nuxt-auth-utils 0.5.25 → 0.5.27

package/dist/runtime/server/lib/oauth/oidc.d.ts

@@ -0,0 +1,216 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthOidcConfig {
+    /**
+     * OAuth Client ID
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * OAuth Client secret.
+     * If unset, PKCE will be used where no client secret is needed.
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * OpenID configuration. If a string is passed, it is considered to be the full URL to the OpenID configuration endpoint
+     * where all required endpoints are listed and fetched from automatically.
+     *
+     * Alternatively, an object can be set with the required endpoint URLs.
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_OPENID_CONFIG
+     * @example "https://my-provider.com/.well-known/openid-configuration"
+     */
+    openidConfig?: string | OIDCConfiguration;
+    /**
+     * OAuth Scope
+     *
+     * @default ['openid']
+     * @example ['openid', 'profile', 'email']
+     */
+    scope?: string[];
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_REDIRECT_URL
+     */
+    redirectURL?: string;
+    /**
+     * Additional custom params that are passed to the specific endpoint requests.
+     * Can be used to provide custom (query) params.
+     */
+    params?: Partial<Record<'authorization_endpoint' | 'token_endpoint' | 'userinfo_endpoint', object>>;
+}
+/**
+ * Standard OIDC claims.
+ *
+ * @see: https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+ */
+interface OidcUser {
+    /**
+     * Subject - Identifier for the End-User at the Issuer.
+     */
+    sub: string;
+    /**
+     * End-User's full name in displayable form including all name parts,
+     * possibly including titles and suffixes, ordered according to the
+     * End-User's locale and preferences.
+     */
+    name?: string;
+    /**
+     * Given name(s) or first name(s) of the End-User. Note that in some cultures,
+     * people can have multiple given names; all can be present, with the names
+     * being separated by space characters.
+     */
+    given_name?: string;
+    /**
+     * Surname(s) or last name(s) of the End-User. Note that in some cultures,
+     * people can have multiple family names or no family name; all can be present,
+     * with the names being separated by space characters.
+     */
+    family_name?: string;
+    /**
+     * Middle name(s) of the End-User. Note that in some cultures, people can have
+     * multiple middle names; all can be present, with the names being separated by
+     * space characters. Also note that in some cultures, middle names are not used.
+     */
+    middle_name?: string;
+    /**
+     * Casual name of the End-User that may or may not be the same as the given_name.
+     * For instance, a nickname value of Mike might be returned alongside a given_name
+     * value of Michael.
+     */
+    nickname?: string;
+    /**
+     * Shorthand name by which the End-User wishes to be referred to at the RP, such as
+     * janedoe or j.doe. This value MAY be any valid JSON string including special
+     * characters such as @, /, or whitespace. The RP MUST NOT rely upon this value
+     * being unique.
+     */
+    preferred_username?: string;
+    /**
+     * URL of the End-User's profile page. The contents of this Web page SHOULD be
+     * about the End-User.
+     */
+    profile?: string;
+    /**
+     * URL of the End-User's profile picture. This URL MUST refer to an image file
+     * (for example, a PNG, JPEG, or GIF image file), rather than to a Web page
+     * containing an image. Note that this URL SHOULD specifically reference a profile
+     * photo of the End-User suitable for displaying when describing the End-User,
+     * rather than an arbitrary photo taken by the End-User.
+     */
+    picture?: string;
+    /**
+     * URL of the End-User's Web page or blog. This Web page SHOULD contain information
+     * published by the End-User or an organization that the End-User is affiliated with.
+     */
+    website?: string;
+    /**
+     * End-User's preferred e-mail address. Its value MUST conform to the RFC 5322
+     * addr-spec syntax. The RP MUST NOT rely upon this value being unique.
+     */
+    email?: string;
+    /**
+     * True if the End-User's e-mail address has been verified; otherwise false.
+     * When this Claim Value is true, this means that the OP took affirmative steps
+     * to ensure that this e-mail address was controlled by the End-User at the time
+     * the verification was performed. The means by which an e-mail address is verified
+     * is context specific, and dependent upon the trust framework or contractual
+     * agreements within which the parties are operating.
+     */
+    email_verified?: boolean;
+    /**
+     * End-User's gender. Values defined by this specification are female and male.
+     * Other values MAY be used when neither of the defined values are applicable.
+     */
+    gender?: string;
+    /**
+     * End-User's birthday, represented as an ISO 8601-1 YYYY-MM-DD format. The year
+     * MAY be 0000, indicating that it is omitted. To represent only the year, YYYY
+     * format is allowed. Note that depending on the underlying platform's date related
+     * function, providing just year can result in varying month and day, so the
+     * implementers need to take this factor into account to correctly process the dates.
+     */
+    birthdate?: string;
+    /**
+     * String from IANA Time Zone Database representing the End-User's time zone.
+     * For example, Europe/Paris or America/Los_Angeles.
+     */
+    zoneinfo?: string;
+    /**
+     * End-User's locale, represented as a BCP47 language tag. This is typically an
+     * ISO 639 Alpha-2 language code in lowercase and an ISO 3166-1 Alpha-2 country
+     * code in uppercase, separated by a dash. For example, en-US or fr-CA. As a
+     * compatibility note, some implementations have used an underscore as the separator
+     * rather than a dash, for example, en_US; Relying Parties MAY choose to accept
+     * this locale syntax as well.
+     */
+    locale?: string;
+    /**
+     * End-User's preferred telephone number. E.164 is RECOMMENDED as the format of
+     * this Claim, for example, +1 (555) 555-5555 or +56 (2) 687 2400. If the phone
+     * number contains an extension, it is RECOMMENDED that the extension be represented
+     * using the RFC 3966 extension syntax, for example, +1 (555) 555-5555;ext=5678.
+     */
+    phone_number?: string;
+    /**
+     * True if the End-User's phone number has been verified; otherwise false. When
+     * this Claim Value is true, this means that the OP took affirmative steps to
+     * ensure that this phone number was controlled by the End-User at the time the
+     * verification was performed. The means by which a phone number is verified is
+     * context specific, and dependent upon the trust framework or contractual
+     * agreements within which the parties are operating. When true, the phone_number
+     * Claim MUST be in E.164 format and any extensions MUST be represented in RFC 3966 format.
+     */
+    phone_number_verified?: boolean;
+    /**
+     * End-User's preferred postal address.
+     */
+    address?: AddressClaim;
+    /**
+     * Time the End-User's information was last updated. Its value is a JSON number
+     * representing the number of seconds from 1970-01-01T00:00:00Z as measured in
+     * UTC until the date/time.
+     */
+    updated_at?: number;
+}
+/**
+ * Address claim structure as defined in OpenID Connect specification
+ */
+interface AddressClaim {
+    /** Full mailing address, formatted for display or use on a mailing label */
+    formatted?: string;
+    /** Full street address component, which may include house number, street name, post office box, and multi-line extended street address information */
+    street_address?: string;
+    /** City or locality component */
+    locality?: string;
+    /** State, province, prefecture, or region component */
+    region?: string;
+    /** Zip code or postal code component */
+    postal_code?: string;
+    /** Country name component */
+    country?: string;
+}
+interface OidcTokens {
+    access_token: string;
+    token_type: string;
+    scope?: string;
+    id_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+}
+interface OIDCConfiguration {
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint?: string;
+}
+/**
+ * Event handler for generic OAuth using OIDC and PKCE.
+ */
+export declare function defineOAuthOidcEventHandler<TUser = OidcUser>({ config, onSuccess, onError }: OAuthConfig<OAuthOidcConfig, {
+    user: TUser;
+    tokens: OidcTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/oidc.js

