nuxt-auth-utils 0.3.9 → 0.4.0

package/dist/runtime/server/lib/oauth/dropbox.js

@@ -0,0 +1,72 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthDropboxEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.dropbox, {
+      authorizationURL: "https://www.dropbox.com/oauth2/authorize",
+      tokenURL: "https://api.dropboxapi.com/oauth2/token",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (!config.clientId) {
+      return handleMissingConfiguration(event, "dropbox", ["clientId"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (!config.scope.includes("openid")) {
+        config.scope.push("openid");
+      }
+      if (config.emailRequired && !config.scope.includes("email")) {
+        config.scope.push("email");
+      }
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          ...config.authorizationParams
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`
+      },
+      params: {
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "dropbox", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const users = await $fetch("https://api.dropboxapi.com/2/openid/userinfo", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    const user = users;
+    if (!user) {
+      const error = createError({
+        statusCode: 500,
+        message: "Could not get Dropbox user",
+        data: tokens
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/facebook.d.ts

@@ -45,4 +45,4 @@ export interface OAuthFacebookConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthFacebookEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthFacebookConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthFacebookEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthFacebookConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/facebook.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthFacebookEventHandler({
+export function defineOAuthFacebookEventHandler({
   config,
   onSuccess,
   onError

package/dist/runtime/server/lib/oauth/github.d.ts

@@ -45,4 +45,4 @@ export interface OAuthGitHubConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthGitHubEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthGitHubConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthGitHubEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthGitHubConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/github.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthGitHubEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.github, {
       authorizationURL: "https://github.com/login/oauth/authorize",

package/dist/runtime/server/lib/oauth/gitlab.d.ts

@@ -44,4 +44,4 @@ export interface OAuthGitLabConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthGitLabEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGitLabConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthGitLabEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGitLabConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/gitlab.js

@@ -8,7 +8,7 @@ import {
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthGitLabEventHandler({
+export function defineOAuthGitLabEventHandler({
   config,
   onSuccess,
   onError

package/dist/runtime/server/lib/oauth/google.d.ts

@@ -44,4 +44,4 @@ export interface OAuthGoogleConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthGoogleEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGoogleConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthGoogleEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGoogleConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/google.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function oauthGoogleEventHandler({
+export function defineOAuthGoogleEventHandler({
   config,
   onSuccess,
   onError
@@ -29,6 +29,7 @@ export function oauthGoogleEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
+          state: query.state || "",
           ...config.authorizationParams
         })
       );

package/dist/runtime/server/lib/oauth/instagram.d.ts

@@ -45,4 +45,4 @@ export interface OAuthInstagramConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthInstagramEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthInstagramConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthInstagramEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthInstagramConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/instagram.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthInstagramEventHandler({
+export function defineOAuthInstagramEventHandler({
   config,
   onSuccess,
   onError

package/dist/runtime/server/lib/oauth/keycloak.d.ts

@@ -38,4 +38,4 @@ export interface OAuthKeycloakConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthKeycloakEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthKeycloakConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthKeycloakEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthKeycloakConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/keycloak.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthKeycloakEventHandler({
+export function defineOAuthKeycloakEventHandler({
   config,
   onSuccess,
   onError

package/dist/runtime/server/lib/oauth/linkedin.d.ts

@@ -42,4 +42,4 @@ export interface OAuthLinkedInConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthLinkedInEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinkedInConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthLinkedInEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinkedInConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/linkedin.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function oauthLinkedInEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthLinkedInEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.linkedin, {
       authorizationURL: "https://www.linkedin.com/oauth/v2/authorization",

package/dist/runtime/server/lib/oauth/microsoft.d.ts

@@ -51,4 +51,4 @@ export interface OAuthMicrosoftConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthMicrosoftEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthMicrosoftConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthMicrosoftConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/microsoft.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthMicrosoftEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.microsoft, {
       authorizationParams: {}

package/dist/runtime/server/lib/oauth/paypal.d.ts

@@ -49,4 +49,4 @@ export interface OAuthPaypalConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthPaypalEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPaypalConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthPaypalEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPaypalConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/paypal.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthPaypalEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthPaypalEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.paypal, {
       sandbox: import.meta.dev,

