nuxt-auth-utils 0.5.26 → 0.5.28

package/README.md

@@ -236,8 +236,10 @@ It can also be set using environment variables:
 - LinkedIn
 - LiveChat
 - Microsoft
+- OIDC / OpenID Connect (Generic)
 - Okta
 - Ory
+- osu!
 - PayPal
 - Polar
 - Salesforce
@@ -420,7 +422,7 @@ export default defineWebAuthnRegisterEventHandler({
     // If he registers a new account with credentials
     return z.object({
       // we want the userName to be a valid email
-      userName: z.string().email() 
+      userName: z.string().email()
     }).parse(userBody)
   },
   async onSuccess(event, { credential, user }) {
@@ -448,6 +450,8 @@ export default defineWebAuthnRegisterEventHandler({
   },
 })
 ```
+> [!TIP]
+> If you want to plug in and use the [Community sourced list of AAGUIDS](https://github.com/passkeydeveloper/passkey-authenticator-aaguids) to decorate your display of added passkeys, you can access the the ID via `credential.aaguid` inside `onSuccess`
 
 ```ts
 // server/api/webauthn/authenticate.post.ts

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.26",
+  "version": "0.5.28",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,7 +1,7 @@
-import { readFile, writeFile } from 'node:fs/promises';
 import { defineNuxtModule, createResolver, addComponentsDir, addImports, addPlugin, addServerPlugin, addServerImportsDir, logger, addServerHandler } from '@nuxt/kit';
-import { join } from 'pathe';
 import { defu } from 'defu';
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'pathe';
 import { randomUUID } from 'uncrypto';
 import { atprotoProviders, atprotoProviderDefaultClientMetadata, getClientMetadataFilename } from '../dist/runtime/utils/atproto.js';
 
@@ -393,6 +393,19 @@ const module$1 = defineNuxtModule({
       redirectURL: "",
       scope: []
     });
+    runtimeConfig.oauth.oidc = defu(runtimeConfig.oauth.oidc, {
+      clientId: "",
+      clientSecret: "",
+      openidConfig: "",
+      redirectURL: "",
+      scope: []
+    });
+    runtimeConfig.oauth.osu = defu(runtimeConfig.oauth.osu, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: []
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/kick.d.ts

@@ -35,4 +35,21 @@ export interface OAuthKickConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthKickEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthKickConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+interface KickUser {
+    email: string;
+    name: string;
+    profile_picture: string;
+    user_id: string;
+}
+interface KickTokens {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    scope: string;
+    token_type: string;
+}
+export declare function defineOAuthKickEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthKickConfig, {
+    user: KickUser;
+    tokens: KickTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/oidc.d.ts

