nuxt-auth-utils 0.5.10 → 0.5.12

package/README.md

@@ -62,7 +62,7 @@ Nuxt Auth Utils automatically adds some plugins to fetch the current user sessio
 
 ```vue
 <script setup>
-const { loggedIn, user, session, fetch, clear } = useUserSession()
+const { loggedIn, user, session, fetch, clear, openInPopup } = useUserSession()
 </script>
 
 <template>
@@ -74,6 +74,8 @@ const { loggedIn, user, session, fetch, clear } = useUserSession()
   <div v-else>
     <h1>Not logged in</h1>
     <a href="/auth/github">Login with GitHub</a>
+    <!-- or open the OAuth route in a popup -->
+    <button @click="openInPopup('/auth/github')">Login with GitHub</button>
   </div>
 </template>
 ```
@@ -106,6 +108,10 @@ interface UserSessionComposable {
    * Clear the user session and remove the session cookie.
    */
   clear: () => Promise<void>
+  /**
+   * Open the OAuth route in a popup that auto-closes when successful.
+   */
+  openInPopup: (route: string, size?: { width?: number, height?: number }) => void
 }
 ```
 
@@ -211,11 +217,13 @@ It can also be set using environment variables:
 - Authentik
 - AWS Cognito
 - Battle.net
+- Bluesky (AT Protocol)
 - Discord
 - Dropbox
 - Facebook
 - GitHub
 - GitLab
+- Gitea
 - Google
 - Hubspot
 - Instagram
@@ -297,6 +305,28 @@ export default defineNuxtConfig({
 })
 ```
 
+### AT Protocol
+
+Social networks that rely on AT Protocol (e.g., Bluesky) slightly differ from a regular OAuth flow.
+
+To enable OAuth with AT Protocol, you need to:
+
+1. Install the peer dependencies:
+
+```bash
+npx nypm i @atproto/oauth-client-node @atproto/api
+```
+
+2. Enable it in your `nuxt.config.ts`
+
+```ts
+export default defineNuxtConfig({
+  auth: {
+    atproto: true
+  }
+})
+```
+
 ### WebAuthn (passkey)
 
 WebAuthn (Web Authentication) is a web standard that enhances security by replacing passwords with passkeys using public key cryptography. Users can authenticate with biometric data (like fingerprints or facial recognition) or physical devices (like USB keys), reducing the risk of phishing and password breaches. This approach offers a more secure and user-friendly authentication method, supported by major browsers and platforms.
@@ -704,26 +734,26 @@ Checkout the [`SessionConfig`](https://github.com/unjs/h3/blob/c04c458810e34eb15
 
 ```bash
 # Install dependencies
-npm install
+pnpm install
 
 # Generate type stubs
-npm run dev:prepare
+pnpm run dev:prepare
 
 # Develop with the playground
-npm run dev
+pnpm run dev
 
 # Build the playground
-npm run dev:build
+pnpm run dev:build
 
 # Run ESLint
-npm run lint
+pnpm run lint
 
 # Run Vitest
-npm run test
-npm run test:watch
+pnpm run test
+pnpm run test:watch
 
 # Release new version
-npm run release
+pnpm run release
 ```
 
 <!-- Badges -->

package/dist/module.d.mts

@@ -8,6 +8,11 @@ interface ModuleOptions {
      * @default false
      */
     webAuthn?: boolean;
+    /**
+     * Enable atproto OAuth (Bluesky, etc.)
+     * @default false
+     */
+    atproto?: boolean;
     /**
      * Hash options used for password hashing
      */

package/dist/module.d.ts

@@ -8,6 +8,11 @@ interface ModuleOptions {
      * @default false
      */
     webAuthn?: boolean;
+    /**
+     * Enable atproto OAuth (Bluesky, etc.)
+     * @default false
+     */
+    atproto?: boolean;
     /**
      * Hash options used for password hashing
      */

