nuxt-auth-utils 0.5.34 → 0.6.0

package/dist/runtime/server/lib/webauthn/authenticate.d.ts

@@ -1,3 +1,3 @@
-import type { EventHandler } from 'h3';
+import type { EventHandler } from 'nuxt/server';
 import type { WebAuthnAuthenticateEventHandlerOptions, WebAuthnCredential } from '#auth-utils';
 export declare function defineWebAuthnAuthenticateEventHandler<T extends WebAuthnCredential>({ storeChallenge, getChallenge, getCredential, allowCredentials, getOptions, onSuccess, onError, }: WebAuthnAuthenticateEventHandlerOptions<T>): EventHandler;

package/dist/runtime/server/lib/webauthn/authenticate.js

@@ -1,9 +1,8 @@
-import { eventHandler, H3Error, createError, getRequestURL, readBody } from "h3";
+import { defineEventHandler, createError, getRequestURL, isNuxtError, readBody, useRuntimeConfig } from "nuxt/server";
 import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
 import defu from "defu";
 import { getRandomValues } from "uncrypto";
 import { base64URLStringToBuffer, bufferToBase64URLString } from "@simplewebauthn/browser";
-import { useRuntimeConfig } from "#imports";
 export function defineWebAuthnAuthenticateEventHandler({
   storeChallenge,
   getChallenge,
@@ -13,10 +12,10 @@ export function defineWebAuthnAuthenticateEventHandler({
   onSuccess,
   onError
 }) {
-  return eventHandler(async (event) => {
+  return defineEventHandler(async (event) => {
     const url = getRequestURL(event);
     const body = await readBody(event);
-    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig(event).webauthn.authenticate, {
+    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig().webauthn.authenticate, {
       rpID: url.hostname
     });
     if (!storeChallenge) {
@@ -38,7 +37,7 @@ export function defineWebAuthnAuthenticateEventHandler({
         };
       }
       if (!body.attemptId)
-        throw createError({ statusCode: 400 });
+        throw createError({ status: 400 });
       let expectedChallenge = "";
       if (getChallenge) {
         expectedChallenge = await getChallenge(event, body.attemptId);
@@ -59,7 +58,7 @@ export function defineWebAuthnAuthenticateEventHandler({
         }
       });
       if (!verification.verified)
-        throw createError({ statusCode: 400, message: "Failed to verify registration response" });
+        throw createError({ status: 400, message: "Failed to verify registration response" });
       await onSuccess(event, {
         credential,
         authenticationInfo: verification.authenticationInfo
@@ -67,9 +66,9 @@ export function defineWebAuthnAuthenticateEventHandler({
       return verification;
     } catch (error) {
       if (!onError) throw error;
-      if (error instanceof H3Error)
+      if (isNuxtError(error))
         return onError(event, error);
-      return onError(event, createError({ statusCode: 500, message: "Failed to authenticate credential" }));
+      return onError(event, createError({ status: 500, message: "Failed to authenticate credential" }));
     }
   });
 }

package/dist/runtime/server/lib/webauthn/register.d.ts

@@ -1,5 +1,5 @@
-import type { H3Event, EventHandler } from 'h3';
+import type { EventHandler, RequestEvent } from 'nuxt/server';
 import type { ValidateUserFunction } from '../../../types/webauthn.js';
 import type { WebAuthnUser, WebAuthnRegisterEventHandlerOptions } from '#auth-utils';
 export declare function defineWebAuthnRegisterEventHandler<T extends WebAuthnUser>({ storeChallenge, getChallenge, getOptions, validateUser, excludeCredentials, onSuccess, onError, }: WebAuthnRegisterEventHandlerOptions<T>): EventHandler;
-export declare function validateUserData<T>(userBody: WebAuthnUser, event: H3Event, fn: ValidateUserFunction<T>): Promise<T>;
+export declare function validateUserData<T>(userBody: WebAuthnUser, event: RequestEvent, fn: ValidateUserFunction<T>): Promise<T>;

