nuxt-auth-utils 0.5.16 → 0.5.18

package/README.md

@@ -16,7 +16,7 @@ Add Authentication to Nuxt applications with secured & sealed cookies sessions.
 ## Features
 
 - [Hybrid Rendering](#hybrid-rendering) support (SSR / CSR / SWR / Prerendering)
-- [30+ OAuth Providers](#supported-oauth-providers)
+- [40+ OAuth Providers](#supported-oauth-providers)
 - [Password Hashing](#password-hashing)
 - [WebAuthn (passkey)](#webauthn-passkey)
 - [`useUserSession()` Vue composable](#vue-composable)
@@ -216,6 +216,7 @@ It can also be set using environment variables:
 - Auth0
 - Authentik
 - AWS Cognito
+- Azure B2C
 - Battle.net
 - Bluesky (AT Protocol)
 - Discord
@@ -225,16 +226,21 @@ It can also be set using environment variables:
 - GitLab
 - Gitea
 - Google
+- Heroku
 - Hubspot
 - Instagram
+- Kick
 - Keycloak
 - Line
 - Linear
 - LinkedIn
+- LiveChat
 - Microsoft
 - PayPal
 - Polar
+- Salesforce
 - Seznam
+- Slack
 - Spotify
 - Steam
 - Strava

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.16",
+  "version": "0.5.18",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -155,6 +155,16 @@ const module = defineNuxtModule({
       userURL: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.azureb2c = defu(runtimeConfig.oauth.azureb2c, {
+      clientId: "",
+      policy: "",
+      tenant: "",
+      scope: [],
+      authorizationURL: "",
+      tokenURL: "",
+      userURL: "",
+      redirectURL: ""
+    });
     runtimeConfig.oauth.discord = defu(runtimeConfig.oauth.discord, {
       clientId: "",
       clientSecret: "",
@@ -315,6 +325,34 @@ const module = defineNuxtModule({
       redirectURL: "",
       clientId: ""
     });
+    runtimeConfig.oauth.kick = defu(runtimeConfig.oauth.kick, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
+    runtimeConfig.oauth.livechat = defu(runtimeConfig.oauth.livechat, {
+      clientId: "",
+      clientSecret: ""
+    });
+    runtimeConfig.oauth.salesforce = defu(runtimeConfig.oauth.salesforce, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      baseURL: "",
+      scope: ""
+    });
+    runtimeConfig.oauth.slack = defu(runtimeConfig.oauth.slack, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: ""
+    });
+    runtimeConfig.oauth.heroku = defu(runtimeConfig.oauth.heroku, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: ""
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/apple.js

@@ -61,15 +61,15 @@ export function defineOAuthAppleEventHandler({
           redirect_uri: config.redirectURL
         }
       });
-      const tokens = await verifyJwt(accessTokenResult.id_token, {
+      const payload = await verifyJwt(accessTokenResult.id_token, {
         publicJwkUrl: "https://appleid.apple.com/auth/keys",
         audience: config.clientId,
         issuer: "https://appleid.apple.com"
       });
-      if (!tokens) {
-        return handleAccessTokenErrorResponse(event, "apple", tokens, onError);
+      if (!payload) {
+        return handleAccessTokenErrorResponse(event, "apple", payload, onError);
       }
-      return onSuccess(event, { user, tokens });
+      return onSuccess(event, { user, payload, tokens: accessTokenResult });
     } catch (error) {
       return handleAccessTokenErrorResponse(event, "apple", error, onError);
     }

