nuxt-auth-utils 0.5.25 → 0.5.26

package/README.md

@@ -156,11 +156,8 @@ const session = await requireUserSession(event)
 
 You can define the type for your user session by creating a type declaration file (for example, `auth.d.ts`) in your project to augment the `UserSession` type:
 
-> [!NOTE]
-> If you are using Nuxt >=4.0.0 or compatibility version 4 add the `auth.d.ts` file to the `shared` directory to get the correct types in server and client.
-
 ```ts
-// auth.d.ts
+// shared/types/auth.d.ts
 declare module '#auth-utils' {
   interface User {
     // Add your own fields
@@ -245,6 +242,7 @@ It can also be set using environment variables:
 - Polar
 - Salesforce
 - Seznam
+- Shopify Customer
 - Slack
 - Spotify
 - Steam
@@ -301,6 +299,17 @@ if (await verifyPassword(hashedPassword, 'user_password')) {
 }
 ```
 
+It also provides a `passwordNeedsRehash` function to check if a password needs to be rehashed. This is useful when the hash settings are changed, such as as increasing the scrypt cost parameters.
+
+```ts
+const needsRehash = await passwordNeedsRehash(hashedPassword)
+
+if (needsRehash) {
+  // Password needs to be rehashed
+  hashedPassword = await hashPassword('user_password')
+}
+```
+
 You can configure the scrypt options in your `nuxt.config.ts`:
 
 ```ts
@@ -600,7 +609,7 @@ This is because the user session is stored in a secure cookie and cannot be acce
 
 **This means that you should not rely on the user session during prerendering.**
 
-You may also choose to instruct Nuxt AUth Utils to fetch the user session only on the client side, with the `loadStrategy` option in your `nuxt.config.ts`:
+You may also choose to instruct Nuxt Auth Utils to fetch the user session only on the client side, with the `loadStrategy` option in your `nuxt.config.ts`:
 
 ```ts
 export default defineNuxtConfig({
@@ -612,6 +621,20 @@ export default defineNuxtConfig({
 
 When using the `client-only` load strategy, the user session can still be manually fetched on the server side by calling `fetch` from the `useUserSession` composable.
 
+### Disable session loading
+
+You may also choose to disable session loading entirely, with the `loadStrategy` option in your `nuxt.config.ts`:
+
+```ts
+export default defineNuxtConfig({
+  auth: {
+    loadStrategy: 'none'
+  }
+})
+```
+
+When using the `none` load strategy, the user session can still be manually fetched by calling `useUserSession().fetch()`.
+
 ### `<AuthState>` component
 
 You can use the `<AuthState>` component to safely display auth-related data in your components without worrying about the rendering mode.

package/dist/module.d.mts

@@ -1,4 +1,3 @@
-import * as _nuxt_schema from '@nuxt/schema';
 import { ScryptConfig } from '@adonisjs/hash/types';
 import { SessionConfig } from 'h3';
 
@@ -26,7 +25,7 @@ interface ModuleOptions {
      * Session load strategy
      * @default 'server-first'
      */
-    loadStrategy?: 'server-first' | 'client-only';
+    loadStrategy?: 'server-first' | 'client-only' | 'none';
 }
 declare module 'nuxt/schema' {
     interface RuntimeConfig {
@@ -40,11 +39,11 @@ declare module 'nuxt/schema' {
     }
     interface PublicRuntimeConfig {
         auth: {
-            loadStrategy: 'server-first' | 'client-only';
+            loadStrategy: 'server-first' | 'client-only' | 'none';
         };
     }
 }
-declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
+declare const _default: any;
 
 export { _default as default };
 export type { ModuleOptions };

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.25",
+  "version": "0.5.26",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -5,7 +5,7 @@ import { defu } from 'defu';
 import { randomUUID } from 'uncrypto';
 import { atprotoProviders, atprotoProviderDefaultClientMetadata, getClientMetadataFilename } from '../dist/runtime/utils/atproto.js';
 
