nuxt-auth-utils 0.4.4 → 0.5.1

package/README.md

@@ -296,7 +296,7 @@ To enable WebAuthn you need to:
 1. Install the peer dependencies:
 
 ```bash
-npx nypm i @simplewebauthn/server @simplewebauthn/browser
+npx nypm i @simplewebauthn/server@11 @simplewebauthn/browser@11
 ```
 
 2. Enable it in your `nuxt.config.ts`
@@ -425,7 +425,7 @@ export default defineWebAuthnAuthenticateEventHandler({
 ```
 
 > [!IMPORTANT]
-> Webauthn uses challenges to prevent replay attacks. By default, this module does not make use if this feature. If you want to use challenges (**which is highly recommended**), the `storeChallenge` and `getChallenge` functions are provided. An attempt ID is created and sent with each autentication request. You can use this ID to store the challenge in a database or KV store as shown in the example below.
+> Webauthn uses challenges to prevent replay attacks. By default, this module does not make use if this feature. If you want to use challenges (**which is highly recommended**), the `storeChallenge` and `getChallenge` functions are provided. An attempt ID is created and sent with each authentication request. You can use this ID to store the challenge in a database or KV store as shown in the example below.
 
 > ```ts
 > export default defineWebAuthnAuthenticateEventHandler({

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.4.4",
+  "version": "0.5.1",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -1,5 +1,5 @@
 import { readFile, writeFile } from 'node:fs/promises';
-import { defineNuxtModule, createResolver, addComponentsDir, addImportsDir, addPlugin, addServerPlugin, addServerImportsDir, logger, addServerHandler } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, addComponentsDir, addImports, addPlugin, addServerPlugin, addServerImportsDir, logger, addServerHandler } from '@nuxt/kit';
 import { join } from 'pathe';
 import { defu } from 'defu';
 import { randomUUID } from 'uncrypto';
@@ -21,8 +21,14 @@ const module = defineNuxtModule({
     nuxt.options.alias["#auth-utils"] = resolver.resolve(
       "./runtime/types/index"
     );
+    const composables = [
+      { name: "useUserSession", from: resolver.resolve("./runtime/app/composables/session") }
+    ];
+    if (options.webAuthn) {
+      composables.push({ name: "useWebAuthn", from: resolver.resolve("./runtime/app/composables/webauthn") });
+    }
     addComponentsDir({ path: resolver.resolve("./runtime/app/components") });
-    addImportsDir(resolver.resolve("./runtime/app/composables"));
+    addImports(composables);
     addPlugin(resolver.resolve("./runtime/app/plugins/session.server"));
     addPlugin(resolver.resolve("./runtime/app/plugins/session.client"));
     addServerPlugin(resolver.resolve("./runtime/server/plugins/oauth"));

package/dist/runtime/app/composables/webauthn.d.ts

@@ -10,4 +10,9 @@ export declare function useWebAuthn(options?: {
      * @default '/api/webauthn/authenticate'
      */
     authenticateEndpoint?: string;
+    /**
+     * Enable browser autofill for authentication
+     * @default false
+     */
+    useBrowserAutofill?: boolean;
 }): WebAuthnComposable;

package/dist/runtime/app/composables/webauthn.js

@@ -7,7 +7,11 @@ import {
 } from "@simplewebauthn/browser";
 import { ref, onMounted } from "#imports";
 export function useWebAuthn(options = {}) {
-  const { registerEndpoint = "/api/webauthn/register", authenticateEndpoint = "/api/webauthn/authenticate" } = options;
+  const {
+    registerEndpoint = "/api/webauthn/register",
+    authenticateEndpoint = "/api/webauthn/authenticate",
+    useBrowserAutofill = false
+  } = options;
   async function register(user) {
     const { creationOptions, attemptId } = await $fetch(registerEndpoint, {
       method: "POST",
@@ -16,7 +20,9 @@ export function useWebAuthn(options = {}) {
         verify: false
       }
     });
-    const attestationResponse = await startRegistration(creationOptions);
+    const attestationResponse = await startRegistration({
+      optionsJSON: creationOptions
+    });
     const verificationResponse = await $fetch(registerEndpoint, {
       method: "POST",
       body: {
@@ -36,7 +42,10 @@ export function useWebAuthn(options = {}) {
         userName
       }
     });
-    const assertionResponse = await startAuthentication(requestOptions);
+    const assertionResponse = await startAuthentication({
+      optionsJSON: requestOptions,
+      useBrowserAutofill
+    });
     const verificationResponse = await $fetch(authenticateEndpoint, {
       method: "POST",
       body: {

package/dist/runtime/server/lib/webauthn/authenticate.js

@@ -16,17 +16,17 @@ export function defineWebAuthnAuthenticateEventHandler({
   return eventHandler(async (event) => {
     const url = getRequestURL(event);
