nuxt-auth-utils 0.5.22 → 0.5.24

package/README.md

@@ -240,6 +240,7 @@ It can also be set using environment variables:
 - LiveChat
 - Microsoft
 - Okta
+- Ory
 - PayPal
 - Polar
 - Salesforce
@@ -599,6 +600,18 @@ This is because the user session is stored in a secure cookie and cannot be acce
 
 **This means that you should not rely on the user session during prerendering.**
 
+You may also choose to instruct Nuxt AUth Utils to fetch the user session only on the client side, with the `loadStrategy` option in your `nuxt.config.ts`:
+
+```ts
+export default defineNuxtConfig({
+  auth: {
+    loadStrategy: 'client-only'
+  }
+})
+```
+
+When using the `client-only` load strategy, the user session can still be manually fetched on the server side by calling `fetch` from the `useUserSession` composable.
+
 ### `<AuthState>` component
 
 You can use the `<AuthState>` component to safely display auth-related data in your components without worrying about the rendering mode.
@@ -616,7 +629,7 @@ One common use case if the Login button in the header:
 </template>
 ```
 
-If the page is cached or prerendered, nothing will be rendered until the user session is fetched on the client-side.
+If the page is cached or prerendered or the load strategy set as `client-only`, nothing will be rendered until the user session is fetched on the client-side.
 
 You can use the `placeholder` slot to show a placeholder on server-side and while the user session is being fetched on client-side for the prerendered pages:
 

package/dist/module.d.mts

@@ -22,6 +22,11 @@ interface ModuleOptions {
          */
         scrypt?: ScryptConfig;
     };
+    /**
+     * Session load strategy
+     * @default 'server-first'
+     */
+    loadStrategy?: 'server-first' | 'client-only';
 }
 declare module 'nuxt/schema' {
     interface RuntimeConfig {
@@ -33,7 +38,13 @@ declare module 'nuxt/schema' {
          */
         session: SessionConfig;
     }
+    interface PublicRuntimeConfig {
+        auth: {
+            loadStrategy: 'server-first' | 'client-only';
+        };
+    }
 }
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
 
-export { type ModuleOptions, _default as default };
+export { _default as default };
+export type { ModuleOptions };

package/dist/module.json

@@ -1,9 +1,9 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.22",
+  "version": "0.5.24",
   "builder": {
-    "@nuxt/module-builder": "0.8.4",
-    "unbuild": "2.0.0"
+    "@nuxt/module-builder": "1.0.2",
+    "unbuild": "3.6.1"
   }
 }

package/dist/module.mjs

@@ -16,7 +16,8 @@ const module = defineNuxtModule({
     atproto: false,
     hash: {
       scrypt: {}
-    }
+    },
+    loadStrategy: "server-first"
   },
   async setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
@@ -74,7 +75,7 @@ const module = defineNuxtModule({
     const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
     runtimeConfig.session = defu(runtimeConfig.session, {
       name: "nuxt-session",
-      password: process.env[envSessionPassword] || "",
+      password: "",
       cookie: {
         sameSite: "lax"
       }
@@ -82,18 +83,21 @@ const module = defineNuxtModule({
     runtimeConfig.hash = defu(runtimeConfig.hash, {
       scrypt: options.hash?.scrypt
     });
-    if (nuxt.options.dev && !runtimeConfig.session.password) {
-      runtimeConfig.session.password = randomUUID().replace(/-/g, "");
+    if (nuxt.options.dev && !process.env[envSessionPassword]) {
+      const password = process.env[envSessionPassword] = randomUUID().replace(/-/g, "");
       const envPath = join(nuxt.options.rootDir, ".env");
       const envContent = await readFile(envPath, "utf-8").catch(() => "");
       if (!envContent.includes(envSessionPassword)) {
         await writeFile(
           envPath,
-          `${envContent ? envContent + "\n" : envContent}${envSessionPassword}=${runtimeConfig.session.password}`,
+          `${envContent ? envContent + "\n" : envContent}${envSessionPassword}=${password}`,
           "utf-8"
         );
