nuxt-auth-utils 0.5.34 → 0.6.1

package/README.md

@@ -29,6 +29,8 @@ It has few dependencies (only from [UnJS](https://github.com/unjs)), run on mult
 
 ## Requirements
 
+This module requires Nuxt 4.6 or later. If you upgrade from v0.5, read [Migrate from v0.5](#migrate-from-v05).
+
 This module only works with a Nuxt server running as it uses server API routes (`nuxt build`).
 
 This means that you cannot use this module with `nuxt generate`.
@@ -43,14 +45,19 @@ You can anyway use [Hybrid Rendering](#hybrid-rendering) to pre-render pages of
 npx nuxi@latest module add auth-utils
 ```
 
-2. Add a `NUXT_SESSION_PASSWORD` env variable with at least 32 characters in the `.env`.
+2. Set the `NUXT_APP_SECRET` env variable in production, with at least 32 characters.
+
+```bash
+# Generate a secret
+openssl rand -base64 32
+```
 
 ```bash
 # .env
-NUXT_SESSION_PASSWORD=password-with-at-least-32-characters
+NUXT_APP_SECRET=<the-generated-secret>
 ```
 
-Nuxt Auth Utils generates one for you when running Nuxt in development the first time if no `NUXT_SESSION_PASSWORD` is set.
+Nuxt Auth Utils seals the session cookie with a secret that it derives from the [Nuxt `appSecret`](https://nuxt.com/blog/v4-6). In development, Nuxt generates an `appSecret` for you if none is set. Builds never generate one, so you must set `NUXT_APP_SECRET` in production.
 
 3. That's it! You can now add authentication to your Nuxt app ✨
 
@@ -122,6 +129,19 @@ interface UserSessionComposable {
 
 The following helpers are auto-imported in your `server/` directory.
 
+They accept the event of a handler defined with `defineEventHandler` from `nuxt/server`. On Nuxt 4, they also accept the event of a handler defined with the auto-imported `defineEventHandler` from h3.
+
+```ts
+// server/api/me.get.ts
+import { defineEventHandler } from 'nuxt/server'
+
+export default defineEventHandler(async (event) => {
+  const { user } = await requireUserSession(event)
+
+  return user
+})
+```
+
 ### Session Management
 
 ```ts
@@ -152,6 +172,9 @@ await clearUserSession(event)
 
 // Require a user session (send back 401 if no `user` key in session)
 const session = await requireUserSession(event)
+
+// Customize the error status and message
+const session = await requireUserSession(event, { status: 403, message: 'Forbidden' })
 ```
 
 You can define the type for your user session by creating a type declaration file (for example, `auth.d.ts`) in your project to augment the `UserSession` type:
@@ -271,6 +294,8 @@ You can add your favorite provider by creating a new file in [src/runtime/server
 Example: `~/server/routes/auth/github.get.ts`
 
 ```ts
+import { sendRedirect } from 'nuxt/server'
+
 export default defineOAuthGitHubEventHandler({
   config: {
     emailRequired: true
@@ -291,6 +316,8 @@ export default defineOAuthGitHubEventHandler({
 })
 ```
 
+The `event` given to `onSuccess` and `onError` is a `RequestEvent` from `nuxt/server`. Import the helpers you use from `nuxt/server`, for example `sendRedirect`. On Nuxt 4, the auto-imported h3 helpers also work, but TypeScript reports a type error.
+
 Make sure to set the callback URL in your OAuth app settings as `<your-domain>/auth/github`.
 
 If the redirect URL mismatch in production, this means that the module cannot guess the right redirect URL. You can set the `NUXT_OAUTH_<PROVIDER>_REDIRECT_URL` env variable to overwrite the default one.
@@ -450,7 +477,7 @@ export default defineWebAuthnRegisterEventHandler({
     // And verify that the email is the same as the one in session
     const session = await getUserSession(event)
     if (session.user?.email && session.user.email !== userBody.userName) {
-      throw createError({ statusCode: 400, message: 'Email not matching current session' })
+      throw createError({ status: 400, message: 'Email not matching current session' })
     }
 
     // If he registers a new account with credentials
@@ -495,7 +522,7 @@ export default defineWebAuthnAuthenticateEventHandler({
     const credentials = await useDatabase().sql`...`
     // If no credentials are found, the authentication cannot be completed
     if (!credentials.length)
-      throw createError({ statusCode: 400, message: 'User not found' })
+      throw createError({ status: 400, message: 'User not found' })
 
     // If user is found, only allow credentials that are registered
     // The browser will automatically try to use the credential that it knows about
@@ -509,7 +536,7 @@ export default defineWebAuthnAuthenticateEventHandler({
 
     // If the credential is not found, there is no account to log in to
     if (!credential)
-      throw createError({ statusCode: 400, message: 'Credential not found' })
+      throw createError({ status: 400, message: 'Credential not found' })
 
     return credential
   },
@@ -549,7 +576,7 @@ export default defineWebAuthnAuthenticateEventHandler({
 >     await useStorage().removeItem(`attempt:${attemptId}`)
 >
 >     if (!challenge)
->       throw createError({ statusCode: 400, message: 'Challenge expired' })
+>       throw createError({ status: 400, message: 'Challenge expired' })
 >
 >     return challenge
 >   },
@@ -607,9 +634,11 @@ We leverage hooks to let you extend the session data with your own data or log w
 
