nuxt-auth-utils 0.5.1 → 0.5.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -0
- package/dist/module.json +1 -1
- package/dist/module.mjs +12 -0
- package/dist/runtime/app/composables/session.js +17 -20
- package/dist/runtime/server/lib/oauth/authentik.d.ts +25 -0
- package/dist/runtime/server/lib/oauth/authentik.js +72 -0
- package/dist/runtime/server/lib/oauth/zitadel.d.ts +37 -0
- package/dist/runtime/server/lib/oauth/zitadel.js +77 -0
- package/dist/runtime/types/oauth-config.d.ts +1 -1
- package/package.json +12 -9
package/README.md
CHANGED
package/dist/module.json
CHANGED
package/dist/module.mjs
CHANGED
|
@@ -225,6 +225,18 @@ const module = defineNuxtModule({
|
|
|
225
225
|
clientSecret: "",
|
|
226
226
|
redirectURL: ""
|
|
227
227
|
});
|
|
228
|
+
runtimeConfig.oauth.zitadel = defu(runtimeConfig.oauth.zitadel, {
|
|
229
|
+
clientId: "",
|
|
230
|
+
clientSecret: "",
|
|
231
|
+
domain: "",
|
|
232
|
+
redirectURL: ""
|
|
233
|
+
});
|
|
234
|
+
runtimeConfig.oauth.authentik = defu(runtimeConfig.oauth.authentik, {
|
|
235
|
+
clientId: "",
|
|
236
|
+
clientSecret: "",
|
|
237
|
+
domain: "",
|
|
238
|
+
redirectURL: ""
|
|
239
|
+
});
|
|
228
240
|
}
|
|
229
241
|
});
|
|
230
242
|
|
|
@@ -1,9 +1,22 @@
|
|
|
1
1
|
import { useState, computed, useRequestFetch } from "#imports";
|
|
2
|
-
const useSessionState = () => useState("nuxt-session", () => ({}));
|
|
3
|
-
const useAuthReadyState = () => useState("nuxt-auth-ready", () => false);
|
|
4
2
|
export function useUserSession() {
|
|
5
|
-
const sessionState =
|
|
6
|
-
const authReadyState =
|
|
3
|
+
const sessionState = useState("nuxt-session", () => ({}));
|
|
4
|
+
const authReadyState = useState("nuxt-auth-ready", () => false);
|
|
5
|
+
const clear = async () => {
|
|
6
|
+
await $fetch("/api/_auth/session", { method: "DELETE" });
|
|
7
|
+
sessionState.value = {};
|
|
8
|
+
};
|
|
9
|
+
const fetch = async () => {
|
|
10
|
+
sessionState.value = await useRequestFetch()("/api/_auth/session", {
|
|
11
|
+
headers: {
|
|
12
|
+
Accept: "text/json"
|
|
13
|
+
},
|
|
14
|
+
retry: false
|
|
15
|
+
}).catch(() => ({}));
|
|
16
|
+
if (!authReadyState.value) {
|
|
17
|
+
authReadyState.value = true;
|
|
18
|
+
}
|
|
19
|
+
};
|
|
7
20
|
return {
|
|
8
21
|
ready: computed(() => authReadyState.value),
|
|
9
22
|
loggedIn: computed(() => Boolean(sessionState.value.user)),
|
|
@@ -13,19 +26,3 @@ export function useUserSession() {
|
|
|
13
26
|
clear
|
|
14
27
|
};
|
|
15
28
|
}
|
|
16
|
-
async function fetch() {
|
|
17
|
-
const authReadyState = useAuthReadyState();
|
|
18
|
-
useSessionState().value = await useRequestFetch()("/api/_auth/session", {
|
|
19
|
-
headers: {
|
|
20
|
-
Accept: "text/json"
|
|
21
|
-
},
|
|
22
|
-
retry: false
|
|
23
|
-
}).catch(() => ({}));
|
|
24
|
-
if (!authReadyState.value) {
|
|
25
|
-
authReadyState.value = true;
|
|
26
|
-
}
|
|
27
|
-
}
|
|
28
|
-
async function clear() {
|
|
29
|
-
await $fetch("/api/_auth/session", { method: "DELETE" });
|
|
30
|
-
useSessionState().value = {};
|
|
31
|
-
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
import type { OAuthConfig } from '#auth-utils';
|
|
2
|
+
export interface OAuthAuthentikConfig {
|
|
3
|
+
/**
|
|
4
|
+
* Authentik OAuth Client ID
|
|
5
|
+
* @default process.env.NUXT_OAUTH_AUTHENTIK_CLIENT_ID
|
|
6
|
+
*/
|
|
7
|
+
clientId?: string;
|
|
8
|
+
/**
|
|
9
|
+
* Authentik OAuth Client Secret
|
|
10
|
+
