nuxt-auth-utils 0.5.25 → 0.5.27

package/dist/runtime/server/lib/oauth/zitadel.js

@@ -1,5 +1,5 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
-import { withQuery } from "ufo";
+import { hasProtocol, withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handlePkceVerifier, handleInvalidState } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
@@ -21,8 +21,9 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
     if (!config.clientId || !config.domain) {
       return handleMissingConfiguration(event, "zitadel", ["clientId", "domain"], onError);
     }
-    const authorizationURL = `https://${config.domain}/oauth/v2/authorize`;
-    const tokenURL = `https://${config.domain}/oauth/v2/token`;
+    const domain = hasProtocol(config.domain) ? config.domain : `https://${config.domain}`;
+    const authorizationURL = `${domain}/oauth/v2/authorize`;
+    const tokenURL = `${domain}/oauth/v2/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     const verifier = await handlePkceVerifier(event);
     const state = await handleState(event);
@@ -66,7 +67,7 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
       return handleAccessTokenErrorResponse(event, "zitadel", tokens, onError);
     }
     const accessToken = tokens.access_token;
-    const user = await $fetch(`https://${config.domain}/oidc/v1/userinfo`, {
+    const user = await $fetch(`${domain}/oidc/v1/userinfo`, {
       headers: {
         Authorization: `Bearer ${accessToken}`,
         Accept: "application/json"

package/dist/runtime/server/lib/utils.d.ts

@@ -26,15 +26,15 @@ export interface RequestAccessTokenOptions {
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
  */
-export declare function requestAccessToken(url: string, options: RequestAccessTokenOptions): Promise<any>;
+export declare function requestAccessToken<T = any>(url: string, options: RequestAccessTokenOptions): Promise<T>;
 /**
  * Handle OAuth access token error response
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
  */
-export declare function handleAccessTokenErrorResponse(event: H3Event, oauthProvider: OAuthProvider, oauthError: any, onError?: OnError): void | Promise<void>;
-export declare function handleMissingConfiguration(event: H3Event, provider: OAuthProvider, missingKeys: string[], onError?: OnError): void | Promise<void>;
-export declare function handleInvalidState(event: H3Event, provider: OAuthProvider, onError?: OnError): void | Promise<void>;
+export declare function handleAccessTokenErrorResponse(event: H3Event, oauthProvider: OAuthProvider, oauthError: any, onError?: OnError): any;
+export declare function handleMissingConfiguration(event: H3Event, provider: OAuthProvider, missingKeys: string[], onError?: OnError): any;
+export declare function handleInvalidState(event: H3Event, provider: OAuthProvider, onError?: OnError): any;
 /**
  * JWT signing using jose
  *
@@ -61,13 +61,13 @@ interface JWTVerifyOptions {
 }
 export declare function verifyJwt<T>(token: string, options: JWTVerifyOptions): Promise<T>;
 export declare function handlePkceVerifier(event: H3Event): Promise<{
-    code_verifier: string;
-    code_challenge?: undefined;
-    code_challenge_method?: undefined;
-} | {
     code_verifier: string;
     code_challenge: string;
     code_challenge_method: string;
+} | {
+    code_verifier: string | undefined;
+    code_challenge?: undefined;
+    code_challenge_method?: undefined;
 }>;
-export declare function handleState(event: H3Event): Promise<string>;
+export declare function handleState(event: H3Event): Promise<string | undefined>;
 export {};

