nuxt-auth-utils 0.5.28 → 0.5.30

package/dist/runtime/server/lib/oauth/google.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthGoogleEventHandler({
   config,
@@ -20,6 +20,7 @@ export function defineOAuthGoogleEventHandler({
       return handleMissingConfiguration(event, "google", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["email", "profile"];
       return sendRedirect(
@@ -29,11 +30,14 @@ export function defineOAuthGoogleEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: query.state || "",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "google", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/heroku.js

@@ -40,8 +40,8 @@ export function defineOAuthHerokuEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/hubspot.js

@@ -5,6 +5,8 @@ import {
   getOAuthRedirectURL,
   handleAccessTokenErrorResponse,
   handleMissingConfiguration,
+  handleInvalidState,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
@@ -19,16 +21,21 @@ export function defineOAuthHubspotEventHandler({ config, onSuccess, onError }) {
     if (query.error) {
       return handleAccessTokenErrorResponse(event, "hubspot", query, onError);
     }
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
         withQuery("https://app.hubspot.com/oauth/authorize", {
           client_id: config.clientId,
           redirect_uri: redirectURL,
-          scope: config.scope?.join(" ") || "oauth"
+          scope: config.scope?.join(" ") || "oauth",
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "hubspot", onError);
+    }
     const tokens = await requestAccessToken(
       "https://api.hubapi.com/oauth/v1/token",
       {

package/dist/runtime/server/lib/oauth/instagram.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthInstagramEventHandler({
   config,
@@ -33,6 +33,7 @@ export function defineOAuthInstagramEventHandler({
       return handleMissingConfiguration(event, "instagram", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       return sendRedirect(
@@ -41,10 +42,14 @@ export function defineOAuthInstagramEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(),
-          response_type: "code"
+          response_type: "code",
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "instagram", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         client_id: config.clientId,

package/dist/runtime/server/lib/oauth/keycloak.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthKeycloakEventHandler({
   config,
@@ -30,6 +30,7 @@ export function defineOAuthKeycloakEventHandler({
     const authorizationURL = `${realmURL}/protocol/openid-connect/auth`;
     const tokenURL = `${realmURLInternal}/protocol/openid-connect/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["openid"];
       return sendRedirect(
@@ -40,10 +41,14 @@ export function defineOAuthKeycloakEventHandler({
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           response_type: "code",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "keycloak", onError);
+    }
     config.scope = config.scope || [];
     if (!config.scope.includes("openid")) {
       config.scope.push("openid");
@@ -56,6 +61,8 @@ export function defineOAuthKeycloakEventHandler({
         redirect_uri: redirectURL,
         code: query.code
       }
+    }).catch((error) => {
+      return handleAccessTokenErrorResponse(event, "keycloak", error?.data || error, onError);
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "keycloak", tokens, onError);

package/dist/runtime/server/lib/oauth/kick.js

@@ -1,8 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { randomUUID } from "uncrypto";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken, handlePkceVerifier } from "../utils.js";
+import { handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken, handlePkceVerifier, handleState } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthKickEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +14,7 @@ export function defineOAuthKickEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "kick", ["clientId", "clientSecret"], onError);
     }
     const verifier = await handlePkceVerifier(event);
+    const state = await handleState(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {
       config.scope = config.scope || [];
@@ -27,12 +27,15 @@ export function defineOAuthKickEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: randomUUID(),
+          state,
           code_challenge: verifier.code_challenge,
           code_challenge_method: verifier.code_challenge_method
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "kick", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/line.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthLineEventHandler({
   config,
@@ -29,6 +29,7 @@ export function defineOAuthLineEventHandler({
       return handleMissingConfiguration(event, "line", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["profile", "openid"];
       return sendRedirect(
@@ -38,11 +39,14 @@ export function defineOAuthLineEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: query.state || "",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "line", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/linear.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthLinearEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -24,6 +24,7 @@ export function defineOAuthLinearEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "linear", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["read"];
       return sendRedirect(
@@ -33,10 +34,14 @@ export function defineOAuthLinearEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "linear", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"

package/dist/runtime/server/lib/oauth/linkedin.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthLinkedInEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthLinkedInEventHandler({ config, onSuccess, onError })
       return handleMissingConfiguration(event, "linkedin", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.length) {
@@ -30,10 +31,14 @@ export function defineOAuthLinkedInEventHandler({ config, onSuccess, onError })
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "linkedin", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/livechat.js

@@ -1,11 +1,12 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { defu } from "defu";
 import { withQuery } from "ufo";
-import { randomUUID } from "uncrypto";
 import {
   getOAuthRedirectURL,
   handleAccessTokenErrorResponse,
+  handleInvalidState,
   handleMissingConfiguration,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
@@ -19,9 +20,7 @@ export function defineOAuthLiveChatEventHandler({
       authorizationURL: "https://accounts.livechat.com",
       tokenURL: "https://accounts.livechat.com/v2/token",
       userURL: "https://accounts.livechat.com/v2/accounts/me",
-      authorizationParams: {
-        state: randomUUID()
-      }
+      authorizationParams: {}
     });
     if (!config.clientId || !config.clientSecret) {
       return handleMissingConfiguration(
@@ -33,6 +32,7 @@ export function defineOAuthLiveChatEventHandler({
     }
     const query = getQuery(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
@@ -41,10 +41,14 @@ export function defineOAuthLiveChatEventHandler({
           redirect_uri: redirectURL,
           response_type: "code",
           scope: config.scope?.length ? config.scope.join(" ") : void 0,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "livechat", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       params: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/microsoft.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError })
     const authorizationURL = config.authorizationURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/authorize`;
     const tokenURL = config.tokenURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope && config.scope.length > 0 ? config.scope : ["User.Read"];
       config.scope = [...new Set(config.scope)];
@@ -25,11 +26,14 @@ export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError })
           response_type: "code",
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: query.state || "",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "microsoft", onError);
+    }
     const tokens = await requestAccessToken(tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/oidc.js

