nuxt-auth-utils 0.5.21 → 0.5.22

package/README.md

@@ -239,6 +239,7 @@ It can also be set using environment variables:
 - LinkedIn
 - LiveChat
 - Microsoft
+- Okta
 - PayPal
 - Polar
 - Salesforce

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.21",
+  "version": "0.5.22",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -353,6 +353,14 @@ const module = defineNuxtModule({
       redirectURL: "",
       scope: ""
     });
+    runtimeConfig.oauth.okta = defu(runtimeConfig.oauth.okta, {
+      clientId: "",
+      clientSecret: "",
+      domain: "",
+      audience: "",
+      scope: [],
+      redirectURL: ""
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/okta.d.ts

@@ -0,0 +1,88 @@
+import type { H3Event } from 'h3';
+import type { OAuthConfig } from '#auth-utils';
+export interface OpenIdConfig {
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    end_session_endpoint?: string;
+    [key: string]: unknown;
+}
+export interface OAuthConfigExt<TConfig, TResult = {
+    user: Record<string, unknown>;
+    tokens: Record<string, unknown>;
+    openIdConfig: OpenIdConfig;
+}> extends OAuthConfig<TConfig, TResult> {
+    config?: TConfig;
+    onSuccess: (event: H3Event, result: TResult) => Promise<void> | void;
+    onError?: (event: H3Event, error: unknown) => Promise<void> | void;
+}
+export interface OAuthOktaConfig {
+    /**
+     * Okta OAuth Client ID
+     * @default process.env.NUXT_OAUTH_OKTA_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Okta OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_OKTA_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Okta OAuth Issuer
+     * @default process.env.NUXT_OAUTH_OKTA_DOMAIN
+     */
+    domain?: string;
+    /**
+     * Okta OAuth Authorization Server
+     * @see https://developer.okta.com/docs/guides/customize-authz-server/main/#create-an-authorization-server
+     * @default process.env.NUXT_OAUTH_OKTA_AUTHORIZATION_SERVER
+     */
+    authorizationServer?: string;
+    /**
+     * Okta OAuth Audience
+     * @default process.env.NUXT_OAUTH_OKTA_AUDIENCE
+     */
+    audience?: string;
+    /**
+     * Okta OAuth Scope
+     * @default []
+     * @see https://okta.com/docs/get-started/apis/scopes/openid-connect-scopes
+     * @example ['openid']
+     */
+    scope?: string | string[];
+    /**
+     * Require email from user, adds the ['email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+    /**
+     * Maximum Authentication Age. If the elapsed time is greater than this value, the OP must attempt to actively re-authenticate the end-user.
+     * @default 0
+     * @see https://okta.com/docs/authenticate/login/max-age-reauthentication
+     */
+    maxAge?: number;
+    /**
+     * Login connection. If no connection is specified, it will redirect to the standard Okta login page and show the Login Widget.
+     * @default ''
+     * @see https://okta.com/docs/api/authentication#social
+     * @example 'github'
+     */
+    connection?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://okta.com/docs/api/authentication#social
+     * @example { display: 'popup' }
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_OKTA_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+    /**
+     * OpenID Configuration cache TTL in milliseconds
+     * @default 86400000 (24 hours)
+     */
+    openIdConfigCacheTTL?: number;
+}
+export declare function defineOAuthOktaEventHandler({ config, onSuccess, onError }: OAuthConfigExt<OAuthOktaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/okta.js

