nuxt-auth-utils 0.5.34 → 0.6.1

package/dist/runtime/server/lib/session.d.ts

@@ -0,0 +1,11 @@
+import type { SessionConfig } from 'nuxt/server';
+/**
+ * Name of the cookie the user session is sealed into.
+ */
+export declare const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+/**
+ * The session config of the user session: the runtime config merged under `config`, without `password`.
+ */
+export declare function resolveSessionConfig(config?: Omit<SessionConfig, 'password'>): SessionConfig & {
+    name: string;
+};

package/dist/runtime/server/lib/session.js

@@ -0,0 +1,33 @@
+import { useRuntimeConfig } from "nuxt/server";
+import { defu } from "defu";
+export const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+const APP_SESSION_COOKIE_NAME = "nuxt-session";
+export function resolveSessionConfig(config = {}) {
+  const runtimeConfig = useRuntimeConfig();
+  warnLegacySessionPassword(runtimeConfig);
+  const { password: _password, ...finalConfig } = defu(config, runtimeConfig.session, { name: USER_SESSION_COOKIE_NAME });
+  if (finalConfig.name === APP_SESSION_COOKIE_NAME) {
+    warnAppSessionName();
+    finalConfig.name = USER_SESSION_COOKIE_NAME;
+  }
+  if (finalConfig.cookie?.secure === "false") {
+    finalConfig.cookie = { ...finalConfig.cookie, secure: false };
+  }
+  return finalConfig;
+}
+let warnedAppSessionName = false;
+function warnAppSessionName() {
+  if (warnedAppSessionName) return;
+  warnedAppSessionName = true;
+  console.warn(`[nuxt-auth-utils] The session name \`${APP_SESSION_COOKIE_NAME}\` is the cookie of \`useSession()\` from \`nuxt/server\`, using \`${USER_SESSION_COOKIE_NAME}\` instead. Set another \`runtimeConfig.session.name\` (\`NUXT_SESSION_NAME\`) to rename the user session cookie.`);
+}
+let checkedLegacySessionPassword = false;
+function warnLegacySessionPassword(runtimeConfig) {
+  if (checkedLegacySessionPassword) return;
+  checkedLegacySessionPassword = true;
+  const envPrefix = runtimeConfig.nitro?.envPrefix || "NUXT_";
+  const envKey = `${envPrefix}SESSION_PASSWORD`;
+  if (globalThis.process?.env?.[envKey] || runtimeConfig.session?.password) {
+    console.warn(`[nuxt-auth-utils] \`${envKey}\` (\`runtimeConfig.session.password\`) is not used anymore. Set \`NUXT_APP_SECRET\` instead, for example with \`openssl rand -base64 32\`. Sessions are now sealed with a secret derived from \`appSecret\`.`);
+  }
+}