-const module = defineNuxtModule({
+const module$1 = defineNuxtModule({
   meta: {
     name: "auth-utils",
     configKey: "auth"
@@ -32,8 +32,10 @@ const module = defineNuxtModule({
     }
     addComponentsDir({ path: resolver.resolve("./runtime/app/components") });
     addImports(composables);
-    addPlugin(resolver.resolve("./runtime/app/plugins/session.server"));
-    addPlugin(resolver.resolve("./runtime/app/plugins/session.client"));
+    if (options.loadStrategy !== "none") {
+      addPlugin(resolver.resolve("./runtime/app/plugins/session.server"));
+      addPlugin(resolver.resolve("./runtime/app/plugins/session.client"));
+    }
     addServerPlugin(resolver.resolve("./runtime/server/plugins/oauth"));
     addServerImportsDir(resolver.resolve("./runtime/server/lib/oauth"));
     if (nuxt.options.nitro?.experimental?.websocket) {
@@ -385,7 +387,13 @@ const module = defineNuxtModule({
       tokenURL: "",
       userURL: ""
     });
+    runtimeConfig.oauth.shopifyCustomer = defu(runtimeConfig.oauth.shopifyCustomer, {
+      shopDomain: "",
+      clientId: "",
+      redirectURL: "",
+      scope: []
+    });
   }
 });
 
-export { module as default };
+export { module$1 as default };

package/dist/runtime/app/components/AuthState.vue.d.ts

@@ -1,16 +1,17 @@
 declare var __VLS_1: {
-    loggedIn: boolean;
-    user: import("../../types/index.js").User | null;
-    session: import("../../types/index.js").UserSession | null;
-    clear: () => Promise<void>;
+    loggedIn: any;
+    user: any;
+    session: any;
+    clear: any;
 }, __VLS_3: {};
 type __VLS_Slots = {} & {
     default?: (props: typeof __VLS_1) => any;
 } & {
     placeholder?: (props: typeof __VLS_3) => any;
 };
-declare const __VLS_component: import("vue-demi").DefineComponent<{}, {}, {}, {}, {}, import("vue-demi").ComponentOptionsMixin, import("vue-demi").ComponentOptionsMixin, {}, string, import("vue-demi").PublicProps, Readonly<{}> & Readonly<{}>, {}, {}, {}, {}, string, import("vue-demi").ComponentProvideOptions, true, {}, any>;
-declare const _default: __VLS_WithSlots<typeof __VLS_component, __VLS_Slots>;
+declare const __VLS_base: import("vue").DefineComponent<{}, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<{}> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
+declare const __VLS_export: __VLS_WithSlots<typeof __VLS_base, __VLS_Slots>;
+declare const _default: typeof __VLS_export;
 export default _default;
 type __VLS_WithSlots<T, S> = T & {
     new (): {

package/dist/runtime/server/api/session.get.d.ts

@@ -1,6 +1,2 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
-    [key: string]: unknown;
-    id: string;
-    user?: import("../../types/index.js").User;
-}>>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<UserSession>>;
 export default _default;

package/dist/runtime/server/lib/atproto/bluesky.d.ts

@@ -22,7 +22,7 @@ type BlueSkyTokens = NodeSavedSession['tokenSet'];
 export declare function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBlueskyConfig, {
     user: BlueSkyUser;
     tokens: BlueSkyTokens;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export declare class StateStore implements NodeSavedStateStore {
     private event;
     private readonly stateKey;

package/dist/runtime/server/lib/oauth/apple.d.ts

@@ -74,4 +74,4 @@ export declare function defineOAuthAppleEventHandler({ config, onSuccess, onErro
     user: OAuthAppleUser;
     payload: OAuthAppleTokens;
     tokens: any;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/atlassian.d.ts

@@ -91,5 +91,5 @@ export interface OAuthAtlassianConfig {
 export declare function defineOAuthAtlassianEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthAtlassianConfig, {
     user: AtlassianUser;
     tokens: AtlassianTokens;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export {};

package/dist/runtime/server/lib/oauth/auth0.d.ts

@@ -57,4 +57,4 @@ export interface OAuthAuth0Config {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthAuth0EventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuth0Config>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthAuth0EventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuth0Config>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/authentik.d.ts

@@ -27,4 +27,4 @@ export interface OAuthAuthentikConfig {
      */
     scope?: string[];
 }
-export declare function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuthentikConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuthentikConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/azureb2c.d.ts

@@ -51,4 +51,4 @@ export interface OAuthAzureB2CConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthAzureB2CEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAzureB2CConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthAzureB2CEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAzureB2CConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/azureb2c.js