@@ -32,10 +32,10 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
         client_id: config.clientId,
         redirect_uri: redirectURL,
         scope: config.scope.join(" "),
-        state,
         nonce,
         response_type: "code",
-        ...config.params?.authorization_endpoint
+        ...config.params?.authorization_endpoint,
+        state
       };
       authQuery.code_challenge = verifier.code_challenge;
       authQuery.code_challenge_method = verifier.code_challenge_method;

package/dist/runtime/server/lib/oauth/okta.js

@@ -1,4 +1,4 @@
-import { eventHandler, getQuery, sendRedirect, createError, deleteCookie } from "h3";
+import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleState, handleInvalidState, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
@@ -108,13 +108,12 @@ export function defineOAuthOktaEventHandler({ config, onSuccess, onError }) {
           audience: config.audience || "",
           max_age: config.maxAge || 0,
           connection: config.connection || "",
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
     if (query.state !== state) {
-      deleteCookie(event, "nuxt-auth-state");
       return handleInvalidState(event, "okta", onError);
     }
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/ory.js

@@ -49,10 +49,10 @@ export function defineOAuthOryEventHandler({ config, onSuccess, onError }) {
           response_type: "code",
           redirect_uri: redirectURL,
           scope: config.scope,
-          state,
           code_challenge: verifier.code_challenge,
           code_challenge_method: verifier.code_challenge_method,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/osu.js

@@ -28,8 +28,8 @@ export function defineOAuthOsuEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/paypal.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthPaypalEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -22,6 +22,7 @@ export function defineOAuthPaypalEventHandler({ config, onSuccess, onError }) {
       config.tokenURL = `https://${paypalAPI}/v1/oauth2/token`;
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("openid")) {
@@ -38,10 +39,14 @@ export function defineOAuthPaypalEventHandler({ config, onSuccess, onError }) {
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           flowEntry: "static",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "paypal", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`

package/dist/runtime/server/lib/oauth/polar.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, getOAuthRedirectURL, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthPolarEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -14,6 +14,7 @@ export function defineOAuthPolarEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "polar", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("openid"))
@@ -27,10 +28,14 @@ export function defineOAuthPolarEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "polar", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/riotgames.d.ts

@@ -0,0 +1,74 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthRiotGamesConfig {
+    /**
+     * RiotGames OAuth Client ID
+     * @default process.env.NUXT_OAUTH_RIOTGAMES_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * RiotGames OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_RIOTGAMES_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * RiotGames OAuth Scope
+     * @default []
+     * @see https://beta.developer.riotgames.com/sign-on
+     * @example ['cpid', 'offline_access']
+     */
+    scope?: string[];
+    /**
+     * RiotGames OAuth Authorization URL
+     * @default 'https://auth.riotgames.com/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Riot OAuth Token URL
+     * @default 'https://auth.riotgames.com/token'
+     */
+    tokenURL?: string;
+    /**
+     * RiotGames API URL
+     * @default 'https://auth.riotgames.com'
+     */
+    apiURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_RIOTGAMES_REDIRECT_URL
+     */
+    redirectURL?: string;
+    /**
+     * API routing values for Accounts Endpoint. You can query for any account in any region.
+     * @default 'europe'
+     */
+    region?: 'americas' | 'europe' | 'asia';
+}
+interface RiotGamesUser extends RiotGamesAccount, RiotGamesUserInfo {
+}
+interface RiotGamesAccount {
+    puuid: string;
+    gameName: string;
+    tagLine: string;
+}
+interface RiotGamesUserInfo {
+    sub: string;
+    cpid?: string;
+    jti: string;
+}
+interface RiotGamesTokens {
+    access_token: string;
+    refresh_token: string;
+    id_token: string;
+    expires_in: number;
+    scope: string;
+    token_type: string;
+}
+export declare function defineOAuthRiotGamesEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRiotGamesConfig, {
+    user: RiotGamesUser;
+    tokens: RiotGamesTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/riotgames.js

@@ -0,0 +1,83 @@
+import { createError, eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthRiotGamesEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.riotgames, {
+      authorizationURL: "https://auth.riotgames.com/authorize",
+      tokenURL: "https://auth.riotgames.com/token",
+      apiURL: "https://auth.riotgames.com",
+      region: "europe"
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `RiotGames login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "riotgames", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope || [];
+      if (!config.scope.includes("openid")) {
+        config.scope.push("openid");
+      }
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          response_type: "code",
+          scope: config.scope.join(" "),
+          ...config.authorizationParams,
+          state
+        })
+      );
+    }
+    if (query.state !== state) {
+      return handleInvalidState(event, "riotgames", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "riotgames", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const [account, userInfo] = await Promise.all([
+      $fetch(`https://${config.region}.api.riotgames.com/riot/account/v1/accounts/me`, {
+        headers: {
+          Authorization: `Bearer ${accessToken}`
+        }
+      }),
+      $fetch(`${config.apiURL}/userinfo`, {
+        headers: {
+          Authorization: `Bearer ${accessToken}`
+        }
+      })
+    ]);
+    const user = {
+      ...account,
+      ...userInfo
+    };
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}