nuxt-auth-utils 0.5.23 → 0.5.25

package/README.md

@@ -600,6 +600,18 @@ This is because the user session is stored in a secure cookie and cannot be acce
 
 **This means that you should not rely on the user session during prerendering.**
 
+You may also choose to instruct Nuxt AUth Utils to fetch the user session only on the client side, with the `loadStrategy` option in your `nuxt.config.ts`:
+
+```ts
+export default defineNuxtConfig({
+  auth: {
+    loadStrategy: 'client-only'
+  }
+})
+```
+
+When using the `client-only` load strategy, the user session can still be manually fetched on the server side by calling `fetch` from the `useUserSession` composable.
+
 ### `<AuthState>` component
 
 You can use the `<AuthState>` component to safely display auth-related data in your components without worrying about the rendering mode.
@@ -617,7 +629,7 @@ One common use case if the Login button in the header:
 </template>
 ```
 
-If the page is cached or prerendered, nothing will be rendered until the user session is fetched on the client-side.
+If the page is cached or prerendered or the load strategy set as `client-only`, nothing will be rendered until the user session is fetched on the client-side.
 
 You can use the `placeholder` slot to show a placeholder on server-side and while the user session is being fetched on client-side for the prerendered pages:
 

package/dist/module.d.mts

@@ -22,6 +22,11 @@ interface ModuleOptions {
          */
         scrypt?: ScryptConfig;
     };
+    /**
+     * Session load strategy
+     * @default 'server-first'
+     */
+    loadStrategy?: 'server-first' | 'client-only';
 }
 declare module 'nuxt/schema' {
     interface RuntimeConfig {
@@ -33,7 +38,13 @@ declare module 'nuxt/schema' {
          */
         session: SessionConfig;
     }
+    interface PublicRuntimeConfig {
+        auth: {
+            loadStrategy: 'server-first' | 'client-only';
+        };
+    }
 }
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
 
-export { type ModuleOptions, _default as default };
+export { _default as default };
+export type { ModuleOptions };

package/dist/module.json

@@ -1,9 +1,9 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.23",
+  "version": "0.5.25",
   "builder": {
-    "@nuxt/module-builder": "0.8.4",
-    "unbuild": "2.0.0"
+    "@nuxt/module-builder": "1.0.2",
+    "unbuild": "3.6.1"
   }
 }

package/dist/module.mjs

@@ -16,7 +16,8 @@ const module = defineNuxtModule({
     atproto: false,
     hash: {
       scrypt: {}
-    }
+    },
+    loadStrategy: "server-first"
   },
   async setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
@@ -83,17 +84,24 @@ const module = defineNuxtModule({
       scrypt: options.hash?.scrypt
     });
     if (nuxt.options.dev && !process.env[envSessionPassword]) {
-      const password = process.env[envSessionPassword] = randomUUID().replace(/-/g, "");
-      const envPath = join(nuxt.options.rootDir, ".env");
-      const envContent = await readFile(envPath, "utf-8").catch(() => "");
-      if (!envContent.includes(envSessionPassword)) {
-        await writeFile(
-          envPath,
-          `${envContent ? envContent + "\n" : envContent}${envSessionPassword}=${password}`,
-          "utf-8"
-        );
+      if (nuxt.options.runtimeConfig.session.password) {
+        process.env[envSessionPassword] = nuxt.options.runtimeConfig.session.password;
+      } else {
+        const password = process.env[envSessionPassword] = randomUUID().replace(/-/g, "");
+        const envPath = join(nuxt.options.rootDir, ".env");
+        const envContent = await readFile(envPath, "utf-8").catch(() => "");
+        if (!envContent.includes(envSessionPassword)) {
+          await writeFile(
+            envPath,
+            `${envContent ? envContent + "\n" : envContent}${envSessionPassword}=${password}`,
+            "utf-8"
+          );
+        }
       }
     }
+    runtimeConfig.public.auth = defu(runtimeConfig.public.auth, {
+      loadStrategy: options.loadStrategy ?? "server-first"
+    });
     runtimeConfig.webauthn = defu(runtimeConfig.webauthn, {
       register: {},
       authenticate: {}

package/dist/runtime/app/components/AuthState.vue

@@ -1,7 +1,6 @@
-<script lang="ts" setup>
-import { useUserSession } from '#imports'
-
-const { loggedIn, user, session, clear, ready } = useUserSession()
+<script setup>
+import { useUserSession } from "#imports";
