nuxt-auth-utils 0.5.27 → 0.5.29

package/README.md

@@ -219,6 +219,7 @@ It can also be set using environment variables:
 - Azure B2C
 - Battle.net
 - Bluesky (AT Protocol)
+- Box.com
 - Discord
 - Dropbox
 - Facebook
@@ -239,8 +240,10 @@ It can also be set using environment variables:
 - OIDC / OpenID Connect (Generic)
 - Okta
 - Ory
+- osu!
 - PayPal
 - Polar
+- Riot Games
 - Salesforce
 - Seznam
 - Shopify Customer
@@ -303,7 +306,7 @@ if (await verifyPassword(hashedPassword, 'user_password')) {
 It also provides a `passwordNeedsRehash` function to check if a password needs to be rehashed. This is useful when the hash settings are changed, such as as increasing the scrypt cost parameters.
 
 ```ts
-const needsRehash = await passwordNeedsRehash(hashedPassword)
+const needsRehash = passwordNeedsRehash(hashedPassword)
 
 if (needsRehash) {
   // Password needs to be rehashed
@@ -449,6 +452,8 @@ export default defineWebAuthnRegisterEventHandler({
   },
 })
 ```
+> [!TIP]
+> If you want to plug in and use the [Community sourced list of AAGUIDS](https://github.com/passkeydeveloper/passkey-authenticator-aaguids) to decorate your display of added passkeys, you can access the the ID via `credential.aaguid` inside `onSuccess`
 
 ```ts
 // server/api/webauthn/authenticate.post.ts

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.27",
+  "version": "0.5.29",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -115,6 +115,12 @@ const module$1 = defineNuxtModule({
       redirectURL: "",
       baseURL: ""
     });
+    runtimeConfig.oauth.box = defu(runtimeConfig.oauth.box, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: []
+    });
     runtimeConfig.oauth.github = defu(runtimeConfig.oauth.github, {
       clientId: "",
       clientSecret: "",
@@ -400,6 +406,18 @@ const module$1 = defineNuxtModule({
       redirectURL: "",
       scope: []
     });
+    runtimeConfig.oauth.osu = defu(runtimeConfig.oauth.osu, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: []
+    });
+    runtimeConfig.oauth.riotgames = defu(runtimeConfig.oauth.riotgames, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: []
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/box.d.ts

@@ -0,0 +1,95 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthBoxConfig {
+    /**
+     * Box OAuth Client ID
+     * @default process.env.NUXT_OAUTH_BOX_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Box OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_BOX_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Box OAuth Scope
+     * @default []
+     * @see https://developer.box.com/guides/api-calls/permissions-and-errors/scopes/
+     */
+    scope?: string[];
+    /**
+     * Box OAuth Authorization URL
+     * @default 'https://account.box.com/api/oauth2/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Box OAuth Token URL
+     * @default 'https://api.box.com/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Box User Info URL
+     * @default 'https://api.box.com/2.0/users/me'
+     */
+    userURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://developer.box.com/guides/authentication/oauth2/oauth2-setup/
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_BOX_REDIRECT_URL
+     */
+    redirectURL?: string;
+}
+/**
+ * Box User object returned from /2.0/users/me
+ * @see https://developer.box.com/reference/get-users-me/
+ * @see https://www.postman.com/boxdev/box-s-public-workspace/example/8119550-f7344611-7834-4040-a4ae-d6b3ef95bfdb
+ */
+interface OAuthBoxUser {
+    type: 'user';
+    id: string;
+    name: string;
+    login: string;
+    created_at: string;
+    modified_at: string;
+    language: string;
+    timezone: string;
+    space_amount: number;
+    space_used: number;
+    max_upload_size: number;
+    status: 'active' | 'inactive' | 'cannot_delete_edit' | 'cannot_delete_edit_upload';
+    job_title?: string;
+    phone?: string;
+    address?: string;
+    avatar_url?: string;
+}
+/**
+ * Box OAuth tokens
+ * @see https://developer.box.com/reference/post-oauth2-token/
+ * @see https://www.postman.com/boxdev/box-s-public-workspace/example/8119550-70a8e5bd-4d25-494c-be2c-5409db9d1ace
+ */
+interface OAuthBoxTokens {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    token_type: 'bearer';
+    restricted_to?: Array<{
+        scope: string;
+        object?: {
+            type: string;
+            id: string;
+        };
+    }>;
+}
+/**
+ * Define an OAuth event handler for Box authentication.