@@ -0,0 +1,83 @@
+import { useRuntimeConfig } from "#imports";
+import { defu } from "defu";
+import { createError, eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
+export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth.oidc, {
+      scope: ["openid"]
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `OIDC login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.openidConfig) {
+      return handleMissingConfiguration(event, "oidc", ["clientId", "openidConfig"], onError);
+    }
+    const oidcConfig = typeof config.openidConfig === "string" ? await $fetch(config.openidConfig) : config.openidConfig;
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    const verifier = !config.clientSecret ? await handlePkceVerifier(event) : void 0;
+    if (!query.code) {
+      config.scope = config.scope || [];
+      const authQuery = {
+        client_id: config.clientId,
+        redirect_uri: redirectURL,
+        scope: config.scope.join(" "),
+        state,
+        response_type: "code",
+        ...config.params?.authorization_endpoint
+      };
+      if (verifier) {
+        authQuery.code_challenge = verifier.code_challenge;
+        authQuery.code_challenge_method = verifier.code_challenge_method;
+      }
+      return sendRedirect(
+        event,
+        withQuery(oidcConfig.authorization_endpoint, authQuery)
+      );
+    }
+    if (query.state !== state) {
+      return handleInvalidState(event, "oidc", onError);
+    }
+    const tokenQuery = {
+      grant_type: "authorization_code",
+      client_id: config.clientId,
+      client_secret: config.clientSecret,
+      redirect_uri: redirectURL,
+      code: query.code,
+      ...config.params?.token_endpoint
+    };
+    if (verifier) {
+      tokenQuery.code_verifier = verifier.code_verifier;
+    }
+    const tokens = await requestAccessToken(oidcConfig.token_endpoint, {
+      body: tokenQuery
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "oidc", tokens, onError);
+    }
+    let user = {};
+    if (oidcConfig.userinfo_endpoint) {
+      user = await $fetch(oidcConfig.userinfo_endpoint, {
+        headers: {
+          Authorization: `${tokens.token_type} ${tokens.access_token}`
+        },
+        params: {
+          ...config.params?.userinfo_endpoint
+        }
+      });
+    }
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/okta.d.ts