package/dist/runtime/server/lib/utils.d.ts

@@ -1,8 +1,9 @@
-import { type H3Event } from 'h3';
+import type { RequestEvent } from 'nuxt/server';
 import * as jose from 'jose';
 import type { OAuthProvider, OnError } from '#auth-utils';
 export declare const isDevelopment: boolean;
-export declare function getOAuthRedirectURL(event: H3Event): string;
+export declare function isOAuthCookieSecure(): boolean;
+export declare function getOAuthRedirectURL(event: RequestEvent): string;
 /**
  * Request an access token body.
  *
@@ -34,9 +35,9 @@ export declare function requestAccessToken<T = any>(url: string, options: Reques
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
  */
-export declare function handleAccessTokenErrorResponse(event: H3Event, oauthProvider: OAuthProvider, oauthError: any, onError?: OnError): any;
-export declare function handleMissingConfiguration(event: H3Event, provider: OAuthProvider, missingKeys: string[], onError?: OnError): any;
-export declare function handleInvalidState(event: H3Event, provider: OAuthProvider, onError?: OnError): any;
+export declare function handleAccessTokenErrorResponse(event: RequestEvent, oauthProvider: OAuthProvider, oauthError: any, onError?: OnError): any;
+export declare function handleMissingConfiguration(event: RequestEvent, provider: OAuthProvider, missingKeys: string[], onError?: OnError): any;
+export declare function handleInvalidState(event: RequestEvent, provider: OAuthProvider, onError?: OnError): any;
 /**
  * JWT signing using jose
  *
@@ -62,7 +63,7 @@ interface JWTVerifyOptions {
     issuer: string;
 }
 export declare function verifyJwt<T>(token: string, options: JWTVerifyOptions): Promise<T>;
-export declare function handlePkceVerifier(event: H3Event): Promise<{
+export declare function handlePkceVerifier(event: RequestEvent): Promise<{
     code_verifier: string;
     code_challenge: string;
     code_challenge_method: string;
@@ -75,7 +76,7 @@ interface HandleStateOptions {
     isCallback?: boolean;
     sameSite?: 'lax' | 'none' | 'strict';
 }
-export declare function handleState(event: H3Event, options?: HandleStateOptions): Promise<string | undefined>;
+export declare function handleState(event: RequestEvent, options?: HandleStateOptions): Promise<string | undefined>;
 export declare function parseJwt(token: string): jose.JWTPayload;
-export declare function handleNonce(event: H3Event): string | undefined;
+export declare function handleNonce(event: RequestEvent): string | undefined;
 export {};

package/dist/runtime/server/lib/utils.js

@@ -1,14 +1,16 @@
-import { deleteCookie, getCookie, getQuery, setCookie } from "h3";
-import { getRequestURL } from "h3";
-import { FetchError } from "ofetch";
+import { createError, deleteCookie, getCookie, getQuery, getRequestURL, setCookie } from "nuxt/server";
+import { $fetch, FetchError } from "ofetch";
 import { snakeCase, upperFirst } from "scule";
 import * as jose from "jose";
 import { subtle, getRandomValues } from "uncrypto";
-import { createError } from "#imports";
+import { resolveSessionConfig } from "./session.js";
 export const isDevelopment = process.env.NODE_ENV === "development";
+export function isOAuthCookieSecure() {
+  return !isDevelopment && resolveSessionConfig().cookie?.secure !== false;
+}
 const OAUTH_COOKIE_MAX_AGE = 60 * 10;
 export function getOAuthRedirectURL(event) {
-  const requestURL = getRequestURL(event);
+  const requestURL = getRequestURL(event, { xForwardedProto: true });
   return `${requestURL.protocol}//${requestURL.host}${requestURL.pathname}`;
 }
 export async function requestAccessToken(url, options) {
@@ -33,7 +35,7 @@ export async function requestAccessToken(url, options) {
 export function handleAccessTokenErrorResponse(event, oauthProvider, oauthError, onError) {
   const message = `${upperFirst(oauthProvider)} login failed: ${oauthError.error_description || oauthError.error?.message || oauthError.error || "Unknown error"}`;
   const error = createError({
-    statusCode: 401,
+    status: 401,
     message,
     data: oauthError
   });
@@ -43,7 +45,7 @@ export function handleAccessTokenErrorResponse(event, oauthProvider, oauthError,
 export function handleMissingConfiguration(event, provider, missingKeys, onError) {
   const environmentVariables = missingKeys.map((key) => `NUXT_OAUTH_${provider.toUpperCase()}_${snakeCase(key).toUpperCase()}`);
   const error = createError({
-    statusCode: 500,
+    status: 500,
     message: `Missing ${environmentVariables.join(" or ")} env ${missingKeys.length > 1 ? "variables" : "variable"}.`
   });
   if (!onError) throw error;
@@ -52,7 +54,7 @@ export function handleMissingConfiguration(event, provider, missingKeys, onError
 export function handleInvalidState(event, provider, onError) {
   const message = `${upperFirst(provider)} login failed: state mismatch`;
   const error = createError({
-    statusCode: 500,
+    status: 500,
     message
   });
   if (!onError) throw error;
@@ -86,7 +88,7 @@ export async function handlePkceVerifier(event) {
     const verifier2 = encodeBase64Url(getRandomBytes());
     setCookie(event, "nuxt-auth-pkce", verifier2, {
       httpOnly: true,
-      secure: !isDevelopment,
+      secure: isOAuthCookieSecure(),
       sameSite: "lax",
       maxAge: OAUTH_COOKIE_MAX_AGE,
       path: "/"
@@ -116,7 +118,7 @@ export async function handleState(event, options = {}) {
   const sameSite = options.sameSite || "lax";
   setCookie(event, "nuxt-auth-state", state, {
     httpOnly: true,
-    secure: sameSite === "none" || !isDevelopment,
+    secure: sameSite === "none" || isOAuthCookieSecure(),
     sameSite,
     maxAge: OAUTH_COOKIE_MAX_AGE,
     path: "/"
@@ -136,7 +138,7 @@ export function handleNonce(event) {
   const nonce = encodeBase64Url(getRandomBytes());
   setCookie(event, "nuxt-auth-nonce", nonce, {
     httpOnly: true,
-    secure: !isDevelopment,
+    secure: isOAuthCookieSecure(),
     sameSite: "lax",
     maxAge: OAUTH_COOKIE_MAX_AGE,
     path: "/"