package/dist/runtime/server/lib/webauthn/register.js

@@ -1,9 +1,8 @@
-import { eventHandler, H3Error, createError, getRequestURL, readBody } from "h3";
+import { defineEventHandler, createError, getRequestURL, isNuxtError, readBody, useRuntimeConfig } from "nuxt/server";
 import { generateRegistrationOptions, verifyRegistrationResponse } from "@simplewebauthn/server";
 import defu from "defu";
 import { bufferToBase64URLString } from "@simplewebauthn/browser";
 import { getRandomValues } from "uncrypto";
-import { useRuntimeConfig } from "#imports";
 export function defineWebAuthnRegisterEventHandler({
   storeChallenge,
   getChallenge,
@@ -13,19 +12,19 @@ export function defineWebAuthnRegisterEventHandler({
   onSuccess,
   onError
 }) {
-  return eventHandler(async (event) => {
+  return defineEventHandler(async (event) => {
     const url = getRequestURL(event);
     const body = await readBody(event);
     if (body.verify === void 0 || !body.user?.userName)
       throw createError({
         message: "Invalid request, missing userName or verify property",
-        statusCode: 400
+        status: 400
       });
     let user = body.user;
     if (validateUser) {
       user = await validateUserData(body.user, event, validateUser);
     }
-    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig(event).webauthn.register, {
+    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig().webauthn.register, {
       rpID: url.hostname,
       rpName: url.hostname,
       userName: user.userName,
@@ -55,7 +54,7 @@ export function defineWebAuthnRegisterEventHandler({
       if (!body.attemptId) {
         throw createError({
           message: "Invalid request, missing attemptId",
-          statusCode: 400
+          status: 400
         });
       }
       let expectedChallenge = "";
@@ -74,7 +73,7 @@ export function defineWebAuthnRegisterEventHandler({
       if (!verification.verified) {
         throw createError({
           message: "Failed to verify registration response",
-          statusCode: 400
+          status: 400
         });
       }
       await onSuccess(event, {
@@ -92,9 +91,9 @@ export function defineWebAuthnRegisterEventHandler({
       return verification;
     } catch (error) {
       if (!onError) throw error;
-      if (error instanceof H3Error)
+      if (isNuxtError(error))
         return onError(event, error);
-      return onError(event, createError({ statusCode: 500, message: "Failed to register credential" }));
+      return onError(event, createError({ status: 500, message: "Failed to register credential" }));
     }
   });
 }
@@ -114,7 +113,7 @@ export async function validateUserData(userBody, event, fn) {
 }
 function createUserValidationError(validateError) {
   throw createError({
-    status: validateError?.statusCode || 400,
+    status: validateError?.status || validateError?.statusCode || 400,
     message: validateError?.message || "User Validation Error",
     data: validateError
   });

package/dist/runtime/server/plugins/oauth-hash.d.ts

@@ -0,0 +1,2 @@
+declare const _default: () => void;
+export default _default;

package/dist/runtime/server/plugins/oauth-hash.js

@@ -0,0 +1,8 @@
+import { useRuntimeConfig, useServerHooks } from "nuxt/server";
+export default () => {
+  useServerHooks().hook("render:html", (html) => {
+    const oauth = useRuntimeConfig().oauth;
+    if (!oauth?.facebook?.clientId && !oauth?.instagram?.clientId) return;
+    html.head.unshift('<script>if(window.location.hash==="#_=_"){history.replaceState?history.replaceState(null,null,window.location.href.split("#")[0]):window.location.hash=""}<\/script>');
+  });
+};

package/dist/runtime/server/routes/atproto/client-metadata.json.get.d.ts

@@ -1,4 +1,4 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, {
+declare const _default: import("nuxt/server").EventHandler<{
     redirect_uris: [string, ...string[]];
     scope?: string | undefined;
     response_types?: ["code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token", ...("code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token")[]] | undefined;