@@ -37,7 +37,6 @@ export function defineOAuthAzureB2CEventHandler({ config, onSuccess, onError })
     if (query.state !== state) {
       return handleInvalidState(event, "azureb2c", onError);
     }
-    console.info("code verifier", verifier.code_verifier);
     const tokens = await requestAccessToken(tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/battledotnet.d.ts

@@ -45,4 +45,4 @@ export interface OAuthBattledotnetConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBattledotnetConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBattledotnetConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/cognito.d.ts

@@ -36,4 +36,4 @@ export interface OAuthCognitoConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthCognitoEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthCognitoConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthCognitoEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthCognitoConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/discord.d.ts

@@ -50,4 +50,4 @@ export interface OAuthDiscordConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthDiscordEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDiscordConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthDiscordEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDiscordConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/dropbox.d.ts

@@ -44,4 +44,4 @@ export interface OAuthDropboxConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthDropboxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDropboxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthDropboxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDropboxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/facebook.d.ts

@@ -45,4 +45,4 @@ export interface OAuthFacebookConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthFacebookEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthFacebookConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthFacebookEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthFacebookConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/gitea.d.ts

@@ -48,4 +48,4 @@ export interface OAuthGiteaConfig {
      */
     baseURL?: string;
 }
-export declare function defineOAuthGiteaEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGiteaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthGiteaEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGiteaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/github.d.ts

@@ -93,5 +93,5 @@ interface GitHubTokens {
 export declare function defineOAuthGitHubEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthGitHubConfig, {
     user: GitHubUser;
     tokens: GitHubTokens;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export {};

package/dist/runtime/server/lib/oauth/gitlab.d.ts

@@ -49,4 +49,4 @@ export interface OAuthGitLabConfig {
      */
     baseURL?: string;
 }
-export declare function defineOAuthGitLabEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGitLabConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthGitLabEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGitLabConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/google.d.ts

@@ -44,4 +44,4 @@ export interface OAuthGoogleConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthGoogleEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGoogleConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthGoogleEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGoogleConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/heroku.d.ts

@@ -38,4 +38,4 @@ export interface OAuthHerokuConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthHerokuEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthHerokuConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthHerokuEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthHerokuConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/hubspot.d.ts

@@ -23,4 +23,4 @@ export interface OAuthHubspotConfig {
      */
     scope?: string[];
 }
-export declare function defineOAuthHubspotEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthHubspotConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthHubspotEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthHubspotConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/instagram.d.ts

@@ -45,4 +45,4 @@ export interface OAuthInstagramConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthInstagramEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthInstagramConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthInstagramEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthInstagramConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/keycloak.d.ts

@@ -45,4 +45,4 @@ export interface OAuthKeycloakConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthKeycloakEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthKeycloakConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthKeycloakEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthKeycloakConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/kick.d.ts

@@ -35,4 +35,4 @@ export interface OAuthKickConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthKickEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthKickConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthKickEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthKickConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/line.d.ts

@@ -42,4 +42,4 @@ export interface OAuthLineConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthLineEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthLineConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthLineEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthLineConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/linear.d.ts

@@ -38,4 +38,4 @@ export interface OAuthLinearConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthLinearEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinearConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthLinearEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinearConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/linkedin.d.ts

@@ -42,4 +42,4 @@ export interface OAuthLinkedInConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthLinkedInEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinkedInConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthLinkedInEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinkedInConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/livechat.d.ts

@@ -60,8 +60,7 @@ export interface LiveChatConfig {
      */
     userURL?: string;
     /**
-     * LiveChat OAuth Scope. accounts--my:ro is always applied to get user profile.
-     * @default ['accounts--my:ro']
+     * LiveChat OAuth Scope. If not provided, the default scope from LiveChat will be used.
      * @example ['accounts--my:ro', 'chats--my:ro']
      */
     scope?: string[];
@@ -71,4 +70,4 @@ export interface LiveChatConfig {
      */
     authorizationParams?: Record<string, string>;
 }
-export declare function defineOAuthLiveChatEventHandler({ config, onSuccess, onError, }: OAuthConfig<LiveChatConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthLiveChatEventHandler({ config, onSuccess, onError, }: OAuthConfig<LiveChatConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/livechat.js