@@ -85,4 +85,4 @@ export interface OAuthOktaConfig {
      */
     openIdConfigCacheTTL?: number;
 }
-export declare function defineOAuthOktaEventHandler({ config, onSuccess, onError }: OAuthConfigExt<OAuthOktaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthOktaEventHandler({ config, onSuccess, onError }: OAuthConfigExt<OAuthOktaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/ory.d.ts

@@ -48,4 +48,4 @@ export interface OAuthOryConfig {
      */
     userURL?: string;
 }
-export declare function defineOAuthOryEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOryConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthOryEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOryConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/ory.js

@@ -57,7 +57,7 @@ export function defineOAuthOryEventHandler({ config, onSuccess, onError }) {
       );
     }
     if (query.state !== state) {
-      handleInvalidState(event, "ory", onError);
+      return handleInvalidState(event, "ory", onError);
     }
     const tokenURL = `${config.sdkURL}${config.tokenURL}`;
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/paypal.d.ts

@@ -49,4 +49,4 @@ export interface OAuthPaypalConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthPaypalEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPaypalConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthPaypalEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPaypalConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/polar.d.ts

@@ -46,4 +46,4 @@ export interface OAuthPolarConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthPolarEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPolarConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthPolarEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPolarConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/roblox.d.ts

@@ -123,4 +123,4 @@ export interface OAuthRobloxUser {
         visibility: 'SOCIAL_NETWORK_VISIBILITY_UNSPECIFIED' | 'NO_ONE' | 'FRIENDS' | 'FRIENDS_AND_FOLLOWING' | 'FRIENDS_FOLLOWING_AND_FOLLOWERS' | 'EVERYONE';
     };
 }
-export declare function defineOAuthRobloxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRobloxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthRobloxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRobloxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/salesforce.d.ts

@@ -43,4 +43,4 @@ export interface OAuthSalesforceConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSalesforceEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSalesforceConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSalesforceEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSalesforceConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/seznam.d.ts

