nuxt-auth-utils 0.5.21 → 0.5.23

package/README.md

@@ -239,6 +239,8 @@ It can also be set using environment variables:
 - LinkedIn
 - LiveChat
 - Microsoft
+- Okta
+- Ory
 - PayPal
 - Polar
 - Salesforce

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.21",
+  "version": "0.5.23",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -74,7 +74,7 @@ const module = defineNuxtModule({
     const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
     runtimeConfig.session = defu(runtimeConfig.session, {
       name: "nuxt-session",
-      password: process.env[envSessionPassword] || "",
+      password: "",
       cookie: {
         sameSite: "lax"
       }
@@ -82,14 +82,14 @@ const module = defineNuxtModule({
     runtimeConfig.hash = defu(runtimeConfig.hash, {
       scrypt: options.hash?.scrypt
     });
-    if (nuxt.options.dev && !runtimeConfig.session.password) {
-      runtimeConfig.session.password = randomUUID().replace(/-/g, "");
+    if (nuxt.options.dev && !process.env[envSessionPassword]) {
+      const password = process.env[envSessionPassword] = randomUUID().replace(/-/g, "");
       const envPath = join(nuxt.options.rootDir, ".env");
       const envContent = await readFile(envPath, "utf-8").catch(() => "");
       if (!envContent.includes(envSessionPassword)) {
         await writeFile(
           envPath,
-          `${envContent ? envContent + "\n" : envContent}${envSessionPassword}=${runtimeConfig.session.password}`,
+          `${envContent ? envContent + "\n" : envContent}${envSessionPassword}=${password}`,
           "utf-8"
         );
       }
@@ -353,6 +353,30 @@ const module = defineNuxtModule({
       redirectURL: "",
       scope: ""
     });
+    runtimeConfig.oauth.roblox = defu(runtimeConfig.oauth.roblox, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: ""
+    });
+    runtimeConfig.oauth.okta = defu(runtimeConfig.oauth.okta, {
+      clientId: "",
+      clientSecret: "",
+      domain: "",
+      audience: "",
+      scope: [],
+      redirectURL: ""
+    });
+    runtimeConfig.oauth.ory = defu(runtimeConfig.oauth.ory, {
+      clientId: "",
+      clientSecret: "",
+      sdkURL: "",
+      redirectURL: "",
+      scope: [],
+      authorizationURL: "",
+      tokenURL: "",
+      userURL: ""
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/github.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -25,6 +25,7 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "github", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user:email")) {
@@ -36,10 +37,14 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
+          state,
           ...config.authorizationParams
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "github", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/okta.d.ts

