nuxt-auth-utils 0.5.26 → 0.5.27

package/README.md

@@ -236,6 +236,7 @@ It can also be set using environment variables:
 - LinkedIn
 - LiveChat
 - Microsoft
+- OIDC / OpenID Connect (Generic)
 - Okta
 - Ory
 - PayPal
@@ -420,7 +421,7 @@ export default defineWebAuthnRegisterEventHandler({
     // If he registers a new account with credentials
     return z.object({
       // we want the userName to be a valid email
-      userName: z.string().email() 
+      userName: z.string().email()
     }).parse(userBody)
   },
   async onSuccess(event, { credential, user }) {

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.26",
+  "version": "0.5.27",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,7 +1,7 @@
-import { readFile, writeFile } from 'node:fs/promises';
 import { defineNuxtModule, createResolver, addComponentsDir, addImports, addPlugin, addServerPlugin, addServerImportsDir, logger, addServerHandler } from '@nuxt/kit';
-import { join } from 'pathe';
 import { defu } from 'defu';
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'pathe';
 import { randomUUID } from 'uncrypto';
 import { atprotoProviders, atprotoProviderDefaultClientMetadata, getClientMetadataFilename } from '../dist/runtime/utils/atproto.js';
 
@@ -393,6 +393,13 @@ const module$1 = defineNuxtModule({
       redirectURL: "",
       scope: []
     });
+    runtimeConfig.oauth.oidc = defu(runtimeConfig.oauth.oidc, {
+      clientId: "",
+      clientSecret: "",
+      openidConfig: "",
+      redirectURL: "",
+      scope: []
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/oidc.d.ts

