nuxt-auth-utils 0.5.32 → 0.5.34

package/dist/runtime/server/lib/oauth/wechat.d.ts

@@ -0,0 +1,67 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthWechatConfig {
+    /**
+     * WeChat App ID
+     * @default process.env.NUXT_OAUTH_WECHAT_APP_ID
+     */
+    appId?: string;
+    /**
+     * WeChat App Secret
+     * @default process.env.NUXT_OAUTH_WECHAT_APP_SECRET
+     */
+    appSecret?: string;
+    /**
+     * WeChat OAuth Scope
+     * @default ['snsapi_login']
+     * @see https://developers.weixin.qq.com/doc/oplatform/Website_App/WeChat_Login/Wechat_Login.html
+     */
+    scope?: string[];
+    /**
+     * Authorization URL
+     * @default 'https://open.weixin.qq.com/connect/qrconnect'
+     */
+    authorizationURL?: string;
+    /**
+     * Access token URL
+     * @default 'https://api.weixin.qq.com/sns/oauth2/access_token'
+     */
+    tokenURL?: string;
+    /**
+     * User profile URL
+     * @default 'https://api.weixin.qq.com/sns/userinfo'
+     */
+    userURL?: string;
+    /**
+     * User info language.
+     * @default 'zh_CN'
+     */
+    lang?: 'zh_CN' | 'zh_TW' | 'en';
+    /**
+     * Redirect URL to allow overriding when public hostname cannot be inferred.
+     * @default process.env.NUXT_OAUTH_WECHAT_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export interface WechatOAuthTokens {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    openid: string;
+    scope: string;
+    unionid?: string;
+}
+export interface WechatOAuthUser {
+    openid: string;
+    nickname: string;
+    sex: 0 | 1 | 2;
+    province: string;
+    city: string;
+    country: string;
+    headimgurl: string;
+    privilege: string[];
+    unionid?: string;
+}
+export declare function defineOAuthWechatEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthWechatConfig, {
+    user: WechatOAuthUser;
+    tokens: WechatOAuthTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/wechat.js

@@ -0,0 +1,107 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  getOAuthRedirectURL,
+  handleInvalidState,
+  handleMissingConfiguration,
+  handleState
+} from "../utils.js";
+import { createError, useRuntimeConfig } from "#imports";
+function isWechatOAuthError(value) {
+  return Boolean(
+    value && typeof value === "object" && "errcode" in value && "errmsg" in value
+  );
+}
+function handleWechatOAuthError(event, phase, oauthError, onError) {
+  const error = createError({
+    statusCode: 401,
+    message: `WeChat ${phase} request failed: ${oauthError.errmsg} (${oauthError.errcode})`,
+    data: oauthError
+  });
+  if (!onError) throw error;
+  return onError(event, error);
+}
+export function defineOAuthWechatEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.wechat, {
+      authorizationURL: "https://open.weixin.qq.com/connect/qrconnect",
+      tokenURL: "https://api.weixin.qq.com/sns/oauth2/access_token",
+      userURL: "https://api.weixin.qq.com/sns/userinfo",
+      lang: "zh_CN"
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `WeChat login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.appId || !config.appSecret) {
+      return handleMissingConfiguration(event, "wechat", ["appId", "appSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code && query.state) {
+      await handleState(event, { isCallback: true });
+      const error = createError({
+        statusCode: 401,
+        message: "WeChat login failed: authorization denied",
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    const state = await handleState(event);
+    if (!query.code) {
+      config.scope = config.scope?.length ? config.scope : ["snsapi_login"];
+      return sendRedirect(
+        event,
+        `${withQuery(config.authorizationURL, {
+          appid: config.appId,
+          redirect_uri: redirectURL,
+          response_type: "code",
+          scope: config.scope.join(","),
+          state
+        })}#wechat_redirect`
+      );
+    }
+    if (!state || query.state !== state) {
+      return handleInvalidState(event, "wechat", onError);
+    }
+    const tokens = await $fetch(config.tokenURL, {
+      // WeChat answers JSON with a text/plain content type
+      responseType: "json",
+      query: {
+        appid: config.appId,
+        secret: config.appSecret,
+        code: query.code,
+        grant_type: "authorization_code"
+      }
+    }).catch((error) => ({ errcode: error?.response?.status ?? -1, errmsg: "token request failed" }));
+    if (isWechatOAuthError(tokens)) {
+      return handleWechatOAuthError(event, "token", tokens, onError);
+    }
+    const user = await $fetch(config.userURL, {
+      responseType: "json",
+      query: {
+        access_token: tokens.access_token,
+        openid: tokens.openid,
+        lang: config.lang
+      }
+    }).catch((error) => ({ errcode: error?.response?.status ?? -1, errmsg: "userinfo request failed" }));
+    if (isWechatOAuthError(user)) {
+      return handleWechatOAuthError(event, "userinfo", user, onError);
+    }
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/workos.d.ts

