nuxt-auth-utils 0.3.9 → 0.4.0

package/dist/runtime/server/lib/webauthn/utils.js

@@ -0,0 +1,35 @@
+import { useSession, createError } from "h3";
+import { useRuntimeConfig } from "#imports";
+function useChallengeSession(event) {
+  return useSession(event, {
+    name: "webauthn",
+    password: useRuntimeConfig(event).session.password,
+    cookie: {
+      httpOnly: true,
+      secure: true,
+      maxAge: 180
+      // 3 minutes
+    }
+  });
+}
+export async function storeChallengeAsSession(event, challenge, challengeId) {
+  const challengeSession = await useChallengeSession(event);
+  await challengeSession.update({
+    data: {
+      challenge,
+      challengeId
+    },
+    expires: Date.now() + 180 * 1e3
+    // 3 minutes
+  });
+}
+export async function getChallengeFromSession(event, challengeId) {
+  const challengeSession = await useChallengeSession(event);
+  const challenge = challengeSession.data;
+  await challengeSession.clear();
+  if (challenge.expires < Date.now())
+    throw createError({ statusCode: 400, message: "Challenge expired" });
+  if (challenge.data.challengeId !== challengeId)
+    throw createError({ statusCode: 400, message: "Challenge id mismatch" });
+  return challenge.data.challenge;
+}

package/dist/runtime/server/utils/password.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Hash a password using scrypt
+ * @param password - The plain text password to hash
+ * @returns The hashed password
+ * @example
+ * ```ts
+ * const hashedPassword = await hashPassword('user_password')
+ * ```
+ * @more you can configure the scrypt options in `auth.hash.scrypt`
+ */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Verify a password against a hashed password
+ * @param hashedPassword - The hashed password to verify against
+ * @param plainPassword - The plain text password to verify
+ * @returns `true` if the password is valid, `false` otherwise
+ * @example
+ * ```ts
+ * const isValid = await verifyPassword(hashedPassword, 'user_password')
+ * ```
+ * @more you can configure the scrypt options in `auth.hash.scrypt`
+ */
+export declare function verifyPassword(hashedPassword: string, plainPassword: string): Promise<boolean>;

package/dist/runtime/server/utils/password.js

@@ -0,0 +1,18 @@
+import { Hash } from "@adonisjs/hash";
+import { Scrypt } from "@adonisjs/hash/drivers/scrypt";
+import { useRuntimeConfig } from "#imports";
+let _hash;
+function getHash() {
+  if (!_hash) {
+    const options = useRuntimeConfig().hash?.scrypt;
+    const scrypt = new Scrypt(options);
+    _hash = new Hash(scrypt);
+  }
+  return _hash;
+}
+export async function hashPassword(password) {
+  return await getHash().make(password);
+}
+export async function verifyPassword(hashedPassword, plainPassword) {
+  return await getHash().verify(hashedPassword, plainPassword);
+}

package/dist/runtime/types/index.d.ts

@@ -1,2 +1,3 @@
 export type { User, UserSession, UserSessionRequired, UserSessionComposable, SecureSessionData } from './session.js';
 export type { OAuthConfig, OAuthProvider, OnError } from './oauth-config.js';
+export type { WebAuthnCredential, WebAuthnRegisterEventHandlerOptions, WebAuthnAuthenticateEventHandlerOptions, WebAuthnComposable, WebAuthnUser, } from './webauthn.js';

package/dist/runtime/types/oauth-config.d.ts

@@ -1,5 +1,5 @@
 import type { H3Event, H3Error } from 'h3';
-export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linkedin' | 'microsoft' | 'paypal' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'x' | 'xsuaa' | 'yandex' | (string & {});
+export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linkedin' | 'microsoft' | 'paypal' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'x' | 'xsuaa' | 'yandex' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/dist/runtime/types/webauthn.d.ts