package/dist/runtime/server/lib/webauthn/authenticate.d.ts

@@ -1,3 +1,3 @@
-import type { EventHandler } from 'h3';
+import type { EventHandler } from 'nuxt/server';
 import type { WebAuthnAuthenticateEventHandlerOptions, WebAuthnCredential } from '#auth-utils';
 export declare function defineWebAuthnAuthenticateEventHandler<T extends WebAuthnCredential>({ storeChallenge, getChallenge, getCredential, allowCredentials, getOptions, onSuccess, onError, }: WebAuthnAuthenticateEventHandlerOptions<T>): EventHandler;

package/dist/runtime/server/lib/webauthn/authenticate.js

@@ -1,9 +1,8 @@
-import { eventHandler, H3Error, createError, getRequestURL, readBody } from "h3";
+import { defineEventHandler, createError, getRequestURL, isNuxtError, readBody, useRuntimeConfig } from "nuxt/server";
 import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
 import defu from "defu";
 import { getRandomValues } from "uncrypto";
 import { base64URLStringToBuffer, bufferToBase64URLString } from "@simplewebauthn/browser";
-import { useRuntimeConfig } from "#imports";
 export function defineWebAuthnAuthenticateEventHandler({
   storeChallenge,
   getChallenge,
@@ -13,10 +12,10 @@ export function defineWebAuthnAuthenticateEventHandler({
   onSuccess,
   onError
 }) {
-  return eventHandler(async (event) => {
-    const url = getRequestURL(event);
+  return defineEventHandler(async (event) => {
+    const url = getRequestURL(event, { xForwardedProto: true });
     const body = await readBody(event);
-    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig(event).webauthn.authenticate, {
+    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig().webauthn.authenticate, {
       rpID: url.hostname
     });
     if (!storeChallenge) {
@@ -38,7 +37,7 @@ export function defineWebAuthnAuthenticateEventHandler({
         };
       }
       if (!body.attemptId)
-        throw createError({ statusCode: 400 });
+        throw createError({ status: 400 });
       let expectedChallenge = "";
       if (getChallenge) {
         expectedChallenge = await getChallenge(event, body.attemptId);
@@ -59,7 +58,7 @@ export function defineWebAuthnAuthenticateEventHandler({
         }
       });
       if (!verification.verified)
-        throw createError({ statusCode: 400, message: "Failed to verify registration response" });
+        throw createError({ status: 400, message: "Failed to verify registration response" });
       await onSuccess(event, {
         credential,
         authenticationInfo: verification.authenticationInfo
@@ -67,9 +66,9 @@ export function defineWebAuthnAuthenticateEventHandler({
       return verification;
     } catch (error) {
       if (!onError) throw error;
-      if (error instanceof H3Error)
+      if (isNuxtError(error))
         return onError(event, error);
-      return onError(event, createError({ statusCode: 500, message: "Failed to authenticate credential" }));
+      return onError(event, createError({ status: 500, message: "Failed to authenticate credential" }));
     }
   });
 }