@@ -63,4 +63,4 @@ export interface OAuthWorkOSTokens {
 export declare function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthWorkOSConfig, {
     user: OAuthWorkOSUser;
     tokens: OAuthWorkOSTokens;
-}>): any;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/x.d.ts

@@ -43,4 +43,4 @@ export interface OAuthXConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthXEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthXConfig>): any;
+export declare function defineOAuthXEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthXConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/xsuaa.d.ts

@@ -28,4 +28,4 @@ export interface OAuthXSUAAConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthXSUAAConfig>): any;
+export declare function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthXSUAAConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/yandex.d.ts

@@ -43,4 +43,4 @@ export interface OAuthYandexConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthYandexEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthYandexConfig>): any;
+export declare function defineOAuthYandexEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthYandexConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/zendesk.d.ts

@@ -0,0 +1,110 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthZendeskConfig {
+    /**
+     * Zendesk OAuth Client ID
+     * @default process.env.NUXT_OAUTH_ZENDESK_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Zendesk OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_ZENDESK_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Zendesk subdomain, for example `mycompany` for `mycompany.zendesk.com`
+     * @default process.env.NUXT_OAUTH_ZENDESK_SUBDOMAIN
+     */
+    subdomain?: string;
+    /**
+     * Zendesk OAuth Scope
+     * @default ['read']
+     * @see https://support.zendesk.com/hc/en-us/articles/4408845965210-Using-OAuth-authentication-with-your-application
+     * @example ['read', 'write']
+     */
+    scope?: string[];
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_ZENDESK_REDIRECT_URL
+     */
+    redirectURL?: string;
+    /**
+     * Zendesk Marketplace name header value.
+     * Only required for apps published in the Zendesk Marketplace.
+     * @default process.env.NUXT_OAUTH_ZENDESK_MARKETPLACE_NAME
+     */
+    marketplaceName?: string;
+    /**
+     * Zendesk Marketplace organization ID header value.
+     * Only required for apps published in the Zendesk Marketplace.
+     * @default process.env.NUXT_OAUTH_ZENDESK_MARKETPLACE_ORG_ID
+     */
+    marketplaceOrgId?: string;
+    /**
+     * Zendesk Marketplace bot ID header value.
+     * Only required for marketplace bot integrations.
+     * @default process.env.NUXT_OAUTH_ZENDESK_MARKETPLACE_BOT_ID
+     */
+    marketplaceBotId?: string;
+    /**
+     * Zendesk Marketplace app ID header value.
+     * Only required for apps published in the Zendesk Marketplace.
+     * @default process.env.NUXT_OAUTH_ZENDESK_MARKETPLACE_APP_ID
+     */
+    marketplaceAppId?: string;
+}
+export interface ZendeskUser {
+    id: number;
+    url: string;
+    name: string;
+    email: string;
+    created_at: string;
+    updated_at: string;
+    time_zone: string | null;
+    iana_time_zone: string | null;
+    phone: string | null;
+    shared_phone_number: boolean | null;
+    photo: {
+        url: string | null;
+        content_url: string | null;
+    } | null;
+    locale_id: number;
+    locale: string;
+    organization_id: number | null;
+    role: string;
+    verified: boolean;
+    external_id: string | null;
+    tags: string[];
+    alias: string | null;
+    active: boolean;
+    shared: boolean;
+    shared_agent: boolean;
+    last_login_at: string | null;
+    two_factor_auth_enabled: boolean;
+    signature: string | null;
+    details: string | null;
+    notes: string | null;
+    role_type: number | null;
+    custom_role_id: number | null;
+    is_billing_admin: boolean;
+    moderator: boolean;
+    ticket_restriction: string | null;
+    only_private_comments: boolean;
+    restricted_agent: boolean;
+    suspended: boolean;
+    default_group_id: number | null;
+    report_csv: boolean;
+    user_fields: Record<string, unknown>;
+    suspension_details: unknown | null;
+}
+export interface ZendeskTokens {
+    access_token: string;
+    refresh_token?: string;
+    token_type: string;
+    scope: string;
+    expires_in?: number;
+    refresh_token_expires_in?: number;
+}
+export declare function defineOAuthZendeskEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthZendeskConfig, {
+    user: ZendeskUser;
+    tokens: ZendeskTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/zendesk.js