@@ -0,0 +1,76 @@
+import type { AuthenticatorTransportFuture } from '@simplewebauthn/types';
+import type { Ref } from 'vue';
+import type { H3Event, H3Error, ValidateFunction } from 'h3';
+import type { GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, VerifiedAuthenticationResponse, VerifiedRegistrationResponse } from '@simplewebauthn/server';
+export interface WebAuthnCredential {
+    id: string;
+    publicKey: string;
+    counter: number;
+    backedUp: boolean;
+    transports?: AuthenticatorTransportFuture[];
+    [key: string]: unknown;
+}
+export interface WebAuthnUser {
+    userName: string;
+    displayName?: string;
+    [key: string]: unknown;
+}
+type AllowCredentials = NonNullable<GenerateAuthenticationOptionsOpts['allowCredentials']>;
+type WebAuthnEventHandlerBase<T extends Record<PropertyKey, unknown>> = {
+    storeChallenge: (event: H3Event, challenge: string, attemptId: string) => void | Promise<void>;
+    getChallenge: (event: H3Event, attemptId: string) => string | Promise<string>;
+    onSuccess: (event: H3Event, data: T) => void | Promise<void>;
+    onError?: (event: H3Event, error: H3Error) => void | Promise<void>;
+} | {
+    storeChallenge?: undefined;
+    getChallenge?: undefined;
+    onSuccess: (event: H3Event, data: T) => void | Promise<void>;
+    onError?: (event: H3Event, error: H3Error) => void | Promise<void>;
+};
+export type WebAuthnRegisterEventHandlerOptions<T extends WebAuthnUser> = WebAuthnEventHandlerBase<{
+    user: T;
+    credential: WebAuthnCredential;
+    registrationInfo: Exclude<VerifiedRegistrationResponse['registrationInfo'], undefined>;
+}> & {
+    getOptions?: (event: H3Event) => GenerateRegistrationOptionsOpts | Promise<GenerateRegistrationOptionsOpts>;
+    validateUser?: ValidateFunction<T>;
+};
+export type WebAuthnAuthenticateEventHandlerOptions<T extends WebAuthnCredential> = WebAuthnEventHandlerBase<{
+    credential: T;
+    authenticationInfo: Exclude<VerifiedAuthenticationResponse['authenticationInfo'], undefined>;
+}> & {
+    getOptions?: (event: H3Event) => Partial<GenerateAuthenticationOptionsOpts> | Promise<Partial<GenerateAuthenticationOptionsOpts>>;
+    getCredential: (event: H3Event, credentialID: string) => T | Promise<T>;
+    allowCredentials?: (event: H3Event, userName: string) => AllowCredentials | Promise<AllowCredentials>;
+};
+export interface WebAuthnComposable {
+    /**
+     * Vue ref (boolean) that checks if the webauthn API is available
+     */
+    isSupported: Ref<boolean>;
+    /**
+     * Helper function that checks if the browser supports "Conditional UI" for webauthn
+     * @see https://github.com/w3c/webauthn/wiki/Explainer:-WebAuthn-Conditional-UI
+     */
+    isAutofillSupported: () => Promise<boolean>;
+    /**
+     * Helper function that returns if platform specific authenticators are available (Touch ID, Face ID, Windows Hello, etc.)
+     * You can use this information to prioritize these authenticators over others.
+     */
+    isPlatformAvailable: () => Promise<boolean>;
+    /**
+     * Register a credential
+     * @param user - The user data to register
+     * @param user.userName - The user name to register, can be an email address, a username, or any other form of unique ID chosen by the user
+     * @param user.displayName - The display name to register, used for convenience and personalization and should not be relied upon as a secure identifier for authentication processes
+     * @returns true if the registration was successful
+     */
+    register: <T extends WebAuthnUser>(data: T) => Promise<boolean>;
+    /**
+     * Authenticate a credential
+     * @param userName - The user name to authenticate, can be an email address, a username, or any other form of unique ID chosen by the user
+     * @returns true if the authentication was successful
+     */
+    authenticate: (userName?: string) => Promise<boolean>;
+}
+export {};

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.3.9",
-  "description": "Minimalist Auth module for Nuxt with SSR",
-  "repository": "Atinux/nuxt-auth-utils",
+  "version": "0.4.0",
+  "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
+  "repository": "atinux/nuxt-auth-utils",
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.10.0",
+  "packageManager": "pnpm@9.11.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.ts",
@@ -32,26 +32,40 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
+    "@adonisjs/hash": "^9.0.5",
     "@nuxt/kit": "^3.13.2",
     "defu": "^6.1.4",
     "hookable": "^5.5.3",
-    "ofetch": "^1.3.4",
+    "ofetch": "^1.4.0",
     "ohash": "^1.1.4",
     "pathe": "^1.1.2",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
   },
+  "peerDependencies": {
+    "@simplewebauthn/browser": "^10.0.0",
+    "@simplewebauthn/server": "^10.0.1"
+  },
+  "peerDependenciesMeta": {
+    "@simplewebauthn/browser": {
+      "optional": true
+    },
+    "@simplewebauthn/server": {
+      "optional": true
+    }
+  },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.3",
+    "@iconify-json/simple-icons": "^1.2.4",
     "@nuxt/devtools": "latest",
     "@nuxt/eslint-config": "^0.5.7",
     "@nuxt/module-builder": "^0.8.4",
     "@nuxt/schema": "^3.13.2",
     "@nuxt/test-utils": "^3.14.2",
-    "@nuxt/ui": "^2.18.5",
-    "@nuxt/ui-pro": "^1.4.2",
+    "@nuxt/ui": "^2.18.6",
+    "@nuxt/ui-pro": "^1.4.3",
+    "@simplewebauthn/types": "^10.0.0",
     "changelogen": "^0.5.7",
-    "eslint": "^9.10.0",
+    "eslint": "^9.11.1",
     "nuxt": "^3.13.2",
     "typescript": "^5.6.2",
     "vitest": "^2.1.1",