* @default process.env.NUXT_OAUTH_AUTHENTIK_CLIENT_SECRET
|
|
11
|
+
*/
|
|
12
|
+
clientSecret?: string;
|
|
13
|
+
/**
|
|
14
|
+
* Authentik OAuth Domain
|
|
15
|
+
* @example https://<your-authentik-instance>
|
|
16
|
+
* @default process.env.NUXT_OAUTH_AUTHENTIK_DOMAIN
|
|
17
|
+
*/
|
|
18
|
+
domain?: string;
|
|
19
|
+
/**
|
|
20
|
+
* Redirect URL to allow overriding for situations like prod failing to determine public hostname
|
|
21
|
+
* @default process.env.NUXT_OAUTH_AUTHENTIK_REDIRECT_URL or current URL
|
|
22
|
+
*/
|
|
23
|
+
redirectURL?: string;
|
|
24
|
+
}
|
|
25
|
+
export declare function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuthentikConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
|
|
@@ -0,0 +1,72 @@
|
|
|
1
|
+
import { eventHandler, getQuery, sendRedirect } from "h3";
|
|
2
|
+
import { withQuery } from "ufo";
|
|
3
|
+
import { defu } from "defu";
|
|
4
|
+
import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
|
|
5
|
+
import { useRuntimeConfig, createError } from "#imports";
|
|
6
|
+
export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }) {
|
|
7
|
+
return eventHandler(async (event) => {
|
|
8
|
+
config = defu(config, useRuntimeConfig(event).oauth?.authentik);
|
|
9
|
+
const query = getQuery(event);
|
|
10
|
+
if (query.error) {
|
|
11
|
+
const error = createError({
|
|
12
|
+
statusCode: 401,
|
|
13
|
+
message: `Authentik login failed: ${query.error || "Unknown error"}`,
|
|
14
|
+
data: query
|
|
15
|
+
});
|
|
16
|
+
if (!onError) throw error;
|
|
17
|
+
return onError(event, error);
|
|
18
|
+
}
|
|
19
|
+
if (!config.clientId || !config.clientSecret || !config.domain) {
|
|
20
|
+
return handleMissingConfiguration(event, "authentik", ["clientId", "clientSecret", "domain"], onError);
|
|
21
|
+
}
|
|
22
|
+
const authorizationURL = `https://${config.domain}/application/o/authorize/`;
|
|
23
|
+
const tokenURL = `https://${config.domain}/application/o/token/`;
|
|
24
|
+
const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
|
|
25
|
+
if (!query.code) {
|
|
26
|
+
return sendRedirect(
|
|
27
|
+
event,
|
|
28
|
+
withQuery(authorizationURL, {
|
|
29
|
+
response_type: "code",
|
|
30
|
+
client_id: config.clientId,
|
|
31
|
+
redirect_uri: redirectURL,
|
|
32
|
+
scope: ["openid", "profile", "email"].join(" ")
|
|
33
|
+
})
|
|
34
|
+
);
|
|
35
|
+
}
|
|
36
|
+
const tokens = await requestAccessToken(tokenURL, {
|
|
37
|
+
headers: {
|
|
38
|
+
"Authorization": `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`,
|
|
39
|
+
"Content-Type": "application/x-www-form-urlencoded"
|
|
40
|
+
},
|
|
41
|
+
body: {
|
|
42
|
+
grant_type: "authorization_code",
|
|
43
|
+
client_id: config.clientId,
|
|
44
|
+
redirect_uri: redirectURL,
|
|
45
|
+
code: query.code
|
|
46
|
+
}
|
|
47
|
+
});
|
|
48
|
+
if (tokens.error) {
|
|
49
|
+
return handleAccessTokenErrorResponse(event, "authentik", tokens, onError);
|
|
50
|
+
}
|
|
51
|
+
const accessToken = tokens.access_token;
|
|
52
|
+
const user = await $fetch(`https://${config.domain}/application/o/userinfo/`, {
|
|
53
|
+
headers: {
|
|
54
|
+
Authorization: `Bearer ${accessToken}`,
|
|
55
|
+
Accept: "application/json"
|
|
56
|
+
}
|
|
57
|
+
});
|
|
58
|
+
if (!user) {
|
|
59
|
+
const error = createError({
|
|
60
|
+
statusCode: 500,
|
|
61
|
+
message: "Could not get Authentik user",
|
|
62
|
+
data: tokens
|
|
63
|
+
});
|
|
64
|
+
if (!onError) throw error;
|
|
65
|
+