package/dist/runtime/server/routes/atproto/client-metadata.json.get.js

@@ -1,10 +1,10 @@
-import { defineEventHandler, createError } from "h3";
+import { createError, defineEventHandler, getRequestURL, useRuntimeConfig } from "nuxt/server";
+import { withoutBase } from "ufo";
 import { getAtprotoClientMetadata } from "../../utils/atproto.js";
 import { atprotoProviders, getClientMetadataFilename } from "../../../utils/atproto.js";
-import { useRuntimeConfig } from "#imports";
 export default defineEventHandler((event) => {
-  const path = event.path.slice(1);
-  const runtimeConfig = useRuntimeConfig(event);
+  const runtimeConfig = useRuntimeConfig();
+  const path = withoutBase(getRequestURL(event).pathname, runtimeConfig.app.baseURL).slice(1);
   for (const provider of atprotoProviders) {
     const config = runtimeConfig.oauth[provider];
     if (getClientMetadataFilename(provider, config) === path) {
@@ -12,7 +12,7 @@ export default defineEventHandler((event) => {
     }
   }
   throw createError({
-    statusCode: 404,
+    status: 404,
     message: "Provider not found"
   });
 });

package/dist/runtime/server/utils/atproto.d.ts

@@ -1,5 +1,5 @@
-import type { H3Event } from 'h3';
+import type { RequestEvent } from 'nuxt/server';
 import type { OAuthClientMetadataInput } from '@atproto/oauth-client-node';
 import type { OAuthBlueskyConfig } from '../lib/atproto/bluesky.js';
 import type { ATProtoProvider, OAuthConfig } from '#auth-utils';
-export declare function getAtprotoClientMetadata(event: H3Event, provider: ATProtoProvider, config?: OAuthConfig<OAuthBlueskyConfig>['config']): OAuthClientMetadataInput;
+export declare function getAtprotoClientMetadata(event: RequestEvent, provider: ATProtoProvider, config?: OAuthConfig<OAuthBlueskyConfig>['config']): OAuthClientMetadataInput;

package/dist/runtime/server/utils/atproto.js

@@ -1,9 +1,8 @@
-import { getRequestURL } from "h3";
+import { getRequestURL, useRuntimeConfig } from "nuxt/server";
 import { getOAuthRedirectURL } from "../lib/utils.js";
 import { getClientMetadataFilename } from "../../utils/atproto.js";
-import { useRuntimeConfig } from "#imports";
 export function getAtprotoClientMetadata(event, provider, config) {
-  const providerRuntimeConfig = useRuntimeConfig(event).oauth[provider];
+  const providerRuntimeConfig = useRuntimeConfig().oauth[provider];
   const scopes = [.../* @__PURE__ */ new Set(["atproto", ...config?.scope ?? [], ...providerRuntimeConfig.scope ?? []])];
   const scope = scopes.join(" ");
   const grantTypes = [.../* @__PURE__ */ new Set(["authorization_code", ...providerRuntimeConfig.grantTypes ?? []])];

package/dist/runtime/server/utils/password.js

@@ -1,6 +1,6 @@
 import { Hash } from "@adonisjs/hash";
 import { Scrypt } from "@adonisjs/hash/drivers/scrypt";
-import { useRuntimeConfig } from "#imports";
+import { useRuntimeConfig } from "nuxt/server";
 let _hash;
 function getHash() {
   if (!_hash) {