       }
     }
+    runtimeConfig.public.auth = defu(runtimeConfig.public.auth, {
+      loadStrategy: options.loadStrategy ?? "server-first"
+    });
     runtimeConfig.webauthn = defu(runtimeConfig.webauthn, {
       register: {},
       authenticate: {}
@@ -353,6 +357,12 @@ const module = defineNuxtModule({
       redirectURL: "",
       scope: ""
     });
+    runtimeConfig.oauth.roblox = defu(runtimeConfig.oauth.roblox, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: ""
+    });
     runtimeConfig.oauth.okta = defu(runtimeConfig.oauth.okta, {
       clientId: "",
       clientSecret: "",
@@ -361,6 +371,16 @@ const module = defineNuxtModule({
       scope: [],
       redirectURL: ""
     });
+    runtimeConfig.oauth.ory = defu(runtimeConfig.oauth.ory, {
+      clientId: "",
+      clientSecret: "",
+      sdkURL: "",
+      redirectURL: "",
+      scope: [],
+      authorizationURL: "",
+      tokenURL: "",
+      userURL: ""
+    });
   }
 });
 

package/dist/runtime/app/components/AuthState.vue

@@ -1,7 +1,6 @@
-<script lang="ts" setup>
-import { useUserSession } from '#imports'
-
-const { loggedIn, user, session, clear, ready } = useUserSession()
+<script setup>
+import { useUserSession } from "#imports";
+const { loggedIn, user, session, clear, ready } = useUserSession();
 </script>
 
 <template>

package/dist/runtime/app/components/AuthState.vue.d.ts

@@ -0,0 +1,19 @@
+declare var __VLS_1: {
+    loggedIn: boolean;
+    user: import("../../types/index.js").User | null;
+    session: import("../../types/index.js").UserSession | null;
+    clear: () => Promise<void>;
+}, __VLS_3: {};
+type __VLS_Slots = {} & {
+    default?: (props: typeof __VLS_1) => any;
+} & {
+    placeholder?: (props: typeof __VLS_3) => any;
+};
+declare const __VLS_component: import("vue").DefineComponent<{}, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<{}> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
+declare const _default: __VLS_WithSlots<typeof __VLS_component, __VLS_Slots>;
+export default _default;
+type __VLS_WithSlots<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};

package/dist/runtime/app/plugins/session.client.js

@@ -2,7 +2,7 @@ import { defineNuxtPlugin, useUserSession, useError } from "#imports";
 export default defineNuxtPlugin(async (nuxtApp) => {
   if (!nuxtApp.payload.serverRendered) {
     await useUserSession().fetch();
-  } else if (Boolean(nuxtApp.payload.prerenderedAt) || Boolean(nuxtApp.payload.isCached)) {
+  } else if (Boolean(nuxtApp.payload.prerenderedAt) || Boolean(nuxtApp.payload.isCached) || nuxtApp.$config.public.auth.loadStrategy === "client-only") {
     nuxtApp.hook("app:mounted", async () => {
       await useUserSession().fetch();
     });

package/dist/runtime/app/plugins/session.server.js

@@ -4,7 +4,7 @@ export default defineNuxtPlugin({
   enforce: "pre",
   async setup(nuxtApp) {
     nuxtApp.payload.isCached = Boolean(useRequestEvent()?.context.cache);
-    if (nuxtApp.payload.serverRendered && !nuxtApp.payload.prerenderedAt && !nuxtApp.payload.isCached) {
+    if (nuxtApp.payload.serverRendered && !nuxtApp.payload.prerenderedAt && !nuxtApp.payload.isCached && nuxtApp.$config.public.auth.loadStrategy !== "client-only") {
       await useUserSession().fetch();
     }
   }

package/dist/runtime/server/api/session.get.d.ts

@@ -1,6 +1,6 @@
 declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
     [key: string]: unknown;
     id: string;
-    user?: import("../../types").User;
+    user?: import("../../types/index.js").User;
 }>>;
 export default _default;

package/dist/runtime/server/lib/oauth/authentik.d.ts

@@ -21,5 +21,10 @@ export interface OAuthAuthentikConfig {
      * @default process.env.NUXT_OAUTH_AUTHENTIK_REDIRECT_URL or current URL
      */
     redirectURL?: string;
+    /**
+     * Authentik Scope
+     * @default ['openid', 'profile', 'email']
+     */
+    scope?: string[];
 }
 export declare function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuthentikConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/authentik.js