package/dist/runtime/server/lib/webauthn/register.d.ts

@@ -1,5 +1,5 @@
-import type { H3Event, EventHandler } from 'h3';
+import type { EventHandler, RequestEvent } from 'nuxt/server';
 import type { ValidateUserFunction } from '../../../types/webauthn.js';
 import type { WebAuthnUser, WebAuthnRegisterEventHandlerOptions } from '#auth-utils';
 export declare function defineWebAuthnRegisterEventHandler<T extends WebAuthnUser>({ storeChallenge, getChallenge, getOptions, validateUser, excludeCredentials, onSuccess, onError, }: WebAuthnRegisterEventHandlerOptions<T>): EventHandler;
-export declare function validateUserData<T>(userBody: WebAuthnUser, event: H3Event, fn: ValidateUserFunction<T>): Promise<T>;
+export declare function validateUserData<T>(userBody: WebAuthnUser, event: RequestEvent, fn: ValidateUserFunction<T>): Promise<T>;

package/dist/runtime/server/lib/webauthn/register.js

@@ -1,9 +1,8 @@
-import { eventHandler, H3Error, createError, getRequestURL, readBody } from "h3";
+import { defineEventHandler, createError, getRequestURL, isNuxtError, readBody, useRuntimeConfig } from "nuxt/server";
 import { generateRegistrationOptions, verifyRegistrationResponse } from "@simplewebauthn/server";
 import defu from "defu";
 import { bufferToBase64URLString } from "@simplewebauthn/browser";
 import { getRandomValues } from "uncrypto";
-import { useRuntimeConfig } from "#imports";
 export function defineWebAuthnRegisterEventHandler({
   storeChallenge,
   getChallenge,
@@ -13,19 +12,19 @@ export function defineWebAuthnRegisterEventHandler({
   onSuccess,
   onError
 }) {
-  return eventHandler(async (event) => {
-    const url = getRequestURL(event);
+  return defineEventHandler(async (event) => {
+    const url = getRequestURL(event, { xForwardedProto: true });
     const body = await readBody(event);
     if (body.verify === void 0 || !body.user?.userName)
       throw createError({
         message: "Invalid request, missing userName or verify property",
-        statusCode: 400
+        status: 400
       });
     let user = body.user;
     if (validateUser) {
       user = await validateUserData(body.user, event, validateUser);
     }
-    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig(event).webauthn.register, {
+    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig().webauthn.register, {
       rpID: url.hostname,
       rpName: url.hostname,
       userName: user.userName,
@@ -55,7 +54,7 @@ export function defineWebAuthnRegisterEventHandler({
       if (!body.attemptId) {
         throw createError({
           message: "Invalid request, missing attemptId",
-          statusCode: 400
+          status: 400
         });
       }
       let expectedChallenge = "";
@@ -74,7 +73,7 @@ export function defineWebAuthnRegisterEventHandler({
       if (!verification.verified) {
         throw createError({
           message: "Failed to verify registration response",
-          statusCode: 400
+          status: 400
         });
       }
       await onSuccess(event, {
@@ -92,9 +91,9 @@ export function defineWebAuthnRegisterEventHandler({
       return verification;
     } catch (error) {
       if (!onError) throw error;
-      if (error instanceof H3Error)
+      if (isNuxtError(error))
         return onError(event, error);
-      return onError(event, createError({ statusCode: 500, message: "Failed to register credential" }));
+      return onError(event, createError({ status: 500, message: "Failed to register credential" }));
     }
   });
 }
@@ -114,7 +113,7 @@ export async function validateUserData(userBody, event, fn) {
 }
 function createUserValidationError(validateError) {
   throw createError({
-    status: validateError?.statusCode || 400,
+    status: validateError?.status || validateError?.statusCode || 400,
     message: validateError?.message || "User Validation Error",
     data: validateError
   });