@@ -19,7 +19,6 @@ export function defineOAuthLiveChatEventHandler({
       authorizationURL: "https://accounts.livechat.com",
       tokenURL: "https://accounts.livechat.com/v2/token",
       userURL: "https://accounts.livechat.com/v2/accounts/me",
-      scope: [],
       authorizationParams: {
         state: randomUUID()
       }
@@ -34,7 +33,6 @@ export function defineOAuthLiveChatEventHandler({
     }
     const query = getQuery(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
-    const scope = [.../* @__PURE__ */ new Set([...config.scope, "accounts--my:ro"])].join(" ");
     if (!query.code) {
       return sendRedirect(
         event,
@@ -42,7 +40,7 @@ export function defineOAuthLiveChatEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           response_type: "code",
-          scope,
+          scope: config.scope?.length ? config.scope.join(" ") : void 0,
           ...config.authorizationParams
         })
       );

package/dist/runtime/server/lib/oauth/microsoft.d.ts

@@ -51,4 +51,4 @@ export interface OAuthMicrosoftConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthMicrosoftConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthMicrosoftConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/okta.d.ts

@@ -85,4 +85,4 @@ export interface OAuthOktaConfig {
      */
     openIdConfigCacheTTL?: number;
 }
-export declare function defineOAuthOktaEventHandler({ config, onSuccess, onError }: OAuthConfigExt<OAuthOktaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthOktaEventHandler({ config, onSuccess, onError }: OAuthConfigExt<OAuthOktaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/ory.d.ts

@@ -48,4 +48,4 @@ export interface OAuthOryConfig {
      */
     userURL?: string;
 }
-export declare function defineOAuthOryEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOryConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthOryEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOryConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/ory.js

@@ -57,7 +57,7 @@ export function defineOAuthOryEventHandler({ config, onSuccess, onError }) {
       );
     }
     if (query.state !== state) {
-      handleInvalidState(event, "ory", onError);
+      return handleInvalidState(event, "ory", onError);
     }
     const tokenURL = `${config.sdkURL}${config.tokenURL}`;
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/paypal.d.ts

@@ -49,4 +49,4 @@ export interface OAuthPaypalConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthPaypalEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPaypalConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthPaypalEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPaypalConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/polar.d.ts

@@ -46,4 +46,4 @@ export interface OAuthPolarConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthPolarEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPolarConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthPolarEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPolarConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/roblox.d.ts

@@ -123,4 +123,4 @@ export interface OAuthRobloxUser {
         visibility: 'SOCIAL_NETWORK_VISIBILITY_UNSPECIFIED' | 'NO_ONE' | 'FRIENDS' | 'FRIENDS_AND_FOLLOWING' | 'FRIENDS_FOLLOWING_AND_FOLLOWERS' | 'EVERYONE';
     };
 }
-export declare function defineOAuthRobloxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRobloxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthRobloxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRobloxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/salesforce.d.ts

@@ -43,4 +43,4 @@ export interface OAuthSalesforceConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSalesforceEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSalesforceConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSalesforceEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSalesforceConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/seznam.d.ts

@@ -95,4 +95,4 @@ export interface OAuthSeznamUser {
 export declare function defineOAuthSeznamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSeznamConfig, {
     user: OAuthSeznamUser;
     tokens: unknown;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/shopifyCustomer.d.ts

@@ -0,0 +1,26 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthShopifyCustomerConfig {
+    /**
+     * Shopify shop domain ID
+     * @default process.env.NUXT_OAUTH_SHOPIFY_CUSTOMER_SHOP_DOMAIN
+     * @example 123.myshopify.com
+     */
+    shopDomain?: string;
+    /**
+     * Shopify Customer Client ID
+     * @default process.env.NUXT_OAUTH_SHOPIFY_CUSTOMER_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Shopify Customer OAuth Scope
+     * @default ['openid', 'email', 'customer-account-api:full']
+     * @example ['openid', 'email', 'customer-account-api:full']
+     */
+    scope?: string[];
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_SHOPIFY_CUSTOMER_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthShopifyCustomerEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthShopifyCustomerConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/shopifyCustomer.js