 ```ts
 // server/plugins/session.ts
-export default defineNitroPlugin(() => {
+// A server plugin is a function, so this file runs on Nuxt 4 (Nitro 2) and Nuxt 5 (Nitro 3)
+export default () => {
   // Called when the session is fetched during SSR for the Vue composable (/api/_auth/session)
   // Or when we call useUserSession().fetch()
+  // Not called for a visitor without a session cookie: they get an empty session and no cookie is set
   sessionHooks.hook('fetch', async (session, event) => {
     // extend User Session by calling your database
     // or
@@ -620,7 +649,7 @@ export default defineNitroPlugin(() => {
   sessionHooks.hook('clear', async (session, event) => {
     // Log that user logged out
   })
-})
+}
 ```
 
 ## Server-Side Rendering
@@ -728,10 +757,13 @@ export default defineNuxtConfig({
 })
 ```
 
-You can use the `requireUserSession` function in the `upgrade` function to check if the user is authenticated before upgrading the WebSocket connection.
+You can use the `requireUserSession` function in the `upgrade` function to check if the user is authenticated before upgrading the WebSocket connection. In WebSocket handlers, the session is read-only: `setUserSession`, `replaceUserSession` and `clearUserSession` throw an error when given a WebSocket peer or upgrade request.
 
 ```ts
 // server/routes/ws.ts
+// `defineWebSocketHandler` is not auto-imported on Nuxt 5, `h3` works on Nuxt 4 and Nuxt 5
+import { defineWebSocketHandler } from 'h3'
+
 export default defineWebSocketHandler({
   async upgrade(request) {
     // Make sure the user is authenticated before upgrading the WebSocket connection
@@ -773,7 +805,7 @@ onMounted(open)
 
 ## Configuration
 
-We leverage `runtimeConfig.session` to give the defaults option to [h3 `useSession`](https://h3.unjs.io/examples/handle-session).
+Nuxt Auth Utils stores the user session with `useSession` from `nuxt/server`. It uses `runtimeConfig.session` for the default options.
 
 You can overwrite the options in your `nuxt.config.ts`:
 
@@ -792,14 +824,21 @@ Our defaults are:
 
 ```ts
 {
-  name: 'nuxt-session',
-  password: process.env.NUXT_SESSION_PASSWORD || '',
+  name: 'nuxt-auth-session',
   cookie: {
     sameSite: 'lax'
   }
 }
 ```
 
+The available options are:
+
+- `name`: the name of the session cookie.
+- `maxAge`: the lifetime of the cookie and of the sealed session, in seconds.
+- `cookie`: the cookie options, merged over `httpOnly: true`, `secure: true`, `sameSite: 'lax'`, and `path: '/'`.
+
+The session is sealed with a secret that Nuxt derives from `appSecret`. The module ignores `runtimeConfig.session.password`.
+
 You can also overwrite the session config by passing it as 3rd argument of the `setUserSession` and `replaceUserSession` functions:
 
