nuxt-auth-utils 0.5.31 → 0.5.33

package/dist/runtime/server/lib/oauth/kick.js

@@ -33,7 +33,7 @@ export function defineOAuthKickEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "kick", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/line.js

@@ -44,7 +44,7 @@ export function defineOAuthLineEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "line", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/linear.js

@@ -39,7 +39,7 @@ export function defineOAuthLinearEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "linear", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/linkedin.js

@@ -36,7 +36,7 @@ export function defineOAuthLinkedInEventHandler({ config, onSuccess, onError })
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "linkedin", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/livechat.js

@@ -46,7 +46,7 @@ export function defineOAuthLiveChatEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "livechat", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/mastodon.d.ts

@@ -0,0 +1,62 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthMastodonConfig {
+    /**
+     * The instance domain to authenticate against, e.g. `mastodon.social`.
+     *
+     * Unlike most OAuth providers, a Mastodon account lives on a single instance and there is no
+     * shared authorization server, so the instance must be known before the flow can start. If not
+     * set here, it can be provided at runtime as an `instance` query parameter on the initial request
+     * (e.g. `/auth/mastodon?instance=mastodon.social`). A full handle such as `@user@mastodon.social`
+     * or `user@mastodon.social` is also accepted, only the domain part is used.
+     * @default process.env.NUXT_OAUTH_MASTODON_INSTANCE
+     * @example 'mastodon.social'
+     */
+    instance?: string;
+    /**
+     * The name of the application shown to users on the instance's authorization screen.
+     *
+     * Mastodon has no concept of a pre-registered, shared client id: an application must be
+     * registered against every instance it authenticates users on (`POST /api/v1/apps`). This is
+     * that application's display name.
+     * @default 'Nuxt Auth Utils'
+     */
+    clientName?: string;
+    /**
+     * Mastodon OAuth Scope.
+     * @default ['read']
+     * @see https://docs.joinmastodon.org/api/oauth-scopes/
+     * @example ['read', 'read:accounts']
+     */
+    scope?: string[];
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_MASTODON_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export interface OAuthMastodonUser {
+    id: string;
+    username: string;
+    /**
+     * Always the full `user@instance` handle here, even for the authenticated user's own account.
+     * Mastodon's API normally only qualifies `acct` with `@instance` for remote accounts and returns
+     * the bare username for your own, we normalize it since an account only means something together
+     * with the instance it lives on.
+     */
+    acct: string;
+    display_name: string;
+    url: string;
+    avatar: string;
+    [key: string]: unknown;
+}
+interface MastodonTokens {
+    access_token: string;
+    token_type: string;
+    scope: string;
+    created_at: number;
+}
+export declare function defineOAuthMastodonEventHandler<TUser = OAuthMastodonUser>({ config: userConfig, onSuccess, onError }: OAuthConfig<OAuthMastodonConfig, {
+    user: TUser;
+    tokens: MastodonTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/mastodon.js