package/dist/runtime/server/lib/oauth/azureb2c.d.ts

@@ -0,0 +1,54 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthAzureB2CConfig {
+    /**
+     * Azure OAuth Client ID
+     * @default process.env.NUXT_OAUTH_AZUREB2C_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Azure OAuth Policy
+     * @default process.env.NUXT_OAUTH_AZUREB2C_POLICY
+     */
+    policy?: string;
+    /**
+     * Azure OAuth Tenant ID
+     * @default process.env.NUXT_OAUTH_AZUREB2C_TENANT
+     */
+    tenant?: string;
+    /**
+     * Azure OAuth Scope
+     * @default ['offline_access']
+     * @see https://learn.microsoft.com/en-us/azure/active-directory-b2c/access-tokens#scopes
+     */
+    scope?: string[];
+    /**
+     * Azure OAuth Authorization URL
+     * @default 'https://${tenant}.onmicrosoft.com/${policy}/oauth2/v2.0/token'
+     * @see https://learn.microsoft.com/en-us/azure/active-directory-b2c/openid-connect
+     */
+    authorizationURL?: string;
+    /**
+     * Azure OAuth Token URL
+     * @default 'https://${tenant}.onmicrosoft.com/${policy}/oauth2/v2.0/token'
+     * @see https://learn.microsoft.com/en-us/azure/active-directory-b2c/openid-connect
+     */
+    tokenURL?: string;
+    /**
+     * Azure OAuth User URL
+     * @default 'https://graph.microsoft.com/v1.0/me'
+     * @see https://docs.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http
+     */
+    userURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://learn.microsoft.com/en-us/azure/active-directory-b2c/authorization-code-flow
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to prevent in prod prevent redirect_uri mismatch http to https
+     * @default process.env.NUXT_OAUTH_AZUREB2C_REDIRECT_URL
+     * @see https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthAzureB2CEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAzureB2CConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/azureb2c.js

@@ -0,0 +1,79 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handlePkceVerifier, handleState, handleInvalidState } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthAzureB2CEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.azureb2c, {
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (!config.clientId || !config.policy || !config.tenant) {
+      return handleMissingConfiguration(event, "azureb2c", ["clientId", "policy", "tenant"], onError);
+    }
+    const authorizationURL = config.authorizationURL || `https://${config.tenant}.b2clogin.com/${config.tenant}.onmicrosoft.com/${config.policy}/oauth2/v2.0/authorize`;
+    const tokenURL = config.tokenURL || `https://${config.tenant}.b2clogin.com/${config.tenant}.onmicrosoft.com/${config.policy}/oauth2/v2.0/token`;
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    config.scope = config.scope && config.scope.length > 0 ? config.scope : ["openid"];
+    config.scope = [...new Set(config.scope)];
+    const verifier = await handlePkceVerifier(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery(authorizationURL, {
+          client_id: config.clientId,
+          response_type: "code",
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          code_challenge: verifier.code_challenge,
+          code_challenge_method: verifier.code_challenge_method,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      handleInvalidState(event, "azureb2c", onError);
+    }
+    console.info("code verifier", verifier.code_verifier);
+    const tokens = await requestAccessToken(tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        scope: config.scope.join(" "),
+        code: query.code,
+        redirect_uri: redirectURL,
+        response_type: "code",
+        code_verifier: verifier.code_verifier
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "azureb2c", tokens, onError);
+    }
+    const tokenType = tokens.token_type;
+    const accessToken = tokens.access_token;
+    const userURL = config.userURL || "https://graph.microsoft.com/v1.0/me";
+    const user = await $fetch(userURL, {
+      headers: {
+        Authorization: `${tokenType} ${accessToken}`
+      }
+    }).catch((error) => {
+      return { error };
+    });
+    if (user.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `azureb2c login failed: ${user.error || "Unknown error"}`,
+        data: user
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/facebook.js

@@ -29,7 +29,7 @@ export function defineOAuthFacebookEventHandler({
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {
-      config.scope = config.scope || [];
+      config.scope = [...new Set(config.scope)];
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {
@@ -52,7 +52,7 @@ export function defineOAuthFacebookEventHandler({
       return handleAccessTokenErrorResponse(event, "facebook", tokens, onError);
     }
     const accessToken = tokens.access_token;
-    config.fields = config.fields || ["id", "name"];
+    config.fields = [...new Set(config.fields || ["id", "name"])];
     const fields = config.fields.join(",");
     const user = await $fetch(
       `https://graph.facebook.com/v19.0/me?fields=${fields}&access_token=${accessToken}`

package/dist/runtime/server/lib/oauth/github.d.ts

@@ -32,6 +32,11 @@ export interface OAuthGitHubConfig {
      * @default 'https://github.com/login/oauth/access_token'
      */
     tokenURL?: string;
+    /**
+     * GitHub API URL
+     * @default 'https://api.github.com'
+     */
+    apiURL?: string;
     /**
      * Extra authorization parameters to provide to the authorization URL
      * @see https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#1-request-a-users-github-identity

