the challenge instead. For this the `storeChallenge` and `getChallenge` functions are provided.
+
+> ```ts
+> export default defineWebAuthnAuthenticateEventHandler({
+>   async storeChallenge(event, challenge, attemptId) {
+>     // Store the challenge in a KV store or DB
+>     await useStorage().setItem(`attempt:${attemptId}`, challenge)
+>   },
+>   async getChallenge(event, attemptId) {
+>     const challenge = await useStorage().getItem(`attempt:${attemptId}`)
+>
+>     // Make sure to always remove the attempt because they are single use only!
+>     await useStorage().removeItem(`attempt:${attemptId}`)
+>
+>     if (!challenge)
+>       throw createError({ statusCode: 400, message: 'Challenge expired' })
+>
+>     return challenge
+>   },
+>   async onSuccess(event, { authenticator }) {
+>     // ...
+>   },
+> })
+> ```
+
+On the frontend it is as simple as:
+
+```vue
+<script setup lang="ts">
+const { register, authenticate } = useWebAuthn({
+  registerEndpoint: '/api/webauthn/register', // Default
+  authenticateEndpoint: '/api/webauthn/authenticate', // Default
+})
+const { fetch: fetchUserSession } = useUserSession()
+
+const userName = ref('')
+async function signUp() {
+  await register({ userName: userName.value })
+    .then(fetchUserSession) // refetch the user session
+}
+
+async function signIn() {
+  await authenticate(userName.value)
+    .then(fetchUserSession) // refetch the user session
+}
+</script>
+
+<template>
+  <form @submit.prevent="signUp">
+    <input v-model="userName" placeholder="Email or username" />
+    <button type="submit">Sign up</button>
+  </form>
+  <form @submit.prevent="signIn">
+    <input v-model="userName" placeholder="Email or username" />
+    <button type="submit">Sign in</button>
+  </form>
+</template>
+```
+
+Take a look at the [`WebAuthnModal.vue`](https://github.com/atinux/nuxt-auth-utils/blob/main/playground/components/WebAuthnModal.vue) for a full example.
+
+#### Demo
+
+A full demo can be found on https://todo-passkeys.nuxt.dev using [Drizzle ORM](https://orm.drizzle.team/) and [NuxtHub](https://hub.nuxt.com).
+
+The source code of the demo is available on https://github.com/atinux/todo-passkeys.
+
 ### Extend Session
 
 We leverage hooks to let you extend the session data with your own data or log when the user clears the session.
@@ -409,7 +648,7 @@ npm run release
 [npm-version-href]: https://npmjs.com/package/nuxt-auth-utils
 
 [npm-downloads-src]: https://img.shields.io/npm/dm/nuxt-auth-utils.svg?style=flat&colorA=020420&colorB=00DC82
-[npm-downloads-href]: https://npmjs.com/package/nuxt-auth-utils
+[npm-downloads-href]: https://npm.chart.dev/nuxt-auth-utils
 
 [license-src]: https://img.shields.io/npm/l/nuxt-auth-utils.svg?style=flat&colorA=020420&colorB=00DC82
 [license-href]: https://npmjs.com/package/nuxt-auth-utils

package/dist/module.d.mts

@@ -1,6 +1,28 @@
 import * as _nuxt_schema from '@nuxt/schema';
+import { ScryptConfig } from '@adonisjs/hash/types';
 
 interface ModuleOptions {
+    /**
+     * Enable WebAuthn (Passkeys)
+     * @default false
+     */
+    webAuthn?: boolean;
+    /**
+     * Hash options used for password hashing
+     */
+    hash?: {
+        /**
+         * scrypt options used for password hashing
+         */
+        scrypt?: ScryptConfig;
+    };
+}
+declare module 'nuxt/schema' {
+    interface RuntimeConfig {
+        hash: {
+            scrypt: ScryptConfig;
+        };
+    }
 }
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
 

package/dist/module.d.ts

@@ -1,6 +1,28 @@
 import * as _nuxt_schema from '@nuxt/schema';
+import { ScryptConfig } from '@adonisjs/hash/types';
 
 interface ModuleOptions {
+    /**
+     * Enable WebAuthn (Passkeys)
+     * @default false
+     */
+    webAuthn?: boolean;
+    /**
+     * Hash options used for password hashing
+     */
+    hash?: {
+        /**
+         * scrypt options used for password hashing
+         */
+        scrypt?: ScryptConfig;
+    };
+}
+declare module 'nuxt/schema' {
+    interface RuntimeConfig {
+        hash: {
+            scrypt: ScryptConfig;
+        };
+    }
 }
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
 