package/dist/runtime/server/utils/session.d.ts

@@ -1,55 +1,68 @@
-import type { H3Event, SessionConfig } from 'h3';
-import { useSession } from 'h3';
+import type { RequestEvent, SessionConfig } from 'nuxt/server';
 import type { OmitWithIndexSignature } from '../../types/utils.js';
-import type { SessionEvent, UserSession, UserSessionRequired } from '#auth-utils';
-type UseSessionEvent = Parameters<typeof useSession>[0] | SessionEvent;
+import type { LegacyH3Event, SessionEvent, UserSession, UserSessionRequired } from '#auth-utils';
+/**
+ * Name of the cookie the user session is sealed into.
+ */
+export declare const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+type UserSessionData = OmitWithIndexSignature<UserSession, 'id'>;
+/**
+ * Session options, the session is always sealed with a secret derived from `appSecret`.
+ */
+type UserSessionConfig = Omit<SessionConfig, 'password'>;
+/**
+ * An event the session can be written with, WebSocket peers and upgrade requests are read-only.
+ */
+type WritableSessionEvent = RequestEvent | LegacyH3Event;
 export interface SessionHooks {
     /**
      * Called when fetching the session from the API
      * - Add extra properties to the session
      * - Throw an error if the session could not be verified (with a database for example)
      */
-    fetch: (session: UserSession, event: H3Event) => void | Promise<void>;
+    fetch: (session: UserSession, event: RequestEvent) => void | Promise<void>;
     /**
      * Called before clearing the session
      */
-    clear: (session: UserSession, event: H3Event) => void | Promise<void>;
+    clear: (session: UserSession, event: RequestEvent) => void | Promise<void>;
 }
 export declare const sessionHooks: import("hookable").Hookable<SessionHooks, import("hookable").HookKeys<SessionHooks>>;
 /**
  * Get the user session from the current request
- * @param event The Request (h3) event
+ * @param event The request event
  * @returns The user session
  */
-export declare function getUserSession(event: UseSessionEvent): Promise<UserSession>;
+export declare function getUserSession(event: SessionEvent): Promise<UserSession>;
 /**
  * Set a user session
- * @param event The Request (h3) event
+ * @param event The request event
  * @param data User session data, please only store public information since it can be decoded with API calls
  * @see https://github.com/atinux/nuxt-auth-utils
  */
-export declare function setUserSession(event: SessionEvent, data: OmitWithIndexSignature<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
+export declare function setUserSession(event: WritableSessionEvent, data: UserSessionData, config?: UserSessionConfig): Promise<UserSession>;
 /**
  * Replace a user session
- * @param event The Request (h3) event
+ * @param event The request event
  * @param data User session data, please only store public information since it can be decoded with API calls
  */
-export declare function replaceUserSession(event: SessionEvent, data: OmitWithIndexSignature<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
+export declare function replaceUserSession(event: WritableSessionEvent, data: UserSessionData, config?: UserSessionConfig): Promise<UserSession>;
 /**
  * Clear the user session and removing the session cookie
- * @param event The Request (h3) event
+ * @param event The request event
  * @returns true if the session was cleared
  */
-export declare function clearUserSession(event: SessionEvent, config?: Partial<SessionConfig>): Promise<boolean>;
+export declare function clearUserSession(event: WritableSessionEvent, config?: UserSessionConfig): Promise<boolean>;
 /**
  * Require a user session, throw a 401 error if the user is not logged in
  * @param event
  * @param opts Options to customize the error message and status code
- * @param opts.statusCode The status code to use for the error (defaults to 401)
+ * @param opts.status The status code to use for the error (defaults to 401)
+ * @param opts.statusCode Deprecated, use `status`
  * @param opts.message The message to use for the error (defaults to Unauthorized)
  * @see https://github.com/atinux/nuxt-auth-utils
  */
-export declare function requireUserSession(event: UseSessionEvent, opts?: {
+export declare function requireUserSession(event: SessionEvent, opts?: {
+    status?: number;
     statusCode?: number;
     message?: string;
 }): Promise<UserSessionRequired>;