@@ -0,0 +1,88 @@
+import type { H3Event } from 'h3';
+import type { OAuthConfig } from '#auth-utils';
+export interface OpenIdConfig {
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    end_session_endpoint?: string;
+    [key: string]: unknown;
+}
+export interface OAuthConfigExt<TConfig, TResult = {
+    user: Record<string, unknown>;
+    tokens: Record<string, unknown>;
+    openIdConfig: OpenIdConfig;
+}> extends OAuthConfig<TConfig, TResult> {
+    config?: TConfig;
+    onSuccess: (event: H3Event, result: TResult) => Promise<void> | void;
+    onError?: (event: H3Event, error: unknown) => Promise<void> | void;
+}
+export interface OAuthOktaConfig {
+    /**
+     * Okta OAuth Client ID
+     * @default process.env.NUXT_OAUTH_OKTA_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Okta OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_OKTA_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Okta OAuth Issuer
+     * @default process.env.NUXT_OAUTH_OKTA_DOMAIN
+     */
+    domain?: string;
+    /**
+     * Okta OAuth Authorization Server
+     * @see https://developer.okta.com/docs/guides/customize-authz-server/main/#create-an-authorization-server
+     * @default process.env.NUXT_OAUTH_OKTA_AUTHORIZATION_SERVER
+     */
+    authorizationServer?: string;
+    /**
+     * Okta OAuth Audience
+     * @default process.env.NUXT_OAUTH_OKTA_AUDIENCE
+     */
+    audience?: string;
+    /**
+     * Okta OAuth Scope
+     * @default []
+     * @see https://okta.com/docs/get-started/apis/scopes/openid-connect-scopes
+     * @example ['openid']
+     */
+    scope?: string | string[];
+    /**
+     * Require email from user, adds the ['email'] scope if not present
+     * @default false
+     */
+    emailRequired?: boolean;
+    /**
+     * Maximum Authentication Age. If the elapsed time is greater than this value, the OP must attempt to actively re-authenticate the end-user.
+     * @default 0
+     * @see https://okta.com/docs/authenticate/login/max-age-reauthentication
+     */
+    maxAge?: number;
+    /**
+     * Login connection. If no connection is specified, it will redirect to the standard Okta login page and show the Login Widget.
+     * @default ''
+     * @see https://okta.com/docs/api/authentication#social
+     * @example 'github'
+     */
+    connection?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://okta.com/docs/api/authentication#social
+     * @example { display: 'popup' }
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_OKTA_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+    /**
+     * OpenID Configuration cache TTL in milliseconds
+     * @default 86400000 (24 hours)
+     */
+    openIdConfigCacheTTL?: number;
+}
+export declare function defineOAuthOktaEventHandler({ config, onSuccess, onError }: OAuthConfigExt<OAuthOktaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/okta.js

