nuxt-auth-utils 0.5.17 → 0.5.19

package/README.md

@@ -16,7 +16,7 @@ Add Authentication to Nuxt applications with secured & sealed cookies sessions.
 ## Features
 
 - [Hybrid Rendering](#hybrid-rendering) support (SSR / CSR / SWR / Prerendering)
-- [30+ OAuth Providers](#supported-oauth-providers)
+- [40+ OAuth Providers](#supported-oauth-providers)
 - [Password Hashing](#password-hashing)
 - [WebAuthn (passkey)](#webauthn-passkey)
 - [`useUserSession()` Vue composable](#vue-composable)
@@ -226,6 +226,7 @@ It can also be set using environment variables:
 - GitLab
 - Gitea
 - Google
+- Heroku
 - Hubspot
 - Instagram
 - Kick
@@ -237,7 +238,9 @@ It can also be set using environment variables:
 - Microsoft
 - PayPal
 - Polar
+- Salesforce
 - Seznam
+- Slack
 - Spotify
 - Steam
 - Strava

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.17",
+  "version": "0.5.19",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -334,6 +334,25 @@ const module = defineNuxtModule({
       clientId: "",
       clientSecret: ""
     });
+    runtimeConfig.oauth.salesforce = defu(runtimeConfig.oauth.salesforce, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      baseURL: "",
+      scope: ""
+    });
+    runtimeConfig.oauth.slack = defu(runtimeConfig.oauth.slack, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: ""
+    });
+    runtimeConfig.oauth.heroku = defu(runtimeConfig.oauth.heroku, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: ""
+    });
   }
 });
 

package/dist/runtime/server/api/session.get.d.ts

@@ -1,5 +1,6 @@
 declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
-    id: any;
+    [key: string]: unknown;
+    id?: string;
     user?: import("../../types").User;
 }>>;
 export default _default;

package/dist/runtime/server/lib/oauth/facebook.d.ts

@@ -40,7 +40,7 @@ export interface OAuthFacebookConfig {
      */
     authorizationParams?: Record<string, string>;
     /**
-     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
      * @default process.env.NUXT_OAUTH_FACEBOOK_REDIRECT_URL or current URL
      */
     redirectURL?: string;

package/dist/runtime/server/lib/oauth/facebook.js

@@ -35,7 +35,9 @@ export function defineOAuthFacebookEventHandler({
         withQuery(config.authorizationURL, {
           client_id: config.clientId,
           redirect_uri: redirectURL,
-          scope: config.scope.join(" ")
+          scope: config.scope.join(" "),
+          state: query.state || "",
+          ...config.authorizationParams
         })
       );
     }

package/dist/runtime/server/lib/oauth/github.d.ts

@@ -32,6 +32,11 @@ export interface OAuthGitHubConfig {
      * @default 'https://github.com/login/oauth/access_token'
      */
     tokenURL?: string;
+    /**
+     * GitHub API URL
+     * @default 'https://api.github.com'
+     */
+    apiURL?: string;
     /**
      * Extra authorization parameters to provide to the authorization URL
      * @see https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#1-request-a-users-github-identity

package/dist/runtime/server/lib/oauth/github.js

@@ -8,6 +8,7 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
     config = defu(config, useRuntimeConfig(event).oauth?.github, {
       authorizationURL: "https://github.com/login/oauth/authorize",
       tokenURL: "https://github.com/login/oauth/access_token",
+      apiURL: "https://api.github.com",
       authorizationParams: {}
     });
     const query = getQuery(event);
@@ -52,14 +53,14 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
       return handleAccessTokenErrorResponse(event, "github", tokens, onError);
     }
     const accessToken = tokens.access_token;
-    const user = await $fetch("https://api.github.com/user", {
+    const user = await $fetch(`${config.apiURL}/user`, {
       headers: {
         "User-Agent": `Github-OAuth-${config.clientId}`,
         "Authorization": `token ${accessToken}`
       }
     });
     if (!user.email && config.emailRequired) {
-      const emails = await $fetch("https://api.github.com/user/emails", {
+      const emails = await $fetch(`${config.apiURL}/user/emails`, {
         headers: {
           "User-Agent": `Github-OAuth-${config.clientId}`,
           "Authorization": `token ${accessToken}`

package/dist/runtime/server/lib/oauth/heroku.d.ts

@@ -0,0 +1,41 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthHerokuConfig {
+    /**
+     * Heroku OAuth Client ID
+     * @default process.env.NUXT_OAUTH_HEROKU_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Heroku OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_HEROKU_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Heroku OAuth Scope
+     * @default ['identity']
+     * @see https://devcenter.heroku.com/articles/oauth#scopes
+     * @example ['identity']
+     */
+    scope?: string[];
+    /**
+     * Heroku OAuth Authorization URL
+     * @default 'https://id.heroku.com/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Heroku OAuth Authorization URL
+     * @default 'https://id.heroku.com/oauth/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @default {}
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_HEROKU_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthHerokuEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthHerokuConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/heroku.js