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.10",
+  "version": "0.5.12",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -4,6 +4,26 @@ import { join } from 'pathe';
 import { defu } from 'defu';
 import { randomUUID } from 'uncrypto';
 
+const atprotoProviders = ["bluesky"];
+const atprotoProviderDefaultClientMetadata = {
+  clientMetadataFilename: "",
+  clientName: "",
+  clientUri: "",
+  logoUri: "",
+  policyUri: "",
+  tosUri: "",
+  scope: ["atproto"],
+  grantTypes: ["authorization_code"],
+  responseTypes: ["code"],
+  applicationType: "web",
+  redirectUris: [],
+  dpopBoundAccessTokens: true,
+  tokenEndpointAuthMethod: "none"
+};
+function getClientMetadataFilename(provider, config) {
+  return config?.clientMetadataFilename || provider + "/client-metadata.json";
+}
+
 const module = defineNuxtModule({
   meta: {
     name: "auth-utils",
@@ -12,6 +32,7 @@ const module = defineNuxtModule({
   // Default configuration options of the Nuxt module
   defaults: {
     webAuthn: false,
+    atproto: false,
     hash: {
       scrypt: {}
     }
@@ -97,6 +118,12 @@ const module = defineNuxtModule({
       authenticate: {}
     });
     runtimeConfig.oauth = defu(runtimeConfig.oauth, {});
+    runtimeConfig.oauth.gitea = defu(runtimeConfig.oauth.gitea, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      baseURL: ""
+    });
     runtimeConfig.oauth.github = defu(runtimeConfig.oauth.github, {
       clientId: "",
       clientSecret: "",
@@ -157,6 +184,32 @@ const module = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    for (const provider of atprotoProviders) {
+      runtimeConfig.oauth[provider] = defu(runtimeConfig.oauth[provider], atprotoProviderDefaultClientMetadata);
+    }
+    if (options.atproto) {
+      const missingDeps = [];
+      const peerDeps = ["@atproto/oauth-client-node", "@atproto/api"];
+      for (const pkg of peerDeps) {
+        await import(pkg).catch(() => {
+          missingDeps.push(pkg);
+        });
+      }
+      if (missingDeps.length > 0) {
+        logger.withTag("nuxt-auth-utils").error(`Missing dependencies for \`atproto\`, please install with:
+
+\`npx nypm i ${missingDeps.join(" ")}\``);
+        process.exit(1);
+      }
+      for (const provider of atprotoProviders) {
+        addServerHandler({
+          handler: resolver.resolve("./runtime/server/routes/atproto/client-metadata.json.get.ts"),
+          route: "/" + getClientMetadataFilename(provider, runtimeConfig.oauth[provider]),
+          method: "get"
+        });
+      }
+      addServerImportsDir(resolver.resolve("./runtime/server/lib/atproto"));
+    }
     runtimeConfig.oauth.keycloak = defu(runtimeConfig.oauth.keycloak, {
       clientId: "",
       clientSecret: "",

package/dist/runtime/app/composables/session.js

@@ -28,12 +28,32 @@ export function useUserSession() {
       authReadyState.value = true;
     }
   };
+  const popupListener = (e) => {
+    if (e.key === "temp-nuxt-auth-utils-popup") {
+      fetch();
+      window.removeEventListener("storage", popupListener);
+    }
+  };
+  const openInPopup = (route, size = {}) => {
+    localStorage.setItem("temp-nuxt-auth-utils-popup", "true");
+    const width = size.width ?? 960;
+    const height = size.height ?? 600;
+    const top = (window.top?.outerHeight ?? 0) / 2 + (window.top?.screenY ?? 0) - height / 2;
+    const left = (window.top?.outerWidth ?? 0) / 2 + (window.top?.screenX ?? 0) - width / 2;
+    window.open(
+      route,
+      "nuxt-auth-utils-popup",
+      `width=${width}, height=${height}, top=${top}, left=${left}, toolbar=no, location=no, directories=no, status=no, menubar=no, scrollbars=no, resizable=no, copyhistory=no`
+    );
+    window.addEventListener("storage", popupListener);
+  };
   return {
     ready: computed(() => authReadyState.value),
     loggedIn: computed(() => Boolean(sessionState.value.user)),
     user: computed(() => sessionState.value.user || null),
     session: sessionState,
     fetch,
+    openInPopup,
     clear
   };
 }

