nuxt-auth-utils 0.5.22 → 0.5.23

package/README.md

@@ -240,6 +240,7 @@ It can also be set using environment variables:
 - LiveChat
 - Microsoft
 - Okta
+- Ory
 - PayPal
 - Polar
 - Salesforce

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.22",
+  "version": "0.5.23",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -74,7 +74,7 @@ const module = defineNuxtModule({
     const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
     runtimeConfig.session = defu(runtimeConfig.session, {
       name: "nuxt-session",
-      password: process.env[envSessionPassword] || "",
+      password: "",
       cookie: {
         sameSite: "lax"
       }
@@ -82,14 +82,14 @@ const module = defineNuxtModule({
     runtimeConfig.hash = defu(runtimeConfig.hash, {
       scrypt: options.hash?.scrypt
     });
-    if (nuxt.options.dev && !runtimeConfig.session.password) {
-      runtimeConfig.session.password = randomUUID().replace(/-/g, "");
+    if (nuxt.options.dev && !process.env[envSessionPassword]) {
+      const password = process.env[envSessionPassword] = randomUUID().replace(/-/g, "");
       const envPath = join(nuxt.options.rootDir, ".env");
       const envContent = await readFile(envPath, "utf-8").catch(() => "");
       if (!envContent.includes(envSessionPassword)) {
         await writeFile(
           envPath,
-          `${envContent ? envContent + "\n" : envContent}${envSessionPassword}=${runtimeConfig.session.password}`,
+          `${envContent ? envContent + "\n" : envContent}${envSessionPassword}=${password}`,
           "utf-8"
         );
       }
@@ -353,6 +353,12 @@ const module = defineNuxtModule({
       redirectURL: "",
       scope: ""
     });
+    runtimeConfig.oauth.roblox = defu(runtimeConfig.oauth.roblox, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: ""
+    });
     runtimeConfig.oauth.okta = defu(runtimeConfig.oauth.okta, {
       clientId: "",
       clientSecret: "",
@@ -361,6 +367,16 @@ const module = defineNuxtModule({
       scope: [],
       redirectURL: ""
     });
+    runtimeConfig.oauth.ory = defu(runtimeConfig.oauth.ory, {
+      clientId: "",
+      clientSecret: "",
+      sdkURL: "",
+      redirectURL: "",
+      scope: [],
+      authorizationURL: "",
+      tokenURL: "",
+      userURL: ""
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/github.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -25,6 +25,7 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "github", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user:email")) {
@@ -36,10 +37,14 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
+          state,
           ...config.authorizationParams
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "github", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/ory.d.ts

@@ -0,0 +1,51 @@
+import type { OAuthConfig } from '#auth-utils';
+/**
+ * Ory OAuth2
+ * @see https://www.ory.sh/docs/oauth2-oidc/authorization-code-flow
+ */
+export interface OAuthOryConfig {
+    /**
+     * Ory OAuth Client ID
+     * @default process.env.NUXT_OAUTH_ORY_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Ory OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_ORY_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Ory OAuth SDK URL
+     * @default "https://playground.projects.oryapis.com" || process.env.NUXT_OAUTH_ORY_SDK_URL
+     */
+    sdkURL?: string;
+    /**
+     * Ory OAuth Scope
+     * @default ['openid', 'offline']
+     * @see https://www.ory.sh/docs/oauth2-oidc/openid-connect-claims-scope-custom
+     * @example ['openid', 'offline', 'email']
+     */
+    scope?: string[] | string;
+    /**
+     * Ory OAuth Authorization URL
+     * @default '/oauth2/auth'
+     */
+    authorizationURL?: string;
+    /**
+     * Ory OAuth Token URL
+     * @default '/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @example { allow_signup: 'true' }
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Ory OAuth Userinfo URL
+     * @see https://www.ory.sh/docs/oauth2-oidc/userinfo-oidc
+     * @default '/userinfo'
+     */
+    userURL?: string;
+}
+export declare function defineOAuthOryEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOryConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/ory.js