+const { loggedIn, user, session, clear, ready } = useUserSession();
 </script>
 
 <template>

package/dist/runtime/app/components/AuthState.vue.d.ts

@@ -0,0 +1,19 @@
+declare var __VLS_1: {
+    loggedIn: boolean;
+    user: import("../../types/index.js").User | null;
+    session: import("../../types/index.js").UserSession | null;
+    clear: () => Promise<void>;
+}, __VLS_3: {};
+type __VLS_Slots = {} & {
+    default?: (props: typeof __VLS_1) => any;
+} & {
+    placeholder?: (props: typeof __VLS_3) => any;
+};
+declare const __VLS_component: import("vue-demi").DefineComponent<{}, {}, {}, {}, {}, import("vue-demi").ComponentOptionsMixin, import("vue-demi").ComponentOptionsMixin, {}, string, import("vue-demi").PublicProps, Readonly<{}> & Readonly<{}>, {}, {}, {}, {}, string, import("vue-demi").ComponentProvideOptions, true, {}, any>;
+declare const _default: __VLS_WithSlots<typeof __VLS_component, __VLS_Slots>;
+export default _default;
+type __VLS_WithSlots<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};

package/dist/runtime/app/plugins/session.client.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+declare const _default: any;
 export default _default;

package/dist/runtime/app/plugins/session.client.js

@@ -2,7 +2,7 @@ import { defineNuxtPlugin, useUserSession, useError } from "#imports";
 export default defineNuxtPlugin(async (nuxtApp) => {
   if (!nuxtApp.payload.serverRendered) {
     await useUserSession().fetch();
-  } else if (Boolean(nuxtApp.payload.prerenderedAt) || Boolean(nuxtApp.payload.isCached)) {
+  } else if (Boolean(nuxtApp.payload.prerenderedAt) || Boolean(nuxtApp.payload.isCached) || nuxtApp.$config.public.auth.loadStrategy === "client-only") {
     nuxtApp.hook("app:mounted", async () => {
       await useUserSession().fetch();
     });

package/dist/runtime/app/plugins/session.server.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+declare const _default: any;
 export default _default;

package/dist/runtime/app/plugins/session.server.js

@@ -4,7 +4,7 @@ export default defineNuxtPlugin({
   enforce: "pre",
   async setup(nuxtApp) {
     nuxtApp.payload.isCached = Boolean(useRequestEvent()?.context.cache);
-    if (nuxtApp.payload.serverRendered && !nuxtApp.payload.prerenderedAt && !nuxtApp.payload.isCached) {
+    if (nuxtApp.payload.serverRendered && !nuxtApp.payload.prerenderedAt && !nuxtApp.payload.isCached && nuxtApp.$config.public.auth.loadStrategy !== "client-only") {
       await useUserSession().fetch();
     }
   }

package/dist/runtime/server/api/session.get.d.ts

@@ -1,6 +1,6 @@
 declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
     [key: string]: unknown;
     id: string;
-    user?: import("../../types").User;
+    user?: import("../../types/index.js").User;
 }>>;
 export default _default;

package/dist/runtime/server/lib/oauth/auth0.js

@@ -15,6 +15,17 @@ export function defineOAuthAuth0EventHandler({ config, onSuccess, onError }) {
     const tokenURL = `https://${config.domain}/oauth/token`;
     const query = getQuery(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (query.error) {
+      return handleAccessTokenErrorResponse(
+        event,
+        "auth0",
+        {
+          error: query.error,
+          error_description: query.error_description
+        },
+        onError
+      );
+    }
     if (!query.code) {
       config.scope = config.scope || ["openid", "offline_access"];
       if (config.emailRequired && !config.scope.includes("email")) {

package/dist/runtime/server/lib/oauth/authentik.d.ts

@@ -21,5 +21,10 @@ export interface OAuthAuthentikConfig {
      * @default process.env.NUXT_OAUTH_AUTHENTIK_REDIRECT_URL or current URL
      */
     redirectURL?: string;
+    /**
+     * Authentik Scope
+     * @default ['openid', 'profile', 'email']
+     */
+    scope?: string[];
 }
 export declare function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuthentikConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/authentik.js

@@ -29,7 +29,7 @@ export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError })
           response_type: "code",
           client_id: config.clientId,
           redirect_uri: redirectURL,
-          scope: ["openid", "profile", "email"].join(" ")
+          scope: (config.scope || ["openid", "profile", "email"]).join(" ")
         })
       );
     }

package/dist/runtime/server/lib/webauthn/authenticate.d.ts