@@ -29,7 +29,7 @@ export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError })
           response_type: "code",
           client_id: config.clientId,
           redirect_uri: redirectURL,
-          scope: ["openid", "profile", "email"].join(" ")
+          scope: (config.scope || ["openid", "profile", "email"]).join(" ")
         })
       );
     }

package/dist/runtime/server/lib/oauth/github.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -25,6 +25,7 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "github", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user:email")) {
@@ -36,10 +37,14 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
+          state,
           ...config.authorizationParams
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "github", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/ory.d.ts

@@ -0,0 +1,51 @@
+import type { OAuthConfig } from '#auth-utils';
+/**
+ * Ory OAuth2
+ * @see https://www.ory.sh/docs/oauth2-oidc/authorization-code-flow
+ */
+export interface OAuthOryConfig {
+    /**
+     * Ory OAuth Client ID
+     * @default process.env.NUXT_OAUTH_ORY_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Ory OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_ORY_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Ory OAuth SDK URL
+     * @default "https://playground.projects.oryapis.com" || process.env.NUXT_OAUTH_ORY_SDK_URL
+     */
+    sdkURL?: string;
+    /**
+     * Ory OAuth Scope
+     * @default ['openid', 'offline']
+     * @see https://www.ory.sh/docs/oauth2-oidc/openid-connect-claims-scope-custom
+     * @example ['openid', 'offline', 'email']
+     */
+    scope?: string[] | string;
+    /**
+     * Ory OAuth Authorization URL
+     * @default '/oauth2/auth'
+     */
+    authorizationURL?: string;
+    /**
+     * Ory OAuth Token URL
+     * @default '/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @example { allow_signup: 'true' }
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Ory OAuth Userinfo URL
+     * @see https://www.ory.sh/docs/oauth2-oidc/userinfo-oidc
+     * @default '/userinfo'
+     */
+    userURL?: string;
+}
+export declare function defineOAuthOryEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOryConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/ory.js

@@ -0,0 +1,101 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  getOAuthRedirectURL,
+  handleAccessTokenErrorResponse,
+  handleInvalidState,
+  handleMissingConfiguration,
+  handlePkceVerifier,
+  handleState,
+  requestAccessToken
+} from "../utils.js";
+import { createError, useRuntimeConfig } from "#imports";
+export function defineOAuthOryEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.ory, {
+      scope: ["openid", "offline"],
+      sdkURL: "https://playground.projects.oryapis.com",
+      authorizationURL: "/oauth2/auth",
+      tokenURL: "/oauth2/token",
+      userURL: "/userinfo",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Ory login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.sdkURL) {
+      return handleMissingConfiguration(event, "ory", ["clientId", "sdkURL"], onError);
+    }
+    const redirectURL = getOAuthRedirectURL(event);
+    if (Array.isArray(config.scope)) {
+      config.scope = Array.from(new Set(config.scope)).join(" ");
+    }
+    const verifier = await handlePkceVerifier(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      const authorizationURL = `${config.sdkURL}${config.authorizationURL}`;
+      return sendRedirect(
+        event,
+        withQuery(authorizationURL, {
+          client_id: config.clientId,
+          response_type: "code",
+          redirect_uri: redirectURL,
+          scope: config.scope,
+          state,
+          code_challenge: verifier.code_challenge,
+          code_challenge_method: verifier.code_challenge_method,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      handleInvalidState(event, "ory", onError);
+    }