package/dist/runtime/server/lib/utils.js

@@ -1,10 +1,12 @@
-import { deleteCookie, getCookie, setCookie } from "h3";
+import { deleteCookie, getCookie, getQuery, setCookie } from "h3";
 import { getRequestURL } from "h3";
 import { FetchError } from "ofetch";
 import { snakeCase, upperFirst } from "scule";
 import * as jose from "jose";
 import { subtle, getRandomValues } from "uncrypto";
 import { createError } from "#imports";
+const isDevelopment = process.env.NODE_ENV === "development";
+const OAUTH_COOKIE_MAX_AGE = 60 * 10;
 export function getOAuthRedirectURL(event) {
   const requestURL = getRequestURL(event);
   return `${requestURL.protocol}//${requestURL.host}${requestURL.pathname}`;
@@ -79,29 +81,43 @@ function getRandomBytes(size = 32) {
   return getRandomValues(new Uint8Array(size));
 }
 export async function handlePkceVerifier(event) {
-  let verifier = getCookie(event, "nuxt-auth-pkce");
-  if (verifier) {
-    deleteCookie(event, "nuxt-auth-pkce");
-    return { code_verifier: verifier };
+  const query = getQuery(event);
+  if (!query.code) {
+    const verifier2 = encodeBase64Url(getRandomBytes());
+    setCookie(event, "nuxt-auth-pkce", verifier2, {
+      httpOnly: true,
+      secure: !isDevelopment,
+      sameSite: "lax",
+      maxAge: OAUTH_COOKIE_MAX_AGE,
+      path: "/"
+    });
+    const encodedPkce = new TextEncoder().encode(verifier2);
+    const pkceHash = await subtle.digest("SHA-256", encodedPkce);
+    const pkce = encodeBase64Url(new Uint8Array(pkceHash));
+    return {
+      code_verifier: verifier2,
+      code_challenge: pkce,
+      code_challenge_method: "S256"
+    };
   }
-  verifier = encodeBase64Url(getRandomBytes());
-  setCookie(event, "nuxt-auth-pkce", verifier);
-  const encodedPkce = new TextEncoder().encode(verifier);
-  const pkceHash = await subtle.digest("SHA-256", encodedPkce);
-  const pkce = encodeBase64Url(new Uint8Array(pkceHash));
-  return {
-    code_verifier: verifier,
-    code_challenge: pkce,
-    code_challenge_method: "S256"
-  };
+  const verifier = getCookie(event, "nuxt-auth-pkce");
+  deleteCookie(event, "nuxt-auth-pkce");
+  return { code_verifier: verifier };
 }
 export async function handleState(event) {
-  let state = getCookie(event, "nuxt-auth-state");
-  if (state) {
+  const query = getQuery(event);
+  if (query.state) {
+    const state2 = getCookie(event, "nuxt-auth-state");
     deleteCookie(event, "nuxt-auth-state");
-    return state;
+    return state2;
   }
-  state = encodeBase64Url(getRandomBytes(8));
-  setCookie(event, "nuxt-auth-state", state);
+  const state = encodeBase64Url(getRandomBytes(8));
+  setCookie(event, "nuxt-auth-state", state, {
+    httpOnly: true,
+    secure: !isDevelopment,
+    sameSite: "lax",
+    maxAge: OAUTH_COOKIE_MAX_AGE,
+    path: "/"
+  });
   return state;
 }

package/dist/runtime/server/lib/webauthn/register.js

@@ -84,7 +84,8 @@ export function defineWebAuthnRegisterEventHandler({
           publicKey: bufferToBase64URLString(verification.registrationInfo.credential.publicKey.buffer),
           counter: verification.registrationInfo.credential.counter,
           backedUp: verification.registrationInfo.credentialBackedUp,
-          transports: verification.registrationInfo.credential.transports
+          transports: verification.registrationInfo.credential.transports,
+          aaguid: verification.registrationInfo.aaguid
         },
         registrationInfo: verification.registrationInfo
       });

package/dist/runtime/server/plugins/oauth.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nitropack").NitroAppPlugin;
+declare const _default: import("nitropack/types").NitroAppPlugin;
 export default _default;

package/dist/runtime/server/utils/password.d.ts

@@ -21,3 +21,20 @@ export declare function hashPassword(password: string): Promise<string>;
  * @more you can configure the scrypt options in `auth.hash.scrypt`
  */
 export declare function verifyPassword(hashedPassword: string, plainPassword: string): Promise<boolean>;
+/**
+ * Check if the hash value needs a rehash or not. The rehash is required if
+ * configuration settings have changed.
+ * @param hashedPassword - The hashed password to check
+ * @returns `true` if a rehash is needed, `false` otherwise
+ * @example
+ * ```ts
+ * const isValid = await verifyPassword(hashedPassword, plainText)
+ *
+ * // Plain password is valid, and hash needs a rehash
+ * if (isValid && passwordNeedsReHash(hashedPassword)) {
+ *   const newHash = await hashPassword(plainText)
+ * }
+ * ```
+ * @more you can configure the scrypt options in `auth.hash.scrypt`
+ */
+export declare function passwordNeedsReHash(hashedPassword: string): boolean;

package/dist/runtime/server/utils/password.js

@@ -16,3 +16,6 @@ export async function hashPassword(password) {
 export async function verifyPassword(hashedPassword, plainPassword) {
   return await getHash().verify(hashedPassword, plainPassword);
 }
+export function passwordNeedsReHash(hashedPassword) {
+  return getHash().needsReHash(hashedPassword);
+}