return onError(event, error);
|
|
66
|
+
}
|
|
67
|
+
return onSuccess(event, {
|
|
68
|
+
user,
|
|
69
|
+
tokens
|
|
70
|
+
});
|
|
71
|
+
});
|
|
72
|
+
}
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
import type { OAuthConfig } from '#auth-utils';
|
|
2
|
+
export interface OAuthZitadelConfig {
|
|
3
|
+
/**
|
|
4
|
+
* ZITADEL OAuth Client ID
|
|
5
|
+
* @default process.env.NUXT_OAUTH_ZITADEL_CLIENT_ID
|
|
6
|
+
*/
|
|
7
|
+
clientId?: string;
|
|
8
|
+
/**
|
|
9
|
+
* ZITADEL OAuth Client Secret
|
|
10
|
+
* @default process.env.NUXT_OAUTH_ZITADEL_CLIENT_SECRET
|
|
11
|
+
*/
|
|
12
|
+
clientSecret?: string;
|
|
13
|
+
/**
|
|
14
|
+
* ZITADEL OAuth Domain
|
|
15
|
+
* @example <your-zitadel-instance>.zitadel.cloud
|
|
16
|
+
* @default process.env.NUXT_OAUTH_ZITADEL_DOMAIN
|
|
17
|
+
*/
|
|
18
|
+
domain?: string;
|
|
19
|
+
/**
|
|
20
|
+
* ZITADEL OAuth Scope
|
|
21
|
+
* @default ['openid']
|
|
22
|
+
* @see https://zitadel.com/docs/apis/openidoauth/scopes
|
|
23
|
+
* @example ['openid', 'profile', 'email']
|
|
24
|
+
*/
|
|
25
|
+
scope?: string[];
|
|
26
|
+
/**
|
|
27
|
+
* Extra authorization parameters to provide to the authorization URL
|
|
28
|
+
* @example { ui_locales: 'de-CH de en' }
|
|
29
|
+
*/
|
|
30
|
+
authorizationParams?: Record<string, string>;
|
|
31
|
+
/**
|
|
32
|
+
* Redirect URL to allow overriding for situations like prod failing to determine public hostname
|
|
33
|
+
* @default process.env.NUXT_OAUTH_ZITADEL_REDIRECT_URL or current URL
|
|
34
|
+
*/
|
|
35
|
+
redirectURL?: string;
|
|
36
|
+
}
|
|
37
|
+
export declare function defineOAuthZitadelEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthZitadelConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
|
|
@@ -0,0 +1,77 @@
|
|
|
1
|
+
import { eventHandler, getQuery, sendRedirect } from "h3";
|
|
2
|
+
import { withQuery } from "ufo";
|
|
3
|
+
import { defu } from "defu";
|
|
4
|
+
import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
|
|
5
|
+
import { useRuntimeConfig, createError } from "#imports";
|
|
6
|
+
export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
|
|
7
|
+
return eventHandler(async (event) => {
|
|
8
|
+
config = defu(config, useRuntimeConfig(event).oauth?.zitadel, {
|
|
9
|
+
authorizationParams: {}
|
|
10
|
+
});
|
|
11
|
+
const query = getQuery(event);
|
|
12
|
+
if (query.error) {
|
|
13
|
+
const error = createError({
|
|
14
|
+
statusCode: 401,
|
|
15
|
+
message: `Zitadel login failed: ${query.error || "Unknown error"}`,
|
|
16
|
+
data: query
|
|
17
|
+
});
|
|
18
|
+
if (!onError) throw error;
|
|
19
|
+
return onError(event, error);
|
|
20
|
+
}
|
|
21
|
+
if (!config.clientId || !config.clientSecret || !config.domain) {
|
|
22
|
+
return handleMissingConfiguration(event, "zitadel", ["clientId", "clientSecret", "issuerUrl"], onError);
|
|
23
|
+
}
|
|
24
|
+
const authorizationURL = `https://${config.domain}/oauth/v2/authorize`;
|
|
25
|
+
const tokenURL = `https://${config.domain}/oauth/v2/token`;
|
|
26
|
+
const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
|
|
27
|
+
if (!query.code) {
|
|
28
|
+
config.scope = config.scope || ["openid"];
|
|
29
|
+
return sendRedirect(
|
|
30
|
+
event,
|
|
31
|
+
withQuery(authorizationURL, {
|
|
32
|
+
response_type: "code",
|
|
33
|
+
client_id: config.clientId,
|
|
34
|
+
redirect_uri: redirectURL,
|
|
35
|
+
scope: config.scope.join(" "),
|
|
36
|
+
...config.authorizationParams
|
|
37
|
