nuxt-auth-utils 0.5.33 → 0.6.0

package/dist/runtime/server/utils/session.js

@@ -1,7 +1,7 @@
-import { useSession, createError, isEvent } from "h3";
+import { createError, defineEventHandler, useRuntimeConfig, useSession } from "nuxt/server";
 import { defu } from "defu";
 import { createHooks } from "hookable";
-import { useRuntimeConfig } from "#imports";
+export const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
 export const sessionHooks = createHooks();
 export async function getUserSession(event) {
   const session = await _useSession(event);
@@ -11,53 +11,96 @@ export async function getUserSession(event) {
   };
 }
 export async function setUserSession(event, data, config) {
-  const session = await _useSession(event, config);
-  await session.update(defu(data, session.data));
+  const session = await _useSession(event, config, true);
+  await session.update(defu(toJSONData(data), session.data));
   return session.data;
 }
 export async function replaceUserSession(event, data, config) {
-  const session = await _useSession(event, config);
-  await session.clear();
+  const session = await _useSession(event, config, true);
   await session.update((oldData) => {
     for (const key of Object.keys(oldData)) {
       Reflect.deleteProperty(oldData, key);
     }
-    return data;
+    return toJSONData(data);
   });
   return session.data;
 }
 export async function clearUserSession(event, config) {
-  const session = await _useSession(event, config);
-  await sessionHooks.callHookParallel("clear", session.data, event);
+  const session = await _useSession(event, config, true);
+  await sessionHooks.callHookParallel("clear", session.data, toSessionEvent(event).event);
   await session.clear();
   return true;
 }
 export async function requireUserSession(event, opts = {}) {
   const userSession = await getUserSession(event);
   if (!userSession.user) {
-    if (isEvent(event)) {
-      throw createError({
-        statusCode: opts.statusCode || 401,
-        message: opts.message || "Unauthorized"
-      });
-    } else {
-      throw new Response(opts.message || "Unauthorized", {
-        status: opts.statusCode || 401
-      });
+    const status = opts.status || opts.statusCode || 401;
+    const message = opts.message || "Unauthorized";
+    if (toSessionEvent(event).webSocket) {
+      throw new Response(message, { status });
     }
+    throw createError({ status, message });
   }
   return userSession;
 }
-let sessionConfig;
-function _useSession(event, config = {}) {
-  if (!sessionConfig) {
-    const runtimeConfig = useRuntimeConfig(isEvent(event) ? event : void 0);
-    const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
-    sessionConfig = defu({ password: process.env[envSessionPassword] }, runtimeConfig.session);
-    if (!sessionConfig.password) {
-      console.error(`[nuxt-auth-utils] ${envSessionPassword} environment variable or runtimeConfig.session.password was not set.`);
-    }
+async function _useSession(event, config = {}, write = false) {
+  const { event: sessionEvent, webSocket } = toSessionEvent(event);
+  if (write && webSocket) {
+    throw createError({
+      status: 500,
+      message: "[nuxt-auth-utils] The user session is read-only in WebSocket handlers: `setUserSession`, `replaceUserSession` and `clearUserSession` need the event of an HTTP request."
+    });
+  }
+  const runtimeConfig = useRuntimeConfig();
+  warnLegacySessionPassword(runtimeConfig);
+  const { password: _password, ...finalConfig } = defu(config, runtimeConfig.session, { name: USER_SESSION_COOKIE_NAME });
+  if (finalConfig.name === APP_SESSION_COOKIE_NAME) {
+    warnAppSessionName();
+    finalConfig.name = USER_SESSION_COOKIE_NAME;
+  }
+  return useSession(sessionEvent, finalConfig);
+}
+function toJSONData(data) {
+  return JSON.parse(JSON.stringify(data));
+}
+const APP_SESSION_COOKIE_NAME = "nuxt-session";
+let warnedAppSessionName = false;
+function warnAppSessionName() {
+  if (warnedAppSessionName) return;
+  warnedAppSessionName = true;
+  console.warn(`[nuxt-auth-utils] The session name \`${APP_SESSION_COOKIE_NAME}\` is the cookie of \`useSession()\` from \`nuxt/server\`, using \`${USER_SESSION_COOKIE_NAME}\` instead. Set another \`runtimeConfig.session.name\` (\`NUXT_SESSION_NAME\`) to rename the user session cookie.`);
+}
+const toPortableEvent = defineEventHandler((event) => event);
+function toSessionEvent(event) {
+  const input = event;
+  if (input["~portable"] === true || typeof input.res?.headers?.append === "function") {
+    return { event: input, webSocket: false };
+  }
+  if (input.node?.req) {
+    return { event: toPortableEvent(input), webSocket: false };
+  }
+  const headers = input.request?.headers || input.headers;
+  if (headers && typeof headers.get === "function") {
+    return {
+      event: {
+        req: { headers },
+        res: { status: 200, statusText: "", headers: new Headers() }
+      },
+      webSocket: true
+    };
+  }
+  throw createError({
+    status: 500,
+    message: "[nuxt-auth-utils] The session utils need a request event, a WebSocket peer or a WebSocket upgrade request."
+  });
+}
+let checkedLegacySessionPassword = false;
+function warnLegacySessionPassword(runtimeConfig) {
+  if (checkedLegacySessionPassword) return;
+  checkedLegacySessionPassword = true;
+  const envPrefix = runtimeConfig.nitro?.envPrefix || "NUXT_";
+  const envKey = `${envPrefix}SESSION_PASSWORD`;
+  if (globalThis.process?.env?.[envKey] || runtimeConfig.session?.password) {
+    console.warn(`[nuxt-auth-utils] \`${envKey}\` (\`runtimeConfig.session.password\`) is not used anymore. Set \`NUXT_APP_SECRET\` instead, for example with \`openssl rand -base64 32\`. Sessions are now sealed with a secret derived from \`appSecret\`.`);
   }
-  const finalConfig = defu(config, sessionConfig);
-  return useSession(event, finalConfig);
 }