 ```ts
@@ -808,11 +847,41 @@ await setUserSession(event, { ... } , {
 })
 ```
 
-Checkout the [`SessionConfig`](https://github.com/unjs/h3/blob/c04c458810e34eb15c1647e1369e7d7ef19f567d/src/utils/session.ts#L20) for all options.
+## Migrate from v0.5
+
+Nuxt Auth Utils v0.6 moves to `nuxt/server`, the server API of Nuxt 4.6. The same server code runs on Nuxt 4 and Nuxt 5. This release has breaking changes.
+
+> [!WARNING]
+> All users are logged out once after the upgrade. The session cookie has a new name and a new format.
+
+To migrate your app, follow these steps:
+
+1. Upgrade Nuxt to 4.6 or later.
+2. Generate a secret with `openssl rand -base64 32`.
+3. Set the secret as `NUXT_APP_SECRET` in your production environment.
+4. On Cloudflare Workers, set `compatibility_date` to `2025-04-01` or later, or add the `nodejs_compat_populate_process_env` compatibility flag. Otherwise the module can't read `NUXT_APP_SECRET` and the `NUXT_OAUTH_*` variables from your Worker variables and secrets.
+5. Remove `NUXT_SESSION_PASSWORD` from your environment and from your `.env` file. The module logs a warning while it is set.
+6. Change `statusCode` to `status` in `createError()` calls.
+7. In `onSuccess` and `onError` callbacks, import helpers such as `sendRedirect` from `nuxt/server`.
+
+The other changes in v0.6 are:
+
+- The session cookie is `nuxt-auth-session`. It was `nuxt-session`, which is now the default name of `useSession` from `nuxt/server`.
+- The session can't be read from the `x-nuxt-session-session` request header anymore.
+- The `sessionHeader`, `seal`, `crypto`, `generateId`, and `password` session options are removed.
+- The `event` in the OAuth and WebAuthn callbacks is a `RequestEvent` from `nuxt/server`, and `error` is a `NuxtError`.
+- In WebSocket handlers, `setUserSession`, `replaceUserSession` and `clearUserSession` throw an error, as the session cookie can't be sent back to the client.
+- `requireUserSession` accepts a `status` option. The `statusCode` option still works, but it's deprecated.
+- Nuxt throws a 500 error if a session cookie is larger than 4096 bytes.
+- The session `maxAge` counts from the last write: each `setUserSession` call extends the cookie. In v0.5, it counted from when the session was created.
+- The session can't be named `nuxt-session`, the cookie of `useSession()` from `nuxt/server`. The module warns and uses `nuxt-auth-session` instead.
+- WebAuthn requires SimpleWebAuthn v13, with `@simplewebauthn/server` 13.3.2 or later. Import its JSON types from `@simplewebauthn/server` or `@simplewebauthn/browser` instead of `@simplewebauthn/types`.
 
 ## Shared session between microservices and subdomains
 
-To share a session between multiple applications, use the same `NUXT_SESSION_PASSWORD` and session `name` in each of them.
+To share a session between multiple applications, use the same `NUXT_APP_SECRET` and session `name` in each of them.
+
+Any application with the same `NUXT_APP_SECRET` can also derive the other keys Nuxt derives from it, so share it only between applications you trust equally.
 
 If the applications run on different subdomains, also set the session cookie `domain` to the parent domain in each `nuxt.config.ts`:
 
@@ -831,6 +900,34 @@ export default defineNuxtConfig({
 
 The browser then sends the session cookie to every subdomain of `example.com`, and each application can decrypt it.
 
+## Serve over plain HTTP
+
+The OAuth event handlers set short-lived cookies for the state, nonce and PKCE verifier. They are `Secure` except in development. Browsers ignore `Secure` cookies set over plain HTTP, except on `localhost`, so logging in to a built app served over plain HTTP, for example in an end-to-end test stack, fails with `state mismatch`.
+
+When `runtimeConfig.session.cookie.secure` is `false`, both the session cookie and these cookies are set without `Secure`. Nuxt only overrides declared options from environment variables, so declare it in your `nuxt.config.ts` to switch it at runtime:
+
+```ts
+export default defineNuxtConfig({
+  modules: ['nuxt-auth-utils'],
+  runtimeConfig: {
+    session: {
+      cookie: {
+        secure: true
+      }
+    }
+  }