package/dist/runtime/server/utils/session.js

@@ -1,7 +1,7 @@
-import { useSession, createError, isEvent } from "h3";
+import { createError, defineEventHandler, useRuntimeConfig, useSession } from "nuxt/server";
 import { defu } from "defu";
 import { createHooks } from "hookable";
-import { useRuntimeConfig } from "#imports";
+export const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
 export const sessionHooks = createHooks();
 export async function getUserSession(event) {
   const session = await _useSession(event);
@@ -11,53 +11,96 @@ export async function getUserSession(event) {
   };
 }
 export async function setUserSession(event, data, config) {
-  const session = await _useSession(event, config);
-  await session.update(defu(data, session.data));
+  const session = await _useSession(event, config, true);
+  await session.update(defu(toJSONData(data), session.data));
   return session.data;
 }
 export async function replaceUserSession(event, data, config) {
-  const session = await _useSession(event, config);
-  await session.clear();
+  const session = await _useSession(event, config, true);
   await session.update((oldData) => {
     for (const key of Object.keys(oldData)) {
       Reflect.deleteProperty(oldData, key);
     }
-    return data;
+    return toJSONData(data);
   });
   return session.data;
 }
 export async function clearUserSession(event, config) {
-  const session = await _useSession(event, config);
-  await sessionHooks.callHookParallel("clear", session.data, event);
+  const session = await _useSession(event, config, true);
+  await sessionHooks.callHookParallel("clear", session.data, toSessionEvent(event).event);
   await session.clear();
   return true;
 }
 export async function requireUserSession(event, opts = {}) {
   const userSession = await getUserSession(event);
   if (!userSession.user) {
-    if (isEvent(event)) {
-      throw createError({
-        statusCode: opts.statusCode || 401,
-        message: opts.message || "Unauthorized"
-      });
-    } else {
-      throw new Response(opts.message || "Unauthorized", {
-        status: opts.statusCode || 401
-      });
+    const status = opts.status || opts.statusCode || 401;
+    const message = opts.message || "Unauthorized";
+    if (toSessionEvent(event).webSocket) {
+      throw new Response(message, { status });
     }
+    throw createError({ status, message });
   }
   return userSession;
 }
-let sessionConfig;
-function _useSession(event, config = {}) {
-  if (!sessionConfig) {
-    const runtimeConfig = useRuntimeConfig(isEvent(event) ? event : void 0);
-    const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
-    sessionConfig = defu({ password: process.env[envSessionPassword] }, runtimeConfig.session);
-    if (!sessionConfig.password) {
-      console.error(`[nuxt-auth-utils] ${envSessionPassword} environment variable or runtimeConfig.session.password was not set.`);
-    }
+async function _useSession(event, config = {}, write = false) {
+  const { event: sessionEvent, webSocket } = toSessionEvent(event);
+  if (write && webSocket) {
+    throw createError({
+      status: 500,
+      message: "[nuxt-auth-utils] The user session is read-only in WebSocket handlers: `setUserSession`, `replaceUserSession` and `clearUserSession` need the event of an HTTP request."
+    });
+  }
+  const runtimeConfig = useRuntimeConfig();
+  warnLegacySessionPassword(runtimeConfig);
+  const { password: _password, ...finalConfig } = defu(config, runtimeConfig.session, { name: USER_SESSION_COOKIE_NAME });
+  if (finalConfig.name === APP_SESSION_COOKIE_NAME) {
+    warnAppSessionName();
+    finalConfig.name = USER_SESSION_COOKIE_NAME;
+  }
+  return useSession(sessionEvent, finalConfig);
+}
+function toJSONData(data) {
+  return JSON.parse(JSON.stringify(data));
+}
+const APP_SESSION_COOKIE_NAME = "nuxt-session";
+let warnedAppSessionName = false;
+function warnAppSessionName() {
+  if (warnedAppSessionName) return;
+  warnedAppSessionName = true;
+  console.warn(`[nuxt-auth-utils] The session name \`${APP_SESSION_COOKIE_NAME}\` is the cookie of \`useSession()\` from \`nuxt/server\`, using \`${USER_SESSION_COOKIE_NAME}\` instead. Set another \`runtimeConfig.session.name\` (\`NUXT_SESSION_NAME\`) to rename the user session cookie.`);
+}
+const toPortableEvent = defineEventHandler((event) => event);
+function toSessionEvent(event) {
+  const input = event;
+  if (input["~portable"] === true || typeof input.res?.headers?.append === "function") {
+    return { event: input, webSocket: false };
+  }
+  if (input.node?.req) {
+    return { event: toPortableEvent(input), webSocket: false };
+  }
+  const headers = input.request?.headers || input.headers;
+  if (headers && typeof headers.get === "function") {
+    return {
+      event: {
+        req: { headers },
+        res: { status: 200, statusText: "", headers: new Headers() }
+      },
+      webSocket: true
+    };
+  }
+  throw createError({
+    status: 500,
+    message: "[nuxt-auth-utils] The session utils need a request event, a WebSocket peer or a WebSocket upgrade request."
+  });
+}
+let checkedLegacySessionPassword = false;
+function warnLegacySessionPassword(runtimeConfig) {
+  if (checkedLegacySessionPassword) return;
+  checkedLegacySessionPassword = true;
+  const envPrefix = runtimeConfig.nitro?.envPrefix || "NUXT_";
+  const envKey = `${envPrefix}SESSION_PASSWORD`;
+  if (globalThis.process?.env?.[envKey] || runtimeConfig.session?.password) {
+    console.warn(`[nuxt-auth-utils] \`${envKey}\` (\`runtimeConfig.session.password\`) is not used anymore. Set \`NUXT_APP_SECRET\` instead, for example with \`openssl rand -base64 32\`. Sessions are now sealed with a secret derived from \`appSecret\`.`);
   }
-  const finalConfig = defu(config, sessionConfig);
-  return useSession(event, finalConfig);
 }