package/dist/runtime/app/plugins/session.client.js

@@ -7,4 +7,9 @@ export default defineNuxtPlugin(async (nuxtApp) => {
       await useUserSession().fetch();
     });
   }
+  if (localStorage.getItem("temp-nuxt-auth-utils-popup")) {
+    localStorage.removeItem("temp-nuxt-auth-utils-popup");
+    const error = useError();
+    if (!error.value) window.close();
+  }
 });

package/dist/runtime/server/api/session.get.d.ts

@@ -1,5 +1,5 @@
 declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
-    [key: string]: unknown;
+    id: string;
     user?: import("../../types").User;
 }>>;
 export default _default;

package/dist/runtime/server/lib/atproto/bluesky.d.ts

@@ -0,0 +1,39 @@
+import type { H3Event } from 'h3';
+import type { NodeSavedSession, NodeSavedSessionStore, NodeSavedState, NodeSavedStateStore } from '@atproto/oauth-client-node';
+import type { AppBskyActorDefs } from '@atproto/api';
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthBlueskyConfig {
+    /**
+     * Redirect URL to use for this authorization flow. It should only consist of the path, as the hostname must always match the client id's hostname.
+     * @default process.env.NUXT_OAUTH_BLUESKY_REDIRECT_URL
+     * @example '/auth/bluesky'
+     */
+    redirectUrl?: string;
+    /**
+     * Bluesky OAuth Scope. The `atproto` scope is required and will be added if not present.
+     * @default ['atproto']
+     * @see https://atproto.com/specs/oauth#authorization-scopes
+     * @example ['atproto', 'transition:generic']
+     */
+    scope?: string[];
+}
+type BlueSkyUser = AppBskyActorDefs.ProfileViewDetailed | Pick<AppBskyActorDefs.ProfileView, 'did'>;
+type BlueSkyTokens = NodeSavedSession['tokenSet'];
+export declare function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBlueskyConfig, BlueSkyUser, BlueSkyTokens>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare class StateStore implements NodeSavedStateStore {
+    private event;
+    private readonly stateKey;
+    constructor(event: H3Event);
+    get(): Promise<NodeSavedState | undefined>;
+    set(key: string, val: NodeSavedState): Promise<void>;
+    del(): Promise<void>;
+}
+export declare class SessionStore implements NodeSavedSessionStore {
+    private event;
+    private readonly sessionKey;
+    constructor(event: H3Event);
+    get(): Promise<NodeSavedSession | undefined>;
+    set(key: string, val: NodeSavedSession): Promise<void>;
+    del(): Promise<void>;
+}
+export {};