package/dist/runtime/server/lib/oauth/spotify.d.ts

@@ -44,4 +44,4 @@ export interface OAuthSpotifyConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthSpotifyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSpotifyConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSpotifyConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/spotify.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function oauthSpotifyEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.spotify, {
       authorizationURL: "https://accounts.spotify.com/authorize",

package/dist/runtime/server/lib/oauth/steam.d.ts

@@ -17,4 +17,4 @@ export interface OAuthSteamConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthSteamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSteamConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSteamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSteamConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/steam.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function oauthSteamEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.steam, {
       authorizationURL: "https://steamcommunity.com/openid/login"
@@ -23,19 +23,22 @@ export function oauthSteamEventHandler({ config, onSuccess, onError }) {
       };
       return sendRedirect(event, withQuery(config.authorizationURL, steamOpenIdParams));
     }
-    const validateAuth = await $fetch(withQuery(config.authorizationURL, {
-      ...query,
-      "openid.mode": "check_authentication"
-    }));
-    if (!validateAuth.includes("is_valid:true")) {
+    const openIdCheck = {
+      ns: "http://specs.openid.net/auth/2.0",
+      claimed_id: "https://steamcommunity.com/openid/id/",
+      identity: "https://steamcommunity.com/openid/id/"
+    };
+    const idRegex = /^https?:\/\/steamcommunity\.com\/openid\/id\/(\d+)$/;
+    const steamIdCheck = idRegex.exec(query["openid.claimed_id"]);
+    if (query["openid.op_endpoint"] !== config.authorizationURL || !steamIdCheck || query["openid.ns"] !== openIdCheck.ns || !query["openid.claimed_id"]?.startsWith(openIdCheck.claimed_id) || !query["openid.identity"]?.startsWith(openIdCheck.identity)) {
       const error = createError({
         statusCode: 401,
-        message: "Steam login failed: Unknown error"
+        message: "Steam login failed: Claimed identity is invalid."
       });
       if (!onError) throw error;
       return onError(event, error);
     }
-    const steamId = query["openid.claimed_id"].split("/").pop();
+    const steamId = steamIdCheck[1];
     const user = await $fetch(withQuery("https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/", {
       key: config.apiKey,
       steamids: steamId

package/dist/runtime/server/lib/oauth/tiktok.d.ts

@@ -42,4 +42,4 @@ export interface OAuthTikTokConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthTikTokEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTikTokConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthTikTokEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTikTokConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/tiktok.js

@@ -4,7 +4,7 @@ import { defu } from "defu";
 import { sha256 } from "ohash";
 import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthTikTokEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthTikTokEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.tiktok, {
       sandbox: import.meta.dev,

package/dist/runtime/server/lib/oauth/twitch.d.ts

@@ -44,4 +44,4 @@ export interface OAuthTwitchConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/twitch.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthTwitchEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthTwitchEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.twitch, {
       authorizationURL: "https://id.twitch.tv/oauth2/authorize",

package/dist/runtime/server/lib/oauth/vk.d.ts

@@ -43,4 +43,4 @@ export interface OAuthVKConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthVKEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthVKConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthVKEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthVKConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/vk.js

@@ -9,7 +9,7 @@ import {
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
-export function oauthVKEventHandler({
+export function defineOAuthVKEventHandler({
   config,
   onSuccess,
   onError

package/dist/runtime/server/lib/oauth/x.d.ts

@@ -43,4 +43,4 @@ export interface OAuthXConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthXEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthXConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthXEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthXConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/x.js

@@ -9,7 +9,7 @@ import {
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function oauthXEventHandler({
+export function defineOAuthXEventHandler({
   config,
   onSuccess,
   onError

package/dist/runtime/server/lib/oauth/xsuaa.d.ts

@@ -28,4 +28,4 @@ export interface OAuthXSUAAConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthXSUAAEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthXSUAAConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthXSUAAConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/xsuaa.js

@@ -3,7 +3,7 @@ import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function oauthXSUAAEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.xsuaa);
     const query = getQuery(event);

package/dist/runtime/server/lib/oauth/yandex.d.ts

@@ -43,4 +43,4 @@ export interface OAuthYandexConfig {
      */
     redirectURL?: string;
 }
-export declare function oauthYandexEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthYandexConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthYandexEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthYandexConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/yandex.js

