nuxt-auth-utils 0.5.2 → 0.5.4

package/README.md

@@ -205,6 +205,7 @@ It can also be set using environment variables:
 #### Supported OAuth Providers
 
 - Auth0
+- Authentik
 - AWS Cognito
 - Battle.net
 - Discord

package/dist/module.d.mts

@@ -1,5 +1,6 @@
 import * as _nuxt_schema from '@nuxt/schema';
 import { ScryptConfig } from '@adonisjs/hash/types';
+import { SessionConfig } from 'h3';
 
 interface ModuleOptions {
     /**
@@ -22,6 +23,10 @@ declare module 'nuxt/schema' {
         hash: {
             scrypt: ScryptConfig;
         };
+        /**
+         * Session configuration
+         */
+        session: SessionConfig;
     }
 }
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;

package/dist/module.d.ts

@@ -1,5 +1,6 @@
 import * as _nuxt_schema from '@nuxt/schema';
 import { ScryptConfig } from '@adonisjs/hash/types';
+import { SessionConfig } from 'h3';
 
 interface ModuleOptions {
     /**
@@ -22,6 +23,10 @@ declare module 'nuxt/schema' {
         hash: {
             scrypt: ScryptConfig;
         };
+        /**
+         * Session configuration
+         */
+        session: SessionConfig;
     }
 }
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -231,6 +231,12 @@ const module = defineNuxtModule({
       domain: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.authentik = defu(runtimeConfig.oauth.authentik, {
+      clientId: "",
+      clientSecret: "",
+      domain: "",
+      redirectURL: ""
+    });
   }
 });
 

package/dist/runtime/app/composables/session.js

@@ -1,9 +1,33 @@
-import { useState, computed, useRequestFetch } from "#imports";
-const useSessionState = () => useState("nuxt-session", () => ({}));
-const useAuthReadyState = () => useState("nuxt-auth-ready", () => false);
+import { appendResponseHeader } from "h3";
+import { useState, computed, useRequestFetch, useRequestEvent } from "#imports";
 export function useUserSession() {
-  const sessionState = useSessionState();
-  const authReadyState = useAuthReadyState();
+  const serverEvent = import.meta.server ? useRequestEvent() : null;
+  const sessionState = useState("nuxt-session", () => ({}));
+  const authReadyState = useState("nuxt-auth-ready", () => false);
+  const clear = async () => {
+    await useRequestFetch()("/api/_auth/session", {
+      method: "DELETE",
+      onResponse({ response: { headers } }) {
+        if (import.meta.server && serverEvent) {
+          for (const setCookie of headers.getSetCookie()) {
+            appendResponseHeader(serverEvent, "Set-Cookie", setCookie);
+          }
+        }
+      }
+    });
+    sessionState.value = {};
+  };
+  const fetch = async () => {
+    sessionState.value = await useRequestFetch()("/api/_auth/session", {
+      headers: {
+        accept: "application/json"
+      },
+      retry: false
+    }).catch(() => ({}));
+    if (!authReadyState.value) {
+      authReadyState.value = true;
+    }
+  };
   return {
     ready: computed(() => authReadyState.value),
     loggedIn: computed(() => Boolean(sessionState.value.user)),
@@ -13,19 +37,3 @@ export function useUserSession() {
     clear
   };
 }
-async function fetch() {
-  const authReadyState = useAuthReadyState();
-  useSessionState().value = await useRequestFetch()("/api/_auth/session", {
-    headers: {
-      Accept: "text/json"
-    },
-    retry: false
-  }).catch(() => ({}));
-  if (!authReadyState.value) {
-    authReadyState.value = true;
-  }
-}
-async function clear() {
-  await $fetch("/api/_auth/session", { method: "DELETE" });
-  useSessionState().value = {};
-}

package/dist/runtime/server/lib/oauth/authentik.d.ts

@@ -0,0 +1,25 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthAuthentikConfig {
+    /**
+     * Authentik OAuth Client ID
+     * @default process.env.NUXT_OAUTH_AUTHENTIK_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Authentik OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_AUTHENTIK_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Authentik OAuth Domain
+     * @example https://<your-authentik-instance>
+     * @default process.env.NUXT_OAUTH_AUTHENTIK_DOMAIN
+     */
+    domain?: string;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_AUTHENTIK_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuthentikConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/authentik.js

@@ -0,0 +1,72 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.authentik);
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Authentik login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret || !config.domain) {
+      return handleMissingConfiguration(event, "authentik", ["clientId", "clientSecret", "domain"], onError);
+    }
+    const authorizationURL = `https://${config.domain}/application/o/authorize/`;
+    const tokenURL = `https://${config.domain}/application/o/token/`;
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery(authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: ["openid", "profile", "email"].join(" ")
+        })
+      );
+    }
+    const tokens = await requestAccessToken(tokenURL, {
+      headers: {
+        "Authorization": `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`,
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "authentik", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(`https://${config.domain}/application/o/userinfo/`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json"
+      }
+    });
+    if (!user) {
+      const error = createError({
+        statusCode: 500,
+        message: "Could not get Authentik user",
+        data: tokens
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/plugins/oauth.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nitropack/types").NitroAppPlugin;
+declare const _default: import("nitropack").NitroAppPlugin;
 export default _default;

package/dist/runtime/types/oauth-config.d.ts

@@ -1,5 +1,5 @@
 import type { H3Event, H3Error } from 'h3';
-export type OAuthProvider = 'auth0' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | (string & {});
+export type OAuthProvider = 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.12.3",
+  "packageManager": "pnpm@9.13.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.ts",
@@ -36,8 +36,9 @@
   },
   "dependencies": {
     "@adonisjs/hash": "^9.0.5",
-    "@nuxt/kit": "^3.14.0",
+    "@nuxt/kit": "^3.14.159",
     "defu": "^6.1.4",
+    "h3": "^1.13.0",
     "hookable": "^5.5.3",
     "ofetch": "^1.4.1",
     "ohash": "^1.1.4",
@@ -62,16 +63,16 @@
     "@nuxt/devtools": "latest",
     "@nuxt/eslint-config": "^0.6.1",
     "@nuxt/module-builder": "^0.8.4",
-    "@nuxt/schema": "^3.14.0",
+    "@nuxt/schema": "^3.14.159",
     "@nuxt/test-utils": "^3.14.4",
-    "@nuxt/ui": "^2.18.7",
-    "@nuxt/ui-pro": "^1.4.4",
+    "@nuxt/ui": "^2.19.2",
+    "@nuxt/ui-pro": "^1.5.0",
     "@simplewebauthn/types": "^11.0.0",
     "changelogen": "^0.5.7",
     "eslint": "^9.14.0",
-    "nuxt": "^3.14.0",
+    "nuxt": "^3.14.159",
     "typescript": "^5.6.3",
-    "vitest": "^2.1.4",
+    "vitest": "^2.1.5",
     "vue-tsc": "^2.1.10"
   }
 }