@@ -1,5 +1,3 @@
+import type { EventHandler } from 'h3';
 import type { WebAuthnAuthenticateEventHandlerOptions, WebAuthnCredential } from '#auth-utils';
-export declare function defineWebAuthnAuthenticateEventHandler<T extends WebAuthnCredential>({ storeChallenge, getChallenge, getCredential, allowCredentials, getOptions, onSuccess, onError, }: WebAuthnAuthenticateEventHandlerOptions<T>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void | import("@simplewebauthn/server").VerifiedAuthenticationResponse | {
-    requestOptions: import("@simplewebauthn/types").PublicKeyCredentialRequestOptionsJSON;
-    attemptId: string;
-}>>;
+export declare function defineWebAuthnAuthenticateEventHandler<T extends WebAuthnCredential>({ storeChallenge, getChallenge, getCredential, allowCredentials, getOptions, onSuccess, onError, }: WebAuthnAuthenticateEventHandlerOptions<T>): EventHandler;

package/dist/runtime/server/lib/webauthn/authenticate.js

@@ -28,7 +28,7 @@ export function defineWebAuthnAuthenticateEventHandler({
           _config.allowCredentials = await allowCredentials(event, body.userName);
         }
         const options = await generateAuthenticationOptions(_config);
-        const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)));
+        const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)).buffer);
         if (storeChallenge) {
           await storeChallenge(event, options.challenge, attemptId);
         }

package/dist/runtime/server/lib/webauthn/register.d.ts

@@ -1,8 +1,5 @@
-import type { H3Event } from 'h3';
+import type { H3Event, EventHandler } from 'h3';
 import type { ValidateUserFunction } from '../../../types/webauthn.js';
 import type { WebAuthnUser, WebAuthnRegisterEventHandlerOptions } from '#auth-utils';
-export declare function defineWebAuthnRegisterEventHandler<T extends WebAuthnUser>({ storeChallenge, getChallenge, getOptions, validateUser, excludeCredentials, onSuccess, onError, }: WebAuthnRegisterEventHandlerOptions<T>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void | import("@simplewebauthn/server").VerifiedRegistrationResponse | {
-    creationOptions: import("@simplewebauthn/types").PublicKeyCredentialCreationOptionsJSON;
-    attemptId: string;
-}>>;
+export declare function defineWebAuthnRegisterEventHandler<T extends WebAuthnUser>({ storeChallenge, getChallenge, getOptions, validateUser, excludeCredentials, onSuccess, onError, }: WebAuthnRegisterEventHandlerOptions<T>): EventHandler;
 export declare function validateUserData<T>(userBody: WebAuthnUser, event: H3Event, fn: ValidateUserFunction<T>): Promise<T>;

package/dist/runtime/server/lib/webauthn/register.js

@@ -43,7 +43,7 @@ export function defineWebAuthnRegisterEventHandler({
           _config.excludeCredentials = await excludeCredentials(event, user.userName);
         }
         const options = await generateRegistrationOptions(_config);
-        const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)));
+        const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)).buffer);
         if (storeChallenge) {
           await storeChallenge(event, options.challenge, attemptId);
         }
@@ -81,7 +81,7 @@ export function defineWebAuthnRegisterEventHandler({
         user,
         credential: {
           id: verification.registrationInfo.credential.id,
-          publicKey: bufferToBase64URLString(verification.registrationInfo.credential.publicKey),
+          publicKey: bufferToBase64URLString(verification.registrationInfo.credential.publicKey.buffer),
           counter: verification.registrationInfo.credential.counter,
           backedUp: verification.registrationInfo.credentialBackedUp,
           transports: verification.registrationInfo.credential.transports

package/dist/runtime/server/plugins/oauth.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nitropack/types").NitroAppPlugin;
+declare const _default: import("nitropack").NitroAppPlugin;
 export default _default;

package/dist/runtime/server/plugins/ws.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nitropack/types").NitroAppPlugin;
+declare const _default: import("nitropack").NitroAppPlugin;
 export default _default;

package/dist/runtime/utils/atproto.js

@@ -2,15 +2,16 @@ export const atprotoProviders = ["bluesky"];
 export const atprotoProviderDefaultClientMetadata = {
   clientMetadataFilename: "",