@@ -0,0 +1,178 @@
+import { createError, deleteCookie, eventHandler, getCookie, getQuery, sendRedirect, setCookie } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { $fetch } from "ofetch";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleState, isDevelopment, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+const FLOW_COOKIE_NAME = "nuxt-auth-mastodon-flow";
+const appRegistry = /* @__PURE__ */ new Map();
+const pendingRegistrations = /* @__PURE__ */ new Map();
+const MAX_REGISTERED_INSTANCES = 1e3;
+function appRegistryKey(instance, redirectURL) {
+  return `${instance}::${redirectURL}`;
+}
+function resolveInstanceDomain(input) {
+  const withoutProtocol = input.replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+  const withoutLeadingAt = withoutProtocol.replace(/^@/, "");
+  const domain = withoutLeadingAt.includes("@") ? withoutLeadingAt.split("@").pop() : withoutLeadingAt;
+  try {
+    return new URL(`https://${domain}`).hostname;
+  } catch {
+    return domain;
+  }
+}
+function isPubliclyAddressableInstance(instance) {
+  if (!instance || /\s/.test(instance) || instance.endsWith(".")) return false;
+  try {
+    if (new URL(`https://${instance}`).hostname !== instance) return false;
+  } catch {
+    return false;
+  }
+  if (instance === "localhost" || instance.endsWith(".localhost") || instance.endsWith(".local")) return false;
+  if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(instance)) return false;
+  if (instance.includes(":")) return false;
+  return true;
+}
+async function registerApp(instance, redirectURL, scope, clientName) {
+  const app = await $fetch(`https://${instance}/api/v1/apps`, {
+    method: "POST",
+    body: {
+      client_name: clientName,
+      redirect_uris: redirectURL,
+      scopes: scope
+    }
+  });
+  return { client_id: app.client_id, client_secret: app.client_secret };
+}
+async function getOrRegisterApp(instance, redirectURL, scope, clientName) {
+  const key = appRegistryKey(instance, redirectURL);
+  const cached = appRegistry.get(key);
+  if (cached) return cached;
+  const pending = pendingRegistrations.get(key);
+  if (pending) return pending;
+  const registration = registerApp(instance, redirectURL, scope, clientName).then((app) => {
+    if (appRegistry.size >= MAX_REGISTERED_INSTANCES && !appRegistry.has(key)) {
+      const oldestKey = appRegistry.keys().next().value;
+      if (oldestKey) appRegistry.delete(oldestKey);
+    }
+    appRegistry.set(key, app);
+    return app;
+  }).finally(() => {
+    pendingRegistrations.delete(key);
+  });
+  pendingRegistrations.set(key, registration);
+  return registration;
+}
+export function defineOAuthMastodonEventHandler({ config: userConfig, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    const config = defu({}, userConfig, useRuntimeConfig(event).oauth?.mastodon, {
+      clientName: "Nuxt Auth Utils"
+    });
+    config.scope ||= ["read"];
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Mastodon login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    const scope = (config.scope || ["read"]).join(" ");
+    if (!query.code) {
+      const rawInstance = query.instance?.toString() || config.instance;
+      if (!rawInstance) {
+        const error = createError({
+          statusCode: 400,
+          message: "Mastodon login failed: missing instance. Provide it via the `instance` query parameter (e.g. `/auth/mastodon?instance=mastodon.social`), a full handle (`@user@mastodon.social`), or the `instance` config/`NUXT_OAUTH_MASTODON_INSTANCE` env variable."
+        });
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+      const instance2 = resolveInstanceDomain(rawInstance);
+      if (!isPubliclyAddressableInstance(instance2)) {
+        const error = createError({
+          statusCode: 400,
+          message: `Mastodon login failed: "${instance2}" is not a valid instance domain.`
+        });
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+      let app;
+      try {
+        app = await getOrRegisterApp(instance2, redirectURL, scope, config.clientName || "Nuxt Auth Utils");
+      } catch {
+        const error = createError({
+          statusCode: 500,
+          message: `Mastodon login failed: could not register the application with instance "${instance2}". Make sure it is a reachable Mastodon (or compatible) server.`
+        });
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+      const flowState2 = { instance: instance2, clientId: app.client_id, clientSecret: app.client_secret };
+      setCookie(event, FLOW_COOKIE_NAME, btoa(JSON.stringify(flowState2)), {
+        httpOnly: true,
+        secure: !isDevelopment,
+        sameSite: "lax",
+        maxAge: 60 * 10,
+        path: "/"
+      });
+      return sendRedirect(event, withQuery(`https://${instance2}/oauth/authorize`, {
+        client_id: app.client_id,
+        redirect_uri: redirectURL,
+        response_type: "code",
+        scope,
+        state
+      }));
+    }
+    if (!state || query.state !== state) {
+      return handleInvalidState(event, "mastodon", onError);
+    }
+    const flowCookie = getCookie(event, FLOW_COOKIE_NAME);
+    deleteCookie(event, FLOW_COOKIE_NAME, { path: "/" });
+    let flowState;
+    try {
+      flowState = flowCookie ? JSON.parse(atob(flowCookie)) : void 0;
+    } catch {
+      flowState = void 0;
+    }
+    if (!flowState || !isPubliclyAddressableInstance(flowState.instance)) {
+      const error = createError({
+        statusCode: 400,
+        message: "Mastodon login failed: could not recover the application credentials for this login (missing or invalid flow cookie, the flow may have taken too long or cookies are blocked)."
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const { instance, clientId, clientSecret } = flowState;
+    const tokens = await requestAccessToken(`https://${instance}/oauth/token`, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code,
+        scope
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "mastodon", tokens, onError);
+    }
+    const account = await $fetch(`https://${instance}/api/v1/accounts/verify_credentials`, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`
+      }
+    });
+    const user = {
+      ...account,
+      acct: account.acct.includes("@") ? account.acct : `${account.acct}@${instance}`
+    };
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/microsoft.js