@@ -95,4 +95,4 @@ export interface OAuthSeznamUser {
 export declare function defineOAuthSeznamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSeznamConfig, {
     user: OAuthSeznamUser;
     tokens: unknown;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/shopifyCustomer.d.ts

@@ -0,0 +1,26 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthShopifyCustomerConfig {
+    /**
+     * Shopify shop domain ID
+     * @default process.env.NUXT_OAUTH_SHOPIFY_CUSTOMER_SHOP_DOMAIN
+     * @example 123.myshopify.com
+     */
+    shopDomain?: string;
+    /**
+     * Shopify Customer Client ID
+     * @default process.env.NUXT_OAUTH_SHOPIFY_CUSTOMER_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Shopify Customer OAuth Scope
+     * @default ['openid', 'email', 'customer-account-api:full']
+     * @example ['openid', 'email', 'customer-account-api:full']
+     */
+    scope?: string[];
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_SHOPIFY_CUSTOMER_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthShopifyCustomerEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthShopifyCustomerConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/shopifyCustomer.js

@@ -0,0 +1,90 @@
+import { createError, eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthShopifyCustomerEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.shopifyCustomer, {});
+    const query = getQuery(event);
+    if (!config.clientId || !config.shopDomain) {
+      return handleMissingConfiguration(event, "spotify", ["clientId", "shopDomain"], onError);
+    }
+    const verifier = await handlePkceVerifier(event);
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const discoveryResponse = await $fetch(`https://${config.shopDomain}/.well-known/openid-configuration`).then((d) => d).catch(() => null);
+    if (!discoveryResponse?.issuer) {
+      const error = createError({
+        statusCode: 400,
+        message: "Getting Shopify discovery endpoint failed."
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope && config.scope.length > 0 ? config.scope : ["openid", "email", "customer-account-api:full"];
+      config.scope = [...new Set(config.scope)];
+      return sendRedirect(
+        event,
+        withQuery(discoveryResponse.authorization_endpoint, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          code_challenge: verifier.code_challenge,
+          code_challenge_method: verifier.code_challenge_method
+        })
+      );
+    }
+    const tokens = await requestAccessToken(discoveryResponse.token_endpoint, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        redirect_uri: redirectURL,
+        code: query.code,
+        code_verifier: verifier.code_verifier
+      }
+    }).catch(() => ({ error: "failed" }));
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "shopifyCustomer", tokens, onError);
+    }
+    const apiDiscoveryUrl = await $fetch(`https://${config.shopDomain}/.well-known/customer-account-api`).then((d) => d).catch(() => null);
+    if (!apiDiscoveryUrl?.graphql_api) {
+      const error = createError({
+        statusCode: 400,
+        message: "Getting Shopify api endpoints failed."
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const user = await $fetch(apiDiscoveryUrl.graphql_api, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Authorization": tokens.access_token
+      },
+      body: JSON.stringify({
+        operationName: "getCustomer",
+        query: "query { customer { firstName lastName emailAddress { emailAddress }}}"
+      })
+    }).then((d) => d.data).catch(() => null);
+    if (!user || !user.customer) {
+      const error = createError({
+        statusCode: 400,
+        message: "Getting Shopify Customer failed."
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    return onSuccess(event, {
+      tokens,
+      user: user.customer
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/slack.d.ts

@@ -38,4 +38,4 @@ export interface OAuthSlackConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSlackEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSlackConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSlackEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSlackConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/spotify.d.ts

@@ -44,4 +44,4 @@ export interface OAuthSpotifyConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSpotifyConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSpotifyConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/steam.d.ts

@@ -17,4 +17,4 @@ export interface OAuthSteamConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSteamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSteamConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSteamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSteamConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/steam.js