package/dist/runtime/server/lib/oauth/github.js

@@ -8,6 +8,7 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
     config = defu(config, useRuntimeConfig(event).oauth?.github, {
       authorizationURL: "https://github.com/login/oauth/authorize",
       tokenURL: "https://github.com/login/oauth/access_token",
+      apiURL: "https://api.github.com",
       authorizationParams: {}
     });
     const query = getQuery(event);
@@ -52,14 +53,14 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
       return handleAccessTokenErrorResponse(event, "github", tokens, onError);
     }
     const accessToken = tokens.access_token;
-    const user = await $fetch("https://api.github.com/user", {
+    const user = await $fetch(`${config.apiURL}/user`, {
       headers: {
         "User-Agent": `Github-OAuth-${config.clientId}`,
         "Authorization": `token ${accessToken}`
       }
     });
     if (!user.email && config.emailRequired) {
-      const emails = await $fetch("https://api.github.com/user/emails", {
+      const emails = await $fetch(`${config.apiURL}/user/emails`, {
         headers: {
           "User-Agent": `Github-OAuth-${config.clientId}`,
           "Authorization": `token ${accessToken}`

package/dist/runtime/server/lib/oauth/heroku.d.ts

@@ -0,0 +1,41 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthHerokuConfig {
+    /**
+     * Heroku OAuth Client ID
+     * @default process.env.NUXT_OAUTH_HEROKU_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Heroku OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_HEROKU_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Heroku OAuth Scope
+     * @default ['identity']
+     * @see https://devcenter.heroku.com/articles/oauth#scopes
+     * @example ['identity']
+     */
+    scope?: string[];
+    /**
+     * Heroku OAuth Authorization URL
+     * @default 'https://id.heroku.com/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Heroku OAuth Authorization URL
+     * @default 'https://id.heroku.com/oauth/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @default {}
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_HEROKU_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthHerokuEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthHerokuConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/heroku.js

@@ -0,0 +1,75 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthHerokuEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event).oauth?.heroku;
+    const baseURL = "https://id.heroku.com";
+    config = defu(config, runtimeConfig, {
+      authorizationURL: `${baseURL}/oauth/authorize`,
+      tokenURL: `${baseURL}/oauth/token`,
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Heroku login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "heroku", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || ["identity"];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      handleInvalidState(event, "heroku", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "heroku", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(`https://api.heroku.com/account`, {
+      headers: {
+        Accept: "application/vnd.heroku+json; version=3",
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/kick.d.ts

@@ -0,0 +1,38 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthKickConfig {
+    /**
+     * Kick Client ID
+     * @default process.env.NUXT_OAUTH_KICK_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Kick OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_KICK_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Kick OAuth Scope
+     * @default []
+     * @see https://docs.kick.com/getting-started/scopes
+     * @example ['channel:read']
+     */
+    scope?: string[];
+    /**
+     * Kick OAuth Authorization URL
+     * @see https://docs.kick.com/getting-started/generating-tokens-oauth2-flow#authorization-endpoint
+     * @default 'https://id.kick.com/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Kick OAuth Token URL
+     * @see https://docs.kick.com/getting-started/generating-tokens-oauth2-flow#token-endpoint
+     * @default 'https://id.kick.com/oauth/token'
+     */
+    tokenURL?: string;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_KICK_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthKickEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthKickConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/kick.js

@@ -0,0 +1,71 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { randomUUID } from "uncrypto";
+import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken, handlePkceVerifier } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthKickEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.kick, {
+      authorizationURL: "https://id.kick.com/oauth/authorize",
+      tokenURL: "https://id.kick.com/oauth/token"
+    });
+    const query = getQuery(event);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "kick", ["clientId", "clientSecret"], onError);
+    }
+    const verifier = await handlePkceVerifier(event);
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (!config.scope.includes("user:read"))
+        config.scope.push("user:read");
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state: randomUUID(),
+          code_challenge: verifier.code_challenge,
+          code_challenge_method: verifier.code_challenge_method
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code: query.code,
+        code_verifier: verifier.code_verifier
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "kick", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const { data } = await $fetch("https://api.kick.com/public/v1/users", {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json"
+      }
+    });
+    if (!data || !data.length) {
+      const error = createError({
+        statusCode: 500,
+        message: "Could not get Kick user",
+        data: tokens
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const user = data[0];
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/livechat.d.ts

