nuxt-auth-utils 0.4.1 → 0.4.3

package/README.md

@@ -126,7 +126,7 @@ await setUserSession(event, {
   user: {
     login: 'atinux'
   },
-  // Private data accessible on server/ routes
+  // Private data accessible only on server/ routes
   secure: {
     apiToken: '1234567890'
   },
@@ -215,9 +215,11 @@ It can also be set using environment variables:
 - Google
 - Instagram
 - Keycloak
+- Linear
 - LinkedIn
 - Microsoft
 - PayPal
+- Polar
 - Spotify
 - Steam
 - TikTok

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -147,6 +147,11 @@ const module = defineNuxtModule({
       realm: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.linear = defu(runtimeConfig.oauth.linear, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
     runtimeConfig.oauth.linkedin = defu(runtimeConfig.oauth.linkedin, {
       clientId: "",
       clientSecret: "",
@@ -209,6 +214,11 @@ const module = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.polar = defu(runtimeConfig.oauth.polar, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
   }
 });
 

package/dist/runtime/app/plugins/session.client.d.ts

@@ -1,2 +1,2 @@
-declare const _default: any;
+declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
 export default _default;

package/dist/runtime/app/plugins/session.server.d.ts

@@ -1,2 +1,2 @@
-declare const _default: any;
+declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
 export default _default;

package/dist/runtime/server/lib/oauth/linear.d.ts

@@ -0,0 +1,41 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthLinearConfig {
+    /**
+     * Linear OAuth Client ID
+     * @default process.env.NUXT_OAUTH_LINEAR_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Linear OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_LINEAR_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Linear OAuth Scope
+     * @default ['read']
+     * @see https://developers.linear.app/docs/oauth/authentication#scopes
+     * @example ['read', 'write', 'issues:create', 'comments:create', 'timeSchedule:write', 'admin']
+     */
+    scope?: string[];
+    /**
+     * Linear OAuth Authorization URL
+     * @default 'https://linear.app/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Linear OAuth Token URL
+     * @default 'https://api.linear.app/oauth/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://developers.linear.app/docs/oauth/authentication#id-2.-redirect-user-access-requests-to-linear
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_LINEAR_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthLinearEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinearConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/linear.js

@@ -0,0 +1,80 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthLinearEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.linear, {
+      authorizationURL: "https://linear.app/oauth/authorize",
+      tokenURL: "https://api.linear.app/oauth/token",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Linear login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "linear", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || ["read"];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          ...config.authorizationParams
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "linear", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch("https://api.linear.app/graphql", {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${accessToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        query: "{ viewer { id name email } }"
+      })
+    });
+    if (!user.data || !user.data.viewer) {
+      const error = createError({
+        statusCode: 500,
+        message: "Could not get Linear user",
+        data: tokens
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user: user.data.viewer
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/polar.d.ts

@@ -0,0 +1,49 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthPolarConfig {
+    /**
+     * Polar Client ID
+     * @default process.env.NUXT_OAUTH_POLAR_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Polar OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_POLAR_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Polar OAuth Scope
+     * @default []
+     * @see https://api.polar.sh/.well-known/openid-configuration
+     * @example ['openid']
+     */
+    scope?: string[];
+    /**
+     * Require email from user, adds the ['email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+    /**
+     * Polar OAuth Authorization URL
+     * @see https://docs.polar.sh/api/authentication#start-the-authorization-flow
+     * @default 'https://polar.sh/oauth2/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Polar OAuth Token URL
+     * @see https://docs.polar.sh/api/authentication#exchange-the-authorization-code
+     * @default 'https://api.polar.sh/v1/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://docs.polar.sh/api/authentication#user-vs-organization-access-tokens
+     * @example { sub_type: 'organization' }
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_POLAR_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthPolarEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPolarConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/polar.js

@@ -0,0 +1,67 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthPolarEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.polar, {
+      authorizationURL: "https://polar.sh/oauth2/authorize",
+      tokenURL: "https://api.polar.sh/v1/oauth2/token"
+    });
+    const query = getQuery(event);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "polar", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (!config.scope.includes("openid"))
+        config.scope.push("openid");
+      if (config.emailRequired && !config.scope.includes("email"))
+        config.scope.push("email");
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          ...config.authorizationParams
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "polar", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch("https://api.polar.sh/v1/oauth2/userinfo", {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json"
+      }
+    });
+    if (!user) {
+      const error = createError({
+        statusCode: 500,
+        message: "Could not get Polar user",
+        data: tokens
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/utils/session.d.ts

@@ -37,7 +37,7 @@ export declare function replaceUserSession(event: H3Event, data: UserSession, co
  * @param event The Request (h3) event
  * @returns true if the session was cleared
  */
-export declare function clearUserSession(event: H3Event): Promise<boolean>;
+export declare function clearUserSession(event: H3Event, config?: Partial<SessionConfig>): Promise<boolean>;
 /**
  * Require a user session, throw a 401 error if the user is not logged in
  * @param event

package/dist/runtime/server/utils/session.js

@@ -17,8 +17,8 @@ export async function replaceUserSession(event, data, config) {
   await session.update(data);
   return session.data;
 }
-export async function clearUserSession(event) {
-  const session = await _useSession(event);
+export async function clearUserSession(event, config) {
+  const session = await _useSession(event, config);
   await sessionHooks.callHookParallel("clear", session.data, event);
   await session.clear();
   return true;

package/dist/runtime/types/oauth-config.d.ts

@@ -1,5 +1,5 @@
 import type { H3Event, H3Error } from 'h3';
-export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linkedin' | 'microsoft' | 'paypal' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'x' | 'xsuaa' | 'yandex' | (string & {});
+export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'x' | 'xsuaa' | 'yandex' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": "atinux/nuxt-auth-utils",
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.11.0",
+  "packageManager": "pnpm@9.12.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.ts",
@@ -55,7 +55,7 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.4",
+    "@iconify-json/simple-icons": "^1.2.6",
     "@nuxt/devtools": "latest",
     "@nuxt/eslint-config": "^0.5.7",
     "@nuxt/module-builder": "^0.8.4",
@@ -65,10 +65,10 @@
     "@nuxt/ui-pro": "^1.4.3",
     "@simplewebauthn/types": "^10.0.0",
     "changelogen": "^0.5.7",
-    "eslint": "^9.11.1",
+    "eslint": "^9.12.0",
     "nuxt": "^3.13.2",
     "typescript": "^5.6.2",
-    "vitest": "^2.1.1",
+    "vitest": "^2.1.2",
     "vue-tsc": "^2.1.6"
   }
 }