+})
+```
+
+Then start the built app with `NUXT_SESSION_COOKIE_SECURE=false`:
+
+```bash
+NUXT_SESSION_COOKIE_SECURE=false node .output/server/index.mjs
+```
+
+> [!WARNING]
+> Only do this when the app is served over plain HTTP: without `Secure`, the cookies can be read or overwritten on the network. A proxy that terminates TLS is not a reason to disable it, as `Secure` applies to the browser's connection.
+
 ## More
 
 - [nuxt-authorization](https://github.com/barbapapazes/nuxt-authorization): Authorization module for managing permissions inside a Nuxt app, compatible with `nuxt-auth-utils`
@@ -847,6 +944,12 @@ pnpm run dev:prepare
 # Develop with the playground
 pnpm run dev
 
+# Develop with the playground on the Nuxt 5 nightly (Nitro 3), run `pnpm install` to go back to the lockfile
+pnpm run dev:v5
+
+# Run the tests on the Nuxt 5 nightly
+pnpm run install:nuxt5 && pnpm run dev:prepare && pnpm run test
+
 # Build the playground
 pnpm run dev:build
 

package/dist/module.d.mts

@@ -1,5 +1,5 @@
 import { ScryptConfig } from '@adonisjs/hash/types';
-import { SessionConfig } from 'h3';
+import { SessionConfig } from 'nuxt/server';
 
 interface ModuleOptions {
     /**
@@ -33,9 +33,9 @@ declare module 'nuxt/schema' {
             scrypt: ScryptConfig;
         };
         /**
-         * Session configuration
+         * Session configuration, the session is sealed with a secret derived from `appSecret` (`NUXT_APP_SECRET`)
          */
-        session: SessionConfig;
+        session: Omit<SessionConfig, 'password'>;
     }
     interface PublicRuntimeConfig {
         auth: {

package/dist/module.json

@@ -1,7 +1,10 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.34",
+  "compatibility": {
+    "nuxt": ">=4.6.0"
+  },
+  "version": "0.6.1",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,14 +1,14 @@
-import { defineNuxtModule, createResolver, addComponentsDir, addImports, addPlugin, addServerPlugin, addServerImportsDir, logger, addServerHandler } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, addComponentsDir, addImports, addPlugin, addServerPlugin, addServerImportsDir, logger, addServerHandler, getNitroVersion } from '@nuxt/kit';
 import { defu } from 'defu';
-import { readFile, writeFile } from 'node:fs/promises';
-import { join } from 'pathe';
-import { randomUUID } from 'uncrypto';
 import { atprotoProviders, atprotoProviderDefaultClientMetadata, getClientMetadataFilename } from '../dist/runtime/utils/atproto.js';
 
 const module$1 = defineNuxtModule({
   meta: {
     name: "auth-utils",
-    configKey: "auth"
+    configKey: "auth",
+    compatibility: {
+      nuxt: ">=4.6.0"
+    }
   },
   // Default configuration options of the Nuxt module
   defaults: {
@@ -36,11 +36,8 @@ const module$1 = defineNuxtModule({
       addPlugin(resolver.resolve("./runtime/app/plugins/session.server"));
       addPlugin(resolver.resolve("./runtime/app/plugins/session.client"));
     }
-    addServerPlugin(resolver.resolve("./runtime/server/plugins/oauth"));
+    addServerPlugin(resolver.resolve("./runtime/server/plugins/oauth-hash"));
     addServerImportsDir(resolver.resolve("./runtime/server/lib/oauth"));
-    if (nuxt.options.nitro?.experimental?.websocket) {
-      addServerPlugin(resolver.resolve("./runtime/server/plugins/ws"));
-    }
     if (options.webAuthn) {
       const missingDeps = [];
       const peerDeps = ["@simplewebauthn/server", "@simplewebauthn/browser"];
@@ -68,16 +65,22 @@ const module$1 = defineNuxtModule({
       route: "/api/_auth/session",
       method: "get"
     });
-    nuxt.options.nitro.unenv ||= {};
-    nuxt.options.nitro.unenv.external ||= [];
-    if (!nuxt.options.nitro.unenv.external.includes("node:crypto")) {
-      nuxt.options.nitro.unenv.external.push("node:crypto");
+    if (getNitroVersion(nuxt) === 2) {
+      const nitroOptions = nuxt.options.nitro;
+      nitroOptions.unenv ||= {};
+      nitroOptions.unenv.external ||= [];
+      if (!nitroOptions.unenv.external.includes("node:crypto")) {
+        nitroOptions.unenv.external.push("node:crypto");
+      }
     }
     const runtimeConfig = nuxt.options.runtimeConfig;
     const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
