nuxt-auth-utils 0.5.32 → 0.5.33

package/dist/runtime/server/lib/oauth/line.d.ts

@@ -42,4 +42,4 @@ export interface OAuthLineConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthLineEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthLineConfig>): any;
+export declare function defineOAuthLineEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthLineConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/linear.d.ts

@@ -38,4 +38,4 @@ export interface OAuthLinearConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthLinearEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinearConfig>): any;
+export declare function defineOAuthLinearEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinearConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/linkedin.d.ts

@@ -42,4 +42,4 @@ export interface OAuthLinkedInConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthLinkedInEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinkedInConfig>): any;
+export declare function defineOAuthLinkedInEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthLinkedInConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/livechat.d.ts

@@ -70,4 +70,4 @@ export interface LiveChatConfig {
      */
     authorizationParams?: Record<string, string>;
 }
-export declare function defineOAuthLiveChatEventHandler({ config, onSuccess, onError, }: OAuthConfig<LiveChatConfig>): any;
+export declare function defineOAuthLiveChatEventHandler({ config, onSuccess, onError, }: OAuthConfig<LiveChatConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/mastodon.d.ts

@@ -0,0 +1,62 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthMastodonConfig {
+    /**
+     * The instance domain to authenticate against, e.g. `mastodon.social`.
+     *
+     * Unlike most OAuth providers, a Mastodon account lives on a single instance and there is no
+     * shared authorization server, so the instance must be known before the flow can start. If not
+     * set here, it can be provided at runtime as an `instance` query parameter on the initial request
+     * (e.g. `/auth/mastodon?instance=mastodon.social`). A full handle such as `@user@mastodon.social`
+     * or `user@mastodon.social` is also accepted, only the domain part is used.
+     * @default process.env.NUXT_OAUTH_MASTODON_INSTANCE
+     * @example 'mastodon.social'
+     */
+    instance?: string;
+    /**
+     * The name of the application shown to users on the instance's authorization screen.
+     *
+     * Mastodon has no concept of a pre-registered, shared client id: an application must be
+     * registered against every instance it authenticates users on (`POST /api/v1/apps`). This is
+     * that application's display name.
+     * @default 'Nuxt Auth Utils'
+     */
+    clientName?: string;
+    /**
+     * Mastodon OAuth Scope.
+     * @default ['read']
+     * @see https://docs.joinmastodon.org/api/oauth-scopes/
+     * @example ['read', 'read:accounts']
+     */
+    scope?: string[];
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_MASTODON_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export interface OAuthMastodonUser {
+    id: string;
+    username: string;
+    /**
+     * Always the full `user@instance` handle here, even for the authenticated user's own account.
+     * Mastodon's API normally only qualifies `acct` with `@instance` for remote accounts and returns
+     * the bare username for your own, we normalize it since an account only means something together
+     * with the instance it lives on.
+     */
+    acct: string;
+    display_name: string;
+    url: string;
+    avatar: string;
+    [key: string]: unknown;
+}
+interface MastodonTokens {
+    access_token: string;
+    token_type: string;
+    scope: string;
+    created_at: number;
+}
+export declare function defineOAuthMastodonEventHandler<TUser = OAuthMastodonUser>({ config: userConfig, onSuccess, onError }: OAuthConfig<OAuthMastodonConfig, {
+    user: TUser;
+    tokens: MastodonTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/mastodon.js