     const body = await readBody(event);
-    const _config = defu(await getOptions?.(event) ?? {}, useRuntimeConfig(event).webauthn.authenticate, {
+    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig(event).webauthn.authenticate, {
       rpID: url.hostname
     });
-    if (allowCredentials && body.userName) {
-      _config.allowCredentials = await allowCredentials(event, body.userName);
-    }
     if (!storeChallenge) {
       _config.challenge = "";
     }
     try {
       if (!body.verify) {
+        if (allowCredentials && body.userName) {
+          _config.allowCredentials = await allowCredentials(event, body.userName);
+        }
         const options = await generateAuthenticationOptions(_config);
         const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)));
         if (storeChallenge) {
@@ -49,9 +49,11 @@ export function defineWebAuthnAuthenticateEventHandler({
         expectedChallenge,
         expectedOrigin: url.origin,
         expectedRPID: url.hostname,
-        authenticator: {
-          credentialID: credential.id,
-          credentialPublicKey: new Uint8Array(base64URLStringToBuffer(credential.publicKey)),
+        requireUserVerification: false,
+        // TODO: make configurable https://simplewebauthn.dev/docs/advanced/passkeys#verifyauthenticationresponse
+        credential: {
+          id: credential.id,
+          publicKey: new Uint8Array(base64URLStringToBuffer(credential.publicKey)),
           counter: credential.counter,
           transports: credential.transports
         }

package/dist/runtime/server/lib/webauthn/register.d.ts

@@ -1,6 +1,6 @@
 import type { ValidateFunction } from 'h3';
 import type { WebAuthnUser, WebAuthnRegisterEventHandlerOptions } from '#auth-utils';
-export declare function defineWebAuthnRegisterEventHandler<T extends WebAuthnUser>({ storeChallenge, getChallenge, getOptions, validateUser, onSuccess, onError, }: WebAuthnRegisterEventHandlerOptions<T>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void | import("@simplewebauthn/server").VerifiedRegistrationResponse | {
+export declare function defineWebAuthnRegisterEventHandler<T extends WebAuthnUser>({ storeChallenge, getChallenge, getOptions, validateUser, excludeCredentials, onSuccess, onError, }: WebAuthnRegisterEventHandlerOptions<T>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void | import("@simplewebauthn/server").VerifiedRegistrationResponse | {
     creationOptions: import("@simplewebauthn/types").PublicKeyCredentialCreationOptionsJSON;
     attemptId: string;
 }>>;

package/dist/runtime/server/lib/webauthn/register.js

@@ -9,6 +9,7 @@ export function defineWebAuthnRegisterEventHandler({
   getChallenge,
   getOptions,
   validateUser,
+  excludeCredentials,
   onSuccess,
   onError
 }) {
@@ -24,7 +25,7 @@ export function defineWebAuthnRegisterEventHandler({
     if (validateUser) {
       user = await validateUserData(body.user, validateUser);
     }
-    const _config = defu(await getOptions?.(event) ?? {}, useRuntimeConfig(event).webauthn.register, {
+    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig(event).webauthn.register, {
       rpID: url.hostname,
       rpName: url.hostname,
       userName: user.userName,
@@ -38,6 +39,9 @@ export function defineWebAuthnRegisterEventHandler({
     }
     try {
       if (!body.verify) {
+        if (excludeCredentials) {
+          _config.excludeCredentials = await excludeCredentials(event, user.userName);
+        }
         const options = await generateRegistrationOptions(_config);
         const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)));
         if (storeChallenge) {
@@ -76,11 +80,11 @@ export function defineWebAuthnRegisterEventHandler({
       await onSuccess(event, {
         user,
         credential: {
-          id: verification.registrationInfo.credentialID,
-          publicKey: bufferToBase64URLString(verification.registrationInfo.credentialPublicKey),
-          counter: verification.registrationInfo.counter,
+          id: verification.registrationInfo.credential.id,
+          publicKey: bufferToBase64URLString(verification.registrationInfo.credential.publicKey),
+          counter: verification.registrationInfo.credential.counter,
           backedUp: verification.registrationInfo.credentialBackedUp,
-          transports: body.response.response.transports
+          transports: verification.registrationInfo.credential.transports
         },
         registrationInfo: verification.registrationInfo
       });

package/dist/runtime/types/webauthn.d.ts

@@ -1,4 +1,4 @@
-import type { AuthenticatorTransportFuture } from '@simplewebauthn/types';
+import type { AuthenticationResponseJSON, AuthenticatorTransportFuture, RegistrationResponseJSON } from '@simplewebauthn/types';