@@ -0,0 +1,90 @@
+import { createError, eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthShopifyCustomerEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.shopifyCustomer, {});
+    const query = getQuery(event);
+    if (!config.clientId || !config.shopDomain) {
+      return handleMissingConfiguration(event, "spotify", ["clientId", "shopDomain"], onError);
+    }
+    const verifier = await handlePkceVerifier(event);
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const discoveryResponse = await $fetch(`https://${config.shopDomain}/.well-known/openid-configuration`).then((d) => d).catch(() => null);
+    if (!discoveryResponse?.issuer) {
+      const error = createError({
+        statusCode: 400,
+        message: "Getting Shopify discovery endpoint failed."
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope && config.scope.length > 0 ? config.scope : ["openid", "email", "customer-account-api:full"];
+      config.scope = [...new Set(config.scope)];
+      return sendRedirect(
+        event,
+        withQuery(discoveryResponse.authorization_endpoint, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          code_challenge: verifier.code_challenge,
+          code_challenge_method: verifier.code_challenge_method
+        })
+      );
+    }
+    const tokens = await requestAccessToken(discoveryResponse.token_endpoint, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        redirect_uri: redirectURL,
+        code: query.code,
+        code_verifier: verifier.code_verifier
+      }
+    }).catch(() => ({ error: "failed" }));
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "shopifyCustomer", tokens, onError);
+    }
+    const apiDiscoveryUrl = await $fetch(`https://${config.shopDomain}/.well-known/customer-account-api`).then((d) => d).catch(() => null);
+    if (!apiDiscoveryUrl?.graphql_api) {
+      const error = createError({
+        statusCode: 400,
+        message: "Getting Shopify api endpoints failed."
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const user = await $fetch(apiDiscoveryUrl.graphql_api, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Authorization": tokens.access_token
+      },
+      body: JSON.stringify({
+        operationName: "getCustomer",
+        query: "query { customer { firstName lastName emailAddress { emailAddress }}}"
+      })
+    }).then((d) => d.data).catch(() => null);
+    if (!user || !user.customer) {
+      const error = createError({
+        statusCode: 400,
+        message: "Getting Shopify Customer failed."
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user: user.customer
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/slack.d.ts

@@ -38,4 +38,4 @@ export interface OAuthSlackConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSlackEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSlackConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSlackEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSlackConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/spotify.d.ts

@@ -44,4 +44,4 @@ export interface OAuthSpotifyConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSpotifyConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSpotifyConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/steam.d.ts

@@ -17,4 +17,4 @@ export interface OAuthSteamConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSteamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSteamConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSteamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSteamConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/steam.js

@@ -15,11 +15,12 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
     const url = getRequestURL(event);
     if (!query["openid.claimed_id"]) {
       const redirectURL = config.redirectURL || getRequestURL(event).href;
+      const realm = url.port ? `${url.protocol}//${url.hostname}:${url.port}` : `${url.protocol}//${url.hostname}`;
       const steamOpenIdParams = {
         "openid.ns": "http://specs.openid.net/auth/2.0",
         "openid.mode": "checkid_setup",
         "openid.return_to": redirectURL,
-        "openid.realm": `${url.protocol}//${url.hostname}`,
+        "openid.realm": realm,
         "openid.identity": "http://specs.openid.net/auth/2.0/identifier_select",
         "openid.claimed_id": "http://specs.openid.net/auth/2.0/identifier_select"
       };

package/dist/runtime/server/lib/oauth/strava.d.ts

@@ -116,4 +116,4 @@ export interface OAuthStravaTokens {
 export declare function defineOAuthStravaEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthStravaConfig, {
     user: OAuthStravaUser;
     tokens: OAuthStravaTokens;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/tiktok.d.ts

@@ -42,4 +42,4 @@ export interface OAuthTikTokConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthTikTokEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTikTokConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthTikTokEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTikTokConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/twitch.d.ts

@@ -44,4 +44,4 @@ export interface OAuthTwitchConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/vk.d.ts

@@ -43,4 +43,4 @@ export interface OAuthVKConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthVKEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthVKConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthVKEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthVKConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/workos.d.ts