@@ -0,0 +1,215 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthOidcConfig {
+    /**
+     * OAuth Client ID
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * OAuth Client secret.
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * OpenID configuration. If a string is passed, it is considered to be the full URL to the OpenID configuration endpoint
+     * where all required endpoints are listed and fetched from automatically.
+     *
+     * Alternatively, an object can be set with the required endpoint URLs.
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_OPENID_CONFIG
+     * @example "https://my-provider.com/.well-known/openid-configuration"
+     */
+    openidConfig?: string | OIDCConfiguration;
+    /**
+     * OAuth Scope
+     *
+     * @default ['openid']
+     * @example ['openid', 'profile', 'email']
+     */
+    scope?: string[];
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     *
+     * @default process.env.NUXT_OAUTH_OIDC_REDIRECT_URL
+     */
+    redirectURL?: string;
+    /**
+     * Additional custom params that are passed to the specific endpoint requests.
+     * Can be used to provide custom (query) params.
+     */
+    params?: Partial<Record<'authorization_endpoint' | 'token_endpoint' | 'userinfo_endpoint', object>>;
+}
+/**
+ * Standard OIDC claims.
+ *
+ * @see: https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+ */
+interface OidcUser {
+    /**
+     * Subject - Identifier for the End-User at the Issuer.
+     */
+    sub: string;
+    /**
+     * End-User's full name in displayable form including all name parts,
+     * possibly including titles and suffixes, ordered according to the
+     * End-User's locale and preferences.
+     */
+    name?: string;
+    /**
+     * Given name(s) or first name(s) of the End-User. Note that in some cultures,
+     * people can have multiple given names; all can be present, with the names
+     * being separated by space characters.
+     */
+    given_name?: string;
+    /**
+     * Surname(s) or last name(s) of the End-User. Note that in some cultures,
+     * people can have multiple family names or no family name; all can be present,
+     * with the names being separated by space characters.
+     */
+    family_name?: string;
+    /**
+     * Middle name(s) of the End-User. Note that in some cultures, people can have
+     * multiple middle names; all can be present, with the names being separated by
+     * space characters. Also note that in some cultures, middle names are not used.
+     */
+    middle_name?: string;
+    /**
+     * Casual name of the End-User that may or may not be the same as the given_name.
+     * For instance, a nickname value of Mike might be returned alongside a given_name
+     * value of Michael.
+     */
+    nickname?: string;
+    /**
+     * Shorthand name by which the End-User wishes to be referred to at the RP, such as
+     * janedoe or j.doe. This value MAY be any valid JSON string including special
+     * characters such as @, /, or whitespace. The RP MUST NOT rely upon this value
+     * being unique.
+     */
+    preferred_username?: string;
+    /**
+     * URL of the End-User's profile page. The contents of this Web page SHOULD be
+     * about the End-User.
+     */
+    profile?: string;
+    /**
+     * URL of the End-User's profile picture. This URL MUST refer to an image file
+     * (for example, a PNG, JPEG, or GIF image file), rather than to a Web page
+     * containing an image. Note that this URL SHOULD specifically reference a profile
+     * photo of the End-User suitable for displaying when describing the End-User,
+     * rather than an arbitrary photo taken by the End-User.
+     */
+    picture?: string;
+    /**
+     * URL of the End-User's Web page or blog. This Web page SHOULD contain information
+     * published by the End-User or an organization that the End-User is affiliated with.
+     */
+    website?: string;
+    /**
+     * End-User's preferred e-mail address. Its value MUST conform to the RFC 5322
+     * addr-spec syntax. The RP MUST NOT rely upon this value being unique.
+     */
+    email?: string;
+    /**
+     * True if the End-User's e-mail address has been verified; otherwise false.
+     * When this Claim Value is true, this means that the OP took affirmative steps
+     * to ensure that this e-mail address was controlled by the End-User at the time
+     * the verification was performed. The means by which an e-mail address is verified
+     * is context specific, and dependent upon the trust framework or contractual
+     * agreements within which the parties are operating.
+     */
+    email_verified?: boolean;
+    /**
+     * End-User's gender. Values defined by this specification are female and male.
+     * Other values MAY be used when neither of the defined values are applicable.
+     */
+    gender?: string;
+    /**
+     * End-User's birthday, represented as an ISO 8601-1 YYYY-MM-DD format. The year
+     * MAY be 0000, indicating that it is omitted. To represent only the year, YYYY
+     * format is allowed. Note that depending on the underlying platform's date related
+     * function, providing just year can result in varying month and day, so the
+     * implementers need to take this factor into account to correctly process the dates.
+     */
+    birthdate?: string;
+    /**
+     * String from IANA Time Zone Database representing the End-User's time zone.
+     * For example, Europe/Paris or America/Los_Angeles.
+     */
+    zoneinfo?: string;
+    /**
+     * End-User's locale, represented as a BCP47 language tag. This is typically an
+     * ISO 639 Alpha-2 language code in lowercase and an ISO 3166-1 Alpha-2 country
+     * code in uppercase, separated by a dash. For example, en-US or fr-CA. As a
+     * compatibility note, some implementations have used an underscore as the separator
+     * rather than a dash, for example, en_US; Relying Parties MAY choose to accept
+     * this locale syntax as well.
+     */
+    locale?: string;
+    /**
+     * End-User's preferred telephone number. E.164 is RECOMMENDED as the format of
+     * this Claim, for example, +1 (555) 555-5555 or +56 (2) 687 2400. If the phone
+     * number contains an extension, it is RECOMMENDED that the extension be represented
+     * using the RFC 3966 extension syntax, for example, +1 (555) 555-5555;ext=5678.
+     */
+    phone_number?: string;
+    /**
+     * True if the End-User's phone number has been verified; otherwise false. When
+     * this Claim Value is true, this means that the OP took affirmative steps to
+     * ensure that this phone number was controlled by the End-User at the time the
+     * verification was performed. The means by which a phone number is verified is
+     * context specific, and dependent upon the trust framework or contractual
+     * agreements within which the parties are operating. When true, the phone_number
+     * Claim MUST be in E.164 format and any extensions MUST be represented in RFC 3966 format.
+     */
+    phone_number_verified?: boolean;
+    /**
+     * End-User's preferred postal address.
+     */
+    address?: AddressClaim;
+    /**
+     * Time the End-User's information was last updated. Its value is a JSON number
+     * representing the number of seconds from 1970-01-01T00:00:00Z as measured in
+     * UTC until the date/time.
+     */
+    updated_at?: number;
+}
+/**
+ * Address claim structure as defined in OpenID Connect specification
+ */
+interface AddressClaim {
+    /** Full mailing address, formatted for display or use on a mailing label */
+    formatted?: string;
+    /** Full street address component, which may include house number, street name, post office box, and multi-line extended street address information */
+    street_address?: string;
+    /** City or locality component */
+    locality?: string;
+    /** State, province, prefecture, or region component */
+    region?: string;
+    /** Zip code or postal code component */
+    postal_code?: string;
+    /** Country name component */
+    country?: string;
+}
+interface OidcTokens {
+    access_token: string;
+    token_type: string;
+    scope?: string;
+    id_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+}
+interface OIDCConfiguration {
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint?: string;
+}
+/**
+ * Event handler for generic OAuth using OIDC and PKCE.
+ */
+export declare function defineOAuthOidcEventHandler<TUser = OidcUser>({ config, onSuccess, onError }: OAuthConfig<OAuthOidcConfig, {
+    user: TUser;
+    tokens: OidcTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/oidc.js