package/dist/runtime/types/event.d.ts

@@ -1,4 +1,28 @@
-import type { H3Event } from 'h3';
-import type { RequestEvent } from '@nuxt/schema';
+import type { RequestEvent } from 'nuxt/server';
+import type { IncomingMessage, ServerResponse } from 'node:http';
 export type { RequestEvent };
-export type SessionEvent = H3Event | RequestEvent;
+/**
+ * The h3 v1 event a handler defined with `defineEventHandler` from `h3` (or its auto-import) receives on Nuxt 4.
+ * @deprecated Use `defineEventHandler` from `nuxt/server`. Removed with Nuxt 5 support.
+ */
+export interface LegacyH3Event {
+    node: {
+        req: IncomingMessage;
+        res: ServerResponse;
+    };
+}
+/**
+ * A WebSocket peer or upgrade request, from `defineWebSocketHandler`.
+ * The session is read-only: changes are not sent back to the client.
+ */
+export type WebSocketSessionEvent = {
+    request: {
+        headers: Headers;
+    };
+} | {
+    headers: Headers;
+};
+/**
+ * Any event the session utils accept.
+ */
+export type SessionEvent = RequestEvent | LegacyH3Event | WebSocketSessionEvent;

package/dist/runtime/types/index.d.ts

@@ -1,4 +1,4 @@
 export type { User, UserSession, UserSessionRequired, UserSessionComposable, SecureSessionData } from './session.js';
-export type { RequestEvent, SessionEvent } from './event.js';
+export type { RequestEvent, SessionEvent, LegacyH3Event, WebSocketSessionEvent } from './event.js';
 export type { OAuthConfig, OAuthProvider, ATProtoProvider, OnError } from './oauth-config.js';
 export type { WebAuthnCredential, WebAuthnRegisterEventHandlerOptions, WebAuthnAuthenticateEventHandlerOptions, WebAuthnComposable, WebAuthnUser, } from './webauthn.js';

package/dist/runtime/types/oauth-config.d.ts

@@ -1,12 +1,12 @@
-import type { H3Event, H3Error } from 'h3';
+import type { NuxtError, RequestEvent } from 'nuxt/server';
 export type ATProtoProvider = 'bluesky';
-export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cloudflare' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'mastodon' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'wechat' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | (string & {});
-export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
+export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cloudflare' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'mastodon' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'wechat' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | 'zendesk' | (string & {});
+export type OnError = (event: RequestEvent, error: NuxtError) => unknown;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;
     tokens: any;
 }> {
     config?: TConfig;
-    onSuccess: (event: H3Event, result: TResult) => Promise<void> | void;
+    onSuccess: (event: RequestEvent, result: TResult) => unknown;
     onError?: OnError;
 }