@@ -63,4 +63,4 @@ export interface OAuthWorkOSTokens {
 export declare function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthWorkOSConfig, {
     user: OAuthWorkOSUser;
     tokens: OAuthWorkOSTokens;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/x.d.ts

@@ -43,4 +43,4 @@ export interface OAuthXConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthXEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthXConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthXEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthXConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/xsuaa.d.ts

@@ -28,4 +28,4 @@ export interface OAuthXSUAAConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthXSUAAConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthXSUAAConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/yandex.d.ts

@@ -43,4 +43,4 @@ export interface OAuthYandexConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthYandexEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthYandexConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthYandexEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthYandexConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/zitadel.d.ts

@@ -34,4 +34,4 @@ export interface OAuthZitadelConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthZitadelEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthZitadelConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthZitadelEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthZitadelConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/zitadel.js

@@ -1,5 +1,5 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
-import { withQuery } from "ufo";
+import { hasProtocol, withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handlePkceVerifier, handleInvalidState } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
@@ -21,8 +21,9 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
     if (!config.clientId || !config.domain) {
       return handleMissingConfiguration(event, "zitadel", ["clientId", "domain"], onError);
     }
-    const authorizationURL = `https://${config.domain}/oauth/v2/authorize`;
-    const tokenURL = `https://${config.domain}/oauth/v2/token`;
+    const domain = hasProtocol(config.domain) ? config.domain : `https://${config.domain}`;
+    const authorizationURL = `${domain}/oauth/v2/authorize`;
+    const tokenURL = `${domain}/oauth/v2/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     const verifier = await handlePkceVerifier(event);
     const state = await handleState(event);
@@ -66,7 +67,7 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
       return handleAccessTokenErrorResponse(event, "zitadel", tokens, onError);
     }
     const accessToken = tokens.access_token;
-    const user = await $fetch(`https://${config.domain}/oidc/v1/userinfo`, {
+    const user = await $fetch(`${domain}/oidc/v1/userinfo`, {
       headers: {
         Authorization: `Bearer ${accessToken}`,
         Accept: "application/json"

package/dist/runtime/server/lib/utils.d.ts

@@ -32,9 +32,9 @@ export declare function requestAccessToken(url: string, options: RequestAccessTo
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
  */
-export declare function handleAccessTokenErrorResponse(event: H3Event, oauthProvider: OAuthProvider, oauthError: any, onError?: OnError): void | Promise<void>;
-export declare function handleMissingConfiguration(event: H3Event, provider: OAuthProvider, missingKeys: string[], onError?: OnError): void | Promise<void>;
-export declare function handleInvalidState(event: H3Event, provider: OAuthProvider, onError?: OnError): void | Promise<void>;
+export declare function handleAccessTokenErrorResponse(event: H3Event, oauthProvider: OAuthProvider, oauthError: any, onError?: OnError): any;
+export declare function handleMissingConfiguration(event: H3Event, provider: OAuthProvider, missingKeys: string[], onError?: OnError): any;
+export declare function handleInvalidState(event: H3Event, provider: OAuthProvider, onError?: OnError): any;
 /**
  * JWT signing using jose
  *
@@ -61,13 +61,13 @@ interface JWTVerifyOptions {
 }
 export declare function verifyJwt<T>(token: string, options: JWTVerifyOptions): Promise<T>;
 export declare function handlePkceVerifier(event: H3Event): Promise<{
-    code_verifier: string;
-    code_challenge?: undefined;
-    code_challenge_method?: undefined;
-} | {
     code_verifier: string;
     code_challenge: string;
     code_challenge_method: string;
+} | {
+    code_verifier: string | undefined;
+    code_challenge?: undefined;
+    code_challenge_method?: undefined;
 }>;
-export declare function handleState(event: H3Event): Promise<string>;
+export declare function handleState(event: H3Event): Promise<string | undefined>;
 export {};