@@ -0,0 +1,178 @@
+import { createError, deleteCookie, eventHandler, getCookie, getQuery, sendRedirect, setCookie } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { $fetch } from "ofetch";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleState, isDevelopment, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+const FLOW_COOKIE_NAME = "nuxt-auth-mastodon-flow";
+const appRegistry = /* @__PURE__ */ new Map();
+const pendingRegistrations = /* @__PURE__ */ new Map();
+const MAX_REGISTERED_INSTANCES = 1e3;
+function appRegistryKey(instance, redirectURL) {
+  return `${instance}::${redirectURL}`;
+}
+function resolveInstanceDomain(input) {
+  const withoutProtocol = input.replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+  const withoutLeadingAt = withoutProtocol.replace(/^@/, "");
+  const domain = withoutLeadingAt.includes("@") ? withoutLeadingAt.split("@").pop() : withoutLeadingAt;
+  try {
+    return new URL(`https://${domain}`).hostname;
+  } catch {
+    return domain;
+  }
+}
+function isPubliclyAddressableInstance(instance) {
+  if (!instance || /\s/.test(instance) || instance.endsWith(".")) return false;
+  try {
+    if (new URL(`https://${instance}`).hostname !== instance) return false;
+  } catch {
+    return false;
+  }
+  if (instance === "localhost" || instance.endsWith(".localhost") || instance.endsWith(".local")) return false;
+  if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(instance)) return false;
+  if (instance.includes(":")) return false;
+  return true;
+}
+async function registerApp(instance, redirectURL, scope, clientName) {
+  const app = await $fetch(`https://${instance}/api/v1/apps`, {
+    method: "POST",
+    body: {
+      client_name: clientName,
+      redirect_uris: redirectURL,
+      scopes: scope
+    }
+  });
+  return { client_id: app.client_id, client_secret: app.client_secret };
+}
+async function getOrRegisterApp(instance, redirectURL, scope, clientName) {
+  const key = appRegistryKey(instance, redirectURL);
+  const cached = appRegistry.get(key);
+  if (cached) return cached;
+  const pending = pendingRegistrations.get(key);
+  if (pending) return pending;
+  const registration = registerApp(instance, redirectURL, scope, clientName).then((app) => {
+    if (appRegistry.size >= MAX_REGISTERED_INSTANCES && !appRegistry.has(key)) {
+      const oldestKey = appRegistry.keys().next().value;
+      if (oldestKey) appRegistry.delete(oldestKey);
+    }
+    appRegistry.set(key, app);
+    return app;
+  }).finally(() => {
+    pendingRegistrations.delete(key);
+  });
+  pendingRegistrations.set(key, registration);
+  return registration;
+}
+export function defineOAuthMastodonEventHandler({ config: userConfig, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    const config = defu({}, userConfig, useRuntimeConfig(event).oauth?.mastodon, {
+      clientName: "Nuxt Auth Utils"
+    });
+    config.scope ||= ["read"];
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Mastodon login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    const scope = (config.scope || ["read"]).join(" ");
+    if (!query.code) {
+      const rawInstance = query.instance?.toString() || config.instance;
+      if (!rawInstance) {
+        const error = createError({
+          statusCode: 400,
+          message: "Mastodon login failed: missing instance. Provide it via the `instance` query parameter (e.g. `/auth/mastodon?instance=mastodon.social`), a full handle (`@user@mastodon.social`), or the `instance` config/`NUXT_OAUTH_MASTODON_INSTANCE` env variable."
+        });
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+      const instance2 = resolveInstanceDomain(rawInstance);
+      if (!isPubliclyAddressableInstance(instance2)) {
+        const error = createError({
+          statusCode: 400,
+          message: `Mastodon login failed: "${instance2}" is not a valid instance domain.`
+        });
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+      let app;
+      try {
+        app = await getOrRegisterApp(instance2, redirectURL, scope, config.clientName || "Nuxt Auth Utils");
+      } catch {
+        const error = createError({
+          statusCode: 500,
+          message: `Mastodon login failed: could not register the application with instance "${instance2}". Make sure it is a reachable Mastodon (or compatible) server.`
+        });
+        if (!onError) throw error;
+        return onError(event, error);
+      }
+      const flowState2 = { instance: instance2, clientId: app.client_id, clientSecret: app.client_secret };
+      setCookie(event, FLOW_COOKIE_NAME, btoa(JSON.stringify(flowState2)), {
+        httpOnly: true,
+        secure: !isDevelopment,
+        sameSite: "lax",
+        maxAge: 60 * 10,
+        path: "/"
+      });
+      return sendRedirect(event, withQuery(`https://${instance2}/oauth/authorize`, {
+        client_id: app.client_id,
+        redirect_uri: redirectURL,
+        response_type: "code",
+        scope,
+        state
+      }));
+    }
+    if (!state || query.state !== state) {
+      return handleInvalidState(event, "mastodon", onError);
+    }
+    const flowCookie = getCookie(event, FLOW_COOKIE_NAME);
+    deleteCookie(event, FLOW_COOKIE_NAME, { path: "/" });
+    let flowState;
+    try {
+      flowState = flowCookie ? JSON.parse(atob(flowCookie)) : void 0;
+    } catch {
+      flowState = void 0;
+    }
+    if (!flowState || !isPubliclyAddressableInstance(flowState.instance)) {
+      const error = createError({
+        statusCode: 400,
+        message: "Mastodon login failed: could not recover the application credentials for this login (missing or invalid flow cookie, the flow may have taken too long or cookies are blocked)."
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const { instance, clientId, clientSecret } = flowState;
+    const tokens = await requestAccessToken(`https://${instance}/oauth/token`, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code,
+        scope
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "mastodon", tokens, onError);
+    }
+    const account = await $fetch(`https://${instance}/api/v1/accounts/verify_credentials`, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`
+      }
+    });
+    const user = {
+      ...account,
+      acct: account.acct.includes("@") ? account.acct : `${account.acct}@${instance}`
+    };
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/microsoft.d.ts