package/dist/runtime/types/event.d.ts

@@ -1,4 +1,28 @@
-import type { H3Event } from 'h3';
-import type { RequestEvent } from '@nuxt/schema';
+import type { RequestEvent } from 'nuxt/server';
+import type { IncomingMessage, ServerResponse } from 'node:http';
 export type { RequestEvent };
-export type SessionEvent = H3Event | RequestEvent;
+/**
+ * The h3 v1 event a handler defined with `defineEventHandler` from `h3` (or its auto-import) receives on Nuxt 4.
+ * @deprecated Use `defineEventHandler` from `nuxt/server`. Removed with Nuxt 5 support.
+ */
+export interface LegacyH3Event {
+    node: {
+        req: IncomingMessage;
+        res: ServerResponse;
+    };
+}
+/**
+ * A WebSocket peer or upgrade request, from `defineWebSocketHandler`.
+ * The session is read-only: changes are not sent back to the client.
+ */
+export type WebSocketSessionEvent = {
+    request: {
+        headers: Headers;
+    };
+} | {
+    headers: Headers;
+};
+/**
+ * Any event the session utils accept.
+ */
+export type SessionEvent = RequestEvent | LegacyH3Event | WebSocketSessionEvent;

package/dist/runtime/types/index.d.ts

@@ -1,4 +1,4 @@
 export type { User, UserSession, UserSessionRequired, UserSessionComposable, SecureSessionData } from './session.js';
-export type { RequestEvent, SessionEvent } from './event.js';
+export type { RequestEvent, SessionEvent, LegacyH3Event, WebSocketSessionEvent } from './event.js';
 export type { OAuthConfig, OAuthProvider, ATProtoProvider, OnError } from './oauth-config.js';
 export type { WebAuthnCredential, WebAuthnRegisterEventHandlerOptions, WebAuthnAuthenticateEventHandlerOptions, WebAuthnComposable, WebAuthnUser, } from './webauthn.js';

package/dist/runtime/types/oauth-config.d.ts

@@ -1,12 +1,12 @@
-import type { H3Event, H3Error } from 'h3';
+import type { NuxtError, RequestEvent } from 'nuxt/server';
 export type ATProtoProvider = 'bluesky';
 export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cloudflare' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'mastodon' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'wechat' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | 'zendesk' | (string & {});
-export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
+export type OnError = (event: RequestEvent, error: NuxtError) => unknown;
 export interface OAuthConfig<TConfig, TResult = {
     user: any;
     tokens: any;
 }> {
     config?: TConfig;
-    onSuccess: (event: H3Event, result: TResult) => Promise<void> | void;
+    onSuccess: (event: RequestEvent, result: TResult) => unknown;
     onError?: OnError;
 }