package/dist/runtime/server/lib/atproto/bluesky.js

@@ -0,0 +1,101 @@
+import { createError, eventHandler, getQuery, sendRedirect, getCookie, setCookie, deleteCookie } from "h3";
+import { NodeOAuthClient, OAuthCallbackError, OAuthResolverError, OAuthResponseError } from "@atproto/oauth-client-node";
+import { Agent } from "@atproto/api";
+import { getAtprotoClientMetadata } from "../../utils/atproto.js";
+export function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    const clientMetadata = getAtprotoClientMetadata(event, "bluesky", config);
+    const scopes = clientMetadata.scope?.split(" ") ?? [];
+    const sessionStore = new SessionStore(event);
+    const stateStore = new StateStore(event);
+    const client = new NodeOAuthClient({
+      stateStore,
+      sessionStore,
+      clientMetadata
+    });
+    const query = getQuery(event);
+    if (!query.code) {
+      try {
+        const handle = query.handle?.toString();
+        if (!handle) throw createError({
+          statusCode: 400,
+          message: "Query parameter `handle` empty or missing. Please provide a valid Bluesky handle."
+        });
+        const url = await client.authorize(handle, { scope: clientMetadata.scope });
+        return sendRedirect(event, url.toString());
+      } catch (err) {
+        const error = (() => {
+          switch (true) {
+            case err instanceof OAuthResponseError:
+              return createError({
+                statusCode: 500,
+                message: `Bluesky login failed: ${err.errorDescription || "Unknown error"}`,
+                data: err.payload
+              });
+            case err instanceof OAuthResolverError:
+              return createError({
+                statusCode: 400,
+                message: `Bluesky login failed: ${err.message || "Unknown error"}`
+              });
+            default:
+              throw err;
+          }
+        })();
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+    }
+    try {
+      const { session } = await client.callback(new URLSearchParams(query));
+      const sessionInfo = await sessionStore.get();
+      const profile = scopes.includes("transition:generic") ? (await new Agent(session).getProfile({ actor: session.did })).data : null;
+      sessionStore.del();
+      return onSuccess(event, {
+        user: profile ?? { did: session.did },
+        tokens: sessionInfo.tokenSet
+      });
+    } catch (err) {
+      if (!(err instanceof OAuthCallbackError)) throw err;
+      const error = createError({
+        statusCode: 500,
+        message: `Bluesky login failed: ${err.message || "Unknown error"}`
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+  });
+}
+export class StateStore {
+  constructor(event) {
+    this.event = event;
+  }
+  stateKey = "oauth:bluesky:stat";
+  async get() {
+    const result = getCookie(this.event, this.stateKey);
+    if (!result) return;
+    return JSON.parse(atob(result));
+  }
+  async set(key, val) {
+    setCookie(this.event, this.stateKey, btoa(JSON.stringify(val)));
+  }
+  async del() {
+    deleteCookie(this.event, this.stateKey);
+  }
+}
+export class SessionStore {
+  constructor(event) {
+    this.event = event;
+  }
+  sessionKey = "oauth:bluesky:session";
+  async get() {
+    const result = getCookie(this.event, this.sessionKey);
+    if (!result) return;
+    return JSON.parse(atob(result));
+  }
+  async set(key, val) {
+    setCookie(this.event, this.sessionKey, btoa(JSON.stringify(val)));
+  }
+  async del() {
+    deleteCookie(this.event, this.sessionKey);
+  }
+}

package/dist/runtime/server/lib/oauth/gitea.d.ts

@@ -0,0 +1,51 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthGiteaConfig {
+    /**
+     * Gitea OAuth Client ID
+     * @default process.env.NUXT_OAUTH_GITEA_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Gitea OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_GITEA_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Gitea OAuth Scope
+     * @default ['read:user']
+     * @see https://docs.gitea.io/en-us/oauth2-provider/
+     * @example ['read:user']
+     */
+    scope?: string[];
+    /**
+     * Require email from user, adds the ['email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+    /**
+     * Gitea OAuth Authorization URL
+     * @default '/login/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Gitea OAuth Token URL
+     * @default '/login/oauth/access_token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://docs.gitea.io/en-us/oauth2-provider/
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_GITEA_REDIRECT_URL
+     */
+    redirectURL?: string;
+    /**
+     * URL of your Gitea instance
+     * @default 'https://gitea.com'
+     */
+    baseURL?: string;
+}
+export declare function defineOAuthGiteaEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGiteaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/gitea.js

@@ -0,0 +1,85 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  handleMissingConfiguration,
+  handleAccessTokenErrorResponse,
+  getOAuthRedirectURL,
+  requestAccessToken
+} from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthGiteaEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event).oauth?.gitea;
+    const baseURL = config?.baseURL ?? runtimeConfig.baseURL ?? "https://gitea.com";
+    config = defu(config, runtimeConfig, {
+      authorizationURL: `${baseURL}/login/oauth/authorize`,
+      tokenURL: `${baseURL}/login/oauth/access_token`,
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Gitea login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(
+        event,
+        "gitea",
+        ["clientId", "clientSecret"],
+        onError
+      );
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (!config.scope.length) {
+        config.scope.push("read:user");
+      }
+      if (config.emailRequired && !config.scope.includes("email")) {
+        config.scope.push("email");
+      }
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          ...config.authorizationParams
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "gitea", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(`${baseURL}/api/v1/user`, {
+      headers: {
+        Authorization: `token ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/github.js