+ * @see https://developer.box.com/guides/authentication/oauth2/
+ * @see https://www.postman.com/boxdev/box-s-public-workspace/collection/trhp912/box-platform-api
+ */
+export declare function defineOAuthBoxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBoxConfig, {
+    user: OAuthBoxUser;
+    tokens: OAuthBoxTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/box.js

@@ -0,0 +1,69 @@
+import { eventHandler, getQuery, sendRedirect, createError } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthBoxEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.box, {
+      authorizationURL: "https://account.box.com/api/oauth2/authorize",
+      tokenURL: "https://api.box.com/oauth2/token",
+      userURL: "https://api.box.com/2.0/users/me",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const errorMessageParts = [query.error, query.error_description].filter(Boolean).join(": ");
+      const error = createError({
+        statusCode: 401,
+        message: `Box login failed: ${errorMessageParts || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "box", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      const scope = config.scope || [];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      return handleInvalidState(event, "box", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "box", tokens, onError);
+    }
+    const user = await $fetch(config.userURL, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/keycloak.js

@@ -56,6 +56,8 @@ export function defineOAuthKeycloakEventHandler({
         redirect_uri: redirectURL,
         code: query.code
       }
+    }).catch((error) => {
+      return handleAccessTokenErrorResponse(event, "keycloak", error?.data || error, onError);
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "keycloak", tokens, onError);

package/dist/runtime/server/lib/oauth/kick.d.ts

@@ -35,4 +35,21 @@ export interface OAuthKickConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthKickEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthKickConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+interface KickUser {
+    email: string;
+    name: string;
+    profile_picture: string;
+    user_id: string;
+}
+interface KickTokens {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    scope: string;
+    token_type: string;
+}
+export declare function defineOAuthKickEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthKickConfig, {
+    user: KickUser;
+    tokens: KickTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/oidc.d.ts

@@ -8,7 +8,6 @@ export interface OAuthOidcConfig {
     clientId?: string;
     /**
      * OAuth Client secret.
-     * If unset, PKCE will be used where no client secret is needed.
      *
      * @default process.env.NUXT_OAUTH_OIDC_CLIENT_SECRET
      */

package/dist/runtime/server/lib/oauth/oidc.js

@@ -2,7 +2,7 @@ import { useRuntimeConfig } from "#imports";
 import { defu } from "defu";
 import { createError, eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
-import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken, handleNonce, parseJwt } from "../utils.js";
 export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth.oidc, {
@@ -24,7 +24,8 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
     const oidcConfig = typeof config.openidConfig === "string" ? await $fetch(config.openidConfig) : config.openidConfig;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     const state = await handleState(event);
-    const verifier = !config.clientSecret ? await handlePkceVerifier(event) : void 0;
+    const verifier = await handlePkceVerifier(event);
+    const nonce = handleNonce(event);
     if (!query.code) {
       config.scope = config.scope || [];
       const authQuery = {
@@ -32,13 +33,12 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
         redirect_uri: redirectURL,
         scope: config.scope.join(" "),
         state,
+        nonce,
         response_type: "code",
         ...config.params?.authorization_endpoint
       };
-      if (verifier) {
-        authQuery.code_challenge = verifier.code_challenge;
-        authQuery.code_challenge_method = verifier.code_challenge_method;
-      }
+      authQuery.code_challenge = verifier.code_challenge;
+      authQuery.code_challenge_method = verifier.code_challenge_method;
       return sendRedirect(
         event,
         withQuery(oidcConfig.authorization_endpoint, authQuery)
@@ -53,17 +53,26 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
       client_secret: config.clientSecret,
       redirect_uri: redirectURL,
       code: query.code,
+      code_verifier: verifier.code_verifier,
       ...config.params?.token_endpoint
     };
-    if (verifier) {
-      tokenQuery.code_verifier = verifier.code_verifier;
-    }
     const tokens = await requestAccessToken(oidcConfig.token_endpoint, {
       body: tokenQuery
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "oidc", tokens, onError);
     }
+    if (tokens.id_token) {
+      const claims = parseJwt(tokens.id_token);
+      if (claims.nonce !== nonce) {
+        const error = createError({
+          statusCode: 401,
+          message: "OIDC login failed: nonce mismatch"
+        });
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+    }
     let user = {};
     if (oidcConfig.userinfo_endpoint) {
       user = await $fetch(oidcConfig.userinfo_endpoint, {

package/dist/runtime/server/lib/oauth/osu.d.ts

@@ -0,0 +1,42 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthOsuConfig {
+    /**
+     * osu! OAuth Client ID
+     * @default process.env.NUXT_OAUTH_OSU_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * osu! OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_OSU_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * osu! OAuth Scope
+     *
+     * The identify scope is always implicitly provided.