package/dist/runtime/types/webauthn.d.ts

@@ -1,7 +1,6 @@
-import type { AuthenticationResponseJSON, AuthenticatorTransportFuture, RegistrationResponseJSON } from '@simplewebauthn/types';
 import type { Ref } from 'vue';
-import type { H3Event, H3Error, ValidateResult } from 'h3';
-import type { GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, VerifiedAuthenticationResponse, VerifiedRegistrationResponse } from '@simplewebauthn/server';
+import type { NuxtError, RequestEvent, ValidateResult } from 'nuxt/server';
+import type { AuthenticationResponseJSON, AuthenticatorTransportFuture, GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, RegistrationResponseJSON, VerifiedAuthenticationResponse, VerifiedRegistrationResponse } from '@simplewebauthn/server';
 export interface WebAuthnCredential {
     id: string;
     publicKey: string;
@@ -18,15 +17,15 @@ export interface WebAuthnUser {
 }
 type CredentialsList = NonNullable<GenerateAuthenticationOptionsOpts['allowCredentials']>;
 type WebAuthnEventHandlerBase<T extends Record<PropertyKey, unknown>> = {
-    storeChallenge: (event: H3Event, challenge: string, attemptId: string) => void | Promise<void>;
-    getChallenge: (event: H3Event, attemptId: string) => string | Promise<string>;
-    onSuccess: (event: H3Event, data: T) => void | Promise<void>;
-    onError?: (event: H3Event, error: H3Error) => void | Promise<void>;
+    storeChallenge: (event: RequestEvent, challenge: string, attemptId: string) => void | Promise<void>;
+    getChallenge: (event: RequestEvent, attemptId: string) => string | Promise<string>;
+    onSuccess: (event: RequestEvent, data: T) => unknown;
+    onError?: (event: RequestEvent, error: NuxtError) => unknown;
 } | {
     storeChallenge?: undefined;
     getChallenge?: undefined;
-    onSuccess: (event: H3Event, data: T) => void | Promise<void>;
-    onError?: (event: H3Event, error: H3Error) => void | Promise<void>;
+    onSuccess: (event: RequestEvent, data: T) => unknown;
+    onError?: (event: RequestEvent, error: NuxtError) => unknown;
 };
 export type RegistrationBody<T extends WebAuthnUser> = {
     user: T;
@@ -37,15 +36,15 @@ export type RegistrationBody<T extends WebAuthnUser> = {
     attemptId: string;
     response: RegistrationResponseJSON;
 };
-export type ValidateUserFunction<T> = (userBody: WebAuthnUser, event: H3Event) => ValidateResult<T> | Promise<ValidateResult<T>>;
+export type ValidateUserFunction<T> = (userBody: WebAuthnUser, event: RequestEvent) => ValidateResult<T> | Promise<ValidateResult<T>>;
 export type WebAuthnRegisterEventHandlerOptions<T extends WebAuthnUser> = WebAuthnEventHandlerBase<{
     user: T;
     credential: WebAuthnCredential;
     registrationInfo: Exclude<VerifiedRegistrationResponse['registrationInfo'], undefined>;
 }> & {
-    getOptions?: (event: H3Event, body: RegistrationBody<T>) => Partial<GenerateRegistrationOptionsOpts> | Promise<Partial<GenerateRegistrationOptionsOpts>>;
+    getOptions?: (event: RequestEvent, body: RegistrationBody<T>) => Partial<GenerateRegistrationOptionsOpts> | Promise<Partial<GenerateRegistrationOptionsOpts>>;
     validateUser?: ValidateUserFunction<T>;
-    excludeCredentials?: (event: H3Event, userName: string) => CredentialsList | Promise<CredentialsList>;
+    excludeCredentials?: (event: RequestEvent, userName: string) => CredentialsList | Promise<CredentialsList>;
 };
 export type AuthenticationBody = {
     verify: false;
@@ -60,9 +59,9 @@ export type WebAuthnAuthenticateEventHandlerOptions<T extends WebAuthnCredential
     credential: T;
     authenticationInfo: Exclude<VerifiedAuthenticationResponse['authenticationInfo'], undefined>;
 }> & {
-    getOptions?: (event: H3Event, body: AuthenticationBody) => Partial<GenerateAuthenticationOptionsOpts> | Promise<Partial<GenerateAuthenticationOptionsOpts>>;
-    getCredential: (event: H3Event, credentialID: string) => T | Promise<T>;
-    allowCredentials?: (event: H3Event, userName: string) => CredentialsList | Promise<CredentialsList>;
+    getOptions?: (event: RequestEvent, body: AuthenticationBody) => Partial<GenerateAuthenticationOptionsOpts> | Promise<Partial<GenerateAuthenticationOptionsOpts>>;
+    getCredential: (event: RequestEvent, credentialID: string) => T | Promise<T>;
+    allowCredentials?: (event: RequestEvent, userName: string) => CredentialsList | Promise<CredentialsList>;
 };
 export interface WebAuthnComposable {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.33",
+  "version": "0.6.0",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -25,25 +25,27 @@
   "files": [
     "dist"
   ],
+  "engines": {
+    "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
+  },
   "dependencies": {
     "@adonisjs/hash": "^9.1.1",
-    "@nuxt/kit": "^4.3.1",
+    "@nuxt/kit": "^4.6.0",
     "@nuxt/schema": "^4.6.0",
-    "defu": "^6.1.4",
-    "h3": "^1.15.4",
+    "defu": "^6.1.5",
     "hookable": "^6.0.1",
     "jose": "^6.1.3",
     "ofetch": "^1.5.1",
     "openid-client": "^6.8.2",
-    "pathe": "^2.0.3",
     "scule": "^1.3.0",
+    "ufo": "^1.6.4",
     "uncrypto": "^0.1.3"
   },
   "peerDependencies": {
     "@atproto/api": "^0.13.15",
     "@atproto/oauth-client-node": "^0.2.0",
-    "@simplewebauthn/browser": "^11.0.0",
-    "@simplewebauthn/server": "^11.0.0"
+    "@simplewebauthn/browser": "^13.0.0",
+    "@simplewebauthn/server": "^13.3.2"
   },
   "peerDependenciesMeta": {
     "@simplewebauthn/browser": {
@@ -61,12 +63,11 @@
   },
   "devDependencies": {
     "@iconify-json/simple-icons": "^1.2.71",
-    "@nuxt/devtools": "3.2.1",
+    "@nuxt/devtools": "3.4.4",
     "@nuxt/eslint-config": "^1.15.1",
     "@nuxt/module-builder": "^1.0.2",
     "@nuxt/test-utils": "^4.0.0",
     "@nuxt/ui": "^4.4.0",
-    "@simplewebauthn/types": "^12.0.0",
     "@types/node": "latest",
     "eslint": "^10.0.0",
     "nuxt": "^4.6.0",
@@ -78,6 +79,8 @@
     "dev": "nuxi dev playground",
     "dev:build": "nuxi build playground",
     "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground",
+    "dev:v5": "pnpm install:nuxt5 && nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground && nuxi dev playground",
+    "install:nuxt5": "pnpm install --config.pnpmfile=scripts/nuxt-nightly.cjs --config.lockfile=false --config.minimum-release-age-exclude=*-nightly",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "test": "vitest run",