@@ -76,6 +76,7 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
         return onError(event, error);
       }
       user.email = primaryEmail.email;
+      user.email_verified = primaryEmail.verified;
     }
     return onSuccess(event, {
       user,

package/dist/runtime/server/lib/oauth/microsoft.js

@@ -16,14 +16,15 @@ export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError })
     const tokenURL = config.tokenURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {
-      const scope = config.scope && config.scope.length > 0 ? config.scope : ["User.Read"];
+      config.scope = config.scope && config.scope.length > 0 ? config.scope : ["User.Read"];
+      config.scope = [...new Set(config.scope)];
       return sendRedirect(
         event,
         withQuery(authorizationURL, {
           client_id: config.clientId,
           response_type: "code",
           redirect_uri: redirectURL,
-          scope: scope.join(" "),
+          scope: config.scope.join(" "),
           ...config.authorizationParams
         })
       );

package/dist/runtime/server/routes/atproto/client-metadata.json.get.d.ts

@@ -0,0 +1,129 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, {
+    redirect_uris: [string, ...string[]];
+    scope?: string | undefined;
+    response_types?: ["code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token", ...("code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token")[]] | undefined;
+    grant_types?: ["authorization_code" | "implicit" | "refresh_token" | "password" | "client_credentials" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer", ...("authorization_code" | "implicit" | "refresh_token" | "password" | "client_credentials" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[]] | undefined;
+    token_endpoint_auth_method?: "client_secret_basic" | "client_secret_jwt" | "client_secret_post" | "none" | "private_key_jwt" | "self_signed_tls_client_auth" | "tls_client_auth" | undefined;
+    token_endpoint_auth_signing_alg?: string | undefined;
+    userinfo_signed_response_alg?: string | undefined;
+    userinfo_encrypted_response_alg?: string | undefined;
+    jwks_uri?: string | undefined;
+    jwks?: {
+        keys: ({
+            kty: "RSA";
+            n: string;
+            e: string;
+            alg?: "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            d?: string | undefined;
+            p?: string | undefined;
+            q?: string | undefined;
+            dp?: string | undefined;
+            dq?: string | undefined;
+            qi?: string | undefined;
+            oth?: [{
+                d?: string | undefined;
+                r?: string | undefined;
+                t?: string | undefined;
+            }, ...{
+                d?: string | undefined;
+                r?: string | undefined;
+                t?: string | undefined;
+            }[]] | undefined;
+        } | {
+            kty: "EC";
+            crv: "P-256" | "P-384" | "P-521";
+            x: string;
+            y: string;
+            alg?: "ES256" | "ES384" | "ES512" | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            d?: string | undefined;
+        } | {
+            kty: "EC";
+            crv: "secp256k1";
+            x: string;
+            y: string;
+            alg?: "ES256K" | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            d?: string | undefined;
+        } | {
+            kty: "OKP";
+            crv: "Ed25519" | "Ed448";
+            x: string;
+            alg?: "EdDSA" | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            d?: string | undefined;
+        } | {
+            kty: "oct";
+            k: string;
+            alg?: "HS256" | "HS384" | "HS512" | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+        } | {
+            kty: string;
+            alg?: string | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+        })[];
+    } | undefined;
+    application_type?: "web" | "native" | undefined;
+    subject_type?: "public" | "pairwise" | undefined;
+    request_object_signing_alg?: string | undefined;
+    id_token_signed_response_alg?: string | undefined;
+    authorization_signed_response_alg?: string | undefined;
+    authorization_encrypted_response_enc?: "A128CBC-HS256" | undefined;
+    authorization_encrypted_response_alg?: string | undefined;
+    client_id?: string | undefined;
+    client_name?: string | undefined;
+    client_uri?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    default_max_age?: number | undefined;
+    require_auth_time?: boolean | undefined;
+    contacts?: string[] | undefined;
+    tls_client_certificate_bound_access_tokens?: boolean | undefined;
+    dpop_bound_access_tokens?: boolean | undefined;
+    authorization_details_types?: string[] | undefined;
+}>;
+export default _default;