@@ -8,7 +8,7 @@ import {
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function oauthYandexEventHandler({
+export function defineOAuthYandexEventHandler({
   config,
   onSuccess,
   onError

package/dist/runtime/server/lib/webauthn/authenticate.d.ts

@@ -0,0 +1,5 @@
+import type { WebAuthnAuthenticateEventHandlerOptions, WebAuthnCredential } from '#auth-utils';
+export declare function defineWebAuthnAuthenticateEventHandler<T extends WebAuthnCredential>({ storeChallenge, getChallenge, getCredential, allowCredentials, getOptions, onSuccess, onError, }: WebAuthnAuthenticateEventHandlerOptions<T>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void | import("@simplewebauthn/server").VerifiedAuthenticationResponse | {
+    requestOptions: import("@simplewebauthn/types").PublicKeyCredentialRequestOptionsJSON;
+    attemptId: string;
+}>>;

package/dist/runtime/server/lib/webauthn/authenticate.js

@@ -0,0 +1,73 @@
+import { eventHandler, H3Error, createError, getRequestURL, readBody } from "h3";
+import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
+import defu from "defu";
+import { getRandomValues } from "uncrypto";
+import { base64URLStringToBuffer, bufferToBase64URLString } from "@simplewebauthn/browser";
+import { storeChallengeAsSession, getChallengeFromSession } from "./utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineWebAuthnAuthenticateEventHandler({
+  storeChallenge,
+  getChallenge,
+  getCredential,
+  allowCredentials,
+  getOptions,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const url = getRequestURL(event);
+    const body = await readBody(event);
+    const _config = defu(await getOptions?.(event) ?? {}, useRuntimeConfig(event).webauthn.authenticate, {
+      rpID: url.hostname
+    });
+    if (allowCredentials && body.userName) {
+      _config.allowCredentials = await allowCredentials(event, body.userName);
+    }
+    try {
+      if (!body.verify) {
+        const options = await generateAuthenticationOptions(_config);
+        const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)));
+        if (storeChallenge)
+          await storeChallenge(event, options.challenge, attemptId);
+        else
+          await storeChallengeAsSession(event, options.challenge, attemptId);
+        return {
+          requestOptions: options,
+          attemptId
+        };
+      }
+      if (!body.attemptId)
+        throw createError({ statusCode: 400 });
+      let challenge;
+      if (getChallenge)
+        challenge = await getChallenge(event, body.attemptId);
+      else
+        challenge = await getChallengeFromSession(event, body.attemptId);
+      const credential = await getCredential(event, body.response.id);
+      const verification = await verifyAuthenticationResponse({
+        response: body.response,
+        expectedChallenge: challenge,
+        expectedOrigin: url.origin,
+        expectedRPID: url.hostname,
+        authenticator: {
+          credentialID: credential.id,
+          credentialPublicKey: new Uint8Array(base64URLStringToBuffer(credential.publicKey)),
+          counter: credential.counter,
+          transports: credential.transports
+        }
+      });
+      if (!verification.verified)
+        throw createError({ statusCode: 400, message: "Failed to verify registration response" });
+      await onSuccess(event, {
+        credential,
+        authenticationInfo: verification.authenticationInfo
+      });
+      return verification;
+    } catch (error) {
+      if (!onError) throw error;
+      if (error instanceof H3Error)
+        return onError(event, error);
+      return onError(event, createError({ statusCode: 500, message: "Failed to authenticate credential" }));
+    }
+  });
+}

package/dist/runtime/server/lib/webauthn/register.d.ts

@@ -0,0 +1,7 @@
+import type { ValidateFunction } from 'h3';
+import type { WebAuthnUser, WebAuthnRegisterEventHandlerOptions } from '#auth-utils';
+export declare function defineWebAuthnRegisterEventHandler<T extends WebAuthnUser>({ storeChallenge, getChallenge, getOptions, validateUser, onSuccess, onError, }: WebAuthnRegisterEventHandlerOptions<T>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void | import("@simplewebauthn/server").VerifiedRegistrationResponse | {
+    creationOptions: import("@simplewebauthn/types").PublicKeyCredentialCreationOptionsJSON;
+    attemptId: string;
+}>>;
+export declare function validateUserData<T>(data: unknown, fn: ValidateFunction<T>): Promise<T>;