@@ -0,0 +1,74 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface LiveChatTokens {
+    access_token: string;
+    account_id: string;
+    expires_in: number;
+    organization_id: string;
+    refresh_token: string;
+    scope: string;
+    token_type: string;
+}
+export interface LiveChatUser {
+    account_id: string;
+    name: string;
+    email: string;
+    email_verified: boolean;
+    default_product: string | null;
+    default_organization_id: string | null;
+    avatar_url: string | null;
+    time_zone: string;
+    roles?: {
+        role_id: string;
+        product: string;
+        role: string;
+        type: string;
+        predefined: boolean;
+    }[];
+    updated_at: string;
+    created_at: string;
+    properties?: Record<string, unknown>;
+}
+export interface LiveChatConfig {
+    /**
+     * LiveChat OAuth Client ID
+     * @default process.env.NUXT_LIVECHAT_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * LiveChat OAuth Client Secret
+     * @default process.env.NUXT_LIVECHAT_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_LIVECHAT_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+    /**
+     * LiveChat OAuth Authorization URL
+     * @default 'https://accounts.livechat.com
+     */
+    authorizationURL?: string;
+    /**
+     * LiveChat OAuth Token URL
+     * @default 'https://accounts.livechat.com/v2/token
+     */
+    tokenURL?: string;
+    /**
+     * LiveChat User URL
+     * @default 'https://accounts.livechat.com/v2/accounts/me
+     */
+    userURL?: string;
+    /**
+     * LiveChat OAuth Scope. accounts--my:ro is always applied to get user profile.
+     * @default ['accounts--my:ro']
+     * @example ['accounts--my:ro', 'chats--my:ro']
+     */
+    scope?: string[];
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://platform.text.com/docs/authorization/authorization-in-practice
+     */
+    authorizationParams?: Record<string, string>;
+}
+export declare function defineOAuthLiveChatEventHandler({ config, onSuccess, onError, }: OAuthConfig<LiveChatConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/livechat.js

@@ -0,0 +1,74 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { defu } from "defu";
+import { withQuery } from "ufo";
+import { randomUUID } from "uncrypto";
+import {
+  getOAuthRedirectURL,
+  handleAccessTokenErrorResponse,
+  handleMissingConfiguration,
+  requestAccessToken
+} from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthLiveChatEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.livechat, {
+      authorizationURL: "https://accounts.livechat.com",
+      tokenURL: "https://accounts.livechat.com/v2/token",
+      userURL: "https://accounts.livechat.com/v2/accounts/me",
+      scope: [],
+      authorizationParams: {
+        state: randomUUID()
+      }
+    });
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(
+        event,
+        "livechat",
+        ["clientId", "clientSecret"],
+        onError
+      );
+    }
+    const query = getQuery(event);
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const scope = [.../* @__PURE__ */ new Set([...config.scope, "accounts--my:ro"])].join(" ");
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          response_type: "code",
+          scope,
+          ...config.authorizationParams
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      params: {
+        grant_type: "authorization_code",
+        code: query.code,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL
+      }
+    }).catch((error) => {
+      return { error };
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "livechat", tokens, onError);
+    }
+    const user = await $fetch(config.userURL, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`
+      }
+    });
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/salesforce.d.ts

@@ -0,0 +1,46 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthSalesforceConfig {
+    /**
+     * Salesforce OAuth Client ID
+     * @default process.env.NUXT_OAUTH_SALESFORCE_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Salesforce OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_SALESFORCE_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Salesforce OAuth Scope
+     * @default ['id']
+     * @see https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm
+     * @example ['id']
+     */
+    scope?: string[];
+    /**
+     * Salesforce MyDomain URL
+     * @default 'https://login.salesforce.com'
+     */
+    baseURL?: string;
+    /**
+     * Salesforce OAuth Authorization URL
+     * @default 'https://login.salesforce.com/services/oauth2/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Salesforce OAuth Authorization URL
+     * @default 'https://login.salesforce.com/services/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @default {}
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_SALESFORCE_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthSalesforceEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSalesforceConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/salesforce.js

@@ -0,0 +1,74 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthSalesforceEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event).oauth?.salesforce;
+    const baseURL = config?.baseURL || "https://login.salesforce.com";
+    config = defu(config, runtimeConfig, {
+      authorizationURL: `${baseURL}/services/oauth2/authorize`,
+      tokenURL: `${baseURL}/services/oauth2/token`,
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Salesforce login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "salesforce", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || ["id"];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      handleInvalidState(event, "salesforce", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "salesforce", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(`${baseURL}/services/oauth2/userinfo`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/slack.d.ts