package/dist/runtime/server/routes/atproto/client-metadata.json.get.js

@@ -0,0 +1,18 @@
+import { defineEventHandler, createError } from "h3";
+import { getAtprotoClientMetadata } from "../../utils/atproto.js";
+import { atprotoProviders, getClientMetadataFilename } from "../../../../utils/atproto";
+import { useRuntimeConfig } from "#imports";
+export default defineEventHandler((event) => {
+  const path = event.path.slice(1);
+  const runtimeConfig = useRuntimeConfig(event);
+  for (const provider of atprotoProviders) {
+    const config = runtimeConfig.oauth[provider];
+    if (getClientMetadataFilename(provider, config) === path) {
+      return getAtprotoClientMetadata(event, provider);
+    }
+  }
+  throw createError({
+    statusCode: 404,
+    message: "Provider not found"
+  });
+});

package/dist/runtime/server/utils/atproto.d.ts

@@ -0,0 +1,5 @@
+import type { H3Event } from 'h3';
+import type { OAuthClientMetadataInput } from '@atproto/oauth-client-node';
+import type { OAuthBlueskyConfig } from '../lib/oauth/bluesky.js';
+import type { ATProtoProvider, OAuthConfig } from '#auth-utils';
+export declare function getAtprotoClientMetadata(event: H3Event, provider: ATProtoProvider, config?: OAuthConfig<OAuthBlueskyConfig>['config']): OAuthClientMetadataInput;

package/dist/runtime/server/utils/atproto.js

@@ -0,0 +1,35 @@
+import { getOAuthRedirectURL } from "../lib/utils.js";
+import { getClientMetadataFilename } from "../../../utils/atproto";
+import { getRequestURL, useRuntimeConfig } from "#imports";
+export function getAtprotoClientMetadata(event, provider, config) {
+  const providerRuntimeConfig = useRuntimeConfig(event).oauth[provider];
+  const scopes = [.../* @__PURE__ */ new Set(["atproto", ...config?.scope ?? [], ...providerRuntimeConfig.scope ?? []])];
+  const scope = scopes.join(" ");
+  const grantTypes = [.../* @__PURE__ */ new Set(["authorization_code", ...providerRuntimeConfig.grantTypes ?? []])];
+  const requestURL = getRequestURL(event);
+  const baseUrl = `${requestURL.protocol}//${requestURL.host}`;
+  const redirectURL = new URL(
+    config?.redirectUrl && baseUrl + config.redirectUrl || providerRuntimeConfig.redirectUris[0] && baseUrl + providerRuntimeConfig.redirectUris[0] || getOAuthRedirectURL(event)
+  );
+  const dev = import.meta.dev;
+  if (dev && redirectURL.hostname === "localhost") {
+    redirectURL.hostname = "127.0.0.1";
+  }
+  const redirectUris = (providerRuntimeConfig.redirectUris.length ? providerRuntimeConfig.redirectUris : [requestURL.pathname]).map((uri) => new URL(`${redirectURL.protocol}//${redirectURL.host}${uri}`).toString());
+  const clientId = dev ? `http://localhost?redirect_uri=${encodeURIComponent(redirectURL.toString())}&scope=${encodeURIComponent(scope)}` : `${baseUrl}/${getClientMetadataFilename("bluesky", providerRuntimeConfig)}`;
+  const clientMetadata = {
+    client_name: providerRuntimeConfig.clientName || void 0,
+    client_uri: providerRuntimeConfig.clientUri || void 0,
+    logo_uri: providerRuntimeConfig.logoUri || void 0,
+    policy_uri: providerRuntimeConfig.policyUri || void 0,
+    tos_uri: providerRuntimeConfig.tosUri || void 0,
+    client_id: clientId,
+    redirect_uris: redirectUris,
+    scope,
+    grant_types: grantTypes,
+    application_type: providerRuntimeConfig.applicationType,
+    token_endpoint_auth_method: providerRuntimeConfig.tokenEndpointAuthMethod,
+    dpop_bound_access_tokens: true
+  };
+  return clientMetadata;
+}