package/dist/runtime/server/lib/webauthn/register.js

@@ -0,0 +1,116 @@
+import { eventHandler, H3Error, createError, getRequestURL, readBody } from "h3";
+import { generateRegistrationOptions, verifyRegistrationResponse } from "@simplewebauthn/server";
+import defu from "defu";
+import { bufferToBase64URLString } from "@simplewebauthn/browser";
+import { getRandomValues } from "uncrypto";
+import { storeChallengeAsSession, getChallengeFromSession } from "./utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineWebAuthnRegisterEventHandler({
+  storeChallenge,
+  getChallenge,
+  getOptions,
+  validateUser,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const url = getRequestURL(event);
+    const body = await readBody(event);
+    if (body.verify === void 0 || !body.user?.userName)
+      throw createError({
+        message: "Invalid request, missing userName or verify property",
+        statusCode: 400
+      });
+    let user = body.user;
+    if (validateUser) {
+      user = await validateUserData(body.user, validateUser);
+    }
+    const _config = defu(await getOptions?.(event) ?? {}, useRuntimeConfig(event).webauthn.register, {
+      rpID: url.hostname,
+      rpName: url.hostname,
+      userName: user.userName,
+      userDisplayName: user.displayName,
+      authenticatorSelection: {
+        userVerification: "preferred"
+      }
+    });
+    try {
+      if (!body.verify) {
+        const options = await generateRegistrationOptions(_config);
+        const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)));
+        if (storeChallenge)
+          await storeChallenge?.(event, options.challenge, attemptId);
+        else
+          await storeChallengeAsSession(event, options.challenge, attemptId);
+        return {
+          creationOptions: options,
+          attemptId
+        };
+      }
+      if (!body.attemptId) {
+        throw createError({
+          message: "Invalid request, missing attemptId",
+          statusCode: 400
+        });
+      }
+      let expectedChallenge;
+      if (getChallenge)
+        expectedChallenge = await getChallenge(event, body.attemptId);
+      else
+        expectedChallenge = await getChallengeFromSession(event, body.attemptId);
+      const verification = await verifyRegistrationResponse({
+        response: body.response,
+        expectedChallenge,
+        expectedOrigin: url.origin,
+        expectedRPID: url.hostname,
+        requireUserVerification: false,
+        // TODO: make configurable https://simplewebauthn.dev/docs/advanced/passkeys#verifyregistrationresponse
+        supportedAlgorithmIDs: _config.supportedAlgorithmIDs
+      });
+      if (!verification.verified) {
+        throw createError({
+          message: "Failed to verify registration response",
+          statusCode: 400
+        });
+      }
+      await onSuccess(event, {
+        user,
+        credential: {
+          id: verification.registrationInfo.credentialID,
+          publicKey: bufferToBase64URLString(verification.registrationInfo.credentialPublicKey),
+          counter: verification.registrationInfo.counter,
+          backedUp: verification.registrationInfo.credentialBackedUp,
+          transports: body.response.response.transports
+        },
+        registrationInfo: verification.registrationInfo
+      });
+      return verification;
+    } catch (error) {
+      if (!onError) throw error;
+      if (error instanceof H3Error)
+        return onError(event, error);
+      return onError(event, createError({ statusCode: 500, message: "Failed to register credential" }));
+    }
+  });
+}
+export async function validateUserData(data, fn) {
+  try {
+    const res = await fn(data);
+    if (res === false) {
+      throw createUserValidationError();
+    }
+    if (res === true) {
+      return data;
+    }
+    return res ?? data;
+  } catch (error) {
+    throw createUserValidationError(error);
+  }
+}
+function createUserValidationError(validateError) {
+  throw createError({
+    status: 400,
+    message: "User Validation Error",
+    data: validateError
+  });
+}

package/dist/runtime/server/lib/webauthn/utils.d.ts

@@ -0,0 +1,3 @@
+import { type H3Event } from 'h3';
+export declare function storeChallengeAsSession(event: H3Event, challenge: string, challengeId: string): Promise<void>;
+export declare function getChallengeFromSession(event: H3Event, challengeId: string): Promise<string>;