nuxt-auth-utils 0.5.32 → 0.5.33

package/README.md

@@ -7,7 +7,7 @@
 
 Add Authentication to Nuxt applications with secured & sealed cookies sessions.
 
-- [Release Notes](/CHANGELOG.md)
+- [Release Notes](https://github.com/atinux/nuxt-auth-utils/releases)
 - [Demo with OAuth](https://github.com/atinux/atidone)
 - [Demo with Passkeys](https://github.com/atinux/todo-passkeys)
 <!-- - [🏀 Online playground](https://stackblitz.com/github/your-org/nuxt-auth-utils?file=playground%2Fapp.vue) -->
@@ -220,6 +220,7 @@ It can also be set using environment variables:
 - Battle.net
 - Bluesky (AT Protocol)
 - Box.com
+- Cloudflare
 - Discord
 - Dropbox
 - Facebook
@@ -236,6 +237,7 @@ It can also be set using environment variables:
 - Linear
 - LinkedIn
 - LiveChat
+- Mastodon
 - Microsoft
 - OIDC / OpenID Connect (Generic)
 - Okta
@@ -254,6 +256,7 @@ It can also be set using environment variables:
 - TikTok
 - Twitch
 - VK
+- WeChat
 - WorkOS
 - X (Twitter)
 - XSUAA
@@ -291,6 +294,34 @@ Make sure to set the callback URL in your OAuth app settings as `<your-domain>/a
 
 If the redirect URL mismatch in production, this means that the module cannot guess the right redirect URL. You can set the `NUXT_OAUTH_<PROVIDER>_REDIRECT_URL` env variable to overwrite the default one.
 
+#### Mastodon
+
+Mastodon does not have a single shared OAuth server: every account lives on its own instance (e.g. `mastodon.social`, `h4.io`), and there is no portable identity across instances the way there is with AT Protocol/Bluesky. Because of this, the provider needs to know which instance to talk to before it can start the flow, and it registers an application against that instance on first use via `POST /api/v1/apps` (Mastodon's own API, not the RFC 7591 Dynamic Client Registration spec it superficially resembles).
+
+```ts
+// server/routes/auth/mastodon.get.ts
+export default defineOAuthMastodonEventHandler({
+  async onSuccess(event, { user }) {
+    await setUserSession(event, {
+      user: {
+        mastodon: user.acct,
+      },
+    })
+    return sendRedirect(event, '/')
+  },
+})
+```
+
+The instance can be provided either as a static `instance` config/`NUXT_OAUTH_MASTODON_INSTANCE` env variable, or per-request as an `instance` query parameter, e.g. `/auth/mastodon?instance=mastodon.social`:
+
+```ts
+navigateTo({ path: '/auth/mastodon', query: { instance: 'mastodon.social' } }, { external: true })
+```
+
+A full handle (`@user@mastodon.social`) is also accepted and only the instance part is used, since that's all that is required to start the OAuth flow.
+
+Registered apps are cached in memory per instance and redirect URL for the lifetime of the server process, so it does not re-register on every login. The callback doesn't depend on this cache, so after a restart or on another worker, the next login only registers a new application.
+
 ### Password Hashing
 
 Nuxt Auth Utils provides password hashing utilities like `hashPassword` and `verifyPassword` to hash and verify passwords by using [scrypt](https://en.wikipedia.org/wiki/Scrypt) as it is supported in many JS runtime.
@@ -778,6 +809,27 @@ await setUserSession(event, { ... } , {
 
 Checkout the [`SessionConfig`](https://github.com/unjs/h3/blob/c04c458810e34eb15c1647e1369e7d7ef19f567d/src/utils/session.ts#L20) for all options.
 
+## Shared session between microservices and subdomains
+
+To share a session between multiple applications, use the same `NUXT_SESSION_PASSWORD` and session `name` in each of them.
+
+If the applications run on different subdomains, also set the session cookie `domain` to the parent domain in each `nuxt.config.ts`:
+
+```ts
+export default defineNuxtConfig({
+  modules: ['nuxt-auth-utils'],
+  runtimeConfig: {
+    session: {
+      cookie: {
+        domain: '.example.com'
+      }
+    }
+  }
+})
+```
+
+The browser then sends the session cookie to every subdomain of `example.com`, and each application can decrypt it.
+
 ## More
 
