nuxt-auth-utils 0.5.4 → 0.5.5

package/README.md

@@ -221,11 +221,13 @@ It can also be set using environment variables:
 - Microsoft
 - PayPal
 - Polar
+- Seznam
 - Spotify
 - Steam
 - TikTok
 - Twitch
 - VK
+- WorkOS
 - X (Twitter)
 - XSUAA
 - Yandex
@@ -349,10 +351,21 @@ The following code does not include the actual database queries, but shows the g
 import { z } from 'zod'
 export default defineWebAuthnRegisterEventHandler({
   // optional
-  validateUser: z.object({
-    // we want the userName to be a valid email
-    userName: z.string().email() 
-  }).parse,
+  async validateUser(userBody, event) {
+    // bonus: check if the user is already authenticated to link a credential to his account
+    // We first check if the user is already authenticated by getting the session
+    // And verify that the email is the same as the one in session
+    const session = await getUserSession(event)
+    if (session.user?.email && session.user.email !== body.userName) {
+      throw createError({ statusCode: 400, message: 'Email not matching curent session' })
+    }
+
+    // If he registers a new account with credentials
+    return z.object({
+      // we want the userName to be a valid email
+      userName: z.string().email() 
+    }).parse(userBody)
+  },
   async onSuccess(event, { credential, user }) {
     // The credential creation has been successful
     // We need to create a user if it does not exist

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -126,6 +126,13 @@ const module = defineNuxtModule({
       audience: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.workos = defu(runtimeConfig.oauth.workos, {
+      clientId: "",
+      clientSecret: "",
+      connectionId: "",
+      screenHint: "",
+      redirectURL: ""
+    });
     runtimeConfig.oauth.microsoft = defu(runtimeConfig.oauth.microsoft, {
       clientId: "",
       clientSecret: "",
@@ -237,6 +244,11 @@ const module = defineNuxtModule({
       domain: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.seznam = defu(runtimeConfig.oauth.seznam, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/seznam.d.ts

@@ -0,0 +1,95 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthSeznamConfig {
+    /**
+     * Seznam OAuth Client ID
+     * @default process.env.NUXT_OAUTH_SEZNAM_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Seznam OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_SEZNAM_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Seznam OAuth Scope
+     * @default ['identity']
+     * @see https://vyvojari.seznam.cz/oauth/scopes?lang=en
+     * @example ['identity', 'avatar']
+     */
+    scope?: string[];
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * Redirect URL has to be set as well in the Seznam OAuth settings https://vyvojari.seznam.cz/oauth/admin in order for it to work
+     * @see https://vyvojari.seznam.cz/oauth/admin
+     * @default process.env.NUXT_OAUTH_SEZNAM_REDIRECT_URL
+     */
+    redirectURL?: string;
+    /**
+     * Seznam OAuth Authorization URL
+     * @default 'https://login.szn.cz/api/v1/oauth/auth'
+     */
+    authorizationURL?: string;
+    /**
+     * Seznam OAuth Token URL
+     * @default 'https://login.szn.cz/api/v1/oauth/token'
+     */
+    tokenURL?: string;
+    /**
+     * Seznam OAuth User URL
+     * @default 'https://login.szn.cz/api/v1/user'
+     */
+    userURL?: string;
+}
+export interface OAuthSeznamUser {
+    /**
+     * Unique persistent user account identifier
+     */
+    oauth_user_id: string;
+    /**
+     * The user's e-mail address or null for users without an e-mail
+     */
+    email: string | null;
+    /**
+     * Given name (when available)
+     */
+    firstname: string;
+    /**
+     * Family name (when available)
+     */
+    lastname: string;
+    /**
+     * User account identifier suitable for usage within the Seznam ad infrastructure
+     */
+    advert_user_id: string;
+    /**
+     * (only when provided and validated by the user; null otherwise)
+     * Available only when you use the contact-phone scope
+     * @see https://vyvojari.seznam.cz/oauth/scopes?lang=en
+     */
+    contact_phone?: string | null;
+    /**
+     *  the image's URL
+     * Available only when you use the avatar scope
+     * @see https://vyvojari.seznam.cz/oauth/scopes?lang=en
+     */
+    avatar_url?: string | null;
+    /**
+     * true/false value corresponding to the user's adult status
+     * Available only when you use the avatar scope
+     * @see https://vyvojari.seznam.cz/oauth/scopes?lang=en
+     */
+    adulthood?: boolean;
+    /**
+     * date of birth in the ISO 8601 format (only when present; null otherwise)
+     * Available only when you use the birthday scope
+     * @see https://vyvojari.seznam.cz/oauth/scopes?lang=en
+     */
+    birthday?: string | null;
+    /**
+     * one of the allowed strings "Male" / "Female" / "Other" (null if not set)
+     * Available only when you use the gender scope
+     * @see https://vyvojari.seznam.cz/oauth/scopes?lang=en
+     */
+    gender?: string | null;
+}
+export declare function defineOAUthSeznamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSeznamConfig, OAuthSeznamUser>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/seznam.js