package/dist/runtime/server/lib/utils.js

@@ -1,10 +1,12 @@
-import { deleteCookie, getCookie, setCookie } from "h3";
+import { deleteCookie, getCookie, getQuery, setCookie } from "h3";
 import { getRequestURL } from "h3";
 import { FetchError } from "ofetch";
 import { snakeCase, upperFirst } from "scule";
 import * as jose from "jose";
 import { subtle, getRandomValues } from "uncrypto";
 import { createError } from "#imports";
+const isDevelopment = process.env.NODE_ENV === "development";
+const OAUTH_COOKIE_MAX_AGE = 60 * 10;
 export function getOAuthRedirectURL(event) {
   const requestURL = getRequestURL(event);
   return `${requestURL.protocol}//${requestURL.host}${requestURL.pathname}`;
@@ -79,29 +81,43 @@ function getRandomBytes(size = 32) {
   return getRandomValues(new Uint8Array(size));
 }
 export async function handlePkceVerifier(event) {
-  let verifier = getCookie(event, "nuxt-auth-pkce");
-  if (verifier) {
-    deleteCookie(event, "nuxt-auth-pkce");
-    return { code_verifier: verifier };
+  const query = getQuery(event);
+  if (!query.code) {
+    const verifier2 = encodeBase64Url(getRandomBytes());
+    setCookie(event, "nuxt-auth-pkce", verifier2, {
+      httpOnly: true,
+      secure: !isDevelopment,
+      sameSite: "lax",
+      maxAge: OAUTH_COOKIE_MAX_AGE,
+      path: "/"
+    });
+    const encodedPkce = new TextEncoder().encode(verifier2);
+    const pkceHash = await subtle.digest("SHA-256", encodedPkce);
+    const pkce = encodeBase64Url(new Uint8Array(pkceHash));
+    return {
+      code_verifier: verifier2,
+      code_challenge: pkce,
+      code_challenge_method: "S256"
+    };
   }
-  verifier = encodeBase64Url(getRandomBytes());
-  setCookie(event, "nuxt-auth-pkce", verifier);
-  const encodedPkce = new TextEncoder().encode(verifier);
-  const pkceHash = await subtle.digest("SHA-256", encodedPkce);
-  const pkce = encodeBase64Url(new Uint8Array(pkceHash));
-  return {
-    code_verifier: verifier,
-    code_challenge: pkce,
-    code_challenge_method: "S256"
-  };
+  const verifier = getCookie(event, "nuxt-auth-pkce");
+  deleteCookie(event, "nuxt-auth-pkce");
+  return { code_verifier: verifier };
 }
 export async function handleState(event) {
-  let state = getCookie(event, "nuxt-auth-state");
-  if (state) {
+  const query = getQuery(event);
+  if (query.state) {
+    const state2 = getCookie(event, "nuxt-auth-state");
     deleteCookie(event, "nuxt-auth-state");
-    return state;
+    return state2;
   }
-  state = encodeBase64Url(getRandomBytes(8));
-  setCookie(event, "nuxt-auth-state", state);
+  const state = encodeBase64Url(getRandomBytes(8));
+  setCookie(event, "nuxt-auth-state", state, {
+    httpOnly: true,
+    secure: !isDevelopment,
+    sameSite: "lax",
+    maxAge: OAUTH_COOKIE_MAX_AGE,
+    path: "/"
+  });
   return state;
 }

package/dist/runtime/server/plugins/oauth.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nitropack").NitroAppPlugin;
+declare const _default: import("nitropack/types").NitroAppPlugin;
 export default _default;

package/dist/runtime/server/utils/password.d.ts

@@ -21,3 +21,20 @@ export declare function hashPassword(password: string): Promise<string>;
  * @more you can configure the scrypt options in `auth.hash.scrypt`
  */
 export declare function verifyPassword(hashedPassword: string, plainPassword: string): Promise<boolean>;
+/**
+ * Check if the hash value needs a rehash or not. The rehash is required if
+ * configuration settings have changed.
+ * @param hashedPassword - The hashed password to check
+ * @returns `true` if a rehash is needed, `false` otherwise
+ * @example
+ * ```ts
+ * const isValid = await verifyPassword(hashedPassword, plainText)
+ *
+ * // Plain password is valid, and hash needs a rehash
+ * if (isValid && passwordNeedsReHash(hashedPassword)) {
+ *   const newHash = await hashPassword(plainText)
+ * }
+ * ```
+ * @more you can configure the scrypt options in `auth.hash.scrypt`
+ */
+export declare function passwordNeedsReHash(hashedPassword: string): boolean;