@@ -0,0 +1,171 @@
+import { eventHandler, getQuery, sendRedirect, createError, deleteCookie } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleState, handleInvalidState, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+const openIdConfigCache = /* @__PURE__ */ new Map();
+const DEFAULT_CACHE_TTL = 1e3 * 60 * 60 * 24;
+export function defineOAuthOktaEventHandler({ config, onSuccess, onError }) {
+  function normalizeScope(scope, emailRequired) {
+    let result;
+    if (!scope || typeof scope === "string" && scope.trim() === "") {
+      result = ["openid", "email", "profile"];
+    } else if (typeof scope === "string") {
+      result = scope.split(/[,| ]+/).filter(Boolean);
+    } else if (Array.isArray(scope) && scope.length > 0) {
+      result = scope;
+    } else {
+      result = ["openid", "email", "profile"];
+    }
+    result = [...new Set(result)];
+    if (emailRequired && !result.includes("email")) {
+      result.push("email");
+    }
+    return result;
+  }
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event);
+    config = defu(config, runtimeConfig.oauth?.okta, {
+      authorizationParams: {}
+    });
+    if (!config.clientId || !config.clientSecret || !config.domain || typeof config.domain !== "string" || !config.domain.trim()) {
+      return handleMissingConfiguration(event, "okta", ["clientId", "clientSecret", "domain"], onError);
+    }
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Okta login failed: ${query.error || "Unknown error"} - ${query.error_description || ""}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    config.scope = normalizeScope(config.scope, config.emailRequired);
+    const getOpenIdConfig = async (openIdConfigurationUrl2, event2) => {
+      const now = Date.now();
+      const cacheTTL = config?.openIdConfigCacheTTL || DEFAULT_CACHE_TTL;
+      const cached = openIdConfigCache.get(openIdConfigurationUrl2);
+      if (cached) {
+        if (cached.expiresAt > now) {
+          return cached.data;
+        } else {
+          openIdConfigCache.delete(openIdConfigurationUrl2);
+        }
+      }
+      let openIdConfig2 = null;
+      try {
+        openIdConfig2 = await $fetch(openIdConfigurationUrl2);
+        if (openIdConfig2) {
+          openIdConfigCache.set(openIdConfigurationUrl2, {
+            data: openIdConfig2,
+            expiresAt: now + cacheTTL
+          });
+        }
+      } catch (error) {
+        if (config && config.domain) {
+          const authz = config.authorizationServer;
+          openIdConfig2 = {
+            authorization_endpoint: authz ? `https://${config.domain}/oauth2/${authz}/v1/authorize` : `https://${config.domain}/oauth2/v1/authorize`,
+            token_endpoint: authz ? `https://${config.domain}/oauth2/${authz}/v1/token` : `https://${config.domain}/oauth2/v1/token`,
+            userinfo_endpoint: authz ? `https://${config.domain}/oauth2/${authz}/v1/userinfo` : `https://${config.domain}/oauth2/v1/userinfo`,
+            end_session_endpoint: void 0
+          };
+          openIdConfigCache.set(openIdConfigurationUrl2, {
+            data: openIdConfig2,
+            expiresAt: now + Math.min(cacheTTL / 24, 1e3 * 60 * 60)
+            // 1 hour or 1/24th of configured TTL, whichever is smaller
+          });
+        } else {
+          console.error("Failed to fetch Okta OpenID configuration. Please check your Okta domain and network connectivity:", error);
+          const err = createError({
+            statusCode: 500,
+            message: "Could not get Okta OpenID configuration. Please verify that your Okta domain is correct and reachable, and that the OpenID configuration endpoint is accessible.",
+            data: error
+          });
+          if (onError) await onError(event2, err);
+          throw err;
+        }
+      }
+      return openIdConfig2;
+    };
+    const authServer = config.authorizationServer;
+    const openIdConfigurationUrl = authServer ? `https://${config.domain}/oauth2/${authServer}/.well-known/openid-configuration` : `https://${config.domain}/.well-known/openid-configuration`;
+    const openIdConfig = await getOpenIdConfig(openIdConfigurationUrl, event);
+    const authorizationURL = openIdConfig.authorization_endpoint;
+    const tokenURL = openIdConfig.token_endpoint;
+    const userInfoUrl = openIdConfig.userinfo_endpoint;
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery(authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          audience: config.audience || "",
+          max_age: config.maxAge || 0,
+          connection: config.connection || "",
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      deleteCookie(event, "nuxt-auth-state");
+      return handleInvalidState(event, "okta", onError);
+    }
+    const tokens = await requestAccessToken(tokenURL, {
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: {
+        response_type: "code",
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        scope: config.scope?.join(" "),
+        redirect_uri: redirectURL,
+        code: query.code,
+        state: query.state
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "okta", tokens, onError);
+    }
+    if (!tokens.access_token || typeof tokens.access_token !== "string" || !tokens.token_type || typeof tokens.token_type !== "string") {
+      const err = createError({
+        statusCode: 400,
+        message: "Invalid token response from Okta",
+        data: tokens
+      });
+      if (onError) return onError(event, err);
+      throw err;
+    }
+    const tokenType = tokens.token_type;
+    const accessToken = tokens.access_token;
+    let user;
+    try {
+      user = await $fetch(userInfoUrl, {
+        headers: {
+          Authorization: `${tokenType} ${accessToken}`
+        }
+      });
+    } catch (error) {
+      const err = createError({
+        statusCode: 410,
+        message: `Could not get Okta user info - ${error instanceof Error ? error.message : String(error)}`,
+        data: tokens
+      });
+      if (onError) return onError(event, err);
+      throw err;
+    }
+    return onSuccess(event, {
+      tokens,
+      user,
+      openIdConfig
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/zitadel.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handlePkceVerifier, handleInvalidState } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -18,12 +18,14 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
       if (!onError) throw error;
       return onError(event, error);
     }
-    if (!config.clientId || !config.clientSecret || !config.domain) {
-      return handleMissingConfiguration(event, "zitadel", ["clientId", "clientSecret", "issuerUrl"], onError);
+    if (!config.clientId || !config.domain) {
+      return handleMissingConfiguration(event, "zitadel", ["clientId", "domain"], onError);
     }
     const authorizationURL = `https://${config.domain}/oauth/v2/authorize`;
     const tokenURL = `https://${config.domain}/oauth/v2/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const verifier = await handlePkceVerifier(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["openid"];
       return sendRedirect(
@@ -33,22 +35,33 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
+          state,
+          code_challenge: verifier.code_challenge,
+          code_challenge_method: verifier.code_challenge_method,
           ...config.authorizationParams
         })
       );
     }
-    const tokens = await requestAccessToken(tokenURL, {
-      headers: {
-        "Authorization": `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`,
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
+    if (query.state !== state) {
+      return handleInvalidState(event, "zitadel", onError);
+    }
+    const request = {
       body: {
         grant_type: "authorization_code",
         client_id: config.clientId,
         redirect_uri: redirectURL,
-        code: query.code
+        code: query.code,
+        code_verifier: verifier.code_verifier
       }
-    });
+    };
+    if (config.clientSecret) {
+      const basicAuthorization = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
+      request.headers = {
+        "Authorization": `Basic ${basicAuthorization}`,
+        "Content-Type": "application/x-www-form-urlencoded"
+      };
+    }
+    const tokens = await requestAccessToken(tokenURL, request);
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "zitadel", tokens, onError);
     }

package/dist/runtime/server/lib/utils.d.ts

@@ -14,7 +14,7 @@ export interface RequestAccessTokenBody {
     client_secret?: string;
     [key: string]: string | undefined;
 }
-interface RequestAccessTokenOptions {
+export interface RequestAccessTokenOptions {
     body?: RequestAccessTokenBody;
     params?: Record<string, string | undefined>;
     headers?: Record<string, string>;

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'okta' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.21",
+  "version": "0.5.22",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",