+    const tokenURL = `${config.sdkURL}${config.tokenURL}`;
+    const tokens = await requestAccessToken(tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        code: query.code,
+        redirect_uri: redirectURL,
+        scope: config.scope,
+        code_verifier: verifier.code_verifier
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "ory", tokens, onError);
+    }
+    const tokenType = tokens.token_type;
+    const accessToken = tokens.access_token;
+    const userURL = `${config.sdkURL}${config.userURL}`;
+    const user = await $fetch(userURL, {
+      headers: {
+        "User-Agent": `Ory-${config.clientId}`,
+        "Authorization": `${tokenType} ${accessToken}`
+      }
+    }).catch((error) => {
+      return { error };
+    });
+    if (user.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Ory userinfo failed: ${user.error || "Unknown error"}`,
+        data: user
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/roblox.d.ts

@@ -0,0 +1,126 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthRobloxConfig {
+    /**
+     * Roblox OAuth Client ID
+     * @default process.env.NUXT_OAUTH_ROBLOX_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Roblox OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_ROBLOX_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Roblox OAuth Scope
+     * Some scopes and claims listed are only available to official Roblox apps, e.g. email
+     * @default ['openid', 'profile']
+     * @see https://apis.roblox.com/oauth/.well-known/openid-configuration
+     * @example ['openid', 'profile', 'asset:read', 'universe-messaging-service:publish']
+     */
+    scope?: string[];
+    /**
+     * Roblox OAuth Authorization URL
+     * @default 'https://apis.roblox.com/oauth/v1/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Roblox OAuth Token URL
+     * @default 'https://apis.roblox.com/oauth/v1/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://create.roblox.com/docs/cloud/auth/oauth2-reference#get-v1authorize
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_ROBLOX_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export interface OAuthRobloxUser {
+    /**
+     * The resource path of the user
+     * @example "users/123"
+     */
+    path: string;
+    /**
+     * The timestamp at which the user was created
+     * @readonly
+     * @example "2023-07-05T12:34:56Z"
+     */
+    createTime: string;
+    /**
+     * Unique ID that identifies a user in Roblox
+     * @readonly
+     * @example "123456"
+     */
+    id: string;
+    /**
+     * Unique username for a user in Roblox
+     * @example "exampleUser"
+     */
+    name: string;
+    /**
+     * Display name for the user
+     * @example "userDefinedName"
+     */
+    displayName: string;
+    /**
+     * User-defined information about themselves
+     * @example "Example User's bio"
+     */
+    about: string;
+    /**
+     * Current locale selected by the user as an IETF language code
+     * @example "en-US"
+     */
+    locale: string;
+    /**
+     * Whether the user is a premium user
+     * @readonly
+     * @example true
+     */
+    premium: boolean;
+    /**
+     * Specifies if the user is identity-verified
+     * Verification includes, but isn't limited to, non-VoIP phone numbers or government IDs
+     * Available only with the user.advanced:read scope
+     * @readonly
+     * @example true
+     */
+    idVerified: boolean;
+    /**
+     * User's social network profiles and visibility.
+     */
+    socialNetworkProfiles: {
+        /**
+         * Facebook profile URI.
+         */
+        facebook?: string;
+        /**
+         * Twitter profile URI.
+         */
+        twitter?: string;
+        /**
+         * YouTube profile URI.
+         */
+        youtube?: string;
+        /**
+         * Twitch profile URI.
+         */
+        twitch?: string;
+        /**
+         * Guilded profile URI.
+         */
+        guilded?: string;
+        /**
+         * Visibility of the social network profiles.