@@ -0,0 +1,109 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  handleMissingConfiguration,
+  handleAccessTokenErrorResponse,
+  getOAuthRedirectURL,
+  handleInvalidState,
+  handleState,
+  requestAccessToken
+} from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+function getMarketplaceHeaders(config) {
+  const headers = {};
+  if (config.marketplaceName) {
+    headers["X-Zendesk-Marketplace-Name"] = config.marketplaceName;
+  }
+  if (config.marketplaceOrgId) {
+    headers["X-Zendesk-Marketplace-Organization-Id"] = config.marketplaceOrgId;
+  }
+  if (config.marketplaceBotId) {
+    headers["X-Zendesk-Marketplace-Bot-Id"] = config.marketplaceBotId;
+  }
+  if (config.marketplaceAppId) {
+    headers["X-Zendesk-Marketplace-App-Id"] = config.marketplaceAppId;
+  }
+  return headers;
+}
+export function defineOAuthZendeskEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    const runtimeConfig = useRuntimeConfig(event).oauth?.zendesk;
+    config = defu(config, runtimeConfig);
+    config.scope = config.scope?.length ? config.scope : ["read"];
+    if (!config.scope.includes("read") && !config.scope.includes("users:read")) {
+      config.scope.push("users:read");
+    }
+    if (!config.clientId || !config.clientSecret || !config.subdomain) {
+      return handleMissingConfiguration(
+        event,
+        "zendesk",
+        ["clientId", "clientSecret", "subdomain"],
+        onError
+      );
+    }
+    const baseURL = `https://${config.subdomain}.zendesk.com`;
+    const query = getQuery(event);
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (query.error) {
+      return handleAccessTokenErrorResponse(
+        event,
+        "zendesk",
+        {
+          error: query.error,
+          error_description: query.error_description
+        },
+        onError
+      );
+    }
+    const state = await handleState(event);
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery(`${baseURL}/oauth/authorizations/new`, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(" "),
+          state
+        })
+      );
+    }
+    if (!state || query.state !== state) {
+      return handleInvalidState(event, "zendesk", onError);
+    }
+    const marketplaceHeaders = getMarketplaceHeaders(config);
+    const tokens = await requestAccessToken(`${baseURL}/oauth/tokens`, {
+      headers: {
+        // Zendesk documents JSON bodies for the token endpoint
+        "Content-Type": "application/json",
+        ...marketplaceHeaders
+      },
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code,
+        scope: config.scope.join(" ")
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "zendesk", tokens, onError);
+    }
+    const data = await $fetch(`${baseURL}/api/v2/users/me.json`, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`,
+        ...marketplaceHeaders
+      }
+    });
+    return onSuccess(event, {
+      user: data.user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/zitadel.d.ts