 - [nuxt-authorization](https://github.com/barbapapazes/nuxt-authorization): Authorization module for managing permissions inside a Nuxt app, compatible with `nuxt-auth-utils`
@@ -803,11 +855,10 @@ pnpm run lint
 # Run Vitest
 pnpm run test
 pnpm run test:watch
-
-# Release new version
-pnpm run release
 ```
 
+Releases are automated with [uppt](https://github.com/danielroe/uppt): every push to `main` opens or updates a draft release PR from conventional commits. Merging it tags the version, creates the GitHub release and stages the npm publish, which is then approved on npmjs.com.
+
 <!-- Badges -->
 [npm-version-src]: https://img.shields.io/npm/v/nuxt-auth-utils/latest.svg?style=flat&colorA=020420&colorB=00DC82
 [npm-version-href]: https://npmjs.com/package/nuxt-auth-utils

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.32",
+  "version": "0.5.33",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -191,6 +191,11 @@ const module$1 = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.cloudflare = defu(runtimeConfig.oauth.cloudflare, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
     for (const provider of atprotoProviders) {
       runtimeConfig.oauth[provider] = defu(runtimeConfig.oauth[provider], atprotoProviderDefaultClientMetadata);
     }
@@ -235,6 +240,11 @@ const module$1 = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.mastodon = defu(runtimeConfig.oauth.mastodon, {
+      instance: "",
+      clientName: "",
+      redirectURL: ""
+    });
     runtimeConfig.oauth.cognito = defu(runtimeConfig.oauth.cognito, {
       clientId: "",
       clientSecret: "",
@@ -245,7 +255,8 @@ const module$1 = defineNuxtModule({
     runtimeConfig.oauth.facebook = defu(runtimeConfig.oauth.facebook, {
       clientId: "",
       clientSecret: "",
-      redirectURL: ""
+      redirectURL: "",
+      apiVersion: "v25.0"
     });
     runtimeConfig.oauth.instagram = defu(runtimeConfig.oauth.instagram, {
       clientId: "",
@@ -329,6 +340,12 @@ const module$1 = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.wechat = defu(runtimeConfig.oauth.wechat, {
+      appId: "",
+      appSecret: "",
+      redirectURL: "",
+      scope: []
+    });
     runtimeConfig.oauth.atlassian = defu(runtimeConfig.oauth.atlassian, {
       clientId: "",
       clientSecret: "",
@@ -355,6 +372,7 @@ const module$1 = defineNuxtModule({
       clientSecret: "",
       redirectURL: "",
       baseURL: "",
+      userURL: "",
       scope: ""
     });
     runtimeConfig.oauth.slack = defu(runtimeConfig.oauth.slack, {

package/dist/runtime/app/composables/session.js

@@ -4,8 +4,9 @@ export function useUserSession() {
   const serverEvent = import.meta.server ? useRequestEvent() : null;
   const sessionState = useState("nuxt-session", () => null);
   const authReadyState = useState("nuxt-auth-ready", () => false);
+  const requestFetch = useRequestFetch();
   const clear = async () => {
-    await useRequestFetch()("/api/_auth/session", {
+    await requestFetch("/api/_auth/session", {
       method: "DELETE",
       onResponse({ response: { headers } }) {
         if (import.meta.server && serverEvent) {
@@ -18,7 +19,7 @@ export function useUserSession() {
     sessionState.value = null;
   };
   const fetch = async () => {
-    sessionState.value = await useRequestFetch()("/api/_auth/session", {
+    sessionState.value = await requestFetch("/api/_auth/session", {
       headers: {
         accept: "application/json"
       },
@@ -35,7 +36,11 @@ export function useUserSession() {
     }
   };
   const openInPopup = (route, size = {}) => {
-    localStorage.setItem("temp-nuxt-auth-utils-popup", "true");
+    try {
+      localStorage.setItem("temp-nuxt-auth-utils-popup", "true");
+    } catch (error) {
+      console.error("[nuxt-auth-utils] Could not use localStorage during popup flow initialization.", error);
+    }
     const width = size.width ?? 960;
     const height = size.height ?? 600;
     const top = (window.top?.outerHeight ?? 0) / 2 + (window.top?.screenY ?? 0) - height / 2;

package/dist/runtime/app/plugins/session.client.js

@@ -7,9 +7,13 @@ export default defineNuxtPlugin(async (nuxtApp) => {
       await useUserSession().fetch();
     });
   }
-  if (localStorage.getItem("temp-nuxt-auth-utils-popup")) {
-    localStorage.removeItem("temp-nuxt-auth-utils-popup");
-    const error = useError();
-    if (!error.value) window.close();
+  try {
+    if (localStorage.getItem("temp-nuxt-auth-utils-popup")) {
+      localStorage.removeItem("temp-nuxt-auth-utils-popup");
+      const error = useError();
+      if (!error.value) window.close();
+    }
+  } catch (error) {
+    console.error("[nuxt-auth-utils] Could not use localStorage during popup flow last step. Popup won't be closed automatically.", error);
   }
 });

package/dist/runtime/server/api/session.delete.d.ts

@@ -1,2 +1,4 @@
-declare const _default: any;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    loggedOut: boolean;
+}>>;
 export default _default;

package/dist/runtime/server/api/session.get.d.ts

@@ -1,2 +1,2 @@
-declare const _default: any;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<UserSession>>;
 export default _default;

package/dist/runtime/server/lib/atproto/bluesky.d.ts

@@ -22,7 +22,7 @@ type BlueSkyTokens = NodeSavedSession['tokenSet'];
