nuxt-auth-utils 0.5.27 → 0.5.28

package/README.md

@@ -239,6 +239,7 @@ It can also be set using environment variables:
 - OIDC / OpenID Connect (Generic)
 - Okta
 - Ory
+- osu!
 - PayPal
 - Polar
 - Salesforce
@@ -449,6 +450,8 @@ export default defineWebAuthnRegisterEventHandler({
   },
 })
 ```
+> [!TIP]
+> If you want to plug in and use the [Community sourced list of AAGUIDS](https://github.com/passkeydeveloper/passkey-authenticator-aaguids) to decorate your display of added passkeys, you can access the the ID via `credential.aaguid` inside `onSuccess`
 
 ```ts
 // server/api/webauthn/authenticate.post.ts

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.27",
+  "version": "0.5.28",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -400,6 +400,12 @@ const module$1 = defineNuxtModule({
       redirectURL: "",
       scope: []
     });
+    runtimeConfig.oauth.osu = defu(runtimeConfig.oauth.osu, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: []
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/kick.d.ts

@@ -35,4 +35,21 @@ export interface OAuthKickConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthKickEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthKickConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+interface KickUser {
+    email: string;
+    name: string;
+    profile_picture: string;
+    user_id: string;
+}
+interface KickTokens {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    scope: string;
+    token_type: string;
+}
+export declare function defineOAuthKickEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthKickConfig, {
+    user: KickUser;
+    tokens: KickTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/oidc.d.ts

@@ -8,7 +8,6 @@ export interface OAuthOidcConfig {
     clientId?: string;
     /**
      * OAuth Client secret.
-     * If unset, PKCE will be used where no client secret is needed.
      *
      * @default process.env.NUXT_OAUTH_OIDC_CLIENT_SECRET
      */

package/dist/runtime/server/lib/oauth/oidc.js

@@ -2,7 +2,7 @@ import { useRuntimeConfig } from "#imports";
 import { defu } from "defu";
 import { createError, eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
-import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken, handleNonce, parseJwt } from "../utils.js";
 export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth.oidc, {
@@ -24,7 +24,8 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
     const oidcConfig = typeof config.openidConfig === "string" ? await $fetch(config.openidConfig) : config.openidConfig;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     const state = await handleState(event);
-    const verifier = !config.clientSecret ? await handlePkceVerifier(event) : void 0;
+    const verifier = await handlePkceVerifier(event);
+    const nonce = handleNonce(event);
     if (!query.code) {
       config.scope = config.scope || [];
       const authQuery = {
@@ -32,13 +33,12 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
         redirect_uri: redirectURL,
         scope: config.scope.join(" "),
         state,
+        nonce,
         response_type: "code",
         ...config.params?.authorization_endpoint
       };
-      if (verifier) {
-        authQuery.code_challenge = verifier.code_challenge;
-        authQuery.code_challenge_method = verifier.code_challenge_method;
-      }
+      authQuery.code_challenge = verifier.code_challenge;
+      authQuery.code_challenge_method = verifier.code_challenge_method;
       return sendRedirect(
         event,
         withQuery(oidcConfig.authorization_endpoint, authQuery)
@@ -53,17 +53,26 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
       client_secret: config.clientSecret,
       redirect_uri: redirectURL,
       code: query.code,
+      code_verifier: verifier.code_verifier,
       ...config.params?.token_endpoint
     };
-    if (verifier) {
-      tokenQuery.code_verifier = verifier.code_verifier;
-    }
     const tokens = await requestAccessToken(oidcConfig.token_endpoint, {
       body: tokenQuery
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "oidc", tokens, onError);
     }
+    if (tokens.id_token) {
+      const claims = parseJwt(tokens.id_token);
+      if (claims.nonce !== nonce) {
+        const error = createError({
+          statusCode: 401,
+          message: "OIDC login failed: nonce mismatch"
+        });
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+    }
     let user = {};
     if (oidcConfig.userinfo_endpoint) {
       user = await $fetch(oidcConfig.userinfo_endpoint, {

package/dist/runtime/server/lib/oauth/osu.d.ts

@@ -0,0 +1,42 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthOsuConfig {
+    /**
+     * osu! OAuth Client ID
+     * @default process.env.NUXT_OAUTH_OSU_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * osu! OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_OSU_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * osu! OAuth Scope
+     *
+     * The identify scope is always implicitly provided.
+     * @default []
+     * @see https://osu.ppy.sh/docs/#scopes
+     */
+    scope?: string[];
+    /**
+     * osu! OAuth Authorization URL
+     * @default 'https://osu.ppy.sh/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * osu! OAuth Token URL
+     * @default 'https://osu.ppy.sh/oauth/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see 'https://osu.ppy.sh/docs/#authorization-code-grant'
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_OSU_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthOsuEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOsuConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/osu.js

@@ -0,0 +1,63 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthOsuEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.osu, {
+      authorizationURL: "https://osu.ppy.sh/oauth/authorize",
+      tokenURL: "https://osu.ppy.sh/oauth/token",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "osu", ["clientId", "clientSecret"], onError);
+    }
+    if (query.error) {
+      return handleAccessTokenErrorResponse(event, "osu", query, onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      return handleInvalidState(event, "osu", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "osu", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch("https://osu.ppy.sh/api/v2/me", {
+      headers: {
+        "user-agent": "Nuxt Auth Utils",
+        "Authorization": `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/twitch.d.ts

@@ -44,4 +44,28 @@ export interface OAuthTwitchConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+interface TwitchUser {
+    id: string;
+    login: string;
+    display_name: string;
+    type: string;
+    broadcaster_type: string;
+    description: string;
+    profile_image_url: string;
+    offline_image_url: string;
+    view_count: number;
+    email?: string;
+    created_at: string;
+}
+interface TwitchTokens {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    scope: string[];
+    token_type: string;
+}
+export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig, {
+    user: TwitchUser;
+    tokens: TwitchTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/utils.d.ts

@@ -1,4 +1,5 @@
 import { type H3Event } from 'h3';
+import * as jose from 'jose';
 import type { OAuthProvider, OnError } from '#auth-utils';
 export declare function getOAuthRedirectURL(event: H3Event): string;
 /**
@@ -70,4 +71,6 @@ export declare function handlePkceVerifier(event: H3Event): Promise<{
     code_challenge_method?: undefined;
 }>;
 export declare function handleState(event: H3Event): Promise<string | undefined>;
+export declare function parseJwt(token: string): jose.JWTPayload;
+export declare function handleNonce(event: H3Event): string | undefined;
 export {};

package/dist/runtime/server/lib/utils.js

@@ -121,3 +121,23 @@ export async function handleState(event) {
   });
   return state;
 }
+export function parseJwt(token) {
+  return jose.decodeJwt(token);
+}
+export function handleNonce(event) {
+  const query = getQuery(event);
+  if (query.code) {
+    const nonce2 = getCookie(event, "nuxt-auth-nonce");
+    deleteCookie(event, "nuxt-auth-nonce");
+    return nonce2;
+  }
+  const nonce = encodeBase64Url(getRandomBytes(8));
+  setCookie(event, "nuxt-auth-nonce", nonce, {
+    httpOnly: true,
+    secure: !isDevelopment,
+    sameSite: "lax",
+    maxAge: OAUTH_COOKIE_MAX_AGE,
+    path: "/"
+  });
+  return nonce;
+}

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oicd' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.27",
+  "version": "0.5.28",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",