@@ -51,4 +51,4 @@ export interface OAuthMicrosoftConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthMicrosoftConfig>): any;
+export declare function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthMicrosoftConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/oidc.d.ts

@@ -211,5 +211,5 @@ interface OIDCConfiguration {
 export declare function defineOAuthOidcEventHandler<TUser = OidcUser>({ config, onSuccess, onError }: OAuthConfig<OAuthOidcConfig, {
     user: TUser;
     tokens: OidcTokens;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export {};

package/dist/runtime/server/lib/oauth/oidc.js

@@ -5,9 +5,7 @@ import { withQuery } from "ufo";
 import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken, handleNonce, parseJwt } from "../utils.js";
 export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
-    config = defu(config, useRuntimeConfig(event).oauth.oidc, {
-      scope: ["openid"]
-    });
+    config = defu(config, useRuntimeConfig(event).oauth.oidc);
     const query = getQuery(event);
     if (query.error) {
       const error = createError({
@@ -28,6 +26,9 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
     const nonce = handleNonce(event);
     if (!query.code) {
       config.scope = config.scope || [];
+      if (!config.scope.includes("openid")) {
+        config.scope.push("openid");
+      }
       const authQuery = {
         client_id: config.clientId,
         redirect_uri: redirectURL,

package/dist/runtime/server/lib/oauth/okta.d.ts

@@ -85,4 +85,4 @@ export interface OAuthOktaConfig {
      */
     openIdConfigCacheTTL?: number;
 }
-export declare function defineOAuthOktaEventHandler({ config, onSuccess, onError }: OAuthConfigExt<OAuthOktaConfig>): any;
+export declare function defineOAuthOktaEventHandler({ config, onSuccess, onError }: OAuthConfigExt<OAuthOktaConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/ory.d.ts

@@ -48,4 +48,4 @@ export interface OAuthOryConfig {
      */
     userURL?: string;
 }
-export declare function defineOAuthOryEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOryConfig>): any;
+export declare function defineOAuthOryEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOryConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/osu.d.ts

@@ -39,4 +39,4 @@ export interface OAuthOsuConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthOsuEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOsuConfig>): any;
+export declare function defineOAuthOsuEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthOsuConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/paypal.d.ts

@@ -49,4 +49,4 @@ export interface OAuthPaypalConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthPaypalEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPaypalConfig>): any;
+export declare function defineOAuthPaypalEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPaypalConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/polar.d.ts

@@ -46,4 +46,4 @@ export interface OAuthPolarConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthPolarEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPolarConfig>): any;
+export declare function defineOAuthPolarEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthPolarConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/riotgames.d.ts