@@ -0,0 +1,216 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthOidcConfig {
+    /**
+     * OAuth Client ID
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * OAuth Client secret.
+     * If unset, PKCE will be used where no client secret is needed.
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * OpenID configuration. If a string is passed, it is considered to be the full URL to the OpenID configuration endpoint
+     * where all required endpoints are listed and fetched from automatically.
+     *
+     * Alternatively, an object can be set with the required endpoint URLs.
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_OPENID_CONFIG
+     * @example "https://my-provider.com/.well-known/openid-configuration"
+     */
+    openidConfig?: string | OIDCConfiguration;
+    /**
+     * OAuth Scope
+     *
+     * @default ['openid']
+     * @example ['openid', 'profile', 'email']
+     */
+    scope?: string[];
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_REDIRECT_URL
+     */
+    redirectURL?: string;
+    /**
+     * Additional custom params that are passed to the specific endpoint requests.
+     * Can be used to provide custom (query) params.
+     */
+    params?: Partial<Record<'authorization_endpoint' | 'token_endpoint' | 'userinfo_endpoint', object>>;
+}
+/**
+ * Standard OIDC claims.
+ *
+ * @see: https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+ */
+interface OidcUser {
+    /**
+     * Subject - Identifier for the End-User at the Issuer.
+     */
+    sub: string;
+    /**
+     * End-User's full name in displayable form including all name parts,
+     * possibly including titles and suffixes, ordered according to the
+     * End-User's locale and preferences.
+     */
+    name?: string;
+    /**
+     * Given name(s) or first name(s) of the End-User. Note that in some cultures,
+     * people can have multiple given names; all can be present, with the names
+     * being separated by space characters.
+     */
+    given_name?: string;
+    /**
+     * Surname(s) or last name(s) of the End-User. Note that in some cultures,
+     * people can have multiple family names or no family name; all can be present,
+     * with the names being separated by space characters.
+     */
+    family_name?: string;
+    /**
+     * Middle name(s) of the End-User. Note that in some cultures, people can have
+     * multiple middle names; all can be present, with the names being separated by
+     * space characters. Also note that in some cultures, middle names are not used.
+     */
+    middle_name?: string;
+    /**
+     * Casual name of the End-User that may or may not be the same as the given_name.
+     * For instance, a nickname value of Mike might be returned alongside a given_name
+     * value of Michael.
+     */
+    nickname?: string;
+    /**
+     * Shorthand name by which the End-User wishes to be referred to at the RP, such as
+     * janedoe or j.doe. This value MAY be any valid JSON string including special
+     * characters such as @, /, or whitespace. The RP MUST NOT rely upon this value
+     * being unique.
+     */
+    preferred_username?: string;
+    /**
+     * URL of the End-User's profile page. The contents of this Web page SHOULD be
+     * about the End-User.
+     */
+    profile?: string;
+    /**
+     * URL of the End-User's profile picture. This URL MUST refer to an image file
+     * (for example, a PNG, JPEG, or GIF image file), rather than to a Web page
+     * containing an image. Note that this URL SHOULD specifically reference a profile
+     * photo of the End-User suitable for displaying when describing the End-User,
+     * rather than an arbitrary photo taken by the End-User.
+     */
+    picture?: string;
+    /**
+     * URL of the End-User's Web page or blog. This Web page SHOULD contain information
+     * published by the End-User or an organization that the End-User is affiliated with.
+     */
+    website?: string;
+    /**
+     * End-User's preferred e-mail address. Its value MUST conform to the RFC 5322
+     * addr-spec syntax. The RP MUST NOT rely upon this value being unique.
+     */
+    email?: string;
+    /**
+     * True if the End-User's e-mail address has been verified; otherwise false.
+     * When this Claim Value is true, this means that the OP took affirmative steps
+     * to ensure that this e-mail address was controlled by the End-User at the time
+     * the verification was performed. The means by which an e-mail address is verified
+     * is context specific, and dependent upon the trust framework or contractual
+     * agreements within which the parties are operating.
+     */
+    email_verified?: boolean;
+    /**
+     * End-User's gender. Values defined by this specification are female and male.
+     * Other values MAY be used when neither of the defined values are applicable.
+     */
+    gender?: string;
+    /**
+     * End-User's birthday, represented as an ISO 8601-1 YYYY-MM-DD format. The year
+     * MAY be 0000, indicating that it is omitted. To represent only the year, YYYY
+     * format is allowed. Note that depending on the underlying platform's date related
+     * function, providing just year can result in varying month and day, so the
+     * implementers need to take this factor into account to correctly process the dates.
+     */
+    birthdate?: string;
+    /**
+     * String from IANA Time Zone Database representing the End-User's time zone.
+     * For example, Europe/Paris or America/Los_Angeles.
+     */
+    zoneinfo?: string;
+    /**
+     * End-User's locale, represented as a BCP47 language tag. This is typically an
+     * ISO 639 Alpha-2 language code in lowercase and an ISO 3166-1 Alpha-2 country
+     * code in uppercase, separated by a dash. For example, en-US or fr-CA. As a
+     * compatibility note, some implementations have used an underscore as the separator
+     * rather than a dash, for example, en_US; Relying Parties MAY choose to accept
+     * this locale syntax as well.
+     */
+    locale?: string;
+    /**
+     * End-User's preferred telephone number. E.164 is RECOMMENDED as the format of
+     * this Claim, for example, +1 (555) 555-5555 or +56 (2) 687 2400. If the phone
+     * number contains an extension, it is RECOMMENDED that the extension be represented
+     * using the RFC 3966 extension syntax, for example, +1 (555) 555-5555;ext=5678.
+     */
+    phone_number?: string;
+    /**
+     * True if the End-User's phone number has been verified; otherwise false. When
+     * this Claim Value is true, this means that the OP took affirmative steps to
+     * ensure that this phone number was controlled by the End-User at the time the
+     * verification was performed. The means by which a phone number is verified is
+     * context specific, and dependent upon the trust framework or contractual
+     * agreements within which the parties are operating. When true, the phone_number
+     * Claim MUST be in E.164 format and any extensions MUST be represented in RFC 3966 format.
+     */
+    phone_number_verified?: boolean;
+    /**
+     * End-User's preferred postal address.
+     */
+    address?: AddressClaim;
+    /**
+     * Time the End-User's information was last updated. Its value is a JSON number
+     * representing the number of seconds from 1970-01-01T00:00:00Z as measured in
+     * UTC until the date/time.
+     */
+    updated_at?: number;
+}
+/**
+ * Address claim structure as defined in OpenID Connect specification
+ */
+interface AddressClaim {
+    /** Full mailing address, formatted for display or use on a mailing label */
+    formatted?: string;
+    /** Full street address component, which may include house number, street name, post office box, and multi-line extended street address information */
+    street_address?: string;
+    /** City or locality component */
+    locality?: string;
+    /** State, province, prefecture, or region component */
+    region?: string;
+    /** Zip code or postal code component */
+    postal_code?: string;
+    /** Country name component */
+    country?: string;
+}
+interface OidcTokens {
+    access_token: string;
+    token_type: string;
+    scope?: string;
+    id_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+}
+interface OIDCConfiguration {
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint?: string;
+}
+/**
+ * Event handler for generic OAuth using OIDC and PKCE.
+ */
+export declare function defineOAuthOidcEventHandler<TUser = OidcUser>({ config, onSuccess, onError }: OAuthConfig<OAuthOidcConfig, {
+    user: TUser;
+    tokens: OidcTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/oidc.js