   clientName: "",
-  clientUri: "",
-  logoUri: "",
-  policyUri: "",
-  tosUri: "",
+  clientUri: void 0,
+  logoUri: void 0,
+  policyUri: void 0,
+  tosUri: void 0,
   scope: ["atproto"],
   grantTypes: ["authorization_code"],
   responseTypes: ["code"],
   applicationType: "web",
-  redirectUris: [],
+  // @ts-expect-error TypeScript is too smart for its own good
+  redirectUris: void 0,
   dpopBoundAccessTokens: true,
   tokenEndpointAuthMethod: "none"
 };

package/dist/types.d.mts

@@ -1 +1,3 @@
-export { type ModuleOptions, default } from './module.js'
+export { default } from './module.mjs'
+
+export { type ModuleOptions } from './module.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.23",
+  "version": "0.5.25",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,16 +8,21 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.15.4",
+  "packageManager": "pnpm@10.16.1",
   "exports": {
     ".": {
-      "types": "./dist/types.d.ts",
-      "import": "./dist/module.mjs",
-      "require": "./dist/module.cjs"
+      "types": "./dist/types.d.mts",
+      "import": "./dist/module.mjs"
+    }
+  },
+  "main": "./dist/module.mjs",
+  "typesVersions": {
+    "*": {
+      ".": [
+        "./dist/types.d.mts"
+      ]
     }
   },
-  "main": "./dist/module.cjs",
-  "types": "./dist/types.d.ts",
   "files": [
     "dist"
   ],
@@ -30,19 +35,18 @@
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "test": "vitest run",
-    "test:types": "vue-tsc --noEmit",
-    "test:types:playground": "nuxt typecheck playground",
+    "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit",
     "test:watch": "vitest watch"
   },
   "dependencies": {
     "@adonisjs/hash": "^9.1.1",
-    "@nuxt/kit": "^3.18.1",
+    "@nuxt/kit": "^4.1.2",
     "defu": "^6.1.4",
     "h3": "^1.15.4",
     "hookable": "^5.5.3",
-    "jose": "^5.10.0",
+    "jose": "^6.1.0",
     "ofetch": "^1.4.1",
-    "openid-client": "^6.6.2",
+    "openid-client": "^6.8.0",
     "pathe": "^2.0.3",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
@@ -68,20 +72,20 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.46",
-    "@nuxt/devtools": "2.0.0-beta.7",
-    "@nuxt/eslint-config": "^0.7.6",
-    "@nuxt/module-builder": "^0.8.4",
-    "@nuxt/schema": "^3.15.4",
-    "@nuxt/test-utils": "^3.15.4",
-    "@nuxt/ui": "^2.21.0",
-    "@nuxt/ui-pro": "^1.7.0",
-    "@simplewebauthn/types": "^11.0.0",
-    "changelogen": "^0.5.7",
-    "eslint": "^9.32.0",
-    "nuxt": "^3.18.1",
-    "typescript": "5.6.3",
-    "vitest": "^3.0.5",
-    "vue-tsc": "^2.2.12"
+    "@iconify-json/simple-icons": "^1.2.52",
+    "@nuxt/devtools": "2.6.3",
+    "@nuxt/eslint-config": "^1.9.0",
+    "@nuxt/module-builder": "^1.0.2",
+    "@nuxt/schema": "^4.1.2",
+    "@nuxt/test-utils": "^3.19.2",
+    "@types/node": "latest",
+    "@nuxt/ui": "^4.0.0-alpha.1",
+    "@simplewebauthn/types": "^12.0.0",
+    "changelogen": "^0.6.2",
+    "eslint": "^9.35.0",
+    "nuxt": "^4.1.2",
+    "typescript": "5.9.2",
+    "vitest": "^3.2.4",
+    "vue-tsc": "^3.0.7"
   }
 }

package/dist/module.cjs

@@ -1,5 +0,0 @@
-module.exports = function(...args) {
-  return import('./module.mjs').then(m => m.default.call(this, ...args))
-}
-const _meta = module.exports.meta = require('./module.json')
-module.exports.getMeta = () => Promise.resolve(_meta)

package/dist/module.d.ts

@@ -1,39 +0,0 @@
-import * as _nuxt_schema from '@nuxt/schema';
-import { ScryptConfig } from '@adonisjs/hash/types';
-import { SessionConfig } from 'h3';
-
-interface ModuleOptions {
-    /**
-     * Enable WebAuthn (Passkeys)
-     * @default false
-     */
-    webAuthn?: boolean;
-    /**
-     * Enable atproto OAuth (Bluesky, etc.)
-     * @default false
-     */
-    atproto?: boolean;
-    /**
-     * Hash options used for password hashing
-     */
-    hash?: {
-        /**
-         * scrypt options used for password hashing
-         */
-        scrypt?: ScryptConfig;
-    };
-}
-declare module 'nuxt/schema' {
-    interface RuntimeConfig {
-        hash: {
-            scrypt: ScryptConfig;
-        };
-        /**
-         * Session configuration
-         */
-        session: SessionConfig;
-    }
-}
-declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
-
-export { type ModuleOptions, _default as default };

package/dist/types.d.ts

@@ -1 +0,0 @@
-export { type ModuleOptions, default } from './module'