package/dist/runtime/server/plugins/oauth-hash.d.ts

@@ -0,0 +1,2 @@
+declare const _default: () => void;
+export default _default;

package/dist/runtime/server/plugins/oauth-hash.js

@@ -0,0 +1,8 @@
+import { useRuntimeConfig, useServerHooks } from "nuxt/server";
+export default () => {
+  useServerHooks().hook("render:html", (html) => {
+    const oauth = useRuntimeConfig().oauth;
+    if (!oauth?.facebook?.clientId && !oauth?.instagram?.clientId) return;
+    html.head.unshift('<script>if(window.location.hash==="#_=_"){history.replaceState?history.replaceState(null,null,window.location.href.split("#")[0]):window.location.hash=""}<\/script>');
+  });
+};

package/dist/runtime/server/routes/atproto/client-metadata.json.get.d.ts

@@ -1,4 +1,4 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, {
+declare const _default: import("nuxt/server").EventHandler<{
     redirect_uris: [string, ...string[]];
     scope?: string | undefined;
     response_types?: ["code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token", ...("code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token")[]] | undefined;

package/dist/runtime/server/routes/atproto/client-metadata.json.get.js

@@ -1,10 +1,10 @@
-import { defineEventHandler, createError } from "h3";
+import { createError, defineEventHandler, getRequestURL, useRuntimeConfig } from "nuxt/server";
+import { withoutBase } from "ufo";
 import { getAtprotoClientMetadata } from "../../utils/atproto.js";
 import { atprotoProviders, getClientMetadataFilename } from "../../../utils/atproto.js";
-import { useRuntimeConfig } from "#imports";
 export default defineEventHandler((event) => {
-  const path = event.path.slice(1);
-  const runtimeConfig = useRuntimeConfig(event);
+  const runtimeConfig = useRuntimeConfig();
+  const path = withoutBase(getRequestURL(event).pathname, runtimeConfig.app.baseURL).slice(1);
   for (const provider of atprotoProviders) {
     const config = runtimeConfig.oauth[provider];
     if (getClientMetadataFilename(provider, config) === path) {
@@ -12,7 +12,7 @@ export default defineEventHandler((event) => {
     }
   }
   throw createError({
-    statusCode: 404,
+    status: 404,
     message: "Provider not found"
   });
 });

package/dist/runtime/server/utils/atproto.d.ts

@@ -1,5 +1,5 @@
-import type { H3Event } from 'h3';
+import type { RequestEvent } from 'nuxt/server';
 import type { OAuthClientMetadataInput } from '@atproto/oauth-client-node';
 import type { OAuthBlueskyConfig } from '../lib/atproto/bluesky.js';
 import type { ATProtoProvider, OAuthConfig } from '#auth-utils';
-export declare function getAtprotoClientMetadata(event: H3Event, provider: ATProtoProvider, config?: OAuthConfig<OAuthBlueskyConfig>['config']): OAuthClientMetadataInput;
+export declare function getAtprotoClientMetadata(event: RequestEvent, provider: ATProtoProvider, config?: OAuthConfig<OAuthBlueskyConfig>['config']): OAuthClientMetadataInput;