@@ -0,0 +1,41 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthSlackConfig {
+    /**
+     * Slack OAuth Client ID
+     * @default process.env.NUXT_OAUTH_SLACK_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Slack OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_SLACK_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Slack OAuth Scope
+     * @default ['openid', 'email', 'profile']
+     * @see https://api.slack.com/scopes?filter=user
+     * @example ['openid']
+     */
+    scope?: string[];
+    /**
+     * Slack OAuth Authorization URL
+     * @default 'https://slack.com/openid/connect/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Slack OAuth Authorization URL
+     * @default 'https://slack.com/api/openid.connect.token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @default {}
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_SLACK_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthSlackEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSlackConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/slack.js

@@ -0,0 +1,74 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthSlackEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event).oauth?.slack;
+    const baseURL = "https://slack.com";
+    config = defu(config, runtimeConfig, {
+      authorizationURL: `${baseURL}/openid/connect/authorize`,
+      tokenURL: `${baseURL}/api/openid.connect.token`,
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Slack login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "slack", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || ["openid", "email", "profile"];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      handleInvalidState(event, "slack", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "slack", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(`${baseURL}/api/openid.connect.userInfo`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/steam.js

@@ -12,25 +12,48 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
     if (!config.apiKey) {
       return handleMissingConfiguration(event, "steam", ["apiKey"], onError);
     }
+    const url = getRequestURL(event);
     if (!query["openid.claimed_id"]) {
       const redirectURL = config.redirectURL || getRequestURL(event).href;
       const steamOpenIdParams = {
         "openid.ns": "http://specs.openid.net/auth/2.0",
         "openid.mode": "checkid_setup",
         "openid.return_to": redirectURL,
+        "openid.realm": `${url.protocol}//${url.hostname}`,
         "openid.identity": "http://specs.openid.net/auth/2.0/identifier_select",
         "openid.claimed_id": "http://specs.openid.net/auth/2.0/identifier_select"
       };
       return sendRedirect(event, withQuery(config.authorizationURL, steamOpenIdParams));
     }
+    if (!query["openid.signed"] || !query["openid.sig"]) {
+      const error = createError({
+        statusCode: 400,
+        message: "Steam login failed: Incomplete query."
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
     const openIdCheck = {
-      ns: "http://specs.openid.net/auth/2.0",
-      claimed_id: "https://steamcommunity.com/openid/id/",
-      identity: "https://steamcommunity.com/openid/id/"
+      "openid.ns": "http://specs.openid.net/auth/2.0",
+      "openid.mode": "check_authentication",
+      "openid.signed": query["openid.signed"],
+      "openid.sig": query["openid.sig"]
     };
-    const idRegex = /^https?:\/\/steamcommunity\.com\/openid\/id\/(\d+)$/;
-    const steamIdCheck = idRegex.exec(query["openid.claimed_id"]);
-    if (query["openid.op_endpoint"] !== config.authorizationURL || !steamIdCheck || query["openid.ns"] !== openIdCheck.ns || !query["openid.claimed_id"]?.startsWith(openIdCheck.claimed_id) || !query["openid.identity"]?.startsWith(openIdCheck.identity)) {
+    for (const signed of query["openid.signed"].split(",")) {
+      if (!query[`openid.${signed}`]) {
+        const error = createError({
+          statusCode: 400,
+          message: "Steam login failed: Incomplete query."
+        });
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+      openIdCheck[`openid.${signed}`] = query[`openid.${signed}`];
+    }
+    const auth_validation = await $fetch(withQuery(config?.authorizationURL, openIdCheck));
+    const validRegex = /is_valid:true/;
+    const valid = validRegex.test(auth_validation);
+    if (!valid) {
       const error = createError({
         statusCode: 401,
         message: "Steam login failed: Claimed identity is invalid."
@@ -38,6 +61,8 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
       if (!onError) throw error;
       return onError(event, error);
     }
+    const idRegex = /^https?:\/\/steamcommunity\.com\/openid\/id\/(\d+)$/;
+    const steamIdCheck = idRegex.exec(query["openid.claimed_id"]);
     const steamId = steamIdCheck[1];
     const user = await $fetch(withQuery("https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/", {
       key: config.apiKey,

package/dist/runtime/server/lib/oauth/tiktok.js

@@ -1,7 +1,7 @@
+import crypto from "node:crypto";
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { sha256 } from "ohash";
 import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthTikTokEventHandler({ config, onSuccess, onError }) {
@@ -31,7 +31,7 @@ export function defineOAuthTikTokEventHandler({ config, onSuccess, onError }) {
           scope: config.scope.join(","),
           ...config.sandbox ? {
             code_verifier: codeVerifier,
-            code_challenge: sha256(codeVerifier),
+            code_challenge: crypto.createHash("sha256").update(codeVerifier).digest("hex"),
             code_challenge_method: "S256"
           } : {}
         })