+     * @default []
+     * @see https://osu.ppy.sh/docs/#scopes
+     */
+    scope?: string[];
+    /**
+     * osu! OAuth Authorization URL
+     * @default 'https://osu.ppy.sh/oauth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * osu! OAuth Token URL
+     * @default 'https://osu.ppy.sh/oauth/token'
+     */
+    tokenURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see 'https://osu.ppy.sh/docs/#authorization-code-grant'
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_OSU_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export declare function defineOAuthOsuEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOsuConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/osu.js

@@ -0,0 +1,63 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthOsuEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.osu, {
+      authorizationURL: "https://osu.ppy.sh/oauth/authorize",
+      tokenURL: "https://osu.ppy.sh/oauth/token",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "osu", ["clientId", "clientSecret"], onError);
+    }
+    if (query.error) {
+      return handleAccessTokenErrorResponse(event, "osu", query, onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      return handleInvalidState(event, "osu", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "osu", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch("https://osu.ppy.sh/api/v2/me", {
+      headers: {
+        "user-agent": "Nuxt Auth Utils",
+        "Authorization": `Bearer ${accessToken}`
+      }
+    });
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/riotgames.d.ts

@@ -0,0 +1,74 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthRiotGamesConfig {
+    /**
+     * RiotGames OAuth Client ID
+     * @default process.env.NUXT_OAUTH_RIOTGAMES_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * RiotGames OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_RIOTGAMES_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * RiotGames OAuth Scope
+     * @default []
+     * @see https://beta.developer.riotgames.com/sign-on
+     * @example ['cpid', 'offline_access']
+     */
+    scope?: string[];
+    /**
+     * RiotGames OAuth Authorization URL
+     * @default 'https://auth.riotgames.com/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Riot OAuth Token URL
+     * @default 'https://auth.riotgames.com/token'
+     */
+    tokenURL?: string;
+    /**
+     * RiotGames API URL
+     * @default 'https://auth.riotgames.com'
+     */
+    apiURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_RIOTGAMES_REDIRECT_URL
+     */
+    redirectURL?: string;
+    /**
+     * API routing values for Accounts Endpoint. You can query for any account in any region.
+     * @default 'europe'
+     */
+    region?: 'americas' | 'europe' | 'asia';
+}
+interface RiotGamesUser extends RiotGamesAccount, RiotGamesUserInfo {
+}
+interface RiotGamesAccount {
+    puuid: string;
+    gameName: string;
+    tagLine: string;
+}
+interface RiotGamesUserInfo {
+    sub: string;
+    cpid?: string;
+    jti: string;
+}
+interface RiotGamesTokens {
+    access_token: string;
+    refresh_token: string;
+    id_token: string;
+    expires_in: number;
+    scope: string;
+    token_type: string;
+}
+export declare function defineOAuthRiotGamesEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRiotGamesConfig, {
+    user: RiotGamesUser;
+    tokens: RiotGamesTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/riotgames.js

@@ -0,0 +1,83 @@
+import { createError, eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthRiotGamesEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.riotgames, {
+      authorizationURL: "https://auth.riotgames.com/authorize",
+      tokenURL: "https://auth.riotgames.com/token",
+      apiURL: "https://auth.riotgames.com",
+      region: "europe"
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `RiotGames login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "riotgames", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (!config.scope.includes("openid")) {
+        config.scope.push("openid");
+      }
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          response_type: "code",
+          scope: config.scope.join(" "),
+          state,
+          ...config.authorizationParams
+        })
+      );
+    }
+    if (query.state !== state) {
+      return handleInvalidState(event, "riotgames", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "riotgames", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const [account, userInfo] = await Promise.all([
+      $fetch(`https://${config.region}.api.riotgames.com/riot/account/v1/accounts/me`, {