 export declare function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBlueskyConfig, {
     user: BlueSkyUser;
     tokens: BlueSkyTokens;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export declare class StateStore implements NodeSavedStateStore {
     private event;
     private readonly stateKey;

package/dist/runtime/server/lib/oauth/apple.d.ts

@@ -74,4 +74,4 @@ export declare function defineOAuthAppleEventHandler({ config, onSuccess, onErro
     user: OAuthAppleUser;
     payload: OAuthAppleTokens;
     tokens: any;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/apple.js

@@ -71,6 +71,9 @@ export function defineOAuthAppleEventHandler({
           redirect_uri: config.redirectURL
         }
       });
+      if (accessTokenResult.error) {
+        return handleAccessTokenErrorResponse(event, "apple", accessTokenResult, onError);
+      }
       const payload = await verifyJwt(accessTokenResult.id_token, {
         publicJwkUrl: "https://appleid.apple.com/auth/keys",
         audience: config.clientId,

package/dist/runtime/server/lib/oauth/atlassian.d.ts

@@ -91,5 +91,5 @@ export interface OAuthAtlassianConfig {
 export declare function defineOAuthAtlassianEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthAtlassianConfig, {
     user: AtlassianUser;
     tokens: AtlassianTokens;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export {};

package/dist/runtime/server/lib/oauth/auth0.d.ts

@@ -57,4 +57,4 @@ export interface OAuthAuth0Config {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthAuth0EventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuth0Config>): any;
+export declare function defineOAuthAuth0EventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuth0Config>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/authentik.d.ts

@@ -27,4 +27,4 @@ export interface OAuthAuthentikConfig {
      */
     scope?: string[];
 }
-export declare function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuthentikConfig>): any;
+export declare function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuthentikConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/azureb2c.d.ts

@@ -51,4 +51,4 @@ export interface OAuthAzureB2CConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthAzureB2CEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAzureB2CConfig>): any;
+export declare function defineOAuthAzureB2CEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAzureB2CConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/battledotnet.d.ts

@@ -45,4 +45,4 @@ export interface OAuthBattledotnetConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBattledotnetConfig>): any;
+export declare function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBattledotnetConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/box.d.ts

@@ -91,5 +91,5 @@ interface OAuthBoxTokens {
 export declare function defineOAuthBoxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBoxConfig, {
     user: OAuthBoxUser;
     tokens: OAuthBoxTokens;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export {};

package/dist/runtime/server/lib/oauth/cloudflare.d.ts

@@ -0,0 +1,86 @@
+import type { OAuthConfig } from '#auth-utils';
+/**
+ * Cloudflare OAuth provider — Authorization Code flow (the only flow Cloudflare supports).
+ *
+ * References:
+ * - Endpoints:  https://developers.cloudflare.com/fundamentals/oauth/integrate-with-cloudflare/
+ * - Flow/PKCE:  https://developers.cloudflare.com/fundamentals/oauth/create-an-oauth-client/#supported-oauth-flows
+ * - Scopes:     https://developers.cloudflare.com/fundamentals/oauth/create-an-oauth-client/#select-scopes
+ *
+ * Scopes are dot-notation API-permission names (e.g. `workers-platform.read`) fetched from
+ * `GET /client/v4/oauth/scopes` — `openid` is NOT a Cloudflare scope. PKCE (S256) is required
+ * for public clients (auth method `none`) and optional for confidential clients (client secret).
+ */
+export interface OAuthCloudflareConfig {
+    /**
+     * Cloudflare OAuth Client ID
+     * @default process.env.NUXT_OAUTH_CLOUDFLARE_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Cloudflare OAuth Client Secret. Required for confidential clients
+     * (`client_secret_post`/`client_secret_basic`); omit for public PKCE-only
+     * clients (`token_endpoint_auth_method=none`).
+     * @default process.env.NUXT_OAUTH_CLOUDFLARE_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Cloudflare OAuth scopes — dot-notation API token permission IDs from
+     * `GET /client/v4/oauth/scopes`, matching the scopes the client was registered with.
+     * Cloudflare requires at least one; there is no default (`openid` is not a Cloudflare scope).
+     * @see https://developers.cloudflare.com/fundamentals/oauth/create-an-oauth-client/#select-scopes
+     * @example ['workers-platform.read']
+     */
+    scope?: string[];
+    /**
+     * Cloudflare OAuth Authorization URL
+     * @default 'https://dash.cloudflare.com/oauth2/auth'
+     */
+    authorizationURL?: string;
+    /**
+     * Cloudflare OAuth Token URL
+     * @default 'https://dash.cloudflare.com/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Cloudflare OIDC userinfo URL. Returns standard claims (`sub`, `iss`, `aud`, …);
+     * use `GET /client/v4/user` for email/name.