package/dist/runtime/server/utils/atproto.js

@@ -1,13 +1,12 @@
-import { getRequestURL } from "h3";
+import { getRequestURL, useRuntimeConfig } from "nuxt/server";
 import { getOAuthRedirectURL } from "../lib/utils.js";
 import { getClientMetadataFilename } from "../../utils/atproto.js";
-import { useRuntimeConfig } from "#imports";
 export function getAtprotoClientMetadata(event, provider, config) {
-  const providerRuntimeConfig = useRuntimeConfig(event).oauth[provider];
+  const providerRuntimeConfig = useRuntimeConfig().oauth[provider];
   const scopes = [.../* @__PURE__ */ new Set(["atproto", ...config?.scope ?? [], ...providerRuntimeConfig.scope ?? []])];
   const scope = scopes.join(" ");
   const grantTypes = [.../* @__PURE__ */ new Set(["authorization_code", ...providerRuntimeConfig.grantTypes ?? []])];
-  const requestURL = getRequestURL(event);
+  const requestURL = getRequestURL(event, { xForwardedProto: true });
   const baseUrl = `${requestURL.protocol}//${requestURL.host}`;
   const redirectURL = new URL(
     config?.redirectUrl && baseUrl + config.redirectUrl || providerRuntimeConfig.redirectUris[0] && baseUrl + providerRuntimeConfig.redirectUris[0] || getOAuthRedirectURL(event)

package/dist/runtime/server/utils/password.js

@@ -1,6 +1,6 @@
 import { Hash } from "@adonisjs/hash";
 import { Scrypt } from "@adonisjs/hash/drivers/scrypt";
-import { useRuntimeConfig } from "#imports";
+import { useRuntimeConfig } from "nuxt/server";
 let _hash;
 function getHash() {
   if (!_hash) {

package/dist/runtime/server/utils/session.d.ts

@@ -1,56 +1,65 @@
-import type { H3Event, SessionConfig } from 'h3';
-import { useSession } from 'h3';
+import type { RequestEvent, SessionConfig } from 'nuxt/server';
 import type { OmitWithIndexSignature } from '../../types/utils.js';
-import type { SessionEvent, UserSession, UserSessionRequired } from '#auth-utils';
-type UseSessionEvent = Parameters<typeof useSession>[0] | SessionEvent;
+import type { LegacyH3Event, SessionEvent, UserSession, UserSessionRequired } from '#auth-utils';
+export { USER_SESSION_COOKIE_NAME } from '../lib/session.js';
+type UserSessionData = OmitWithIndexSignature<UserSession, 'id'>;
+/**
+ * Session options, the session is always sealed with a secret derived from `appSecret`.
+ */
+type UserSessionConfig = Omit<SessionConfig, 'password'>;
+/**
+ * An event the session can be written with, WebSocket peers and upgrade requests are read-only.
+ */
+type WritableSessionEvent = RequestEvent | LegacyH3Event;
 export interface SessionHooks {
     /**
      * Called when fetching the session from the API
      * - Add extra properties to the session
      * - Throw an error if the session could not be verified (with a database for example)
      */
-    fetch: (session: UserSession, event: H3Event) => void | Promise<void>;
+    fetch: (session: UserSession, event: RequestEvent) => void | Promise<void>;
     /**
      * Called before clearing the session
      */
-    clear: (session: UserSession, event: H3Event) => void | Promise<void>;
+    clear: (session: UserSession, event: RequestEvent) => void | Promise<void>;
 }
 export declare const sessionHooks: import("hookable").Hookable<SessionHooks, import("hookable").HookKeys<SessionHooks>>;
 /**
  * Get the user session from the current request
- * @param event The Request (h3) event
+ * @param event The request event
  * @returns The user session
  */
-export declare function getUserSession(event: UseSessionEvent): Promise<UserSession>;
+export declare function getUserSession(event: SessionEvent): Promise<UserSession>;
 /**
  * Set a user session
- * @param event The Request (h3) event
+ * @param event The request event
  * @param data User session data, please only store public information since it can be decoded with API calls
  * @see https://github.com/atinux/nuxt-auth-utils
  */
-export declare function setUserSession(event: SessionEvent, data: OmitWithIndexSignature<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
+export declare function setUserSession(event: WritableSessionEvent, data: UserSessionData, config?: UserSessionConfig): Promise<UserSession>;
 /**
  * Replace a user session
- * @param event The Request (h3) event
+ * @param event The request event
  * @param data User session data, please only store public information since it can be decoded with API calls
  */
-export declare function replaceUserSession(event: SessionEvent, data: OmitWithIndexSignature<UserSession, 'id'>, config?: Partial<SessionConfig>): Promise<UserSession>;
+export declare function replaceUserSession(event: WritableSessionEvent, data: UserSessionData, config?: UserSessionConfig): Promise<UserSession>;
 /**
  * Clear the user session and removing the session cookie
- * @param event The Request (h3) event
+ * @param event The request event
  * @returns true if the session was cleared
  */
-export declare function clearUserSession(event: SessionEvent, config?: Partial<SessionConfig>): Promise<boolean>;
+export declare function clearUserSession(event: WritableSessionEvent, config?: UserSessionConfig): Promise<boolean>;
 /**
  * Require a user session, throw a 401 error if the user is not logged in
  * @param event
  * @param opts Options to customize the error message and status code
- * @param opts.statusCode The status code to use for the error (defaults to 401)
+ * @param opts.status The status code to use for the error (defaults to 401)
+ * @param opts.statusCode Deprecated, use `status`
  * @param opts.message The message to use for the error (defaults to Unauthorized)
  * @see https://github.com/atinux/nuxt-auth-utils
  */
-export declare function requireUserSession(event: UseSessionEvent, opts?: {
+export declare function requireUserSession(event: SessionEvent, opts?: {
+    status?: number;
     statusCode?: number;
     message?: string;
 }): Promise<UserSessionRequired>;
-export {};