@@ -0,0 +1,101 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  getOAuthRedirectURL,
+  handleAccessTokenErrorResponse,
+  handleInvalidState,
+  handleMissingConfiguration,
+  handlePkceVerifier,
+  handleState,
+  requestAccessToken
+} from "../utils.js";
+import { createError, useRuntimeConfig } from "#imports";
+export function defineOAuthOryEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.ory, {
+      scope: ["openid", "offline"],
+      sdkURL: "https://playground.projects.oryapis.com",
+      authorizationURL: "/oauth2/auth",
+      tokenURL: "/oauth2/token",
+      userURL: "/userinfo",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Ory login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.sdkURL) {
+      return handleMissingConfiguration(event, "ory", ["clientId", "sdkURL"], onError);
+    }
+    const redirectURL = getOAuthRedirectURL(event);
+    if (Array.isArray(config.scope)) {
+      config.scope = Array.from(new Set(config.scope)).join(" ");
+    }
+    const verifier = await handlePkceVerifier(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      const authorizationURL = `${config.sdkURL}${config.authorizationURL}`;
+      return sendRedirect(
+        event,
+        withQuery(authorizationURL, {
+          client_id: config.clientId,
+          response_type: "code",
+          redirect_uri: redirectURL,
+          scope: config.scope,
+          state,
+          code_challenge: verifier.code_challenge,
+          code_challenge_method: verifier.code_challenge_method,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      handleInvalidState(event, "ory", onError);
+    }
+    const tokenURL = `${config.sdkURL}${config.tokenURL}`;
+    const tokens = await requestAccessToken(tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        code: query.code,
+        redirect_uri: redirectURL,
+        scope: config.scope,
+        code_verifier: verifier.code_verifier
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "ory", tokens, onError);
+    }
+    const tokenType = tokens.token_type;
+    const accessToken = tokens.access_token;
+    const userURL = `${config.sdkURL}${config.userURL}`;
+    const user = await $fetch(userURL, {
+      headers: {
+        "User-Agent": `Ory-${config.clientId}`,
+        "Authorization": `${tokenType} ${accessToken}`
+      }
+    }).catch((error) => {
+      return { error };
+    });
+    if (user.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Ory userinfo failed: ${user.error || "Unknown error"}`,
+        data: user
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/roblox.d.ts

@@ -0,0 +1,126 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthRobloxConfig {
+    /**
+     * Roblox OAuth Client ID
+     * @default process.env.NUXT_OAUTH_ROBLOX_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Roblox OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_ROBLOX_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Roblox OAuth Scope
+     * Some scopes and claims listed are only available to official Roblox apps, e.g. email
+     * @default ['openid', 'profile']
+     * @see https://apis.roblox.com/oauth/.well-known/openid-configuration
+     * @example ['openid', 'profile', 'asset:read', 'universe-messaging-service:publish']
+     */
+    scope?: string[];
+    /**
+     * Roblox OAuth Authorization URL
+     * @default 'https://apis.roblox.com/oauth/v1/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Roblox OAuth Token URL
+     * @default 'https://apis.roblox.com/oauth/v1/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://create.roblox.com/docs/cloud/auth/oauth2-reference#get-v1authorize
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_ROBLOX_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export interface OAuthRobloxUser {
+    /**
+     * The resource path of the user
+     * @example "users/123"
+     */
+    path: string;
+    /**
+     * The timestamp at which the user was created
+     * @readonly
+     * @example "2023-07-05T12:34:56Z"
+     */
+    createTime: string;
+    /**
+     * Unique ID that identifies a user in Roblox
+     * @readonly
+     * @example "123456"
+     */
+    id: string;
+    /**
+     * Unique username for a user in Roblox
+     * @example "exampleUser"
+     */
+    name: string;
+    /**
+     * Display name for the user
+     * @example "userDefinedName"
+     */
+    displayName: string;
+    /**
+     * User-defined information about themselves
+     * @example "Example User's bio"
+     */
+    about: string;
+    /**
+     * Current locale selected by the user as an IETF language code
+     * @example "en-US"
+     */
+    locale: string;
+    /**
+     * Whether the user is a premium user
+     * @readonly
+     * @example true
+     */
+    premium: boolean;
+    /**
+     * Specifies if the user is identity-verified
+     * Verification includes, but isn't limited to, non-VoIP phone numbers or government IDs
+     * Available only with the user.advanced:read scope
+     * @readonly
+     * @example true
+     */
+    idVerified: boolean;
+    /**
+     * User's social network profiles and visibility.
+     */
+    socialNetworkProfiles: {
+        /**
+         * Facebook profile URI.
+         */
+        facebook?: string;
+        /**
+         * Twitter profile URI.
+         */
+        twitter?: string;
+        /**
+         * YouTube profile URI.
+         */
+        youtube?: string;
+        /**
+         * Twitch profile URI.
+         */
+        twitch?: string;
+        /**
+         * Guilded profile URI.
+         */
+        guilded?: string;
+        /**
+         * Visibility of the social network profiles.
+         * Available only with the user.social:read scope
+         * @example "SOCIAL_NETWORK_VISIBILITY_UNSPECIFIED"
+         */
+        visibility: 'SOCIAL_NETWORK_VISIBILITY_UNSPECIFIED' | 'NO_ONE' | 'FRIENDS' | 'FRIENDS_AND_FOLLOWING' | 'FRIENDS_FOLLOWING_AND_FOLLOWERS' | 'EVERYONE';
+    };
+}
+export declare function defineOAuthRobloxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRobloxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/roblox.js