package/dist/runtime/server/utils/password.js

@@ -16,3 +16,6 @@ export async function hashPassword(password) {
 export async function verifyPassword(hashedPassword, plainPassword) {
   return await getHash().verify(hashedPassword, plainPassword);
 }
+export function passwordNeedsReHash(hashedPassword) {
+  return getHash().needsReHash(hashedPassword);
+}

package/dist/runtime/server/utils/session.d.ts

@@ -1,5 +1,6 @@
 import type { H3Event, SessionConfig } from 'h3';
 import { useSession } from 'h3';
+import type { OmitWithIndexSignature } from '../../types/utils.js';
 import type { UserSession, UserSessionRequired } from '#auth-utils';
 type UseSessionEvent = Parameters<typeof useSession>[0];
 export interface SessionHooks {
@@ -27,13 +28,13 @@ export declare function getUserSession(event: UseSessionEvent): Promise<UserSess
  * @param data User session data, please only store public information since it can be decoded with API calls
  * @see https://github.com/atinux/nuxt-auth-utils
  */
-export declare function setUserSession(event: H3Event, data: Omit<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
+export declare function setUserSession(event: H3Event, data: OmitWithIndexSignature<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
 /**
  * Replace a user session
  * @param event The Request (h3) event
  * @param data User session data, please only store public information since it can be decoded with API calls
  */
-export declare function replaceUserSession(event: H3Event, data: Omit<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
+export declare function replaceUserSession(event: H3Event, data: OmitWithIndexSignature<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
 /**
  * Clear the user session and removing the session cookie
  * @param event The Request (h3) event

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/dist/runtime/types/utils.d.ts

@@ -0,0 +1,14 @@
+type Prettify<T> = {
+  [K in keyof T]: T[K]
+}
+
+type RemoveIndexSignature<T> = {
+  [K in keyof T as string extends K ? never : K]: T[K]
+}
+
+type GetIndexSignature<T> = {
+  [K in keyof T as string extends K ? K : never]: T[K]
+}
+
+// Basic Omit but does not break if a [x:string]:unknown Index Signature is present in the type
+export type OmitWithIndexSignature<T extends Record<string, unknown>, K extends keyof RemoveIndexSignature<T>> = Prettify<Omit<RemoveIndexSignature<T>, K> & GetIndexSignature<T>>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.25",
+  "version": "0.5.26",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@10.16.1",
+  "packageManager": "pnpm@10.25.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.mts",
@@ -40,13 +40,13 @@
   },
   "dependencies": {
     "@adonisjs/hash": "^9.1.1",
-    "@nuxt/kit": "^4.1.2",
+    "@nuxt/kit": "^4.2.1",
     "defu": "^6.1.4",
     "h3": "^1.15.4",
     "hookable": "^5.5.3",
-    "jose": "^6.1.0",
-    "ofetch": "^1.4.1",
-    "openid-client": "^6.8.0",
+    "jose": "^6.1.3",
+    "ofetch": "^1.5.1",
+    "openid-client": "^6.8.1",
     "pathe": "^2.0.3",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
@@ -72,20 +72,20 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.52",
-    "@nuxt/devtools": "2.6.3",
-    "@nuxt/eslint-config": "^1.9.0",
+    "@iconify-json/simple-icons": "^1.2.62",
+    "@nuxt/devtools": "3.1.1",
+    "@nuxt/eslint-config": "^1.11.0",
     "@nuxt/module-builder": "^1.0.2",
-    "@nuxt/schema": "^4.1.2",
-    "@nuxt/test-utils": "^3.19.2",
+    "@nuxt/schema": "^4.2.1",
+    "@nuxt/test-utils": "^3.21.0",
     "@types/node": "latest",
-    "@nuxt/ui": "^4.0.0-alpha.1",
+    "@nuxt/ui": "^4.2.1",
     "@simplewebauthn/types": "^12.0.0",
     "changelogen": "^0.6.2",
-    "eslint": "^9.35.0",
-    "nuxt": "^4.1.2",
-    "typescript": "5.9.2",
-    "vitest": "^3.2.4",
-    "vue-tsc": "^3.0.7"
+    "eslint": "^9.39.1",
+    "nuxt": "^4.2.1",
+    "typescript": "5.9.3",
+    "vitest": "^4.0.15",
+    "vue-tsc": "^3.1.8"
   }
 }