@@ -34,4 +34,4 @@ export interface OAuthZitadelConfig {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthZitadelEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthZitadelConfig>): any;
+export declare function defineOAuthZitadelEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthZitadelConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/utils.d.ts

@@ -1,6 +1,7 @@
 import { type H3Event } from 'h3';
 import * as jose from 'jose';
 import type { OAuthProvider, OnError } from '#auth-utils';
+export declare const isDevelopment: boolean;
 export declare function getOAuthRedirectURL(event: H3Event): string;
 /**
  * Request an access token body.
@@ -66,7 +67,7 @@ export declare function handlePkceVerifier(event: H3Event): Promise<{
     code_challenge: string;
     code_challenge_method: string;
 } | {
-    code_verifier: any;
+    code_verifier: string | undefined;
     code_challenge?: undefined;
     code_challenge_method?: undefined;
 }>;
@@ -74,7 +75,7 @@ interface HandleStateOptions {
     isCallback?: boolean;
     sameSite?: 'lax' | 'none' | 'strict';
 }
-export declare function handleState(event: H3Event, options?: HandleStateOptions): Promise<any>;
+export declare function handleState(event: H3Event, options?: HandleStateOptions): Promise<string | undefined>;
 export declare function parseJwt(token: string): jose.JWTPayload;
-export declare function handleNonce(event: H3Event): any;
+export declare function handleNonce(event: H3Event): string | undefined;
 export {};

package/dist/runtime/server/lib/utils.js

@@ -5,7 +5,7 @@ import { snakeCase, upperFirst } from "scule";
 import * as jose from "jose";
 import { subtle, getRandomValues } from "uncrypto";
 import { createError } from "#imports";
-const isDevelopment = process.env.NODE_ENV === "development";
+export const isDevelopment = process.env.NODE_ENV === "development";
 const OAUTH_COOKIE_MAX_AGE = 60 * 10;
 export function getOAuthRedirectURL(event) {
   const requestURL = getRequestURL(event);
@@ -24,14 +24,14 @@ export async function requestAccessToken(url, options) {
     headers,
     body
   }).catch((error) => {
-    if (error instanceof FetchError && error.status === 401) {
+    if (error instanceof FetchError && error.status && error.status >= 400 && error.status < 500 && error.data?.error) {
       return error.data;
     }
     throw error;
   });
 }
 export function handleAccessTokenErrorResponse(event, oauthProvider, oauthError, onError) {
-  const message = `${upperFirst(oauthProvider)} login failed: ${oauthError.error_description || oauthError.error || "Unknown error"}`;
+  const message = `${upperFirst(oauthProvider)} login failed: ${oauthError.error_description || oauthError.error?.message || oauthError.error || "Unknown error"}`;
   const error = createError({
     statusCode: 401,
     message,