package/dist/runtime/server/plugins/oauth.d.ts

@@ -1,2 +0,0 @@
-declare const _default: import("nitropack/types").NitroAppPlugin;
-export default _default;

package/dist/runtime/server/plugins/oauth.js

@@ -1,16 +0,0 @@
-import { defineNitroPlugin } from "nitropack/runtime";
-export default defineNitroPlugin((nitroApp) => {
-  if (process.env.NUXT_OAUTH_FACEBOOK_CLIENT_ID && process.env.NUXT_OAUTH_FACEBOOK_CLIENT_SECRET || process.env.NUXT_OAUTH_INSTAGRAM_CLIENT_ID && process.env.NUXT_OAUTH_INSTAGRAM_CLIENT_SECRET) {
-    nitroApp.hooks.hook("render:html", (html) => {
-      html.head.unshift(`
-      <script>
-        if (window.location.hash === "#_=_"){
-          history.replaceState
-              ? history.replaceState(null, null, window.location.href.split("#")[0])
-              : window.location.hash = "";
-        }
-      <\/script>
-    `);
-    });
-  }
-});

package/dist/runtime/server/plugins/ws.d.ts

@@ -1,2 +0,0 @@
-declare const _default: import("nitropack").NitroAppPlugin;
-export default _default;

package/dist/runtime/server/plugins/ws.js

@@ -1,7 +0,0 @@
-import { defineNitroPlugin } from "nitropack/runtime";
-import { getUserSession } from "../utils/session.js";
-export default defineNitroPlugin((nitroApp) => {
-  nitroApp.hooks.hook("request", async (event) => {
-    await getUserSession(event);
-  });
-});