@@ -0,0 +1,83 @@
+import { useRuntimeConfig } from "#imports";
+import { defu } from "defu";
+import { createError, eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
+export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth.oidc, {
+      scope: ["openid"]
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `OIDC login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.openidConfig) {
+      return handleMissingConfiguration(event, "oidc", ["clientId", "openidConfig"], onError);
+    }
+    const oidcConfig = typeof config.openidConfig === "string" ? await $fetch(config.openidConfig) : config.openidConfig;
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    const verifier = !config.clientSecret ? await handlePkceVerifier(event) : void 0;
+    if (!query.code) {
+      config.scope = config.scope || [];
+      const authQuery = {
+        client_id: config.clientId,
+        redirect_uri: redirectURL,
+        scope: config.scope.join(" "),
+        state,
+        response_type: "code",
+        ...config.params?.authorization_endpoint
+      };
+      if (verifier) {
+        authQuery.code_challenge = verifier.code_challenge;
+        authQuery.code_challenge_method = verifier.code_challenge_method;
+      }
+      return sendRedirect(
+        event,
+        withQuery(oidcConfig.authorization_endpoint, authQuery)
+      );
+    }
+    if (query.state !== state) {
+      return handleInvalidState(event, "oidc", onError);
+    }
+    const tokenQuery = {
+      grant_type: "authorization_code",
+      client_id: config.clientId,
+      client_secret: config.clientSecret,
+      redirect_uri: redirectURL,
+      code: query.code,
+      ...config.params?.token_endpoint
+    };
+    if (verifier) {
+      tokenQuery.code_verifier = verifier.code_verifier;
+    }
+    const tokens = await requestAccessToken(oidcConfig.token_endpoint, {
+      body: tokenQuery
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "oidc", tokens, onError);
+    }
+    let user = {};
+    if (oidcConfig.userinfo_endpoint) {
+      user = await $fetch(oidcConfig.userinfo_endpoint, {
+        headers: {
+          Authorization: `${tokens.token_type} ${tokens.access_token}`
+        },
+        params: {
+          ...config.params?.userinfo_endpoint
+        }
+      });
+    }
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/x.js