package/dist/runtime/server/routes/atproto/client-metadata.json.get.d.ts

@@ -1,2 +1,129 @@
-declare const _default: any;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, {
+    redirect_uris: [string, ...string[]];
+    scope?: string | undefined;
+    response_types?: ["code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token", ...("code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token")[]] | undefined;
+    grant_types?: ["authorization_code" | "implicit" | "refresh_token" | "password" | "client_credentials" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer", ...("authorization_code" | "implicit" | "refresh_token" | "password" | "client_credentials" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[]] | undefined;
+    token_endpoint_auth_method?: "client_secret_basic" | "client_secret_jwt" | "client_secret_post" | "none" | "private_key_jwt" | "self_signed_tls_client_auth" | "tls_client_auth" | undefined;
+    token_endpoint_auth_signing_alg?: string | undefined;
+    userinfo_signed_response_alg?: string | undefined;
+    userinfo_encrypted_response_alg?: string | undefined;
+    jwks_uri?: string | undefined;
+    jwks?: {
+        keys: ({
+            kty: "RSA";
+            n: string;
+            e: string;
+            alg?: "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            d?: string | undefined;
+            p?: string | undefined;
+            q?: string | undefined;
+            dp?: string | undefined;
+            dq?: string | undefined;
+            qi?: string | undefined;
+            oth?: [{
+                d?: string | undefined;
+                r?: string | undefined;
+                t?: string | undefined;
+            }, ...{
+                d?: string | undefined;
+                r?: string | undefined;
+                t?: string | undefined;
+            }[]] | undefined;
+        } | {
+            kty: "EC";
+            crv: "P-256" | "P-384" | "P-521";
+            x: string;
+            y: string;
+            alg?: "ES256" | "ES384" | "ES512" | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            d?: string | undefined;
+        } | {
+            kty: "EC";
+            crv: "secp256k1";
+            x: string;
+            y: string;
+            alg?: "ES256K" | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            d?: string | undefined;
+        } | {
+            kty: "OKP";
+            crv: "Ed25519" | "Ed448";
+            x: string;
+            alg?: "EdDSA" | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            d?: string | undefined;
+        } | {
+            kty: "oct";
+            k: string;
+            alg?: "HS256" | "HS384" | "HS512" | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+        } | {
+            kty: string;
+            alg?: string | undefined;
+            kid?: string | undefined;
+            ext?: boolean | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+        })[];
+    } | undefined;
+    application_type?: "web" | "native" | undefined;
+    subject_type?: "public" | "pairwise" | undefined;
+    request_object_signing_alg?: string | undefined;
+    id_token_signed_response_alg?: string | undefined;
+    authorization_signed_response_alg?: string | undefined;
+    authorization_encrypted_response_enc?: "A128CBC-HS256" | undefined;
+    authorization_encrypted_response_alg?: string | undefined;
+    client_id?: string | undefined;
+    client_name?: string | undefined;
+    client_uri?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    default_max_age?: number | undefined;
+    require_auth_time?: boolean | undefined;
+    contacts?: string[] | undefined;
+    tls_client_certificate_bound_access_tokens?: boolean | undefined;
+    dpop_bound_access_tokens?: boolean | undefined;
+    authorization_details_types?: string[] | undefined;
+}>;
 export default _default;

package/dist/runtime/server/utils/session.js

@@ -18,7 +18,12 @@ export async function setUserSession(event, data, config) {
 export async function replaceUserSession(event, data, config) {
   const session = await _useSession(event, config);
   await session.clear();
-  await session.update(data);
+  await session.update((oldData) => {
+    for (const key of Object.keys(oldData)) {
+      Reflect.deleteProperty(oldData, key);
+    }
+    return data;
+  });
   return session.data;
 }
 export async function clearUserSession(event, config) {

package/dist/runtime/types/oauth-config.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event, H3Error } from 'h3';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | (string & {});
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cloudflare' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'mastodon' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'wechat' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | 'zendesk' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;

package/dist/runtime/types/webauthn.d.ts

@@ -1,7 +1,9 @@
-import type { AuthenticationResponseJSON, AuthenticatorTransportFuture, RegistrationResponseJSON } from '@simplewebauthn/types';
 import type { Ref } from 'vue';
 import type { H3Event, H3Error, ValidateResult } from 'h3';
-import type { GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, VerifiedAuthenticationResponse, VerifiedRegistrationResponse } from '@simplewebauthn/server';
+import type { GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, VerifiedAuthenticationResponse, VerifiedRegistrationResponse, verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
+type RegistrationResponseJSON = Parameters<typeof verifyRegistrationResponse>[0]['response'];
+type AuthenticationResponseJSON = Parameters<typeof verifyAuthenticationResponse>[0]['response'];
+type AuthenticatorTransportFuture = NonNullable<Parameters<typeof verifyAuthenticationResponse>[0]['credential']['transports']>[number];
 export interface WebAuthnCredential {
     id: string;
     publicKey: string;