+         * Available only with the user.social:read scope
+         * @example "SOCIAL_NETWORK_VISIBILITY_UNSPECIFIED"
+         */
+        visibility: 'SOCIAL_NETWORK_VISIBILITY_UNSPECIFIED' | 'NO_ONE' | 'FRIENDS' | 'FRIENDS_AND_FOLLOWING' | 'FRIENDS_FOLLOWING_AND_FOLLOWERS' | 'EVERYONE';
+    };
+}
+export declare function defineOAuthRobloxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRobloxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/roblox.js

@@ -0,0 +1,64 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthRobloxEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.roblox, {
+      authorizationURL: "https://apis.roblox.com/oauth/v1/authorize",
+      tokenURL: "https://apis.roblox.com/oauth/v1/token",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "roblox", ["clientId", "clientSecret"], onError);
+    }
+    if (query.error) {
+      return handleAccessTokenErrorResponse(event, "roblox", query, onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          ...config.authorizationParams
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "roblox", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const userInfo = await $fetch("https://apis.roblox.com/oauth/userinfo", {
+      headers: {
+        "user-agent": "Nuxt Auth Utils",
+        "Authorization": `Bearer ${accessToken}`
+      }
+    });
+    const user = await $fetch(`https://apis.roblox.com/cloud/v2/users/${userInfo.sub}`, {
+      headers: {
+        "user-agent": "Nuxt Auth Utils",
+        "Authorization": `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/webauthn/authenticate.d.ts

@@ -1,5 +1,3 @@
+import type { EventHandler } from 'h3';
 import type { WebAuthnAuthenticateEventHandlerOptions, WebAuthnCredential } from '#auth-utils';
-export declare function defineWebAuthnAuthenticateEventHandler<T extends WebAuthnCredential>({ storeChallenge, getChallenge, getCredential, allowCredentials, getOptions, onSuccess, onError, }: WebAuthnAuthenticateEventHandlerOptions<T>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void | import("@simplewebauthn/server").VerifiedAuthenticationResponse | {
-    requestOptions: import("@simplewebauthn/types").PublicKeyCredentialRequestOptionsJSON;
-    attemptId: string;
-}>>;
+export declare function defineWebAuthnAuthenticateEventHandler<T extends WebAuthnCredential>({ storeChallenge, getChallenge, getCredential, allowCredentials, getOptions, onSuccess, onError, }: WebAuthnAuthenticateEventHandlerOptions<T>): EventHandler;

package/dist/runtime/server/lib/webauthn/authenticate.js

@@ -28,7 +28,7 @@ export function defineWebAuthnAuthenticateEventHandler({
           _config.allowCredentials = await allowCredentials(event, body.userName);
         }
         const options = await generateAuthenticationOptions(_config);
-        const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)));
+        const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)).buffer);
         if (storeChallenge) {
           await storeChallenge(event, options.challenge, attemptId);
         }

package/dist/runtime/server/lib/webauthn/register.d.ts

@@ -1,8 +1,5 @@
-import type { H3Event } from 'h3';
+import type { H3Event, EventHandler } from 'h3';
 import type { ValidateUserFunction } from '../../../types/webauthn.js';
 import type { WebAuthnUser, WebAuthnRegisterEventHandlerOptions } from '#auth-utils';
-export declare function defineWebAuthnRegisterEventHandler<T extends WebAuthnUser>({ storeChallenge, getChallenge, getOptions, validateUser, excludeCredentials, onSuccess, onError, }: WebAuthnRegisterEventHandlerOptions<T>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void | import("@simplewebauthn/server").VerifiedRegistrationResponse | {