 import type { Ref } from 'vue';
 import type { H3Event, H3Error, ValidateFunction } from 'h3';
 import type { GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, VerifiedAuthenticationResponse, VerifiedRegistrationResponse } from '@simplewebauthn/server';
@@ -15,7 +15,7 @@ export interface WebAuthnUser {
     displayName?: string;
     [key: string]: unknown;
 }
-type AllowCredentials = NonNullable<GenerateAuthenticationOptionsOpts['allowCredentials']>;
+type CredentialsList = NonNullable<GenerateAuthenticationOptionsOpts['allowCredentials']>;
 type WebAuthnEventHandlerBase<T extends Record<PropertyKey, unknown>> = {
     storeChallenge: (event: H3Event, challenge: string, attemptId: string) => void | Promise<void>;
     getChallenge: (event: H3Event, attemptId: string) => string | Promise<string>;
@@ -27,21 +27,40 @@ type WebAuthnEventHandlerBase<T extends Record<PropertyKey, unknown>> = {
     onSuccess: (event: H3Event, data: T) => void | Promise<void>;
     onError?: (event: H3Event, error: H3Error) => void | Promise<void>;
 };
+export type RegistrationBody<T extends WebAuthnUser> = {
+    user: T;
+    verify: false;
+} | {
+    user: T;
+    verify: true;
+    attemptId: string;
+    response: RegistrationResponseJSON;
+};
 export type WebAuthnRegisterEventHandlerOptions<T extends WebAuthnUser> = WebAuthnEventHandlerBase<{
     user: T;
     credential: WebAuthnCredential;
     registrationInfo: Exclude<VerifiedRegistrationResponse['registrationInfo'], undefined>;
 }> & {
-    getOptions?: (event: H3Event) => GenerateRegistrationOptionsOpts | Promise<GenerateRegistrationOptionsOpts>;
+    getOptions?: (event: H3Event, body: RegistrationBody<T>) => Partial<GenerateRegistrationOptionsOpts> | Promise<Partial<GenerateRegistrationOptionsOpts>>;
     validateUser?: ValidateFunction<T>;
+    excludeCredentials?: (event: H3Event, userName: string) => CredentialsList | Promise<CredentialsList>;
+};
+export type AuthenticationBody = {
+    verify: false;
+    userName?: string;
+} | {
+    verify: true;
+    attemptId: string;
+    userName?: string;
+    response: AuthenticationResponseJSON;
 };
 export type WebAuthnAuthenticateEventHandlerOptions<T extends WebAuthnCredential> = WebAuthnEventHandlerBase<{
     credential: T;
     authenticationInfo: Exclude<VerifiedAuthenticationResponse['authenticationInfo'], undefined>;
 }> & {
-    getOptions?: (event: H3Event) => Partial<GenerateAuthenticationOptionsOpts> | Promise<Partial<GenerateAuthenticationOptionsOpts>>;
+    getOptions?: (event: H3Event, body: AuthenticationBody) => Partial<GenerateAuthenticationOptionsOpts> | Promise<Partial<GenerateAuthenticationOptionsOpts>>;
     getCredential: (event: H3Event, credentialID: string) => T | Promise<T>;
-    allowCredentials?: (event: H3Event, userName: string) => AllowCredentials | Promise<AllowCredentials>;
+    allowCredentials?: (event: H3Event, userName: string) => CredentialsList | Promise<CredentialsList>;
 };
 export interface WebAuthnComposable {
     /**

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.4.4",
+  "version": "0.5.1",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": "atinux/nuxt-auth-utils",
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.12.0",
+  "packageManager": "pnpm@9.12.3",
   "exports": {
     ".": {
       "types": "./dist/types.d.ts",
@@ -36,15 +36,15 @@
     "@nuxt/kit": "^3.13.2",
     "defu": "^6.1.4",
     "hookable": "^5.5.3",
-    "ofetch": "^1.4.0",
+    "ofetch": "^1.4.1",
     "ohash": "^1.1.4",
     "pathe": "^1.1.2",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
   },
   "peerDependencies": {
-    "@simplewebauthn/browser": "^10.0.0",
-    "@simplewebauthn/server": "^10.0.1"
+    "@simplewebauthn/browser": "^11.0.0",
+    "@simplewebauthn/server": "^11.0.0"
   },
   "peerDependenciesMeta": {
     "@simplewebauthn/browser": {
@@ -55,20 +55,20 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.6",
+    "@iconify-json/simple-icons": "^1.2.10",
     "@nuxt/devtools": "latest",
-    "@nuxt/eslint-config": "^0.5.7",
+    "@nuxt/eslint-config": "^0.6.1",
     "@nuxt/module-builder": "^0.8.4",
     "@nuxt/schema": "^3.13.2",
-    "@nuxt/test-utils": "^3.14.2",
-    "@nuxt/ui": "^2.18.6",
-    "@nuxt/ui-pro": "^1.4.3",
-    "@simplewebauthn/types": "^10.0.0",
+    "@nuxt/test-utils": "^3.14.4",
+    "@nuxt/ui": "^2.18.7",
+    "@nuxt/ui-pro": "^1.4.4",
+    "@simplewebauthn/types": "^11.0.0",
     "changelogen": "^0.5.7",
-    "eslint": "^9.12.0",
+    "eslint": "^9.13.0",
     "nuxt": "^3.13.2",
-    "typescript": "^5.6.2",
-    "vitest": "^2.1.2",
-    "vue-tsc": "^2.1.6"
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4",
+    "vue-tsc": "^2.1.10"
   }
 }