nuxt-auth-utils 0.5.31 → 0.5.33

package/dist/runtime/server/lib/oauth/wechat.js

@@ -0,0 +1,107 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  getOAuthRedirectURL,
+  handleInvalidState,
+  handleMissingConfiguration,
+  handleState
+} from "../utils.js";
+import { createError, useRuntimeConfig } from "#imports";
+function isWechatOAuthError(value) {
+  return Boolean(
+    value && typeof value === "object" && "errcode" in value && "errmsg" in value
+  );
+}
+function handleWechatOAuthError(event, phase, oauthError, onError) {
+  const error = createError({
+    statusCode: 401,
+    message: `WeChat ${phase} request failed: ${oauthError.errmsg} (${oauthError.errcode})`,
+    data: oauthError
+  });
+  if (!onError) throw error;
+  return onError(event, error);
+}
+export function defineOAuthWechatEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.wechat, {
+      authorizationURL: "https://open.weixin.qq.com/connect/qrconnect",
+      tokenURL: "https://api.weixin.qq.com/sns/oauth2/access_token",
+      userURL: "https://api.weixin.qq.com/sns/userinfo",
+      lang: "zh_CN"
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `WeChat login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.appId || !config.appSecret) {
+      return handleMissingConfiguration(event, "wechat", ["appId", "appSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code && query.state) {
+      await handleState(event, { isCallback: true });
+      const error = createError({
+        statusCode: 401,
+        message: "WeChat login failed: authorization denied",
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope?.length ? config.scope : ["snsapi_login"];
+      return sendRedirect(
+        event,
+        `${withQuery(config.authorizationURL, {
+          appid: config.appId,
+          redirect_uri: redirectURL,
+          response_type: "code",
+          scope: config.scope.join(","),
+          state
+        })}#wechat_redirect`
+      );
+    }
+    if (!state || query.state !== state) {
+      return handleInvalidState(event, "wechat", onError);
+    }
+    const tokens = await $fetch(config.tokenURL, {
+      // WeChat answers JSON with a text/plain content type
+      responseType: "json",
+      query: {
+        appid: config.appId,
+        secret: config.appSecret,
+        code: query.code,
+        grant_type: "authorization_code"
+      }
+    }).catch((error) => ({ errcode: error?.response?.status ?? -1, errmsg: "token request failed" }));
+    if (isWechatOAuthError(tokens)) {
+      return handleWechatOAuthError(event, "token", tokens, onError);
+    }
+    const user = await $fetch(config.userURL, {
+      responseType: "json",
+      query: {
+        access_token: tokens.access_token,
+        openid: tokens.openid,
+        lang: config.lang
+      }
+    }).catch((error) => ({ errcode: error?.response?.status ?? -1, errmsg: "userinfo request failed" }));
+    if (isWechatOAuthError(user)) {
+      return handleWechatOAuthError(event, "userinfo", user, onError);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/workos.js

@@ -30,7 +30,7 @@ export function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "workos", onError);
     }
     const authenticateResponse = await requestAccessToken("https://api.workos.com/user_management/authenticate", {

package/dist/runtime/server/lib/oauth/x.js

@@ -50,7 +50,7 @@ export function defineOAuthXEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "x", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/xsuaa.js

@@ -27,7 +27,7 @@ export function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "xsuaa", onError);
     }
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/yandex.js

@@ -48,7 +48,7 @@ export function defineOAuthYandexEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "yandex", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/zitadel.js

@@ -43,7 +43,7 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "zitadel", onError);
     }
     const request = {

package/dist/runtime/server/lib/utils.d.ts

@@ -1,6 +1,7 @@
 import { type H3Event } from 'h3';
 import * as jose from 'jose';
 import type { OAuthProvider, OnError } from '#auth-utils';
+export declare const isDevelopment: boolean;
 export declare function getOAuthRedirectURL(event: H3Event): string;
 /**
  * Request an access token body.

package/dist/runtime/server/lib/utils.js

@@ -5,7 +5,7 @@ import { snakeCase, upperFirst } from "scule";
 import * as jose from "jose";
 import { subtle, getRandomValues } from "uncrypto";
 import { createError } from "#imports";
-const isDevelopment = process.env.NODE_ENV === "development";
+export const isDevelopment = process.env.NODE_ENV === "development";
 const OAUTH_COOKIE_MAX_AGE = 60 * 10;
 export function getOAuthRedirectURL(event) {
   const requestURL = getRequestURL(event);
@@ -24,14 +24,14 @@ export async function requestAccessToken(url, options) {
     headers,
     body
   }).catch((error) => {
-    if (error instanceof FetchError && error.status === 401) {
+    if (error instanceof FetchError && error.status && error.status >= 400 && error.status < 500 && error.data?.error) {
       return error.data;
     }
     throw error;
   });
 }
 export function handleAccessTokenErrorResponse(event, oauthProvider, oauthError, onError) {
-  const message = `${upperFirst(oauthProvider)} login failed: ${oauthError.error_description || oauthError.error || "Unknown error"}`;
+  const message = `${upperFirst(oauthProvider)} login failed: ${oauthError.error_description || oauthError.error?.message || oauthError.error || "Unknown error"}`;
   const error = createError({
     statusCode: 401,
     message,

package/dist/runtime/server/utils/session.js

@@ -18,7 +18,12 @@ export async function setUserSession(event, data, config) {
 export async function replaceUserSession(event, data, config) {
   const session = await _useSession(event, config);
   await session.clear();
-  await session.update(data);
+  await session.update((oldData) => {
+    for (const key of Object.keys(oldData)) {
+      Reflect.deleteProperty(oldData, key);
+    }
+    return data;
+  });
   return session.data;
 }
 export async function clearUserSession(event, config) {

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cloudflare' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'mastodon' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'wechat' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.31",
+  "version": "0.5.33",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,7 +8,6 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@10.29.3",
   "exports": {
     ".": {
       "types": "./dist/types.d.mts",
@@ -26,18 +25,6 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "prepack": "nuxt-module-build build",
-    "dev": "nuxi dev playground",
-    "dev:build": "nuxi build playground",
-    "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground",
-    "release": "npm run lint && npm run test && npm run prepack && changelogen --release && npm publish && git push --follow-tags",
-    "lint": "eslint .",
-    "lint:fix": "eslint . --fix",
-    "test": "vitest run",
-    "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit",
-    "test:watch": "vitest watch"
-  },
   "dependencies": {
     "@adonisjs/hash": "^9.1.1",
     "@nuxt/kit": "^4.3.1",
@@ -81,11 +68,20 @@
     "@nuxt/ui": "^4.4.0",
     "@simplewebauthn/types": "^12.0.0",
     "@types/node": "latest",
-    "changelogen": "^0.6.2",
     "eslint": "^10.0.0",
     "nuxt": "^4.6.0",
     "typescript": "5.9.3",
     "vitest": "^4.0.18",
     "vue-tsc": "^3.2.4"
+  },
+  "scripts": {
+    "dev": "nuxi dev playground",
+    "dev:build": "nuxi build playground",
+    "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "test": "vitest run",
+    "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit",
+    "test:watch": "vitest watch"
   }
-}
+}