@@ -15,11 +15,12 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
     const url = getRequestURL(event);
     if (!query["openid.claimed_id"]) {
       const redirectURL = config.redirectURL || getRequestURL(event).href;
+      const realm = url.port ? `${url.protocol}//${url.hostname}:${url.port}` : `${url.protocol}//${url.hostname}`;
       const steamOpenIdParams = {
         "openid.ns": "http://specs.openid.net/auth/2.0",
         "openid.mode": "checkid_setup",
         "openid.return_to": redirectURL,
-        "openid.realm": `${url.protocol}//${url.hostname}`,
+        "openid.realm": realm,
         "openid.identity": "http://specs.openid.net/auth/2.0/identifier_select",
         "openid.claimed_id": "http://specs.openid.net/auth/2.0/identifier_select"
       };

package/dist/runtime/server/lib/oauth/strava.d.ts

@@ -116,4 +116,4 @@ export interface OAuthStravaTokens {
 export declare function defineOAuthStravaEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthStravaConfig, {
     user: OAuthStravaUser;
     tokens: OAuthStravaTokens;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/tiktok.d.ts

@@ -42,4 +42,4 @@ export interface OAuthTikTokConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthTikTokEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTikTokConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthTikTokEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTikTokConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/twitch.d.ts

@@ -44,4 +44,4 @@ export interface OAuthTwitchConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/vk.d.ts

@@ -43,4 +43,4 @@ export interface OAuthVKConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthVKEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthVKConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthVKEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthVKConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/workos.d.ts

@@ -63,4 +63,4 @@ export interface OAuthWorkOSTokens {
 export declare function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthWorkOSConfig, {
     user: OAuthWorkOSUser;
     tokens: OAuthWorkOSTokens;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/x.d.ts

@@ -43,4 +43,4 @@ export interface OAuthXConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthXEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthXConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthXEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthXConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/x.js

@@ -1,14 +1,16 @@
+import { useRuntimeConfig } from "#imports";
+import { defu } from "defu";
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
-import { defu } from "defu";
-import { randomUUID } from "uncrypto";
 import {
-  handleMissingConfiguration,
-  handleAccessTokenErrorResponse,
   getOAuthRedirectURL,
+  handleAccessTokenErrorResponse,
+  handleInvalidState,
+  handleMissingConfiguration,
+  handlePkceVerifier,
+  handleState,
   requestAccessToken
 } from "../utils.js";
-import { useRuntimeConfig } from "#imports";
 export function defineOAuthXEventHandler({
   config,
   onSuccess,
@@ -19,16 +21,15 @@ export function defineOAuthXEventHandler({
       authorizationURL: "https://x.com/i/oauth2/authorize",
       tokenURL: "https://api.x.com/2/oauth2/token",
       userURL: "https://api.x.com/2/users/me",
-      authorizationParams: {
-        state: randomUUID(),
-        code_challenge: randomUUID()
-      }
+      authorizationParams: {}
     });
     const query = getQuery(event);
     if (!config.clientId || !config.clientSecret) {
       return handleMissingConfiguration(event, "x", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const pkce = await handlePkceVerifier(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [
         "tweet.read",
@@ -40,13 +41,18 @@ export function defineOAuthXEventHandler({
         withQuery(config.authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          code_challenge_method: "plain",
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          code_challenge: pkce.code_challenge,
+          code_challenge_method: pkce.code_challenge_method,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "x", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         Authorization: `Basic ${Buffer.from(
@@ -55,7 +61,7 @@ export function defineOAuthXEventHandler({
       },
       params: {
         grant_type: "authorization_code",
-        code_verifier: config.authorizationParams?.code_challenge,
+        code_verifier: pkce.code_verifier,
         redirect_uri: redirectURL,
         code: query.code
       }

package/dist/runtime/server/lib/oauth/xsuaa.d.ts

@@ -28,4 +28,4 @@ export interface OAuthXSUAAConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthXSUAAConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthXSUAAConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/yandex.d.ts

@@ -43,4 +43,4 @@ export interface OAuthYandexConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthYandexEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthYandexConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthYandexEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthYandexConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/zitadel.d.ts

@@ -34,4 +34,4 @@ export interface OAuthZitadelConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthZitadelEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthZitadelConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthZitadelEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthZitadelConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;