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.3.8",
+  "version": "0.4.0",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -1,5 +1,5 @@
 import { readFile, writeFile } from 'node:fs/promises';
-import { defineNuxtModule, createResolver, addComponentsDir, addImportsDir, addPlugin, addServerPlugin, addServerImportsDir, addServerHandler } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, addComponentsDir, addImportsDir, addPlugin, addServerPlugin, addServerImportsDir, logger, addServerHandler } from '@nuxt/kit';
 import { join } from 'pathe';
 import { defu } from 'defu';
 import { randomUUID } from 'uncrypto';
@@ -10,7 +10,12 @@ const module = defineNuxtModule({
     configKey: "auth"
   },
   // Default configuration options of the Nuxt module
-  defaults: {},
+  defaults: {
+    webAuthn: false,
+    hash: {
+      scrypt: {}
+    }
+  },
   async setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
     nuxt.options.alias["#auth-utils"] = resolver.resolve(
@@ -22,6 +27,22 @@ const module = defineNuxtModule({
     addPlugin(resolver.resolve("./runtime/app/plugins/session.client"));
     addServerPlugin(resolver.resolve("./runtime/server/plugins/oauth"));
     addServerImportsDir(resolver.resolve("./runtime/server/lib/oauth"));
+    if (options.webAuthn) {
+      const missingDeps = [];
+      const peerDeps = ["@simplewebauthn/server", "@simplewebauthn/browser"];
+      for (const pkg of peerDeps) {
+        await import(pkg).catch(() => {
+          missingDeps.push(pkg);
+        });
+      }
+      if (missingDeps.length > 0) {
+        logger.withTag("nuxt-auth-utils").error(`Missing dependencies for \`WebAuthn\`, please install with:
+
+\`npx nypm i ${missingDeps.join(" ")}\``);
+        process.exit(1);
+      }
+      addServerImportsDir(resolver.resolve("./runtime/server/lib/webauthn"));
+    }
     addServerImportsDir(resolver.resolve("./runtime/server/utils"));
     addServerHandler({
       handler: resolver.resolve("./runtime/server/api/session.delete"),
@@ -33,6 +54,11 @@ const module = defineNuxtModule({
       route: "/api/_auth/session",
       method: "get"
     });
+    nuxt.options.nitro.unenv ||= {};
+    nuxt.options.nitro.unenv.external ||= [];
+    if (!nuxt.options.nitro.unenv.external.includes("node:crypto")) {
+      nuxt.options.nitro.unenv.external.push("node:crypto");
+    }
     const runtimeConfig = nuxt.options.runtimeConfig;
     const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
     runtimeConfig.session = defu(runtimeConfig.session, {
@@ -42,6 +68,9 @@ const module = defineNuxtModule({
         sameSite: "lax"
       }
     });
+    runtimeConfig.hash = defu(runtimeConfig.hash, {
+      scrypt: options.hash?.scrypt
+    });
     if (nuxt.options.dev && !runtimeConfig.session.password) {
       runtimeConfig.session.password = randomUUID().replace(/-/g, "");
       const envPath = join(nuxt.options.rootDir, ".env");
@@ -54,6 +83,10 @@ const module = defineNuxtModule({
         );
       }
     }
+    runtimeConfig.webauthn = defu(runtimeConfig.webauthn, {
+      register: {},
+      authenticate: {}
+    });
     runtimeConfig.oauth = defu(runtimeConfig.oauth, {});
     runtimeConfig.oauth.github = defu(runtimeConfig.oauth.github, {
       clientId: "",
@@ -171,6 +204,11 @@ const module = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.dropbox = defu(runtimeConfig.oauth.dropbox, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
   }
 });
 

package/dist/runtime/app/composables/webauthn.d.ts

@@ -0,0 +1,13 @@
+import type { WebAuthnComposable } from '#auth-utils';
+export declare function useWebAuthn(options?: {
+    /**
+     * The endpoint to register a new credential.
+     * @default '/api/webauthn/register'
+     */
+    registerEndpoint?: string;
+    /**
+     * The endpoint to authenticate a user.
+     * @default '/api/webauthn/authenticate'
+     */
+    authenticateEndpoint?: string;
+}): WebAuthnComposable;