package/dist/runtime/server/utils/session.d.ts

@@ -20,7 +20,11 @@ export declare const sessionHooks: import("hookable").Hookable<SessionHooks, imp
  * @param event The Request (h3) event
  * @returns The user session
  */
-export declare function getUserSession(event: UseSessionEvent): Promise<UserSession>;
+export declare function getUserSession(event: UseSessionEvent): Promise<{
+    id: string;
+    user?: import("#auth-utils").User;
+    secure?: import("#auth-utils").SecureSessionData;
+}>;
 /**
  * Set a user session
  * @param event The Request (h3) event

package/dist/runtime/server/utils/session.js

@@ -4,7 +4,11 @@ import { createHooks } from "hookable";
 import { useRuntimeConfig } from "#imports";
 export const sessionHooks = createHooks();
 export async function getUserSession(event) {
-  return (await _useSession(event)).data;
+  const session = await _useSession(event);
+  return {
+    id: session.id,
+    ...session.data
+  };
 }
 export async function setUserSession(event, data, config) {
   const session = await _useSession(event, config);

package/dist/runtime/types/atproto.d.ts

@@ -0,0 +1,62 @@
+import type { OAuthClientMetadata } from '@atproto/oauth-client-node';
+export interface AtprotoProviderClientMetadata {
+    /**
+     * The name of the client metadata file. This is used to construct the client ID.
+     * @example 'client-metadata.json'
+     * @example 'bluesky/client-metadata.json'
+     */
+    clientMetadataFilename: string;
+    /**
+     * The human-readable name of the client.
+     */
+    clientName?: OAuthClientMetadata['client_name'];
+    /**
+     * Not to be confused with client_id, this is a homepage URL for the client. If provided, the client_uri must have the same hostname as client_id.
+     */
+    clientUri?: OAuthClientMetadata['client_uri'];
+    /**
+     * The client's logo URL.
+     */
+    logoUri?: OAuthClientMetadata['logo_uri'];
+    /**
+     * URL to human-readable terms of service (ToS) for the client. Only https: URIs are allowed.
+     */
+    tosUri?: OAuthClientMetadata['tos_uri'];
+    /**
+     * URL to human-readable privacy policy for the client. Only https: URIs are allowed.
+     */
+    policyUri?: OAuthClientMetadata['policy_uri'];
+    /**
+     * Must be one of web or native, with web as the default if not specified. Note that this is field specified by OpenID/OIDC, which we are borrowing. Used by the Authorization Server to enforce the relevant "best current practices".
+     * @default 'web'
+     */
+    applicationType?: OAuthClientMetadata['application_type'];
+    /**
+     * `authorization_code` must always be included and will be added if missing. `refresh_token` is optional, but must be included if the client will make token refresh requests.
+     * @default ['authorization_code']
+     */
+    grantTypes?: OAuthClientMetadata['grant_types'];
+    /**
+     * All scope values which might be requested by this client are declared here. The atproto scope is required, and will be added if missing.
+     * @default ['atproto']
+     */
+    scope?: NonNullable<OAuthClientMetadata['scope']>[];
+    /**
+     * `code` must always be included and will be added if missing.
+     */
+    responseTypes?: OAuthClientMetadata['response_types'];
+    /**
+     * At least one redirect URI is required. The URL origin must match that of the `clientId`, so declare only the path.
+     * @example ['/auth/callback']
+     */
+    redirectUris: OAuthClientMetadata['redirect_uris'];
+    /**
+     * The token endpoint authentication method. `none` is the default, and the only supported value at this time.
+     * @default 'none'
+     */
+    tokenEndpointAuthMethod?: OAuthClientMetadata['token_endpoint_auth_method'];
+    /**
+     * DPoP is mandatory for all clients, so this must be present and true.
+     */
+    dpopBoundAccessTokens?: OAuthClientMetadata['dpop_bound_access_tokens'];
+}