@@ -0,0 +1,75 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthHerokuEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event).oauth?.heroku;
+    const baseURL = "https://id.heroku.com";
+    config = defu(config, runtimeConfig, {
+      authorizationURL: `${baseURL}/oauth/authorize`,
+      tokenURL: `${baseURL}/oauth/token`,
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Heroku login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "heroku", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || ["identity"];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      handleInvalidState(event, "heroku", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "heroku", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(`https://api.heroku.com/account`, {
+      headers: {
+        Accept: "application/vnd.heroku+json; version=3",
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/microsoft.js

@@ -25,6 +25,7 @@ export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError })
           response_type: "code",
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
+          state: query.state || "",
           ...config.authorizationParams
         })
       );

package/dist/runtime/server/lib/oauth/salesforce.d.ts

@@ -0,0 +1,46 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthSalesforceConfig {
+    /**
+     * Salesforce OAuth Client ID
+     * @default process.env.NUXT_OAUTH_SALESFORCE_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Salesforce OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_SALESFORCE_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Salesforce OAuth Scope
+     * @default ['id']
+     * @see https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm
+     * @example ['id']
+     */
+    scope?: string[];
+    /**
+     * Salesforce MyDomain URL
+     * @default 'https://login.salesforce.com'
+     */
+    baseURL?: string;
+    /**
+     * Salesforce OAuth Authorization URL
+     * @default 'https://login.salesforce.com/services/oauth2/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Salesforce OAuth Authorization URL
+     * @default 'https://login.salesforce.com/services/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @default {}
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_SALESFORCE_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthSalesforceEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSalesforceConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/salesforce.js

@@ -0,0 +1,74 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthSalesforceEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event).oauth?.salesforce;
+    const baseURL = config?.baseURL || "https://login.salesforce.com";
+    config = defu(config, runtimeConfig, {
+      authorizationURL: `${baseURL}/services/oauth2/authorize`,
+      tokenURL: `${baseURL}/services/oauth2/token`,
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Salesforce login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "salesforce", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || ["id"];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      handleInvalidState(event, "salesforce", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "salesforce", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(`${baseURL}/services/oauth2/userinfo`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/slack.d.ts

@@ -0,0 +1,41 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthSlackConfig {
+    /**
+     * Slack OAuth Client ID
+     * @default process.env.NUXT_OAUTH_SLACK_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Slack OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_SLACK_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Slack OAuth Scope
+     * @default ['openid', 'email', 'profile']
+     * @see https://api.slack.com/scopes?filter=user
+     * @example ['openid']
+     */
+    scope?: string[];
+    /**
+     * Slack OAuth Authorization URL
+     * @default 'https://slack.com/openid/connect/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Slack OAuth Authorization URL
+     * @default 'https://slack.com/api/openid.connect.token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @default {}
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_SLACK_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthSlackEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSlackConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/slack.js

@@ -0,0 +1,74 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthSlackEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event).oauth?.slack;
+    const baseURL = "https://slack.com";
+    config = defu(config, runtimeConfig, {
+      authorizationURL: `${baseURL}/openid/connect/authorize`,
+      tokenURL: `${baseURL}/api/openid.connect.token`,
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Slack login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "slack", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || ["openid", "email", "profile"];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      handleInvalidState(event, "slack", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "slack", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(`${baseURL}/api/openid.connect.userInfo`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/utils/session.d.ts

@@ -20,11 +20,7 @@ export declare const sessionHooks: import("hookable").Hookable<SessionHooks, imp
  * @param event The Request (h3) event
  * @returns The user session
  */
-export declare function getUserSession(event: UseSessionEvent): Promise<{
-    id: any;
-    user?: import("#auth-utils").User;
-    secure?: import("#auth-utils").SecureSessionData;
-}>;
+export declare function getUserSession(event: UseSessionEvent): Promise<UserSession>;
 /**
  * Set a user session
  * @param event The Request (h3) event

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.17",
+  "version": "0.5.19",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",