package/dist/runtime/app/composables/webauthn.js

@@ -0,0 +1,62 @@
+import {
+  browserSupportsWebAuthn,
+  browserSupportsWebAuthnAutofill,
+  platformAuthenticatorIsAvailable,
+  startAuthentication,
+  startRegistration
+} from "@simplewebauthn/browser";
+import { ref, onMounted } from "#imports";
+export function useWebAuthn(options = {}) {
+  const { registerEndpoint = "/api/webauthn/register", authenticateEndpoint = "/api/webauthn/authenticate" } = options;
+  async function register(user) {
+    const { creationOptions, attemptId } = await $fetch(registerEndpoint, {
+      method: "POST",
+      body: {
+        user,
+        verify: false
+      }
+    });
+    const attestationResponse = await startRegistration(creationOptions);
+    const verificationResponse = await $fetch(registerEndpoint, {
+      method: "POST",
+      body: {
+        user,
+        attemptId,
+        response: attestationResponse,
+        verify: true
+      }
+    });
+    return verificationResponse && verificationResponse.verified;
+  }
+  async function authenticate(userName) {
+    const { requestOptions, attemptId } = await $fetch(authenticateEndpoint, {
+      method: "POST",
+      body: {
+        verify: false,
+        userName
+      }
+    });
+    const assertionResponse = await startAuthentication(requestOptions);
+    const verificationResponse = await $fetch(authenticateEndpoint, {
+      method: "POST",
+      body: {
+        attemptId,
+        userName,
+        response: assertionResponse,
+        verify: true
+      }
+    });
+    return verificationResponse && verificationResponse.verified;
+  }
+  const isSupported = ref(false);
+  onMounted(() => {
+    isSupported.value = browserSupportsWebAuthn();
+  });
+  return {
+    register,
+    authenticate,
+    isSupported,
+    isAutofillSupported: browserSupportsWebAuthnAutofill,
+    isPlatformAvailable: platformAuthenticatorIsAvailable
+  };
+}

package/dist/runtime/app/plugins/session.client.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+declare const _default: any;
 export default _default;

package/dist/runtime/app/plugins/session.server.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+declare const _default: any;
 export default _default;

package/dist/runtime/server/api/session.get.js

@@ -2,7 +2,7 @@ import { eventHandler } from "h3";
 import { getUserSession, sessionHooks } from "../utils/session.js";
 export default eventHandler(async (event) => {
   const session = await getUserSession(event);
-  if (session.user) {
+  if (Object.keys(session).length > 0) {
     await sessionHooks.callHookParallel("fetch", session, event);
   }
   const { secure, ...data } = session;

package/dist/runtime/server/lib/oauth/auth0.d.ts

@@ -57,4 +57,4 @@ export interface OAuthAuth0Config {
      */
     redirectURL?: string;
 }
-export declare function oauthAuth0EventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuth0Config>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthAuth0EventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuth0Config>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/auth0.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function oauthAuth0EventHandler({ config, onSuccess, onError }) {
+export function defineOAuthAuth0EventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.auth0, {
       authorizationParams: {}

package/dist/runtime/server/lib/oauth/battledotnet.d.ts

@@ -45,4 +45,4 @@ export interface OAuthBattledotnetConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthBattledotnetEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBattledotnetConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBattledotnetConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/battledotnet.js

@@ -4,7 +4,7 @@ import { defu } from "defu";
 import { randomUUID } from "uncrypto";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthBattledotnetEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.battledotnet, {
       authorizationURL: "https://oauth.battle.net/authorize",

package/dist/runtime/server/lib/oauth/cognito.d.ts

@@ -41,4 +41,4 @@ export interface OAuthCognitoConfig {
      */
     domain?: string;
 }
-export declare function oauthCognitoEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthCognitoConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthCognitoEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthCognitoConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/cognito.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function oauthCognitoEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.cognito, {
       authorizationParams: {}

package/dist/runtime/server/lib/oauth/discord.d.ts

@@ -50,4 +50,4 @@ export interface OAuthDiscordConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthDiscordEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDiscordConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthDiscordEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDiscordConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/discord.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function oauthDiscordEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthDiscordEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.discord, {
       authorizationURL: "https://discord.com/oauth2/authorize",

package/dist/runtime/server/lib/oauth/dropbox.d.ts

@@ -0,0 +1,47 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthDropboxConfig {
+    /**
+     * Dropbox Client ID
+     * @default process.env.NUXT_OAUTH_DROPBOX_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Dropbox OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_DROPBOX_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Dropbox OAuth Scope
+     * @default []
+     * @see https://developers.dropbox.com/oauth-guide#dropbox-api-permissions
+     * @example ['email', 'profile']
+     */
+    scope?: string[];
+    /**
+     * Require email from user, adds the ['email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+    /**
+     * Dropbox OAuth Authorization URL
+     * @default 'https://www.dropbox.com/oauth2/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Dropbox OAuth Token URL
+     * @default 'https://api.dropboxapi.com/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://www.dropbox.com/developers/documentation/http/documentation#authorization
+     * @example { locale: 'en-US' }
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_DROPBOX_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthDropboxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDropboxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;