@@ -31,7 +31,7 @@ export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError })
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "microsoft", onError);
     }
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/oidc.js

@@ -5,9 +5,7 @@ import { withQuery } from "ufo";
 import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken, handleNonce, parseJwt } from "../utils.js";
 export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
-    config = defu(config, useRuntimeConfig(event).oauth.oidc, {
-      scope: ["openid"]
-    });
+    config = defu(config, useRuntimeConfig(event).oauth.oidc);
     const query = getQuery(event);
     if (query.error) {
       const error = createError({
@@ -28,6 +26,9 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
     const nonce = handleNonce(event);
     if (!query.code) {
       config.scope = config.scope || [];
+      if (!config.scope.includes("openid")) {
+        config.scope.push("openid");
+      }
       const authQuery = {
         client_id: config.clientId,
         redirect_uri: redirectURL,
@@ -44,7 +45,7 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
         withQuery(oidcConfig.authorization_endpoint, authQuery)
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "oidc", onError);
     }
     const tokenQuery = {

package/dist/runtime/server/lib/oauth/okta.js

@@ -113,7 +113,7 @@ export function defineOAuthOktaEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "okta", onError);
     }
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/ory.js

@@ -56,7 +56,7 @@ export function defineOAuthOryEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "ory", onError);
     }
     const tokenURL = `${config.sdkURL}${config.tokenURL}`;

package/dist/runtime/server/lib/oauth/osu.js

@@ -33,7 +33,7 @@ export function defineOAuthOsuEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "osu", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/paypal.js

@@ -44,7 +44,7 @@ export function defineOAuthPaypalEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "paypal", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/polar.js

@@ -33,7 +33,7 @@ export function defineOAuthPolarEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "polar", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/riotgames.js

@@ -43,7 +43,7 @@ export function defineOAuthRiotGamesEventHandler({ config, onSuccess, onError })
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "riotgames", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/roblox.js

@@ -33,7 +33,7 @@ export function defineOAuthRobloxEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "roblox", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/salesforce.d.ts

@@ -24,14 +24,19 @@ export interface OAuthSalesforceConfig {
     baseURL?: string;
     /**
      * Salesforce OAuth Authorization URL
-     * @default 'https://login.salesforce.com/services/oauth2/authorize'
+     * @default '${baseURL}/services/oauth2/authorize'
      */
     authorizationURL?: string;
     /**
-     * Salesforce OAuth Authorization URL
-     * @default 'https://login.salesforce.com/services/oauth2/token'
+     * Salesforce OAuth Token URL
+     * @default '${baseURL}/services/oauth2/token'
      */
     tokenURL?: string;
+    /**
+     * Salesforce OAuth User URL
+     * @default '${baseURL}/services/oauth2/userinfo'
+     */
+    userURL?: string;
     /**
      * Extra authorization parameters to provide to the authorization URL
      * @default {}

package/dist/runtime/server/lib/oauth/salesforce.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState, handlePkceVerifier } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthSalesforceEventHandler({
   config,
@@ -10,7 +10,7 @@ export function defineOAuthSalesforceEventHandler({
 }) {
   return eventHandler(async (event) => {
     const runtimeConfig = useRuntimeConfig(event).oauth?.salesforce;
-    const baseURL = config?.baseURL || "https://login.salesforce.com";
+    const baseURL = config?.baseURL || runtimeConfig?.baseURL || "https://login.salesforce.com";
     config = defu(config, runtimeConfig, {
       authorizationURL: `${baseURL}/services/oauth2/authorize`,
       tokenURL: `${baseURL}/services/oauth2/token`,
@@ -30,6 +30,7 @@ export function defineOAuthSalesforceEventHandler({
       return handleMissingConfiguration(event, "salesforce", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const pkce = await handlePkceVerifier(event);
     const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["id"];
@@ -41,11 +42,13 @@ export function defineOAuthSalesforceEventHandler({
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           ...config.authorizationParams,
+          code_challenge: pkce.code_challenge,
+          code_challenge_method: pkce.code_challenge_method,
           state
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "salesforce", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {
@@ -54,14 +57,15 @@ export function defineOAuthSalesforceEventHandler({
         client_id: config.clientId,
         client_secret: config.clientSecret,
         redirect_uri: redirectURL,
-        code: query.code
+        code: query.code,
+        code_verifier: pkce.code_verifier
       }
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "salesforce", tokens, onError);
     }
     const accessToken = tokens.access_token;
-    const user = await $fetch(`${baseURL}/services/oauth2/userinfo`, {
+    const user = await $fetch(config.userURL || `${baseURL}/services/oauth2/userinfo`, {
       headers: {
         Authorization: `Bearer ${accessToken}`
       }

package/dist/runtime/server/lib/oauth/seznam.js

@@ -29,7 +29,7 @@ export function defineOAuthSeznamEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "seznam", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/shopifyCustomer.js

