nuxt-auth-utils 0.5.10 → 0.5.11

package/README.md

@@ -62,7 +62,7 @@ Nuxt Auth Utils automatically adds some plugins to fetch the current user sessio
 
 ```vue
 <script setup>
-const { loggedIn, user, session, fetch, clear } = useUserSession()
+const { loggedIn, user, session, fetch, clear, openInPopup } = useUserSession()
 </script>
 
 <template>
@@ -74,6 +74,8 @@ const { loggedIn, user, session, fetch, clear } = useUserSession()
   <div v-else>
     <h1>Not logged in</h1>
     <a href="/auth/github">Login with GitHub</a>
+    <!-- or open the OAuth route in a popup -->
+    <button @click="openInPopup('/auth/github')">Login with GitHub</button>
   </div>
 </template>
 ```
@@ -106,6 +108,10 @@ interface UserSessionComposable {
    * Clear the user session and remove the session cookie.
    */
   clear: () => Promise<void>
+  /**
+   * Open the OAuth route in a popup that auto-closes when successful.
+   */
+  openInPopup: (route: string, size?: { width?: number, height?: number }) => void
 }
 ```
 
@@ -216,6 +222,7 @@ It can also be set using environment variables:
 - Facebook
 - GitHub
 - GitLab
+- Gitea
 - Google
 - Hubspot
 - Instagram

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.10",
+  "version": "0.5.11",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -97,6 +97,12 @@ const module = defineNuxtModule({
       authenticate: {}
     });
     runtimeConfig.oauth = defu(runtimeConfig.oauth, {});
+    runtimeConfig.oauth.gitea = defu(runtimeConfig.oauth.gitea, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      baseURL: ""
+    });
     runtimeConfig.oauth.github = defu(runtimeConfig.oauth.github, {
       clientId: "",
       clientSecret: "",

package/dist/runtime/app/composables/session.js

@@ -28,12 +28,32 @@ export function useUserSession() {
       authReadyState.value = true;
     }
   };
+  const popupListener = (e) => {
+    if (e.key === "temp-nuxt-auth-utils-popup") {
+      fetch();
+      window.removeEventListener("storage", popupListener);
+    }
+  };
+  const openInPopup = (route, size = {}) => {
+    localStorage.setItem("temp-nuxt-auth-utils-popup", "true");
+    const width = size.width ?? 960;
+    const height = size.height ?? 600;
+    const top = (window.top?.outerHeight ?? 0) / 2 + (window.top?.screenY ?? 0) - height / 2;
+    const left = (window.top?.outerWidth ?? 0) / 2 + (window.top?.screenX ?? 0) - width / 2;
+    window.open(
+      route,
+      "nuxt-auth-utils-popup",
+      `width=${width}, height=${height}, top=${top}, left=${left}, toolbar=no, location=no, directories=no, status=no, menubar=no, scrollbars=no, resizable=no, copyhistory=no`
+    );
+    window.addEventListener("storage", popupListener);
+  };
   return {
     ready: computed(() => authReadyState.value),
     loggedIn: computed(() => Boolean(sessionState.value.user)),
     user: computed(() => sessionState.value.user || null),
     session: sessionState,
     fetch,
+    openInPopup,
     clear
   };
 }

package/dist/runtime/app/plugins/session.client.js

@@ -7,4 +7,9 @@ export default defineNuxtPlugin(async (nuxtApp) => {
       await useUserSession().fetch();
     });
   }
+  if (localStorage.getItem("temp-nuxt-auth-utils-popup")) {
+    localStorage.removeItem("temp-nuxt-auth-utils-popup");
+    const error = useError();
+    if (!error.value) window.close();
+  }
 });

package/dist/runtime/server/lib/oauth/gitea.d.ts

@@ -0,0 +1,51 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthGiteaConfig {
+    /**
+     * Gitea OAuth Client ID
+     * @default process.env.NUXT_OAUTH_GITEA_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Gitea OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_GITEA_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Gitea OAuth Scope
+     * @default ['read:user']
+     * @see https://docs.gitea.io/en-us/oauth2-provider/
+     * @example ['read:user']
+     */
+    scope?: string[];
+    /**
+     * Require email from user, adds the ['email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+    /**
+     * Gitea OAuth Authorization URL
+     * @default '/login/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Gitea OAuth Token URL
+     * @default '/login/oauth/access_token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://docs.gitea.io/en-us/oauth2-provider/
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_GITEA_REDIRECT_URL
+     */
+    redirectURL?: string;
+    /**
+     * URL of your Gitea instance
+     * @default 'https://gitea.com'
+     */
+    baseURL?: string;
+}
+export declare function defineOAuthGiteaEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGiteaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/gitea.js

@@ -0,0 +1,85 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  handleMissingConfiguration,
+  handleAccessTokenErrorResponse,
+  getOAuthRedirectURL,
+  requestAccessToken
+} from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthGiteaEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event).oauth?.gitea;
+    const baseURL = config?.baseURL ?? runtimeConfig.baseURL ?? "https://gitea.com";
+    config = defu(config, runtimeConfig, {
+      authorizationURL: `${baseURL}/login/oauth/authorize`,
+      tokenURL: `${baseURL}/login/oauth/access_token`,
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Gitea login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(
+        event,
+        "gitea",
+        ["clientId", "clientSecret"],
+        onError
+      );
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (!config.scope.length) {
+        config.scope.push("read:user");
+      }
+      if (config.emailRequired && !config.scope.includes("email")) {
+        config.scope.push("email");
+      }
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          ...config.authorizationParams
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "gitea", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(`${baseURL}/api/v1/user`, {
+      headers: {
+        Authorization: `token ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/github.js

@@ -76,6 +76,7 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
         return onError(event, error);
       }
       user.email = primaryEmail.email;
+      user.email_verified = primaryEmail.verified;
     }
     return onSuccess(event, {
       user,

package/dist/runtime/server/lib/oauth/microsoft.js

@@ -16,14 +16,15 @@ export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError })
     const tokenURL = config.tokenURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {
-      const scope = config.scope && config.scope.length > 0 ? config.scope : ["User.Read"];
+      config.scope = config.scope && config.scope.length > 0 ? config.scope : ["User.Read"];
+      config.scope = [...new Set(config.scope)];
       return sendRedirect(
         event,
         withQuery(authorizationURL, {
           client_id: config.clientId,
           response_type: "code",
           redirect_uri: redirectURL,
-          scope: scope.join(" "),
+          scope: config.scope.join(" "),
           ...config.authorizationParams
         })
       );

package/dist/runtime/types/oauth-config.d.ts

@@ -1,5 +1,5 @@
 import type { H3Event, H3Error } from 'h3';
-export type OAuthProvider = 'atlassian' | 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | (string & {});
+export type OAuthProvider = 'atlassian' | 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/dist/runtime/types/session.d.ts

@@ -45,4 +45,11 @@ export interface UserSessionComposable {
      * Clear the user session and remove the session cookie.
      */
     clear: () => Promise<void>;
+    /**
+     * Open the OAuth route in a popup that auto-closes when successful.
+     */
+    openInPopup: (route: string, size?: {
+        width?: number;
+        height?: number;
+    }) => void;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.10",
+  "version": "0.5.11",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",