package/dist/runtime/server/utils/session.js

@@ -1,7 +1,8 @@
-import { useSession, createError, isEvent } from "h3";
+import { createError, defineEventHandler, useSession } from "nuxt/server";
 import { defu } from "defu";
 import { createHooks } from "hookable";
-import { useRuntimeConfig } from "#imports";
+import { resolveSessionConfig } from "../lib/session.js";
+export { USER_SESSION_COOKIE_NAME } from "../lib/session.js";
 export const sessionHooks = createHooks();
 export async function getUserSession(event) {
   const session = await _useSession(event);
@@ -11,53 +12,72 @@ export async function getUserSession(event) {
   };
 }
 export async function setUserSession(event, data, config) {
-  const session = await _useSession(event, config);
-  await session.update(defu(data, session.data));
+  const session = await _useSession(event, config, true);
+  await session.update(defu(toJSONData(data), session.data));
   return session.data;
 }
 export async function replaceUserSession(event, data, config) {
-  const session = await _useSession(event, config);
-  await session.clear();
+  const session = await _useSession(event, config, true);
   await session.update((oldData) => {
     for (const key of Object.keys(oldData)) {
       Reflect.deleteProperty(oldData, key);
     }
-    return data;
+    return toJSONData(data);
   });
   return session.data;
 }
 export async function clearUserSession(event, config) {
-  const session = await _useSession(event, config);
-  await sessionHooks.callHookParallel("clear", session.data, event);
+  const session = await _useSession(event, config, true);
+  await sessionHooks.callHookParallel("clear", session.data, toSessionEvent(event).event);
   await session.clear();
   return true;
 }
 export async function requireUserSession(event, opts = {}) {
   const userSession = await getUserSession(event);
   if (!userSession.user) {
-    if (isEvent(event)) {
-      throw createError({
-        statusCode: opts.statusCode || 401,
-        message: opts.message || "Unauthorized"
-      });
-    } else {
-      throw new Response(opts.message || "Unauthorized", {
-        status: opts.statusCode || 401
-      });
+    const status = opts.status || opts.statusCode || 401;
+    const message = opts.message || "Unauthorized";
+    if (toSessionEvent(event).webSocket) {
+      throw new Response(message, { status });
     }
+    throw createError({ status, message });
   }
   return userSession;
 }
-let sessionConfig;
-function _useSession(event, config = {}) {
-  if (!sessionConfig) {
-    const runtimeConfig = useRuntimeConfig(isEvent(event) ? event : void 0);
-    const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
-    sessionConfig = defu({ password: process.env[envSessionPassword] }, runtimeConfig.session);
-    if (!sessionConfig.password) {
-      console.error(`[nuxt-auth-utils] ${envSessionPassword} environment variable or runtimeConfig.session.password was not set.`);
-    }
+async function _useSession(event, config = {}, write = false) {
+  const { event: sessionEvent, webSocket } = toSessionEvent(event);
+  if (write && webSocket) {
+    throw createError({
+      status: 500,
+      message: "[nuxt-auth-utils] The user session is read-only in WebSocket handlers: `setUserSession`, `replaceUserSession` and `clearUserSession` need the event of an HTTP request."
+    });
+  }
+  return useSession(sessionEvent, resolveSessionConfig(config));
+}
+function toJSONData(data) {
+  return JSON.parse(JSON.stringify(data));
+}
+const toPortableEvent = defineEventHandler((event) => event);
+function toSessionEvent(event) {
+  const input = event;
+  if (input["~portable"] === true || typeof input.res?.headers?.append === "function") {
+    return { event: input, webSocket: false };
+  }
+  if (input.node?.req) {
+    return { event: toPortableEvent(input), webSocket: false };
   }
-  const finalConfig = defu(config, sessionConfig);
-  return useSession(event, finalConfig);
+  const headers = input.request?.headers || input.headers;
+  if (headers && typeof headers.get === "function") {
+    return {
+      event: {
+        req: { headers },
+        res: { status: 200, statusText: "", headers: new Headers() }
+      },
+      webSocket: true
+    };
+  }
+  throw createError({
+    status: 500,
+    message: "[nuxt-auth-utils] The session utils need a request event, a WebSocket peer or a WebSocket upgrade request."
+  });
 }