package/dist/runtime/types/webauthn.d.ts

@@ -1,9 +1,6 @@
 import type { Ref } from 'vue';
-import type { H3Event, H3Error, ValidateResult } from 'h3';
-import type { GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, VerifiedAuthenticationResponse, VerifiedRegistrationResponse, verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
-type RegistrationResponseJSON = Parameters<typeof verifyRegistrationResponse>[0]['response'];
-type AuthenticationResponseJSON = Parameters<typeof verifyAuthenticationResponse>[0]['response'];
-type AuthenticatorTransportFuture = NonNullable<Parameters<typeof verifyAuthenticationResponse>[0]['credential']['transports']>[number];
+import type { NuxtError, RequestEvent, ValidateResult } from 'nuxt/server';
+import type { AuthenticationResponseJSON, AuthenticatorTransportFuture, GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, RegistrationResponseJSON, VerifiedAuthenticationResponse, VerifiedRegistrationResponse } from '@simplewebauthn/server';
 export interface WebAuthnCredential {
     id: string;
     publicKey: string;
@@ -20,15 +17,15 @@ export interface WebAuthnUser {
 }
 type CredentialsList = NonNullable<GenerateAuthenticationOptionsOpts['allowCredentials']>;
 type WebAuthnEventHandlerBase<T extends Record<PropertyKey, unknown>> = {
-    storeChallenge: (event: H3Event, challenge: string, attemptId: string) => void | Promise<void>;
-    getChallenge: (event: H3Event, attemptId: string) => string | Promise<string>;
-    onSuccess: (event: H3Event, data: T) => void | Promise<void>;
-    onError?: (event: H3Event, error: H3Error) => void | Promise<void>;
+    storeChallenge: (event: RequestEvent, challenge: string, attemptId: string) => void | Promise<void>;
+    getChallenge: (event: RequestEvent, attemptId: string) => string | Promise<string>;
+    onSuccess: (event: RequestEvent, data: T) => unknown;
+    onError?: (event: RequestEvent, error: NuxtError) => unknown;
 } | {
     storeChallenge?: undefined;
     getChallenge?: undefined;
-    onSuccess: (event: H3Event, data: T) => void | Promise<void>;
-    onError?: (event: H3Event, error: H3Error) => void | Promise<void>;
+    onSuccess: (event: RequestEvent, data: T) => unknown;
+    onError?: (event: RequestEvent, error: NuxtError) => unknown;
 };
 export type RegistrationBody<T extends WebAuthnUser> = {
     user: T;
@@ -39,15 +36,15 @@ export type RegistrationBody<T extends WebAuthnUser> = {
     attemptId: string;
     response: RegistrationResponseJSON;
 };
-export type ValidateUserFunction<T> = (userBody: WebAuthnUser, event: H3Event) => ValidateResult<T> | Promise<ValidateResult<T>>;
+export type ValidateUserFunction<T> = (userBody: WebAuthnUser, event: RequestEvent) => ValidateResult<T> | Promise<ValidateResult<T>>;
 export type WebAuthnRegisterEventHandlerOptions<T extends WebAuthnUser> = WebAuthnEventHandlerBase<{
     user: T;
     credential: WebAuthnCredential;
     registrationInfo: Exclude<VerifiedRegistrationResponse['registrationInfo'], undefined>;
 }> & {
-    getOptions?: (event: H3Event, body: RegistrationBody<T>) => Partial<GenerateRegistrationOptionsOpts> | Promise<Partial<GenerateRegistrationOptionsOpts>>;
+    getOptions?: (event: RequestEvent, body: RegistrationBody<T>) => Partial<GenerateRegistrationOptionsOpts> | Promise<Partial<GenerateRegistrationOptionsOpts>>;
     validateUser?: ValidateUserFunction<T>;
-    excludeCredentials?: (event: H3Event, userName: string) => CredentialsList | Promise<CredentialsList>;
+    excludeCredentials?: (event: RequestEvent, userName: string) => CredentialsList | Promise<CredentialsList>;