@@ -70,5 +70,5 @@ interface RiotGamesTokens {
 export declare function defineOAuthRiotGamesEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRiotGamesConfig, {
     user: RiotGamesUser;
     tokens: RiotGamesTokens;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export {};

package/dist/runtime/server/lib/oauth/roblox.d.ts

@@ -123,4 +123,4 @@ export interface OAuthRobloxUser {
         visibility: 'SOCIAL_NETWORK_VISIBILITY_UNSPECIFIED' | 'NO_ONE' | 'FRIENDS' | 'FRIENDS_AND_FOLLOWING' | 'FRIENDS_FOLLOWING_AND_FOLLOWERS' | 'EVERYONE';
     };
 }
-export declare function defineOAuthRobloxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRobloxConfig>): any;
+export declare function defineOAuthRobloxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthRobloxConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/salesforce.d.ts

@@ -24,14 +24,19 @@ export interface OAuthSalesforceConfig {
     baseURL?: string;
     /**
      * Salesforce OAuth Authorization URL
-     * @default 'https://login.salesforce.com/services/oauth2/authorize'
+     * @default '${baseURL}/services/oauth2/authorize'
      */
     authorizationURL?: string;
     /**
-     * Salesforce OAuth Authorization URL
-     * @default 'https://login.salesforce.com/services/oauth2/token'
+     * Salesforce OAuth Token URL
+     * @default '${baseURL}/services/oauth2/token'
      */
     tokenURL?: string;
+    /**
+     * Salesforce OAuth User URL
+     * @default '${baseURL}/services/oauth2/userinfo'
+     */
+    userURL?: string;
     /**
      * Extra authorization parameters to provide to the authorization URL
      * @default {}
@@ -43,4 +48,4 @@ export interface OAuthSalesforceConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSalesforceEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSalesforceConfig>): any;
+export declare function defineOAuthSalesforceEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSalesforceConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/salesforce.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState, handlePkceVerifier } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthSalesforceEventHandler({
   config,
@@ -10,7 +10,7 @@ export function defineOAuthSalesforceEventHandler({
 }) {
   return eventHandler(async (event) => {
     const runtimeConfig = useRuntimeConfig(event).oauth?.salesforce;
-    const baseURL = config?.baseURL || "https://login.salesforce.com";
+    const baseURL = config?.baseURL || runtimeConfig?.baseURL || "https://login.salesforce.com";
     config = defu(config, runtimeConfig, {
       authorizationURL: `${baseURL}/services/oauth2/authorize`,
       tokenURL: `${baseURL}/services/oauth2/token`,
@@ -30,6 +30,7 @@ export function defineOAuthSalesforceEventHandler({
       return handleMissingConfiguration(event, "salesforce", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const pkce = await handlePkceVerifier(event);
     const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["id"];
@@ -41,6 +42,8 @@ export function defineOAuthSalesforceEventHandler({
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           ...config.authorizationParams,
+          code_challenge: pkce.code_challenge,
+          code_challenge_method: pkce.code_challenge_method,
           state
         })
       );
@@ -54,14 +57,15 @@ export function defineOAuthSalesforceEventHandler({
         client_id: config.clientId,
         client_secret: config.clientSecret,
         redirect_uri: redirectURL,
-        code: query.code
+        code: query.code,
+        code_verifier: pkce.code_verifier
       }
     });
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "salesforce", tokens, onError);
     }
     const accessToken = tokens.access_token;
-    const user = await $fetch(`${baseURL}/services/oauth2/userinfo`, {
+    const user = await $fetch(config.userURL || `${baseURL}/services/oauth2/userinfo`, {
       headers: {
         Authorization: `Bearer ${accessToken}`
       }

package/dist/runtime/server/lib/oauth/seznam.d.ts

@@ -95,4 +95,4 @@ export interface OAuthSeznamUser {
 export declare function defineOAuthSeznamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSeznamConfig, {
     user: OAuthSeznamUser;
     tokens: unknown;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/shopifyCustomer.d.ts

@@ -23,4 +23,4 @@ export interface OAuthShopifyCustomerConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthShopifyCustomerEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthShopifyCustomerConfig>): any;
+export declare function defineOAuthShopifyCustomerEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthShopifyCustomerConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/shopifyCustomer.js