@@ -0,0 +1,171 @@
+import { eventHandler, getQuery, sendRedirect, createError, deleteCookie } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleState, handleInvalidState, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+const openIdConfigCache = /* @__PURE__ */ new Map();
+const DEFAULT_CACHE_TTL = 1e3 * 60 * 60 * 24;
+export function defineOAuthOktaEventHandler({ config, onSuccess, onError }) {
+  function normalizeScope(scope, emailRequired) {
+    let result;
+    if (!scope || typeof scope === "string" && scope.trim() === "") {
+      result = ["openid", "email", "profile"];
+    } else if (typeof scope === "string") {
+      result = scope.split(/[,| ]+/).filter(Boolean);
+    } else if (Array.isArray(scope) && scope.length > 0) {
+      result = scope;
+    } else {
+      result = ["openid", "email", "profile"];
+    }
+    result = [...new Set(result)];
+    if (emailRequired && !result.includes("email")) {
+      result.push("email");
+    }
+    return result;
+  }
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event);
+    config = defu(config, runtimeConfig.oauth?.okta, {
+      authorizationParams: {}
+    });
+    if (!config.clientId || !config.clientSecret || !config.domain || typeof config.domain !== "string" || !config.domain.trim()) {
+      return handleMissingConfiguration(event, "okta", ["clientId", "clientSecret", "domain"], onError);
+    }
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Okta login failed: ${query.error || "Unknown error"} - ${query.error_description || ""}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    config.scope = normalizeScope(config.scope, config.emailRequired);
+    const getOpenIdConfig = async (openIdConfigurationUrl2, event2) => {
+      const now = Date.now();
+      const cacheTTL = config?.openIdConfigCacheTTL || DEFAULT_CACHE_TTL;
+      const cached = openIdConfigCache.get(openIdConfigurationUrl2);
+      if (cached) {
+        if (cached.expiresAt > now) {
+          return cached.data;
+        } else {
+          openIdConfigCache.delete(openIdConfigurationUrl2);
+        }
+      }
+      let openIdConfig2 = null;
+      try {
+        openIdConfig2 = await $fetch(openIdConfigurationUrl2);
+        if (openIdConfig2) {
+          openIdConfigCache.set(openIdConfigurationUrl2, {
+            data: openIdConfig2,
+            expiresAt: now + cacheTTL
+          });
+        }
+      } catch (error) {
+        if (config && config.domain) {
+          const authz = config.authorizationServer;
+          openIdConfig2 = {
+            authorization_endpoint: authz ? `https://${config.domain}/oauth2/${authz}/v1/authorize` : `https://${config.domain}/oauth2/v1/authorize`,
+            token_endpoint: authz ? `https://${config.domain}/oauth2/${authz}/v1/token` : `https://${config.domain}/oauth2/v1/token`,
+            userinfo_endpoint: authz ? `https://${config.domain}/oauth2/${authz}/v1/userinfo` : `https://${config.domain}/oauth2/v1/userinfo`,
+            end_session_endpoint: void 0
+          };
+          openIdConfigCache.set(openIdConfigurationUrl2, {
+            data: openIdConfig2,
+            expiresAt: now + Math.min(cacheTTL / 24, 1e3 * 60 * 60)
+            // 1 hour or 1/24th of configured TTL, whichever is smaller
+          });
+        } else {
+          console.error("Failed to fetch Okta OpenID configuration. Please check your Okta domain and network connectivity:", error);
+          const err = createError({
+            statusCode: 500,
+            message: "Could not get Okta OpenID configuration. Please verify that your Okta domain is correct and reachable, and that the OpenID configuration endpoint is accessible.",
+            data: error
+          });
+          if (onError) await onError(event2, err);
+          throw err;
+        }
+      }
+      return openIdConfig2;
+    };
+    const authServer = config.authorizationServer;
+    const openIdConfigurationUrl = authServer ? `https://${config.domain}/oauth2/${authServer}/.well-known/openid-configuration` : `https://${config.domain}/.well-known/openid-configuration`;
+    const openIdConfig = await getOpenIdConfig(openIdConfigurationUrl, event);
+    const authorizationURL = openIdConfig.authorization_endpoint;
+    const tokenURL = openIdConfig.token_endpoint;
+    const userInfoUrl = openIdConfig.userinfo_endpoint;
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery(authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          audience: config.audience || "",
+          max_age: config.maxAge || 0,
+          connection: config.connection || "",
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      deleteCookie(event, "nuxt-auth-state");
+      return handleInvalidState(event, "okta", onError);
+    }
+    const tokens = await requestAccessToken(tokenURL, {
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: {
+        response_type: "code",
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        scope: config.scope?.join(" "),
+        redirect_uri: redirectURL,
+        code: query.code,
+        state: query.state
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "okta", tokens, onError);
+    }
+    if (!tokens.access_token || typeof tokens.access_token !== "string" || !tokens.token_type || typeof tokens.token_type !== "string") {
+      const err = createError({
+        statusCode: 400,
+        message: "Invalid token response from Okta",
+        data: tokens
+      });
+      if (onError) return onError(event, err);
+      throw err;
+    }
+    const tokenType = tokens.token_type;
+    const accessToken = tokens.access_token;
+    let user;
+    try {
+      user = await $fetch(userInfoUrl, {
+        headers: {
+          Authorization: `${tokenType} ${accessToken}`
+        }
+      });
+    } catch (error) {
+      const err = createError({
+        statusCode: 410,
+        message: `Could not get Okta user info - ${error instanceof Error ? error.message : String(error)}`,
+        data: tokens
+      });
+      if (onError) return onError(event, err);
+      throw err;
+    }
+    return onSuccess(event, {
+      tokens,
+      user,
+      openIdConfig
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/ory.d.ts