+
})
|
|
38
|
+
);
|
|
39
|
+
}
|
|
40
|
+
const tokens = await requestAccessToken(tokenURL, {
|
|
41
|
+
headers: {
|
|
42
|
+
"Authorization": `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`,
|
|
43
|
+
"Content-Type": "application/x-www-form-urlencoded"
|
|
44
|
+
},
|
|
45
|
+
body: {
|
|
46
|
+
grant_type: "authorization_code",
|
|
47
|
+
client_id: config.clientId,
|
|
48
|
+
redirect_uri: redirectURL,
|
|
49
|
+
code: query.code
|
|
50
|
+
}
|
|
51
|
+
});
|
|
52
|
+
if (tokens.error) {
|
|
53
|
+
return handleAccessTokenErrorResponse(event, "zitadel", tokens, onError);
|
|
54
|
+
}
|
|
55
|
+
const accessToken = tokens.access_token;
|
|
56
|
+
const user = await $fetch(`https://${config.domain}/oidc/v1/userinfo`, {
|
|
57
|
+
headers: {
|
|
58
|
+
Authorization: `Bearer ${accessToken}`,
|
|
59
|
+
Accept: "application/json"
|
|
60
|
+
}
|
|
61
|
+
});
|
|
62
|
+
console.log("Zitadel user:", user);
|
|
63
|
+
if (!user) {
|
|
64
|
+
const error = createError({
|
|
65
|
+
statusCode: 500,
|
|
66
|
+
message: "Could not get Zitadel user",
|
|
67
|
+
data: tokens
|
|
68
|
+
});
|
|
69
|
+
if (!onError) throw error;
|
|
70
|
+
return onError(event, error);
|
|
71
|
+
}
|
|
72
|
+
return onSuccess(event, {
|
|
73
|
+
user,
|
|
74
|
+
tokens
|
|
75
|
+
});
|
|
76
|
+
});
|
|
77
|
+
}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import type { H3Event, H3Error } from 'h3';
|
|
2
|
-
export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'x' | 'xsuaa' | 'yandex' | (string & {});
|
|
2
|
+
export type OAuthProvider = 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | (string & {});
|
|
3
3
|
export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
|
|
4
4
|
export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
|
|
5
5
|
config?: TConfig;
|
package/package.json
CHANGED
|
@@ -1,8 +1,11 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "nuxt-auth-utils",
|
|
3
|
-
"version": "0.5.
|
|
3
|
+
"version": "0.5.3",
|
|
4
4
|
"description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
|
|
5
|
-
"repository":
|
|
5
|
+
"repository": {
|
|
6
|
+
"type": "git",
|
|
7
|
+
"url": "git+https://github.com/atinux/nuxt-auth-utils.git"
|
|
8
|
+
},
|
|
6
9
|
"license": "MIT",
|
|
7
10
|
"type": "module",
|
|
8
11
|
"packageManager": "pnpm@9.12.3",
|
|
@@ -33,7 +36,7 @@
|
|
|
33
36
|
},
|
|
34
37
|
"dependencies": {
|
|
35
38
|
"@adonisjs/hash": "^9.0.5",
|
|
36
|
-
"@nuxt/kit": "^3.
|
|
39
|
+
"@nuxt/kit": "^3.14.159",
|
|
37
40
|
"defu": "^6.1.4",
|
|
38
41
|
"hookable": "^5.5.3",
|
|
39
42
|
"ofetch": "^1.4.1",
|
|
@@ -55,18 +58,18 @@
|
|
|
55
58
|
}
|
|
56
59
|
},
|
|
57
60
|
"devDependencies": {
|
|
58
|
-
"@iconify-json/simple-icons": "^1.2.
|
|
61
|
+
"@iconify-json/simple-icons": "^1.2.11",
|
|
59
62
|
"@nuxt/devtools": "latest",
|
|
60
63
|
"@nuxt/eslint-config": "^0.6.1",
|
|
61
64
|
"@nuxt/module-builder": "^0.8.4",
|
|
62
|
-
"@nuxt/schema": "^3.
|
|
65
|
+
"@nuxt/schema": "^3.14.159",
|
|
63
66
|
"@nuxt/test-utils": "^3.14.4",
|
|
64
|
-
"@nuxt/ui": "^2.
|
|
65
|
-
"@nuxt/ui-pro": "^1.
|
|
67
|
+
"@nuxt/ui": "^2.19.2",
|
|
68
|
+
"@nuxt/ui-pro": "^1.5.0",
|
|
66
69
|
"@simplewebauthn/types": "^11.0.0",
|
|
67
70
|
"changelogen": "^0.5.7",
|
|
68
|
-
"eslint": "^9.
|
|
69
|
-
"nuxt": "^3.
|
|
71
|
+
"eslint": "^9.14.0",
|
|
72
|
+
"nuxt": "^3.14.159",
|
|
70
73
|
"typescript": "^5.6.3",
|
|
71
74
|
"vitest": "^2.1.4",
|
|
72
75
|
"vue-tsc": "^2.1.10"
|