+    if (process.env[envSessionPassword] || runtimeConfig.session?.password) {
+      logger.withTag("nuxt-auth-utils").warn(`\`${envSessionPassword}\` (\`runtimeConfig.session.password\`) is not used anymore. Set \`NUXT_APP_SECRET\` instead, for example with \`openssl rand -base64 32\`. Sessions are now sealed with a secret derived from \`appSecret\`, so users are logged out once.`);
+    }
     runtimeConfig.session = defu(runtimeConfig.session, {
-      name: "nuxt-session",
-      password: "",
+      // Declared so `NUXT_SESSION_NAME` can override it at runtime
+      name: "nuxt-auth-session",
       cookie: {
         sameSite: "lax"
       }
@@ -85,22 +88,6 @@ const module$1 = defineNuxtModule({
     runtimeConfig.hash = defu(runtimeConfig.hash, {
       scrypt: options.hash?.scrypt
     });
-    if (nuxt.options.dev && !process.env[envSessionPassword]) {
-      if (nuxt.options.runtimeConfig.session.password) {
-        process.env[envSessionPassword] = nuxt.options.runtimeConfig.session.password;
-      } else {
-        const password = process.env[envSessionPassword] = randomUUID().replace(/-/g, "");
-        const envPath = join(nuxt.options.rootDir, ".env");
-        const envContent = await readFile(envPath, "utf-8").catch(() => "");
-        if (!envContent.includes(envSessionPassword)) {
-          await writeFile(
-            envPath,
-            `${envContent ? envContent + "\n" : envContent}${envSessionPassword}=${password}`,
-            "utf-8"
-          );
-        }
-      }
-    }
     runtimeConfig.public.auth = defu(runtimeConfig.public.auth, {
       loadStrategy: options.loadStrategy ?? "server-first"
     });

package/dist/runtime/app/composables/session.js

@@ -1,4 +1,3 @@
-import { appendResponseHeader } from "h3";
 import { useState, computed, useRequestFetch, useRequestEvent } from "#imports";
 export function useUserSession() {
   const serverEvent = import.meta.server ? useRequestEvent() : null;
@@ -10,8 +9,10 @@ export function useUserSession() {
       method: "DELETE",
       onResponse({ response: { headers } }) {
         if (import.meta.server && serverEvent) {
+          const res = serverEvent.res;
           for (const setCookie of headers.getSetCookie()) {
-            appendResponseHeader(serverEvent, "Set-Cookie", setCookie);
+            if (res.headers) res.headers.append("set-cookie", setCookie);
+            else res.appendHeader?.("set-cookie", setCookie);
           }
         }
       }

package/dist/runtime/server/api/session.delete.d.ts

@@ -1,4 +1,4 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+declare const _default: import("nuxt/server").EventHandler<Promise<{
     loggedOut: boolean;
 }>>;
 export default _default;

package/dist/runtime/server/api/session.delete.js

@@ -1,6 +1,6 @@
-import { eventHandler } from "h3";
+import { defineEventHandler } from "nuxt/server";
 import { clearUserSession } from "../utils/session.js";
-export default eventHandler(async (event) => {
+export default defineEventHandler(async (event) => {
   await clearUserSession(event);
   return { loggedOut: true };
 });

package/dist/runtime/server/api/session.get.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<UserSession>>;
+declare const _default: import("nuxt/server").EventHandler<Promise<any>>;
 export default _default;

package/dist/runtime/server/api/session.get.js

@@ -1,6 +1,10 @@
-import { eventHandler } from "h3";
+import { defineEventHandler, getCookie } from "nuxt/server";
 import { getUserSession, sessionHooks } from "../utils/session.js";
-export default eventHandler(async (event) => {
+import { resolveSessionConfig } from "../lib/session.js";
+export default defineEventHandler(async (event) => {
+  if (!getCookie(event, resolveSessionConfig().name)) {
+    return {};
+  }
   const session = await getUserSession(event);
   if (Object.keys(session).length > 0) {
     await sessionHooks.callHookParallel("fetch", session, event);

package/dist/runtime/server/lib/atproto/bluesky.d.ts

@@ -1,4 +1,4 @@
-import type { H3Event } from 'h3';
+import type { RequestEvent } from 'nuxt/server';