package/dist/runtime/server/utils/session.d.ts

@@ -1,5 +1,6 @@
 import type { H3Event, SessionConfig } from 'h3';
 import { useSession } from 'h3';
+import type { OmitWithIndexSignature } from '../../types/utils.js';
 import type { UserSession, UserSessionRequired } from '#auth-utils';
 type UseSessionEvent = Parameters<typeof useSession>[0];
 export interface SessionHooks {
@@ -27,13 +28,13 @@ export declare function getUserSession(event: UseSessionEvent): Promise<UserSess
  * @param data User session data, please only store public information since it can be decoded with API calls
  * @see https://github.com/atinux/nuxt-auth-utils
  */
-export declare function setUserSession(event: H3Event, data: Omit<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
+export declare function setUserSession(event: H3Event, data: OmitWithIndexSignature<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
 /**
  * Replace a user session
  * @param event The Request (h3) event
  * @param data User session data, please only store public information since it can be decoded with API calls
  */
-export declare function replaceUserSession(event: H3Event, data: Omit<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
+export declare function replaceUserSession(event: H3Event, data: OmitWithIndexSignature<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
 /**
  * Clear the user session and removing the session cookie
  * @param event The Request (h3) event

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oicd' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/dist/runtime/types/utils.d.ts

@@ -0,0 +1,14 @@
+type Prettify<T> = {
+  [K in keyof T]: T[K]
+}
+
+type RemoveIndexSignature<T> = {
+  [K in keyof T as string extends K ? never : K]: T[K]
+}
+
+type GetIndexSignature<T> = {
+  [K in keyof T as string extends K ? K : never]: T[K]
+}
+
+// Basic Omit but does not break if a [x:string]:unknown Index Signature is present in the type
+export type OmitWithIndexSignature<T extends Record<string, unknown>, K extends keyof RemoveIndexSignature<T>> = Prettify<Omit<RemoveIndexSignature<T>, K> & GetIndexSignature<T>>

package/dist/runtime/types/webauthn.d.ts

@@ -8,6 +8,7 @@ export interface WebAuthnCredential {
     counter: number;
     backedUp: boolean;
     transports?: AuthenticatorTransportFuture[];
+    aaguid?: string;
     [key: string]: unknown;
 }
 export interface WebAuthnUser {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.25",
+  "version": "0.5.27",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@10.16.1",
+  "packageManager": "pnpm@10.28.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.mts",
@@ -40,13 +40,13 @@
   },
   "dependencies": {
     "@adonisjs/hash": "^9.1.1",
-    "@nuxt/kit": "^4.1.2",
+    "@nuxt/kit": "^4.2.2",
     "defu": "^6.1.4",
     "h3": "^1.15.4",
-    "hookable": "^5.5.3",
-    "jose": "^6.1.0",
-    "ofetch": "^1.4.1",
-    "openid-client": "^6.8.0",
+    "hookable": "^6.0.1",
+    "jose": "^6.1.3",
+    "ofetch": "^1.5.1",
+    "openid-client": "^6.8.1",
     "pathe": "^2.0.3",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
@@ -72,20 +72,20 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.52",
-    "@nuxt/devtools": "2.6.3",
-    "@nuxt/eslint-config": "^1.9.0",
+    "@iconify-json/simple-icons": "^1.2.66",
+    "@nuxt/devtools": "3.1.1",
+    "@nuxt/eslint-config": "^1.12.1",
     "@nuxt/module-builder": "^1.0.2",
-    "@nuxt/schema": "^4.1.2",
-    "@nuxt/test-utils": "^3.19.2",
+    "@nuxt/schema": "^4.2.2",
+    "@nuxt/test-utils": "^3.23.0",
     "@types/node": "latest",
-    "@nuxt/ui": "^4.0.0-alpha.1",
+    "@nuxt/ui": "^4.3.0",
     "@simplewebauthn/types": "^12.0.0",
     "changelogen": "^0.6.2",
-    "eslint": "^9.35.0",
-    "nuxt": "^4.1.2",
-    "typescript": "5.9.2",
-    "vitest": "^3.2.4",
-    "vue-tsc": "^3.0.7"
+    "eslint": "^9.39.2",
+    "nuxt": "^4.2.2",
+    "typescript": "5.9.3",
+    "vitest": "^4.0.17",
+    "vue-tsc": "^3.2.2"
   }
 }