-    creationOptions: import("@simplewebauthn/types").PublicKeyCredentialCreationOptionsJSON;
-    attemptId: string;
-}>>;
+export declare function defineWebAuthnRegisterEventHandler<T extends WebAuthnUser>({ storeChallenge, getChallenge, getOptions, validateUser, excludeCredentials, onSuccess, onError, }: WebAuthnRegisterEventHandlerOptions<T>): EventHandler;
 export declare function validateUserData<T>(userBody: WebAuthnUser, event: H3Event, fn: ValidateUserFunction<T>): Promise<T>;

package/dist/runtime/server/lib/webauthn/register.js

@@ -43,7 +43,7 @@ export function defineWebAuthnRegisterEventHandler({
           _config.excludeCredentials = await excludeCredentials(event, user.userName);
         }
         const options = await generateRegistrationOptions(_config);
-        const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)));
+        const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)).buffer);
         if (storeChallenge) {
           await storeChallenge(event, options.challenge, attemptId);
         }
@@ -81,7 +81,7 @@ export function defineWebAuthnRegisterEventHandler({
         user,
         credential: {
           id: verification.registrationInfo.credential.id,
-          publicKey: bufferToBase64URLString(verification.registrationInfo.credential.publicKey),
+          publicKey: bufferToBase64URLString(verification.registrationInfo.credential.publicKey.buffer),
           counter: verification.registrationInfo.credential.counter,
           backedUp: verification.registrationInfo.credentialBackedUp,
           transports: verification.registrationInfo.credential.transports

package/dist/runtime/server/plugins/oauth.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nitropack/types").NitroAppPlugin;
+declare const _default: import("nitropack").NitroAppPlugin;
 export default _default;

package/dist/runtime/server/plugins/ws.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nitropack/types").NitroAppPlugin;
+declare const _default: import("nitropack").NitroAppPlugin;
 export default _default;

package/dist/runtime/server/utils/session.js

@@ -49,6 +49,9 @@ function _useSession(event, config = {}) {
     const runtimeConfig = useRuntimeConfig(isEvent(event) ? event : void 0);
     const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
     sessionConfig = defu({ password: process.env[envSessionPassword] }, runtimeConfig.session);
+    if (!sessionConfig.password) {
+      console.error(`[nuxt-auth-utils] ${envSessionPassword} environment variable or runtimeConfig.session.password was not set.`);
+    }
   }
   const finalConfig = defu(config, sessionConfig);
   return useSession(event, finalConfig);

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'okta' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/dist/runtime/utils/atproto.js

@@ -2,15 +2,16 @@ export const atprotoProviders = ["bluesky"];
 export const atprotoProviderDefaultClientMetadata = {
   clientMetadataFilename: "",
   clientName: "",
-  clientUri: "",
-  logoUri: "",
-  policyUri: "",
-  tosUri: "",
+  clientUri: void 0,
+  logoUri: void 0,
+  policyUri: void 0,
+  tosUri: void 0,
   scope: ["atproto"],
   grantTypes: ["authorization_code"],
   responseTypes: ["code"],
   applicationType: "web",
-  redirectUris: [],
+  // @ts-expect-error TypeScript is too smart for its own good
+  redirectUris: void 0,
   dpopBoundAccessTokens: true,
   tokenEndpointAuthMethod: "none"
 };

package/dist/types.d.mts

@@ -1 +1,3 @@
-export { type ModuleOptions, default } from './module.js'
+export { default } from './module.mjs'
+
+export { type ModuleOptions } from './module.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.22",