package/dist/runtime/server/lib/utils.d.ts

@@ -1,4 +1,4 @@
-import type { H3Event } from 'h3';
+import { type H3Event } from 'h3';
 import type { OAuthProvider, OnError } from '#auth-utils';
 export declare function getOAuthRedirectURL(event: H3Event): string;
 /**
@@ -34,6 +34,7 @@ export declare function requestAccessToken(url: string, options: RequestAccessTo
  */
 export declare function handleAccessTokenErrorResponse(event: H3Event, oauthProvider: OAuthProvider, oauthError: any, onError?: OnError): void | Promise<void>;
 export declare function handleMissingConfiguration(event: H3Event, provider: OAuthProvider, missingKeys: string[], onError?: OnError): void | Promise<void>;
+export declare function handleInvalidState(event: H3Event, provider: OAuthProvider, onError?: OnError): void | Promise<void>;
 /**
  * JWT signing using jose
  *
@@ -59,4 +60,14 @@ interface JWTVerifyOptions {
     issuer: string;
 }
 export declare function verifyJwt<T>(token: string, options: JWTVerifyOptions): Promise<T>;
+export declare function handlePkceVerifier(event: H3Event): Promise<{
+    code_verifier: string;
+    code_challenge?: undefined;
+    code_challenge_method?: undefined;
+} | {
+    code_verifier: string;
+    code_challenge: string;
+    code_challenge_method: string;
+}>;
+export declare function handleState(event: H3Event): Promise<string>;
 export {};

package/dist/runtime/server/lib/utils.js

@@ -1,7 +1,9 @@
+import { deleteCookie, getCookie, setCookie } from "h3";
 import { getRequestURL } from "h3";
 import { FetchError } from "ofetch";
 import { snakeCase, upperFirst } from "scule";
 import * as jose from "jose";
+import { subtle, getRandomValues } from "uncrypto";
 import { createError } from "#imports";
 export function getOAuthRedirectURL(event) {
   const requestURL = getRequestURL(event);
@@ -45,6 +47,15 @@ export function handleMissingConfiguration(event, provider, missingKeys, onError
   if (!onError) throw error;
   return onError(event, error);
 }
+export function handleInvalidState(event, provider, onError) {
+  const message = `${upperFirst(provider)} login failed: state mismatch`;
+  const error = createError({
+    statusCode: 500,
+    message
+  });
+  if (!onError) throw error;
+  return onError(event, error);
+}
 export async function signJwt(payload, options) {
   const now = Math.floor(Date.now() / 1e3);
   const privateKey = await jose.importPKCS8(
@@ -61,3 +72,36 @@ export async function verifyJwt(token, options) {
   });
   return payload;
 }
+function encodeBase64Url(input) {
+  return btoa(String.fromCharCode.apply(null, input)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function getRandomBytes(size = 32) {
+  return getRandomValues(new Uint8Array(size));
+}
+export async function handlePkceVerifier(event) {
+  let verifier = getCookie(event, "nuxt-auth-pkce");
+  if (verifier) {
+    deleteCookie(event, "nuxt-auth-pkce");
+    return { code_verifier: verifier };
+  }
+  verifier = encodeBase64Url(getRandomBytes());
+  setCookie(event, "nuxt-auth-pkce", verifier);
+  const encodedPkce = new TextEncoder().encode(verifier);
+  const pkceHash = await subtle.digest("SHA-256", encodedPkce);
+  const pkce = encodeBase64Url(new Uint8Array(pkceHash));
+  return {
+    code_verifier: verifier,
+    code_challenge: pkce,
+    code_challenge_method: "S256"
+  };
+}
+export async function handleState(event) {
+  let state = getCookie(event, "nuxt-auth-state");
+  if (state) {
+    deleteCookie(event, "nuxt-auth-state");
+    return state;
+  }
+  state = encodeBase64Url(getRandomBytes(8));
+  setCookie(event, "nuxt-auth-state", state);
+  return state;
+}

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.16",
+  "version": "0.5.18",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -42,7 +42,6 @@
     "hookable": "^5.5.3",
     "jose": "^5.9.6",
     "ofetch": "^1.4.1",
-    "ohash": "^1.1.4",
     "openid-client": "^6.1.7",
     "pathe": "^2.0.2",
     "scule": "^1.3.0",