@@ -0,0 +1,92 @@
+import { useRuntimeConfig } from "#imports";
+import { defu } from "defu";
+import { createError, eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken, handleNonce, parseJwt } from "../utils.js";
+export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth.oidc, {
+      scope: ["openid"]
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `OIDC login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.openidConfig) {
+      return handleMissingConfiguration(event, "oidc", ["clientId", "openidConfig"], onError);
+    }
+    const oidcConfig = typeof config.openidConfig === "string" ? await $fetch(config.openidConfig) : config.openidConfig;
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    const verifier = await handlePkceVerifier(event);
+    const nonce = handleNonce(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      const authQuery = {
+        client_id: config.clientId,
+        redirect_uri: redirectURL,
+        scope: config.scope.join(" "),
+        state,
+        nonce,
+        response_type: "code",
+        ...config.params?.authorization_endpoint
+      };
+      authQuery.code_challenge = verifier.code_challenge;
+      authQuery.code_challenge_method = verifier.code_challenge_method;
+      return sendRedirect(
+        event,
+        withQuery(oidcConfig.authorization_endpoint, authQuery)
+      );
+    }
+    if (query.state !== state) {
+      return handleInvalidState(event, "oidc", onError);
+    }
+    const tokenQuery = {
+      grant_type: "authorization_code",
+      client_id: config.clientId,
+      client_secret: config.clientSecret,
+      redirect_uri: redirectURL,
+      code: query.code,
+      code_verifier: verifier.code_verifier,
+      ...config.params?.token_endpoint
+    };
+    const tokens = await requestAccessToken(oidcConfig.token_endpoint, {
+      body: tokenQuery
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "oidc", tokens, onError);
+    }
+    if (tokens.id_token) {
+      const claims = parseJwt(tokens.id_token);
+      if (claims.nonce !== nonce) {
+        const error = createError({
+          statusCode: 401,
+          message: "OIDC login failed: nonce mismatch"
+        });
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+    }
+    let user = {};
+    if (oidcConfig.userinfo_endpoint) {
+      user = await $fetch(oidcConfig.userinfo_endpoint, {
+        headers: {
+          Authorization: `${tokens.token_type} ${tokens.access_token}`
+        },
+        params: {
+          ...config.params?.userinfo_endpoint
+        }
+      });
+    }
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/osu.d.ts