@@ -0,0 +1,51 @@
+import type { OAuthConfig } from '#auth-utils';
+/**
+ * Ory OAuth2
+ * @see https://www.ory.sh/docs/oauth2-oidc/authorization-code-flow
+ */
+export interface OAuthOryConfig {
+    /**
+     * Ory OAuth Client ID
+     * @default process.env.NUXT_OAUTH_ORY_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Ory OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_ORY_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Ory OAuth SDK URL
+     * @default "https://playground.projects.oryapis.com" || process.env.NUXT_OAUTH_ORY_SDK_URL
+     */
+    sdkURL?: string;
+    /**
+     * Ory OAuth Scope
+     * @default ['openid', 'offline']
+     * @see https://www.ory.sh/docs/oauth2-oidc/openid-connect-claims-scope-custom
+     * @example ['openid', 'offline', 'email']
+     */
+    scope?: string[] | string;
+    /**
+     * Ory OAuth Authorization URL
+     * @default '/oauth2/auth'
+     */
+    authorizationURL?: string;
+    /**
+     * Ory OAuth Token URL
+     * @default '/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @example { allow_signup: 'true' }
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Ory OAuth Userinfo URL
+     * @see https://www.ory.sh/docs/oauth2-oidc/userinfo-oidc
+     * @default '/userinfo'
+     */
+    userURL?: string;
+}
+export declare function defineOAuthOryEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOryConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/ory.js

@@ -0,0 +1,101 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  getOAuthRedirectURL,
+  handleAccessTokenErrorResponse,
+  handleInvalidState,
+  handleMissingConfiguration,
+  handlePkceVerifier,
+  handleState,
+  requestAccessToken
+} from "../utils.js";
+import { createError, useRuntimeConfig } from "#imports";
+export function defineOAuthOryEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.ory, {
+      scope: ["openid", "offline"],
+      sdkURL: "https://playground.projects.oryapis.com",
+      authorizationURL: "/oauth2/auth",
+      tokenURL: "/oauth2/token",
+      userURL: "/userinfo",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Ory login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.sdkURL) {
+      return handleMissingConfiguration(event, "ory", ["clientId", "sdkURL"], onError);
+    }
+    const redirectURL = getOAuthRedirectURL(event);
+    if (Array.isArray(config.scope)) {
+      config.scope = Array.from(new Set(config.scope)).join(" ");
+    }
+    const verifier = await handlePkceVerifier(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      const authorizationURL = `${config.sdkURL}${config.authorizationURL}`;
+      return sendRedirect(
+        event,
+        withQuery(authorizationURL, {
+          client_id: config.clientId,
+          response_type: "code",
+          redirect_uri: redirectURL,
+          scope: config.scope,
+          state,
+          code_challenge: verifier.code_challenge,
+          code_challenge_method: verifier.code_challenge_method,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      handleInvalidState(event, "ory", onError);
+    }
+    const tokenURL = `${config.sdkURL}${config.tokenURL}`;
+    const tokens = await requestAccessToken(tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        code: query.code,
+        redirect_uri: redirectURL,
+        scope: config.scope,
+        code_verifier: verifier.code_verifier
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "ory", tokens, onError);
+    }
+    const tokenType = tokens.token_type;
+    const accessToken = tokens.access_token;
+    const userURL = `${config.sdkURL}${config.userURL}`;
+    const user = await $fetch(userURL, {
+      headers: {
+        "User-Agent": `Ory-${config.clientId}`,
+        "Authorization": `${tokenType} ${accessToken}`
+      }
+    }).catch((error) => {
+      return { error };
+    });
+    if (user.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Ory userinfo failed: ${user.error || "Unknown error"}`,
+        data: user
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/roblox.d.ts