@@ -12,7 +12,7 @@ export function defineOAuthShopifyCustomerEventHandler({
     config = defu(config, useRuntimeConfig(event).oauth?.shopifyCustomer, {});
     const query = getQuery(event);
     if (!config.clientId || !config.shopDomain) {
-      return handleMissingConfiguration(event, "spotify", ["clientId", "shopDomain"], onError);
+      return handleMissingConfiguration(event, "shopifyCustomer", ["clientId", "shopDomain"], onError);
     }
     const verifier = await handlePkceVerifier(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);

package/dist/runtime/server/lib/oauth/slack.d.ts

@@ -38,4 +38,4 @@ export interface OAuthSlackConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSlackEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSlackConfig>): any;
+export declare function defineOAuthSlackEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthSlackConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/spotify.d.ts

@@ -44,4 +44,4 @@ export interface OAuthSpotifyConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSpotifyConfig>): any;
+export declare function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSpotifyConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/steam.d.ts

@@ -17,4 +17,4 @@ export interface OAuthSteamConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthSteamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSteamConfig>): any;
+export declare function defineOAuthSteamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSteamConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/strava.d.ts

@@ -116,4 +116,4 @@ export interface OAuthStravaTokens {
 export declare function defineOAuthStravaEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthStravaConfig, {
     user: OAuthStravaUser;
     tokens: OAuthStravaTokens;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/tiktok.d.ts

@@ -42,4 +42,4 @@ export interface OAuthTikTokConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthTikTokEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTikTokConfig>): any;
+export declare function defineOAuthTikTokEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTikTokConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/twitch.d.ts

@@ -67,5 +67,5 @@ interface TwitchTokens {
 export declare function defineOAuthTwitchEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthTwitchConfig, {
     user: TwitchUser;
     tokens: TwitchTokens;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
 export {};

package/dist/runtime/server/lib/oauth/vk.d.ts

@@ -43,4 +43,4 @@ export interface OAuthVKConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthVKEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthVKConfig>): any;
+export declare function defineOAuthVKEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthVKConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/wechat.d.ts

@@ -0,0 +1,67 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthWechatConfig {
+    /**
+     * WeChat App ID
+     * @default process.env.NUXT_OAUTH_WECHAT_APP_ID
+     */
+    appId?: string;
+    /**
+     * WeChat App Secret
+     * @default process.env.NUXT_OAUTH_WECHAT_APP_SECRET
+     */
+    appSecret?: string;
+    /**
+     * WeChat OAuth Scope
+     * @default ['snsapi_login']
+     * @see https://developers.weixin.qq.com/doc/oplatform/Website_App/WeChat_Login/Wechat_Login.html
+     */
+    scope?: string[];
+    /**
+     * Authorization URL
+     * @default 'https://open.weixin.qq.com/connect/qrconnect'
+     */
+    authorizationURL?: string;
+    /**
+     * Access token URL
+     * @default 'https://api.weixin.qq.com/sns/oauth2/access_token'
+     */
+    tokenURL?: string;
+    /**
+     * User profile URL
+     * @default 'https://api.weixin.qq.com/sns/userinfo'
+     */
+    userURL?: string;
+    /**
+     * User info language.
+     * @default 'zh_CN'
+     */
+    lang?: 'zh_CN' | 'zh_TW' | 'en';
+    /**
+     * Redirect URL to allow overriding when public hostname cannot be inferred.
+     * @default process.env.NUXT_OAUTH_WECHAT_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export interface WechatOAuthTokens {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    openid: string;
+    scope: string;
+    unionid?: string;
+}
+export interface WechatOAuthUser {
+    openid: string;
+    nickname: string;
+    sex: 0 | 1 | 2;
+    province: string;
+    city: string;
+    country: string;
+    headimgurl: string;
+    privilege: string[];
+    unionid?: string;
+}
+export declare function defineOAuthWechatEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthWechatConfig, {
+    user: WechatOAuthUser;
+    tokens: WechatOAuthTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;