@@ -0,0 +1,64 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthRobloxEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.roblox, {
+      authorizationURL: "https://apis.roblox.com/oauth/v1/authorize",
+      tokenURL: "https://apis.roblox.com/oauth/v1/token",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "roblox", ["clientId", "clientSecret"], onError);
+    }
+    if (query.error) {
+      return handleAccessTokenErrorResponse(event, "roblox", query, onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          ...config.authorizationParams
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "roblox", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const userInfo = await $fetch("https://apis.roblox.com/oauth/userinfo", {
+      headers: {
+        "user-agent": "Nuxt Auth Utils",
+        "Authorization": `Bearer ${accessToken}`
+      }
+    });
+    const user = await $fetch(`https://apis.roblox.com/cloud/v2/users/${userInfo.sub}`, {
+      headers: {
+        "user-agent": "Nuxt Auth Utils",
+        "Authorization": `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/utils/session.js

@@ -49,6 +49,9 @@ function _useSession(event, config = {}) {
     const runtimeConfig = useRuntimeConfig(isEvent(event) ? event : void 0);
     const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
     sessionConfig = defu({ password: process.env[envSessionPassword] }, runtimeConfig.session);
+    if (!sessionConfig.password) {
+      console.error(`[nuxt-auth-utils] ${envSessionPassword} environment variable or runtimeConfig.session.password was not set.`);
+    }
   }
   const finalConfig = defu(config, sessionConfig);
   return useSession(event, finalConfig);

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'okta' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.22",
+  "version": "0.5.23",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -35,15 +35,15 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@adonisjs/hash": "^9.0.5",
-    "@nuxt/kit": "^3.15.4",
+    "@adonisjs/hash": "^9.1.1",
+    "@nuxt/kit": "^3.18.1",
     "defu": "^6.1.4",
-    "h3": "^1.14.0",
+    "h3": "^1.15.4",
     "hookable": "^5.5.3",
-    "jose": "^5.9.6",
+    "jose": "^5.10.0",
     "ofetch": "^1.4.1",
-    "openid-client": "^6.1.7",
-    "pathe": "^2.0.2",
+    "openid-client": "^6.6.2",
+    "pathe": "^2.0.3",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
   },
@@ -68,7 +68,7 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.23",
+    "@iconify-json/simple-icons": "^1.2.46",
     "@nuxt/devtools": "2.0.0-beta.7",
     "@nuxt/eslint-config": "^0.7.6",
     "@nuxt/module-builder": "^0.8.4",
@@ -78,10 +78,10 @@
     "@nuxt/ui-pro": "^1.7.0",
     "@simplewebauthn/types": "^11.0.0",
     "changelogen": "^0.5.7",
-    "eslint": "^9.19.0",
-    "nuxt": "^3.15.4",
+    "eslint": "^9.32.0",
+    "nuxt": "^3.18.1",
     "typescript": "5.6.3",
     "vitest": "^3.0.5",
-    "vue-tsc": "^2.2.0"
+    "vue-tsc": "^2.2.12"
   }
 }