@@ -0,0 +1,126 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthRobloxConfig {
+    /**
+     * Roblox OAuth Client ID
+     * @default process.env.NUXT_OAUTH_ROBLOX_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Roblox OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_ROBLOX_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Roblox OAuth Scope
+     * Some scopes and claims listed are only available to official Roblox apps, e.g. email
+     * @default ['openid', 'profile']
+     * @see https://apis.roblox.com/oauth/.well-known/openid-configuration
+     * @example ['openid', 'profile', 'asset:read', 'universe-messaging-service:publish']
+     */
+    scope?: string[];
+    /**
+     * Roblox OAuth Authorization URL
+     * @default 'https://apis.roblox.com/oauth/v1/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Roblox OAuth Token URL
+     * @default 'https://apis.roblox.com/oauth/v1/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://create.roblox.com/docs/cloud/auth/oauth2-reference#get-v1authorize
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_ROBLOX_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export interface OAuthRobloxUser {
+    /**
+     * The resource path of the user
+     * @example "users/123"
+     */
+    path: string;
+    /**
+     * The timestamp at which the user was created
+     * @readonly
+     * @example "2023-07-05T12:34:56Z"
+     */
+    createTime: string;
+    /**
+     * Unique ID that identifies a user in Roblox
+     * @readonly
+     * @example "123456"
+     */
+    id: string;
+    /**
+     * Unique username for a user in Roblox
+     * @example "exampleUser"
+     */
+    name: string;
+    /**
+     * Display name for the user
+     * @example "userDefinedName"
+     */
+    displayName: string;
+    /**
+     * User-defined information about themselves
+     * @example "Example User's bio"
+     */
+    about: string;
+    /**
+     * Current locale selected by the user as an IETF language code
+     * @example "en-US"
+     */
+    locale: string;
+    /**
+     * Whether the user is a premium user
+     * @readonly
+     * @example true
+     */
+    premium: boolean;
+    /**
+     * Specifies if the user is identity-verified
+     * Verification includes, but isn't limited to, non-VoIP phone numbers or government IDs
+     * Available only with the user.advanced:read scope
+     * @readonly
+     * @example true
+     */
+    idVerified: boolean;
+    /**
+     * User's social network profiles and visibility.
+     */
+    socialNetworkProfiles: {
+        /**
+         * Facebook profile URI.
+         */
+        facebook?: string;
+        /**
+         * Twitter profile URI.
+         */
+        twitter?: string;
+        /**
+         * YouTube profile URI.
+         */
+        youtube?: string;
+        /**
+         * Twitch profile URI.
+         */
+        twitch?: string;
+        /**
+         * Guilded profile URI.
+         */
+        guilded?: string;
+        /**
+         * Visibility of the social network profiles.
+         * Available only with the user.social:read scope
+         * @example "SOCIAL_NETWORK_VISIBILITY_UNSPECIFIED"
+         */
+        visibility: 'SOCIAL_NETWORK_VISIBILITY_UNSPECIFIED' | 'NO_ONE' | 'FRIENDS' | 'FRIENDS_AND_FOLLOWING' | 'FRIENDS_FOLLOWING_AND_FOLLOWERS' | 'EVERYONE';
+    };
+}
+export declare function defineOAuthRobloxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRobloxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/roblox.js