+     * @default 'https://dash.cloudflare.com/oauth2/userinfo'
+     */
+    userURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_CLOUDFLARE_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+/**
+ * Claims returned by Cloudflare's `/oauth2/userinfo` endpoint. `sub` is the stable
+ * Cloudflare user ID; the rest are standard OIDC token claims. There is no email/name
+ * here — for richer profile data call `GET /client/v4/user` with the access token.
+ */
+export interface CloudflareUser {
+    /** Stable Cloudflare user ID. */
+    sub: string;
+    aud?: string[];
+    iss?: string;
+    iat?: number;
+    auth_time?: number;
+    rat?: number;
+}
+export interface CloudflareTokens {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    /** Present when scope includes `offline_access` */
+    refresh_token?: string;
+    scope: string;
+}
+export declare function defineOAuthCloudflareEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthCloudflareConfig, {
+    user: CloudflareUser;
+    tokens: CloudflareTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/cloudflare.js

@@ -0,0 +1,72 @@
+import { eventHandler, getQuery, sendRedirect, createError } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthCloudflareEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.cloudflare, {
+      authorizationURL: "https://dash.cloudflare.com/oauth2/auth",
+      tokenURL: "https://dash.cloudflare.com/oauth2/token",
+      userURL: "https://dash.cloudflare.com/oauth2/userinfo",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Cloudflare login failed: ${query.error_description || query.error}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId) {
+      return handleMissingConfiguration(event, "cloudflare", ["clientId"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    const pkce = await handlePkceVerifier(event);
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope?.length ? config.scope.join(" ") : void 0,
+          ...config.authorizationParams,
+          code_challenge: pkce.code_challenge,
+          code_challenge_method: pkce.code_challenge_method,
+          state
+        })
+      );
+    }
+    if (!state || query.state !== state) {
+      return handleInvalidState(event, "cloudflare", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        // Public (PKCE-only) clients authenticate with `none` and send no secret.
+        ...config.clientSecret ? { client_secret: config.clientSecret } : {},
+        redirect_uri: redirectURL,
+        code: query.code,
+        code_verifier: pkce.code_verifier
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "cloudflare", tokens, onError);
+    }
+    const user = await $fetch(config.userURL, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/cognito.d.ts

@@ -36,4 +36,4 @@ export interface OAuthCognitoConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthCognitoEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthCognitoConfig>): any;
+export declare function defineOAuthCognitoEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthCognitoConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/discord.d.ts

@@ -50,4 +50,4 @@ export interface OAuthDiscordConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthDiscordEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDiscordConfig>): any;
+export declare function defineOAuthDiscordEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDiscordConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/dropbox.d.ts

@@ -44,4 +44,4 @@ export interface OAuthDropboxConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthDropboxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDropboxConfig>): any;
+export declare function defineOAuthDropboxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthDropboxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/facebook.d.ts

@@ -10,6 +10,12 @@ export interface OAuthFacebookConfig {
      * @default process.env.NUXT_OAUTH_FACEBOOK_CLIENT_SECRET
      */
     clientSecret?: string;
+    /**
+     * Facebook Graph API version used for default OAuth and /me URLs
+     * @default 'v25.0'
+     * @see https://developers.facebook.com/docs/graph-api/changelog/versions/
+     */
+    apiVersion?: string;
     /**
      * Facebook OAuth Scope
      * @default []
@@ -26,14 +32,19 @@ export interface OAuthFacebookConfig {
     fields?: string[];
     /**
      * Facebook OAuth Authorization URL
-     * @default 'https://www.facebook.com/v19.0/dialog/oauth'
+     * @default 'https://www.facebook.com/${apiVersion}/dialog/oauth'
      */
     authorizationURL?: string;
     /**
      * Facebook OAuth Token URL
-     * @default 'https://graph.facebook.com/v19.0/oauth/access_token'
+     * @default 'https://graph.facebook.com/${apiVersion}/oauth/access_token'
      */
     tokenURL?: string;
+    /**
+     * Facebook Graph API user profile URL
+     * @default 'https://graph.facebook.com/${apiVersion}/me'
+     */
+    userURL?: string;
     /**
      * Extra authorization parameters to provide to the authorization URL
      * @see https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/
@@ -45,4 +56,4 @@ export interface OAuthFacebookConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthFacebookEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthFacebookConfig>): any;