package/dist/runtime/types/event.d.ts

@@ -1,4 +1,28 @@
-import type { H3Event } from 'h3';
-import type { RequestEvent } from '@nuxt/schema';
+import type { RequestEvent } from 'nuxt/server';
+import type { IncomingMessage, ServerResponse } from 'node:http';
 export type { RequestEvent };
-export type SessionEvent = H3Event | RequestEvent;
+/**
+ * The h3 v1 event a handler defined with `defineEventHandler` from `h3` (or its auto-import) receives on Nuxt 4.
+ * @deprecated Use `defineEventHandler` from `nuxt/server`. Removed with Nuxt 5 support.
+ */
+export interface LegacyH3Event {
+    node: {
+        req: IncomingMessage;
+        res: ServerResponse;
+    };
+}
+/**
+ * A WebSocket peer or upgrade request, from `defineWebSocketHandler`.
+ * The session is read-only: changes are not sent back to the client.
+ */
+export type WebSocketSessionEvent = {
+    request: {
+        headers: Headers;
+    };
+} | {
+    headers: Headers;
+};
+/**
+ * Any event the session utils accept.
+ */
+export type SessionEvent = RequestEvent | LegacyH3Event | WebSocketSessionEvent;

package/dist/runtime/types/index.d.ts

@@ -1,4 +1,4 @@
 export type { User, UserSession, UserSessionRequired, UserSessionComposable, SecureSessionData } from './session.js';
-export type { RequestEvent, SessionEvent } from './event.js';
+export type { RequestEvent, SessionEvent, LegacyH3Event, WebSocketSessionEvent } from './event.js';
 export type { OAuthConfig, OAuthProvider, ATProtoProvider, OnError } from './oauth-config.js';
 export type { WebAuthnCredential, WebAuthnRegisterEventHandlerOptions, WebAuthnAuthenticateEventHandlerOptions, WebAuthnComposable, WebAuthnUser, } from './webauthn.js';