@@ -0,0 +1,64 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthRobloxEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.roblox, {
+      authorizationURL: "https://apis.roblox.com/oauth/v1/authorize",
+      tokenURL: "https://apis.roblox.com/oauth/v1/token",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "roblox", ["clientId", "clientSecret"], onError);
+    }
+    if (query.error) {
+      return handleAccessTokenErrorResponse(event, "roblox", query, onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          ...config.authorizationParams
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "roblox", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const userInfo = await $fetch("https://apis.roblox.com/oauth/userinfo", {
+      headers: {
+        "user-agent": "Nuxt Auth Utils",
+        "Authorization": `Bearer ${accessToken}`
+      }
+    });
+    const user = await $fetch(`https://apis.roblox.com/cloud/v2/users/${userInfo.sub}`, {
+      headers: {
+        "user-agent": "Nuxt Auth Utils",
+        "Authorization": `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/zitadel.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handlePkceVerifier, handleInvalidState } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -18,12 +18,14 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
       if (!onError) throw error;
       return onError(event, error);
     }
-    if (!config.clientId || !config.clientSecret || !config.domain) {
-      return handleMissingConfiguration(event, "zitadel", ["clientId", "clientSecret", "issuerUrl"], onError);
+    if (!config.clientId || !config.domain) {
+      return handleMissingConfiguration(event, "zitadel", ["clientId", "domain"], onError);
     }
     const authorizationURL = `https://${config.domain}/oauth/v2/authorize`;
     const tokenURL = `https://${config.domain}/oauth/v2/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const verifier = await handlePkceVerifier(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["openid"];
       return sendRedirect(
@@ -33,22 +35,33 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
+          state,
+          code_challenge: verifier.code_challenge,
+          code_challenge_method: verifier.code_challenge_method,
           ...config.authorizationParams
         })
       );
     }
-    const tokens = await requestAccessToken(tokenURL, {
-      headers: {
-        "Authorization": `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`,
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
+    if (query.state !== state) {
+      return handleInvalidState(event, "zitadel", onError);
+    }
+    const request = {
       body: {
         grant_type: "authorization_code",
         client_id: config.clientId,
         redirect_uri: redirectURL,
-        code: query.code
+        code: query.code,
+        code_verifier: verifier.code_verifier
       }
-    });
+    };
+    if (config.clientSecret) {
+      const basicAuthorization = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
+      request.headers = {
+        "Authorization": `Basic ${basicAuthorization}`,
+        "Content-Type": "application/x-www-form-urlencoded"
+      };
+    }
+    const tokens = await requestAccessToken(tokenURL, request);
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "zitadel", tokens, onError);
     }

package/dist/runtime/server/lib/utils.d.ts

@@ -14,7 +14,7 @@ export interface RequestAccessTokenBody {
     client_secret?: string;
     [key: string]: string | undefined;
 }
-interface RequestAccessTokenOptions {
+export interface RequestAccessTokenOptions {
     body?: RequestAccessTokenBody;
     params?: Record<string, string | undefined>;
     headers?: Record<string, string>;

package/dist/runtime/server/utils/session.js

@@ -49,6 +49,9 @@ function _useSession(event, config = {}) {
     const runtimeConfig = useRuntimeConfig(isEvent(event) ? event : void 0);
     const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
     sessionConfig = defu({ password: process.env[envSessionPassword] }, runtimeConfig.session);
+    if (!sessionConfig.password) {
+      console.error(`[nuxt-auth-utils] ${envSessionPassword} environment variable or runtimeConfig.session.password was not set.`);
+    }
   }
   const finalConfig = defu(config, sessionConfig);
   return useSession(event, finalConfig);

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.21",
+  "version": "0.5.23",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -35,15 +35,15 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@adonisjs/hash": "^9.0.5",
-    "@nuxt/kit": "^3.15.4",
+    "@adonisjs/hash": "^9.1.1",
+    "@nuxt/kit": "^3.18.1",
     "defu": "^6.1.4",
-    "h3": "^1.14.0",
+    "h3": "^1.15.4",
     "hookable": "^5.5.3",
-    "jose": "^5.9.6",
+    "jose": "^5.10.0",
     "ofetch": "^1.4.1",
-    "openid-client": "^6.1.7",
-    "pathe": "^2.0.2",
+    "openid-client": "^6.6.2",
+    "pathe": "^2.0.3",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
   },
@@ -68,7 +68,7 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.23",
+    "@iconify-json/simple-icons": "^1.2.46",
     "@nuxt/devtools": "2.0.0-beta.7",
     "@nuxt/eslint-config": "^0.7.6",
     "@nuxt/module-builder": "^0.8.4",
@@ -78,10 +78,10 @@
     "@nuxt/ui-pro": "^1.7.0",
     "@simplewebauthn/types": "^11.0.0",
     "changelogen": "^0.5.7",
-    "eslint": "^9.19.0",
-    "nuxt": "^3.15.4",
+    "eslint": "^9.32.0",
+    "nuxt": "^3.18.1",
     "typescript": "5.6.3",
     "vitest": "^3.0.5",
-    "vue-tsc": "^2.2.0"
+    "vue-tsc": "^2.2.12"
   }
 }