@@ -0,0 +1,42 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthOsuConfig {
+    /**
+     * osu! OAuth Client ID
+     * @default process.env.NUXT_OAUTH_OSU_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * osu! OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_OSU_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * osu! OAuth Scope
+     *
+     * The identify scope is always implicitly provided.
+     * @default []
+     * @see https://osu.ppy.sh/docs/#scopes
+     */
+    scope?: string[];
+    /**
+     * osu! OAuth Authorization URL
+     * @default 'https://osu.ppy.sh/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * osu! OAuth Token URL
+     * @default 'https://osu.ppy.sh/oauth/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see 'https://osu.ppy.sh/docs/#authorization-code-grant'
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_OSU_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthOsuEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOsuConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/osu.js

@@ -0,0 +1,63 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthOsuEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.osu, {
+      authorizationURL: "https://osu.ppy.sh/oauth/authorize",
+      tokenURL: "https://osu.ppy.sh/oauth/token",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "osu", ["clientId", "clientSecret"], onError);
+    }
+    if (query.error) {
+      return handleAccessTokenErrorResponse(event, "osu", query, onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      return handleInvalidState(event, "osu", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "osu", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch("https://osu.ppy.sh/api/v2/me", {
+      headers: {
+        "user-agent": "Nuxt Auth Utils",
+        "Authorization": `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/twitch.d.ts

@@ -44,4 +44,28 @@ export interface OAuthTwitchConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+interface TwitchUser {
+    id: string;
+    login: string;
+    display_name: string;
+    type: string;
+    broadcaster_type: string;
+    description: string;
+    profile_image_url: string;
+    offline_image_url: string;
+    view_count: number;
+    email?: string;
+    created_at: string;
+}
+interface TwitchTokens {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    scope: string[];
+    token_type: string;
+}
+export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig, {
+    user: TwitchUser;
+    tokens: TwitchTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/x.js

@@ -1,14 +1,16 @@
+import { useRuntimeConfig } from "#imports";
+import { defu } from "defu";
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
-import { defu } from "defu";
-import { randomUUID } from "uncrypto";
 import {
-  handleMissingConfiguration,
-  handleAccessTokenErrorResponse,
   getOAuthRedirectURL,
+  handleAccessTokenErrorResponse,
+  handleInvalidState,
+  handleMissingConfiguration,
+  handlePkceVerifier,
+  handleState,
   requestAccessToken
 } from "../utils.js";
-import { useRuntimeConfig } from "#imports";
 export function defineOAuthXEventHandler({
   config,
   onSuccess,
@@ -19,16 +21,15 @@ export function defineOAuthXEventHandler({
       authorizationURL: "https://x.com/i/oauth2/authorize",
       tokenURL: "https://api.x.com/2/oauth2/token",
       userURL: "https://api.x.com/2/users/me",
-      authorizationParams: {
-        state: randomUUID(),
-        code_challenge: randomUUID()
-      }
+      authorizationParams: {}
     });
     const query = getQuery(event);
     if (!config.clientId || !config.clientSecret) {
       return handleMissingConfiguration(event, "x", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const pkce = await handlePkceVerifier(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [
         "tweet.read",
@@ -40,13 +41,18 @@ export function defineOAuthXEventHandler({
         withQuery(config.authorizationURL, {
           response_type: "code",
           client_id: config.clientId,
-          code_challenge_method: "plain",
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          code_challenge: pkce.code_challenge,
+          code_challenge_method: pkce.code_challenge_method,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "x", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         Authorization: `Basic ${Buffer.from(
@@ -55,7 +61,7 @@ export function defineOAuthXEventHandler({
       },
       params: {
         grant_type: "authorization_code",
-        code_verifier: config.authorizationParams?.code_challenge,
+        code_verifier: pkce.code_verifier,
         redirect_uri: redirectURL,
         code: query.code
       }