package/dist/runtime/types/index.d.ts

@@ -1,3 +1,3 @@
 export type { User, UserSession, UserSessionRequired, UserSessionComposable, SecureSessionData } from './session.js';
-export type { OAuthConfig, OAuthProvider, OnError } from './oauth-config.js';
+export type { OAuthConfig, OAuthProvider, ATProtoProvider, OnError } from './oauth-config.js';
 export type { WebAuthnCredential, WebAuthnRegisterEventHandlerOptions, WebAuthnAuthenticateEventHandlerOptions, WebAuthnComposable, WebAuthnUser, } from './webauthn.js';

package/dist/runtime/types/oauth-config.d.ts

@@ -1,5 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
-export type OAuthProvider = 'atlassian' | 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | (string & {});
+export type ATProtoProvider = 'bluesky';
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/dist/runtime/types/session.d.ts

@@ -4,6 +4,10 @@ export interface User {
 export interface SecureSessionData {
 }
 export interface UserSession {
+    /**
+     * Session ID
+     */
+    id: string;
     /**
      * User session data, available on client and server
      */
@@ -45,4 +49,11 @@ export interface UserSessionComposable {
      * Clear the user session and remove the session cookie.
      */
     clear: () => Promise<void>;
+    /**
+     * Open the OAuth route in a popup that auto-closes when successful.
+     */
+    openInPopup: (route: string, size?: {
+        width?: number;
+        height?: number;
+    }) => void;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.10",
+  "version": "0.5.12",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@adonisjs/hash": "^9.0.5",
-    "@nuxt/kit": "^3.15.2",
+    "@nuxt/kit": "^3.15.4",
     "defu": "^6.1.4",
     "h3": "^1.14.0",
     "hookable": "^5.5.3",
@@ -49,6 +49,8 @@
     "uncrypto": "^0.1.3"
   },
   "peerDependencies": {
+    "@atproto/api": "^0.13.15",
+    "@atproto/oauth-client-node": "^0.2.0",
     "@simplewebauthn/browser": "^11.0.0",
     "@simplewebauthn/server": "^11.0.0"
   },
@@ -58,23 +60,29 @@
     },
     "@simplewebauthn/server": {
       "optional": true
+    },
+    "@atproto/oauth-client-node": {
+      "optional": true
+    },
+    "@atproto/api": {
+      "optional": true
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.21",
-    "@nuxt/devtools": "latest",
-    "@nuxt/eslint-config": "^0.7.5",
+    "@iconify-json/simple-icons": "^1.2.23",
+    "@nuxt/devtools": "2.0.0-beta.7",
+    "@nuxt/eslint-config": "^0.7.6",
     "@nuxt/module-builder": "^0.8.4",
-    "@nuxt/schema": "^3.15.2",
+    "@nuxt/schema": "^3.15.4",
     "@nuxt/test-utils": "^3.15.4",
     "@nuxt/ui": "^2.21.0",
     "@nuxt/ui-pro": "^1.7.0",
     "@simplewebauthn/types": "^12.0.0",
     "changelogen": "^0.5.7",
-    "eslint": "^9.18.0",
-    "nuxt": "^3.15.2",
+    "eslint": "^9.19.0",
+    "nuxt": "^3.15.4",
     "typescript": "5.6.3",
-    "vitest": "^3.0.3",
+    "vitest": "^3.0.5",
     "vue-tsc": "^2.2.0"
   }
 }