+  "version": "0.5.24",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,16 +8,21 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.15.4",
+  "packageManager": "pnpm@10.15.1",
   "exports": {
     ".": {
-      "types": "./dist/types.d.ts",
-      "import": "./dist/module.mjs",
-      "require": "./dist/module.cjs"
+      "types": "./dist/types.d.mts",
+      "import": "./dist/module.mjs"
+    }
+  },
+  "main": "./dist/module.mjs",
+  "typesVersions": {
+    "*": {
+      ".": [
+        "./dist/types.d.mts"
+      ]
     }
   },
-  "main": "./dist/module.cjs",
-  "types": "./dist/types.d.ts",
   "files": [
     "dist"
   ],
@@ -30,20 +35,19 @@
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "test": "vitest run",
-    "test:types": "vue-tsc --noEmit",
-    "test:types:playground": "nuxt typecheck playground",
+    "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit",
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@adonisjs/hash": "^9.0.5",
-    "@nuxt/kit": "^3.15.4",
+    "@adonisjs/hash": "^9.1.1",
+    "@nuxt/kit": "^4.1.0",
     "defu": "^6.1.4",
-    "h3": "^1.14.0",
+    "h3": "^1.15.4",
     "hookable": "^5.5.3",
-    "jose": "^5.9.6",
+    "jose": "^6.1.0",
     "ofetch": "^1.4.1",
-    "openid-client": "^6.1.7",
-    "pathe": "^2.0.2",
+    "openid-client": "^6.7.1",
+    "pathe": "^2.0.3",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
   },
@@ -68,20 +72,20 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.23",
-    "@nuxt/devtools": "2.0.0-beta.7",
-    "@nuxt/eslint-config": "^0.7.6",
-    "@nuxt/module-builder": "^0.8.4",
-    "@nuxt/schema": "^3.15.4",
-    "@nuxt/test-utils": "^3.15.4",
-    "@nuxt/ui": "^2.21.0",
-    "@nuxt/ui-pro": "^1.7.0",
-    "@simplewebauthn/types": "^11.0.0",
-    "changelogen": "^0.5.7",
-    "eslint": "^9.19.0",
-    "nuxt": "^3.15.4",
-    "typescript": "5.6.3",
-    "vitest": "^3.0.5",
-    "vue-tsc": "^2.2.0"
+    "@iconify-json/simple-icons": "^1.2.50",
+    "@nuxt/devtools": "2.6.3",
+    "@nuxt/eslint-config": "^1.9.0",
+    "@nuxt/module-builder": "^1.0.2",
+    "@nuxt/schema": "^4.1.0",
+    "@nuxt/test-utils": "^3.19.2",
+    "@types/node": "latest",
+    "@nuxt/ui": "^4.0.0-alpha.1",
+    "@simplewebauthn/types": "^12.0.0",
+    "changelogen": "^0.6.2",
+    "eslint": "^9.34.0",
+    "nuxt": "^4.1.0",
+    "typescript": "5.9.2",
+    "vitest": "^3.2.4",
+    "vue-tsc": "^3.0.6"
   }
 }

package/dist/module.cjs

@@ -1,5 +0,0 @@
-module.exports = function(...args) {
-  return import('./module.mjs').then(m => m.default.call(this, ...args))
-}
-const _meta = module.exports.meta = require('./module.json')
-module.exports.getMeta = () => Promise.resolve(_meta)

package/dist/module.d.ts

@@ -1,39 +0,0 @@
-import * as _nuxt_schema from '@nuxt/schema';
-import { ScryptConfig } from '@adonisjs/hash/types';
-import { SessionConfig } from 'h3';
-
-interface ModuleOptions {
-    /**
-     * Enable WebAuthn (Passkeys)
-     * @default false
-     */
-    webAuthn?: boolean;
-    /**
-     * Enable atproto OAuth (Bluesky, etc.)
-     * @default false
-     */
-    atproto?: boolean;
-    /**
-     * Hash options used for password hashing
-     */
-    hash?: {
-        /**
-         * scrypt options used for password hashing
-         */
-        scrypt?: ScryptConfig;
-    };
-}
-declare module 'nuxt/schema' {
-    interface RuntimeConfig {
-        hash: {
-            scrypt: ScryptConfig;
-        };
-        /**
-         * Session configuration
-         */
-        session: SessionConfig;
-    }
-}
-declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
-
-export { type ModuleOptions, _default as default };

package/dist/types.d.ts

@@ -1 +0,0 @@
-export { type ModuleOptions, default } from './module'