 };
 export type AuthenticationBody = {
     verify: false;
@@ -62,9 +59,9 @@ export type WebAuthnAuthenticateEventHandlerOptions<T extends WebAuthnCredential
     credential: T;
     authenticationInfo: Exclude<VerifiedAuthenticationResponse['authenticationInfo'], undefined>;
 }> & {
-    getOptions?: (event: H3Event, body: AuthenticationBody) => Partial<GenerateAuthenticationOptionsOpts> | Promise<Partial<GenerateAuthenticationOptionsOpts>>;
-    getCredential: (event: H3Event, credentialID: string) => T | Promise<T>;
-    allowCredentials?: (event: H3Event, userName: string) => CredentialsList | Promise<CredentialsList>;
+    getOptions?: (event: RequestEvent, body: AuthenticationBody) => Partial<GenerateAuthenticationOptionsOpts> | Promise<Partial<GenerateAuthenticationOptionsOpts>>;
+    getCredential: (event: RequestEvent, credentialID: string) => T | Promise<T>;
+    allowCredentials?: (event: RequestEvent, userName: string) => CredentialsList | Promise<CredentialsList>;
 };
 export interface WebAuthnComposable {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.34",
+  "version": "0.6.0",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -25,25 +25,27 @@
   "files": [
     "dist"
   ],
+  "engines": {
+    "node": "^22.22.3 || ^24.15.0 || >=26.0.0"
+  },
   "dependencies": {
     "@adonisjs/hash": "^9.1.1",
-    "@nuxt/kit": "^4.3.1",
+    "@nuxt/kit": "^4.6.0",
     "@nuxt/schema": "^4.6.0",
     "defu": "^6.1.5",
-    "h3": "^1.15.9",
     "hookable": "^6.0.1",
     "jose": "^6.1.3",
     "ofetch": "^1.5.1",
     "openid-client": "^6.8.2",
-    "pathe": "^2.0.3",
     "scule": "^1.3.0",
+    "ufo": "^1.6.4",
     "uncrypto": "^0.1.3"
   },
   "peerDependencies": {
     "@atproto/api": "^0.13.15",
     "@atproto/oauth-client-node": "^0.2.0",
-    "@simplewebauthn/browser": "^11.0.0 || ^13.0.0",
-    "@simplewebauthn/server": "^11.0.0 || ^13.3.2"
+    "@simplewebauthn/browser": "^13.0.0",
+    "@simplewebauthn/server": "^13.3.2"
   },
   "peerDependenciesMeta": {
     "@simplewebauthn/browser": {
@@ -77,6 +79,8 @@
     "dev": "nuxi dev playground",
     "dev:build": "nuxi build playground",
     "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground",
+    "dev:v5": "pnpm install:nuxt5 && nuxt-module-build build --stub && nuxt-module-build prepare && nuxi prepare playground && nuxi dev playground",
+    "install:nuxt5": "pnpm install --config.pnpmfile=scripts/nuxt-nightly.cjs --config.lockfile=false --config.minimum-release-age-exclude=*-nightly",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "test": "vitest run",

package/dist/runtime/server/plugins/oauth.d.ts

@@ -1,2 +0,0 @@
-declare const _default: import("nitropack/types").NitroAppPlugin;
-export default _default;

package/dist/runtime/server/plugins/oauth.js

@@ -1,16 +0,0 @@
-import { defineNitroPlugin } from "nitropack/runtime";
-export default defineNitroPlugin((nitroApp) => {
-  if (process.env.NUXT_OAUTH_FACEBOOK_CLIENT_ID && process.env.NUXT_OAUTH_FACEBOOK_CLIENT_SECRET || process.env.NUXT_OAUTH_INSTAGRAM_CLIENT_ID && process.env.NUXT_OAUTH_INSTAGRAM_CLIENT_SECRET) {
-    nitroApp.hooks.hook("render:html", (html) => {
-      html.head.unshift(`
-      <script>
-        if (window.location.hash === "#_=_"){
-          history.replaceState
-              ? history.replaceState(null, null, window.location.href.split("#")[0])
-              : window.location.hash = "";
-        }
-      <\/script>
-    `);
-    });
-  }
-});

package/dist/runtime/server/plugins/ws.d.ts

@@ -1,2 +0,0 @@
-declare const _default: import("nitropack").NitroAppPlugin;
-export default _default;