@@ -12,7 +12,7 @@ export function defineOAuthShopifyCustomerEventHandler({
     config = defu(config, useRuntimeConfig(event).oauth?.shopifyCustomer, {});
     const query = getQuery(event);
     if (!config.clientId || !config.shopDomain) {
-      return handleMissingConfiguration(event, "spotify", ["clientId", "shopDomain"], onError);
+      return handleMissingConfiguration(event, "shopifyCustomer", ["clientId", "shopDomain"], onError);
     }
     const verifier = await handlePkceVerifier(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
@@ -42,7 +42,7 @@ export function defineOAuthShopifyCustomerEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "shopifyCustomer", onError);
     }
     const tokens = await requestAccessToken(discoveryResponse.token_endpoint, {

package/dist/runtime/server/lib/oauth/slack.js

@@ -45,7 +45,7 @@ export function defineOAuthSlackEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "slack", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/spotify.js

@@ -33,7 +33,7 @@ export function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "spotify", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/steam.js

@@ -27,7 +27,7 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
       };
       return sendRedirect(event, withQuery(config.authorizationURL, steamOpenIdParams));
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "steam", onError);
     }
     if (!query["openid.signed"] || !query["openid.sig"]) {

package/dist/runtime/server/lib/oauth/strava.js

@@ -52,7 +52,7 @@ export function defineOAuthStravaEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "strava", onError);
     }
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/tiktok.js

@@ -39,7 +39,7 @@ export function defineOAuthTikTokEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "tiktok", onError);
     }
     const tokens = await requestAccessToken(

package/dist/runtime/server/lib/oauth/twitch.js

@@ -33,7 +33,7 @@ export function defineOAuthTwitchEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "twitch", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/vk.js

@@ -52,7 +52,7 @@ export function defineOAuthVKEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "vk", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/wechat.d.ts

@@ -0,0 +1,67 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthWechatConfig {
+    /**
+     * WeChat App ID
+     * @default process.env.NUXT_OAUTH_WECHAT_APP_ID
+     */
+    appId?: string;
+    /**
+     * WeChat App Secret
+     * @default process.env.NUXT_OAUTH_WECHAT_APP_SECRET
+     */
+    appSecret?: string;
+    /**
+     * WeChat OAuth Scope
+     * @default ['snsapi_login']
+     * @see https://developers.weixin.qq.com/doc/oplatform/Website_App/WeChat_Login/Wechat_Login.html
+     */
+    scope?: string[];
+    /**
+     * Authorization URL
+     * @default 'https://open.weixin.qq.com/connect/qrconnect'
+     */
+    authorizationURL?: string;
+    /**
+     * Access token URL
+     * @default 'https://api.weixin.qq.com/sns/oauth2/access_token'
+     */
+    tokenURL?: string;
+    /**
+     * User profile URL
+     * @default 'https://api.weixin.qq.com/sns/userinfo'
+     */
+    userURL?: string;
+    /**
+     * User info language.
+     * @default 'zh_CN'
+     */
+    lang?: 'zh_CN' | 'zh_TW' | 'en';
+    /**
+     * Redirect URL to allow overriding when public hostname cannot be inferred.
+     * @default process.env.NUXT_OAUTH_WECHAT_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export interface WechatOAuthTokens {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    openid: string;
+    scope: string;
+    unionid?: string;
+}
+export interface WechatOAuthUser {
+    openid: string;
+    nickname: string;
+    sex: 0 | 1 | 2;
+    province: string;
+    city: string;
+    country: string;
+    headimgurl: string;
+    privilege: string[];
+    unionid?: string;
+}
+export declare function defineOAuthWechatEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthWechatConfig, {
+    user: WechatOAuthUser;
+    tokens: WechatOAuthTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;