@@ -1,14 +1,16 @@
+import { useRuntimeConfig } from "#imports";
+import { defu } from "defu";
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
-import { defu } from "defu";
-import { randomUUID } from "uncrypto";
 import {
-  handleMissingConfiguration,
-  handleAccessTokenErrorResponse,
   getOAuthRedirectURL,
+  handleAccessTokenErrorResponse,
+  handleInvalidState,
+  handleMissingConfiguration,
+  handlePkceVerifier,
+  handleState,
   requestAccessToken
 } from "../utils.js";
-import { useRuntimeConfig } from "#imports";
 export function defineOAuthXEventHandler({
   config,
   onSuccess,
@@ -19,16 +21,15 @@ export function defineOAuthXEventHandler({
       authorizationURL: "https://x.com/i/oauth2/authorize",
       tokenURL: "https://api.x.com/2/oauth2/token",
       userURL: "https://api.x.com/2/users/me",
-      authorizationParams: {
-        state: randomUUID(),
-        code_challenge: randomUUID()
-      }
+      authorizationParams: {}
     });
     const query = getQuery(event);
     if (!config.clientId || !config.clientSecret) {
       return handleMissingConfiguration(event, "x", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const pkce = await handlePkceVerifier(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [
         "tweet.read",
@@ -40,13 +41,18 @@ export function defineOAuthXEventHandler({
         withQuery(config.authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          code_challenge_method: "plain",
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          code_challenge: pkce.code_challenge,
+          code_challenge_method: pkce.code_challenge_method,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "x", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         Authorization: `Basic ${Buffer.from(
@@ -55,7 +61,7 @@ export function defineOAuthXEventHandler({
       },
       params: {
         grant_type: "authorization_code",
-        code_verifier: config.authorizationParams?.code_challenge,
+        code_verifier: pkce.code_verifier,
         redirect_uri: redirectURL,
         code: query.code
       }

package/dist/runtime/server/lib/utils.d.ts

@@ -26,7 +26,7 @@ export interface RequestAccessTokenOptions {
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
  */
-export declare function requestAccessToken(url: string, options: RequestAccessTokenOptions): Promise<any>;
+export declare function requestAccessToken<T = any>(url: string, options: RequestAccessTokenOptions): Promise<T>;
 /**
  * Handle OAuth access token error response
  *

package/dist/runtime/server/lib/webauthn/register.js

@@ -84,7 +84,8 @@ export function defineWebAuthnRegisterEventHandler({
           publicKey: bufferToBase64URLString(verification.registrationInfo.credential.publicKey.buffer),
           counter: verification.registrationInfo.credential.counter,
           backedUp: verification.registrationInfo.credentialBackedUp,
-          transports: verification.registrationInfo.credential.transports
+          transports: verification.registrationInfo.credential.transports,
+          aaguid: verification.registrationInfo.aaguid
         },
         registrationInfo: verification.registrationInfo
       });

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oicd' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/dist/runtime/types/webauthn.d.ts

@@ -8,6 +8,7 @@ export interface WebAuthnCredential {
     counter: number;
     backedUp: boolean;
     transports?: AuthenticatorTransportFuture[];
+    aaguid?: string;
     [key: string]: unknown;
 }
 export interface WebAuthnUser {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.26",
+  "version": "0.5.27",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@10.25.0",
+  "packageManager": "pnpm@10.28.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.mts",
@@ -40,10 +40,10 @@
   },
   "dependencies": {
     "@adonisjs/hash": "^9.1.1",
-    "@nuxt/kit": "^4.2.1",
+    "@nuxt/kit": "^4.2.2",
     "defu": "^6.1.4",
     "h3": "^1.15.4",
-    "hookable": "^5.5.3",
+    "hookable": "^6.0.1",
     "jose": "^6.1.3",
     "ofetch": "^1.5.1",
     "openid-client": "^6.8.1",
@@ -72,20 +72,20 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.62",
+    "@iconify-json/simple-icons": "^1.2.66",
     "@nuxt/devtools": "3.1.1",
-    "@nuxt/eslint-config": "^1.11.0",
+    "@nuxt/eslint-config": "^1.12.1",
     "@nuxt/module-builder": "^1.0.2",
-    "@nuxt/schema": "^4.2.1",
-    "@nuxt/test-utils": "^3.21.0",
+    "@nuxt/schema": "^4.2.2",
+    "@nuxt/test-utils": "^3.23.0",
     "@types/node": "latest",
-    "@nuxt/ui": "^4.2.1",
+    "@nuxt/ui": "^4.3.0",
     "@simplewebauthn/types": "^12.0.0",
     "changelogen": "^0.6.2",
-    "eslint": "^9.39.1",
-    "nuxt": "^4.2.1",
+    "eslint": "^9.39.2",
+    "nuxt": "^4.2.2",
     "typescript": "5.9.3",
-    "vitest": "^4.0.15",
-    "vue-tsc": "^3.1.8"
+    "vitest": "^4.0.17",
+    "vue-tsc": "^3.2.2"
   }
 }