+export declare function defineOAuthFacebookEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthFacebookConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/facebook.js

@@ -1,6 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
+import { subtle } from "uncrypto";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthFacebookEventHandler({
@@ -9,9 +10,12 @@ export function defineOAuthFacebookEventHandler({
   onError
 }) {
   return eventHandler(async (event) => {
+    const apiVersion = config?.apiVersion || useRuntimeConfig(event).oauth?.facebook?.apiVersion || "v25.0";
     config = defu(config, useRuntimeConfig(event).oauth?.facebook, {
-      authorizationURL: "https://www.facebook.com/v19.0/dialog/oauth",
-      tokenURL: "https://graph.facebook.com/v19.0/oauth/access_token",
+      apiVersion,
+      authorizationURL: `https://www.facebook.com/${apiVersion}/dialog/oauth`,
+      tokenURL: `https://graph.facebook.com/${apiVersion}/oauth/access_token`,
+      userURL: `https://graph.facebook.com/${apiVersion}/me`,
       authorizationParams: {}
     });
     const query = getQuery(event);
@@ -60,8 +64,16 @@ export function defineOAuthFacebookEventHandler({
     const accessToken = tokens.access_token;
     config.fields = [...new Set(config.fields || ["id", "name"])];
     const fields = config.fields.join(",");
+    const encoder = new TextEncoder();
+    const key = await subtle.importKey("raw", encoder.encode(config.clientSecret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await subtle.sign("HMAC", key, encoder.encode(accessToken));
+    const appsecretProof = Array.from(new Uint8Array(signature), (b) => b.toString(16).padStart(2, "0")).join("");
     const user = await $fetch(
-      `https://graph.facebook.com/v19.0/me?fields=${fields}&access_token=${accessToken}`
+      withQuery(config.userURL, {
+        fields,
+        access_token: accessToken,
+        appsecret_proof: appsecretProof
+      })
     );
     if (!user) {
       const error = createError({

package/dist/runtime/server/lib/oauth/gitea.d.ts

@@ -48,4 +48,4 @@ export interface OAuthGiteaConfig {
      */
     baseURL?: string;
 }
-export declare function defineOAuthGiteaEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGiteaConfig>): any;
+export declare function defineOAuthGiteaEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGiteaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/github.d.ts

@@ -93,5 +93,5 @@ interface GitHubTokens {
 export declare function defineOAuthGitHubEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthGitHubConfig, {
     user: GitHubUser;
     tokens: GitHubTokens;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export {};

package/dist/runtime/server/lib/oauth/gitlab.d.ts

@@ -49,4 +49,4 @@ export interface OAuthGitLabConfig {
      */
     baseURL?: string;
 }
-export declare function defineOAuthGitLabEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGitLabConfig>): any;
+export declare function defineOAuthGitLabEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGitLabConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/google.d.ts

@@ -44,4 +44,4 @@ export interface OAuthGoogleConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthGoogleEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGoogleConfig>): any;
+export declare function defineOAuthGoogleEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthGoogleConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/heroku.d.ts

@@ -38,4 +38,4 @@ export interface OAuthHerokuConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthHerokuEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthHerokuConfig>): any;
+export declare function defineOAuthHerokuEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthHerokuConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/hubspot.d.ts

@@ -23,4 +23,4 @@ export interface OAuthHubspotConfig {
      */
     scope?: string[];
 }
-export declare function defineOAuthHubspotEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthHubspotConfig>): any;
+export declare function defineOAuthHubspotEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthHubspotConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/instagram.d.ts

@@ -45,4 +45,4 @@ export interface OAuthInstagramConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthInstagramEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthInstagramConfig>): any;
+export declare function defineOAuthInstagramEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthInstagramConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/keycloak.d.ts

@@ -45,4 +45,4 @@ export interface OAuthKeycloakConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthKeycloakEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthKeycloakConfig>): any;
+export declare function defineOAuthKeycloakEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthKeycloakConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/kick.d.ts

@@ -51,5 +51,5 @@ interface KickTokens {
 export declare function defineOAuthKickEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthKickConfig, {
     user: KickUser;
     tokens: KickTokens;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export {};