 import type { NodeSavedSession, NodeSavedSessionStore, NodeSavedState, NodeSavedStateStore } from '@atproto/oauth-client-node';
 import type { AppBskyActorDefs } from '@atproto/api';
 import type { OAuthConfig } from '#auth-utils';
@@ -22,11 +22,11 @@ type BlueSkyTokens = NodeSavedSession['tokenSet'];
 export declare function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBlueskyConfig, {
     user: BlueSkyUser;
     tokens: BlueSkyTokens;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+}>): import("nuxt/server").EventHandler<Promise<any>>;
 export declare class StateStore implements NodeSavedStateStore {
     private event;
     private readonly stateKey;
-    constructor(event: H3Event);
+    constructor(event: RequestEvent);
     get(): Promise<NodeSavedState | undefined>;
     set(key: string, val: NodeSavedState): Promise<void>;
     del(): Promise<void>;

package/dist/runtime/server/lib/atproto/bluesky.js

@@ -1,9 +1,9 @@
-import { createError, eventHandler, getQuery, sendRedirect, getCookie, setCookie, deleteCookie } from "h3";
+import { defineEventHandler, createError, deleteCookie, getCookie, getQuery, sendRedirect, setCookie } from "nuxt/server";
 import { NodeOAuthClient, OAuthCallbackError, OAuthResolverError, OAuthResponseError } from "@atproto/oauth-client-node";
 import { Agent } from "@atproto/api";
 import { getAtprotoClientMetadata } from "../../utils/atproto.js";
 export function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }) {
-  return eventHandler(async (event) => {
+  return defineEventHandler(async (event) => {
     const clientMetadata = getAtprotoClientMetadata(event, "bluesky", config);
     const scopes = clientMetadata.scope?.split(" ") ?? [];
     const sessionStore = new SessionStore();
@@ -18,7 +18,7 @@ export function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }) {
       try {
         const handle = query.handle?.toString();
         if (!handle) throw createError({
-          statusCode: 400,
+          status: 400,
           message: "Query parameter `handle` empty or missing. Please provide a valid Bluesky handle."
         });
         const url = await client.authorize(handle, { scope: clientMetadata.scope });
@@ -28,13 +28,13 @@ export function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }) {
           switch (true) {
             case err instanceof OAuthResponseError:
               return createError({
-                statusCode: 500,
+                status: 500,
                 message: `Bluesky login failed: ${err.errorDescription || "Unknown error"}`,
                 data: err.payload
               });
             case err instanceof OAuthResolverError:
               return createError({
-                statusCode: 400,
+                status: 400,
                 message: `Bluesky login failed: ${err.message || "Unknown error"}`
               });
             default:
@@ -57,7 +57,7 @@ export function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }) {
     } catch (err) {
       if (!(err instanceof OAuthCallbackError)) throw err;
       const error = createError({
-        statusCode: 500,
+        status: 500,
         message: `Bluesky login failed: ${err.message || "Unknown error"}`
       });
       if (!onError) throw error;

package/dist/runtime/server/lib/oauth/apple.d.ts

@@ -74,4 +74,4 @@ export declare function defineOAuthAppleEventHandler({ config, onSuccess, onErro
     user: OAuthAppleUser;
     payload: OAuthAppleTokens;
     tokens: any;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+}>): import("nuxt/server").EventHandler<Promise<any>>;

package/dist/runtime/server/lib/oauth/apple.js

@@ -1,16 +1,15 @@
-import { eventHandler, getRequestHeader, readBody, sendRedirect } from "h3";
+import { defineEventHandler, getRequestHeader, readBody, sendRedirect, useRuntimeConfig } from "nuxt/server";
 import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken, signJwt, verifyJwt } from "../utils.js";
-import { useRuntimeConfig } from "#imports";
 export function defineOAuthAppleEventHandler({
   config,
   onSuccess,
   onError
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
 }) {
-  return eventHandler(async (event) => {