+        headers: {
+          Authorization: `Bearer ${accessToken}`
+        }
+      }),
+      $fetch(`${config.apiURL}/userinfo`, {
+        headers: {
+          Authorization: `Bearer ${accessToken}`
+        }
+      })
+    ]);
+    const user = {
+      ...account,
+      ...userInfo
+    };
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/twitch.d.ts

@@ -44,4 +44,28 @@ export interface OAuthTwitchConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+interface TwitchUser {
+    id: string;
+    login: string;
+    display_name: string;
+    type: string;
+    broadcaster_type: string;
+    description: string;
+    profile_image_url: string;
+    offline_image_url: string;
+    view_count: number;
+    email?: string;
+    created_at: string;
+}
+interface TwitchTokens {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    scope: string[];
+    token_type: string;
+}
+export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig, {
+    user: TwitchUser;
+    tokens: TwitchTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/utils.d.ts

@@ -1,4 +1,5 @@
 import { type H3Event } from 'h3';
+import * as jose from 'jose';
 import type { OAuthProvider, OnError } from '#auth-utils';
 export declare function getOAuthRedirectURL(event: H3Event): string;
 /**
@@ -70,4 +71,6 @@ export declare function handlePkceVerifier(event: H3Event): Promise<{
     code_challenge_method?: undefined;
 }>;
 export declare function handleState(event: H3Event): Promise<string | undefined>;
+export declare function parseJwt(token: string): jose.JWTPayload;
+export declare function handleNonce(event: H3Event): string | undefined;
 export {};

package/dist/runtime/server/lib/utils.js

@@ -121,3 +121,23 @@ export async function handleState(event) {
   });
   return state;
 }
+export function parseJwt(token) {
+  return jose.decodeJwt(token);
+}
+export function handleNonce(event) {
+  const query = getQuery(event);
+  if (query.code) {
+    const nonce2 = getCookie(event, "nuxt-auth-nonce");
+    deleteCookie(event, "nuxt-auth-nonce");
+    return nonce2;
+  }
+  const nonce = encodeBase64Url(getRandomBytes(8));
+  setCookie(event, "nuxt-auth-nonce", nonce, {
+    httpOnly: true,
+    secure: !isDevelopment,
+    sameSite: "lax",
+    maxAge: OAUTH_COOKIE_MAX_AGE,
+    path: "/"
+  });
+  return nonce;
+}

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oicd' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/dist/runtime/types/webauthn.d.ts

@@ -86,7 +86,7 @@ export interface WebAuthnComposable {
      * @param user.displayName - The display name to register, used for convenience and personalization and should not be relied upon as a secure identifier for authentication processes
      * @returns true if the registration was successful
      */
-    register: <T extends WebAuthnUser>(data: T) => Promise<boolean>;
+    register: <T extends WebAuthnUser>(user: T) => Promise<boolean>;
     /**
      * Authenticate a credential
      * @param userName - The user name to authenticate, can be an email address, a username, or any other form of unique ID chosen by the user

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.27",
+  "version": "0.5.29",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@10.28.0",
+  "packageManager": "pnpm@10.29.3",
   "exports": {
     ".": {
       "types": "./dist/types.d.mts",
@@ -40,13 +40,13 @@
   },
   "dependencies": {
     "@adonisjs/hash": "^9.1.1",
-    "@nuxt/kit": "^4.2.2",
+    "@nuxt/kit": "^4.3.1",
     "defu": "^6.1.4",
     "h3": "^1.15.4",
     "hookable": "^6.0.1",
     "jose": "^6.1.3",
     "ofetch": "^1.5.1",
-    "openid-client": "^6.8.1",
+    "openid-client": "^6.8.2",
     "pathe": "^2.0.3",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
@@ -72,20 +72,20 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.66",
-    "@nuxt/devtools": "3.1.1",
-    "@nuxt/eslint-config": "^1.12.1",
+    "@iconify-json/simple-icons": "^1.2.71",
+    "@nuxt/devtools": "3.2.1",
+    "@nuxt/eslint-config": "^1.15.1",
     "@nuxt/module-builder": "^1.0.2",
-    "@nuxt/schema": "^4.2.2",
-    "@nuxt/test-utils": "^3.23.0",
+    "@nuxt/schema": "^4.3.1",
+    "@nuxt/test-utils": "^4.0.0",
     "@types/node": "latest",
-    "@nuxt/ui": "^4.3.0",
+    "@nuxt/ui": "^4.4.0",
     "@simplewebauthn/types": "^12.0.0",
     "changelogen": "^0.6.2",
-    "eslint": "^9.39.2",
-    "nuxt": "^4.2.2",
+    "eslint": "^10.0.0",
+    "nuxt": "^4.3.1",
     "typescript": "5.9.3",
-    "vitest": "^4.0.17",
-    "vue-tsc": "^3.2.2"
+    "vitest": "^4.0.18",
+    "vue-tsc": "^3.2.4"
   }
 }