package/dist/runtime/server/lib/utils.d.ts

@@ -1,4 +1,5 @@
 import { type H3Event } from 'h3';
+import * as jose from 'jose';
 import type { OAuthProvider, OnError } from '#auth-utils';
 export declare function getOAuthRedirectURL(event: H3Event): string;
 /**
@@ -26,7 +27,7 @@ export interface RequestAccessTokenOptions {
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
  */
-export declare function requestAccessToken(url: string, options: RequestAccessTokenOptions): Promise<any>;
+export declare function requestAccessToken<T = any>(url: string, options: RequestAccessTokenOptions): Promise<T>;
 /**
  * Handle OAuth access token error response
  *
@@ -70,4 +71,6 @@ export declare function handlePkceVerifier(event: H3Event): Promise<{
     code_challenge_method?: undefined;
 }>;
 export declare function handleState(event: H3Event): Promise<string | undefined>;
+export declare function parseJwt(token: string): jose.JWTPayload;
+export declare function handleNonce(event: H3Event): string | undefined;
 export {};

package/dist/runtime/server/lib/utils.js

@@ -121,3 +121,23 @@ export async function handleState(event) {
   });
   return state;
 }
+export function parseJwt(token) {
+  return jose.decodeJwt(token);
+}
+export function handleNonce(event) {
+  const query = getQuery(event);
+  if (query.code) {
+    const nonce2 = getCookie(event, "nuxt-auth-nonce");
+    deleteCookie(event, "nuxt-auth-nonce");
+    return nonce2;
+  }
+  const nonce = encodeBase64Url(getRandomBytes(8));
+  setCookie(event, "nuxt-auth-nonce", nonce, {
+    httpOnly: true,
+    secure: !isDevelopment,
+    sameSite: "lax",
+    maxAge: OAUTH_COOKIE_MAX_AGE,
+    path: "/"
+  });
+  return nonce;
+}

package/dist/runtime/server/lib/webauthn/register.js

@@ -84,7 +84,8 @@ export function defineWebAuthnRegisterEventHandler({
           publicKey: bufferToBase64URLString(verification.registrationInfo.credential.publicKey.buffer),
           counter: verification.registrationInfo.credential.counter,
           backedUp: verification.registrationInfo.credentialBackedUp,
-          transports: verification.registrationInfo.credential.transports
+          transports: verification.registrationInfo.credential.transports,
+          aaguid: verification.registrationInfo.aaguid
         },
         registrationInfo: verification.registrationInfo
       });

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/dist/runtime/types/webauthn.d.ts

@@ -8,6 +8,7 @@ export interface WebAuthnCredential {
     counter: number;
     backedUp: boolean;
     transports?: AuthenticatorTransportFuture[];
+    aaguid?: string;
     [key: string]: unknown;
 }
 export interface WebAuthnUser {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.26",
+  "version": "0.5.28",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@10.25.0",
+  "packageManager": "pnpm@10.28.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.mts",
@@ -40,10 +40,10 @@
   },
   "dependencies": {
     "@adonisjs/hash": "^9.1.1",
-    "@nuxt/kit": "^4.2.1",
+    "@nuxt/kit": "^4.2.2",
     "defu": "^6.1.4",
     "h3": "^1.15.4",
-    "hookable": "^5.5.3",
+    "hookable": "^6.0.1",
     "jose": "^6.1.3",
     "ofetch": "^1.5.1",
     "openid-client": "^6.8.1",
@@ -72,20 +72,20 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.62",
+    "@iconify-json/simple-icons": "^1.2.66",
     "@nuxt/devtools": "3.1.1",
-    "@nuxt/eslint-config": "^1.11.0",
+    "@nuxt/eslint-config": "^1.12.1",
     "@nuxt/module-builder": "^1.0.2",
-    "@nuxt/schema": "^4.2.1",
-    "@nuxt/test-utils": "^3.21.0",
+    "@nuxt/schema": "^4.2.2",
+    "@nuxt/test-utils": "^3.23.0",
     "@types/node": "latest",
-    "@nuxt/ui": "^4.2.1",
+    "@nuxt/ui": "^4.3.0",
     "@simplewebauthn/types": "^12.0.0",
     "changelogen": "^0.6.2",
-    "eslint": "^9.39.1",
-    "nuxt": "^4.2.1",
+    "eslint": "^9.39.2",
+    "nuxt": "^4.2.2",
     "typescript": "5.9.3",
-    "vitest": "^4.0.15",
-    "vue-tsc": "^3.1.8"
+    "vitest": "^4.0.17",
+    "vue-tsc": "^3.2.2"
   }
 }