-    config = defu(config, useRuntimeConfig(event).oauth?.apple, {
+  return defineEventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig().oauth?.apple, {
       authorizationURL: config?.authorizationURL || "https://appleid.apple.com/auth/authorize",
       authorizationParams: {}
     });

package/dist/runtime/server/lib/oauth/atlassian.d.ts

@@ -91,5 +91,5 @@ export interface OAuthAtlassianConfig {
 export declare function defineOAuthAtlassianEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthAtlassianConfig, {
     user: AtlassianUser;
     tokens: AtlassianTokens;
-}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+}>): import("nuxt/server").EventHandler<Promise<any>>;
 export {};

package/dist/runtime/server/lib/oauth/atlassian.js

@@ -1,14 +1,14 @@
-import { eventHandler, getQuery, sendRedirect } from "h3";
+import { defineEventHandler, createError, getQuery, sendRedirect, useRuntimeConfig } from "nuxt/server";
+import { $fetch } from "ofetch";
 import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
-import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthAtlassianEventHandler({
   config,
   onSuccess,
   onError
 }) {
-  return eventHandler(async (event) => {
+  return defineEventHandler(async (event) => {
     config = defu(config, useRuntimeConfig().oauth?.atlassian, {
       authorizationURL: "https://auth.atlassian.com/authorize",
       tokenURL: "https://auth.atlassian.com/oauth/token",
@@ -45,7 +45,7 @@ export function defineOAuthAtlassianEventHandler({
     }
     if (query.error) {
       const error = createError({
-        statusCode: 401,
+        status: 401,
         message: `Atlassian login failed: ${query.error || "Unknown error"}`,
         data: query
       });
@@ -78,8 +78,8 @@ export function defineOAuthAtlassianEventHandler({
     });
     if (user.account_status === "inactive") {
       const error = createError({
-        statusCode: 403,
-        statusMessage: "Atlassian account is inactive",
+        status: 403,
+        message: "Atlassian account is inactive",
         data: { accountStatus: user.account_status }
       });
       if (!onError) throw error;
@@ -87,8 +87,8 @@ export function defineOAuthAtlassianEventHandler({
     }
     if (!user.email_verified) {
       const error = createError({
-        statusCode: 400,
-        statusMessage: "Email address is not verified",
+        status: 400,
+        message: "Email address is not verified",
         data: { email: user.email }
       });
       if (!onError) throw error;

package/dist/runtime/server/lib/oauth/auth0.d.ts

@@ -57,4 +57,4 @@ export interface OAuthAuth0Config {
      */
     redirectURL?: string;
 }
-export declare function defineOAuthAuth0EventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuth0Config>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export declare function defineOAuthAuth0EventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuth0Config>): import("nuxt/server").EventHandler<Promise<any>>;

package/dist/runtime/server/lib/oauth/auth0.js

@@ -1,11 +1,11 @@
-import { eventHandler, getQuery, sendRedirect } from "h3";
+import { defineEventHandler, getQuery, sendRedirect, useRuntimeConfig } from "nuxt/server";
+import { $fetch } from "ofetch";
 import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
-import { useRuntimeConfig } from "#imports";
 export function defineOAuthAuth0EventHandler({ config, onSuccess, onError }) {
-  return eventHandler(async (event) => {
-    config = defu(config, useRuntimeConfig(event).oauth?.auth0, {
+  return defineEventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig().oauth?.auth0, {
       authorizationParams: {}
     });
     if (!config.clientId || !config.clientSecret || !config.domain) {

package/dist/runtime/server/lib/oauth/authentik.d.ts

@@ -27,4 +27,4 @@ export interface OAuthAuthentikConfig {
      */
     scope?: string[];
 }
-export declare function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuthentikConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export declare function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthAuthentikConfig>): import("nuxt/server").EventHandler<Promise<any>>;