@@ -0,0 +1,57 @@
+import defu from "defu";
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAUthSeznamEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.google, {
+      authorizationURL: "https://login.szn.cz/api/v1/oauth/auth",
+      tokenURL: "https://login.szn.cz/api/v1/oauth/token",
+      userURL: "https://login.szn.cz/api/v1/user"
+    });
+    const query = getQuery(event);
+    if (!config.clientId) {
+      return handleMissingConfiguration(event, "seznam", ["clientId"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      config.scope = config.scope || ["identity"];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope.join(","),
+          state: query.state || ""
+        })
+      );
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        code: query.code,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "seznam", tokens, onError);
+    }
+    const accessToken = tokens.access_token;
+    const user = await $fetch(
+      config.userURL,
+      {
+        headers: {
+          Authorization: `bearer ${accessToken}`
+        }
+      }
+    );
+    return onSuccess(event, {
+      tokens,
+      user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/workos.d.ts

@@ -0,0 +1,58 @@
+import type { OAuthConfig } from '#auth-utils';
+/**
+ * WorkOS OAuth Configuration
+ * @see https://workos.com/docs/reference/user-management/authentication
+ */
+export interface OAuthWorkOSConfig {
+    /**
+     * WorkOS OAuth Client ID
+     * @default process.env.NUXT_OAUTH_WORKOS_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * WorkOS OAuth Client Secret (API Key)
+     * @default process.env.NUXT_OAUTH_WORKOS_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * WorkOS OAuth Connection ID (Not required for WorkOS)
+     * @default process.env.NUXT_OAUTH_WORKOS_CONNECTION_ID
+     */
+    connectionId?: string;
+    /**
+     * WorkOS OAuth screen hint
+     * @default 'sign-in'
+     */
+    screenHint?: 'sign-in' | 'sign-up';
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_WORKOS_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export interface OAuthWorkOSUser {
+    object: 'user';
+    id: string;
+    email: string;
+    first_name: string | null;
+    last_name: string | null;
+    email_verified: boolean;
+    profile_picture_url: string | null;
+    created_at: string;
+    updated_at: string;
+}
+export type OAuthWorkOSAuthenticationMethod = 'SSO' | 'Password' | 'AppleOAuth' | 'GitHubOAuth' | 'GoogleOAuth' | 'MicrosoftOAuth' | 'MagicAuth' | 'Impersonation';
+export interface OAuthWorkOSAuthenticateResponse {
+    user: OAuthWorkOSUser;
+    organization_id: string | null;
+    access_token: string;
+    refresh_token: string;
+    error: string | null;
+    error_description: string | null;
+    authentication_method: OAuthWorkOSAuthenticationMethod;
+}
+export interface OAuthWorkOSTokens {
+    access_token: string;
+    refresh_token: string;
+}
+export declare function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthWorkOSConfig, OAuthWorkOSUser, OAuthWorkOSTokens>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/workos.js

@@ -0,0 +1,54 @@
+import { eventHandler, getQuery, sendRedirect, getRequestIP, getRequestHeader } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.workos, { screen_hint: "sign-in" });
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "workos", ["clientId", "clientSecret"], onError);
+    }
+    const query = getQuery(event);
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (query.error) {
+      return handleAccessTokenErrorResponse(event, "workos", query, onError);
+    }
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery("https://api.workos.com/user_management/authorize", {
+          response_type: "code",
+          provider: "authkit",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          connection_id: config.connectionId,
+          screen_hint: config.screenHint
+        })
+      );
+    }
+    const ip_address = getRequestIP(event);
+    const user_agent = getRequestHeader(event, "user-agent");
+    const authenticateResponse = await requestAccessToken("https://api.workos.com/user_management/authenticate", {
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        ip_address,
+        user_agent,
+        code: query.code
+      }
+    });
+    if (authenticateResponse.error) {
+      return handleAccessTokenErrorResponse(event, "workos", authenticateResponse, onError);
+    }
+    return onSuccess(event, {
+      tokens: { access_token: authenticateResponse.access_token, refresh_token: authenticateResponse.refresh_token },
+      user: authenticateResponse.user
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/xsuaa.js

@@ -35,7 +35,7 @@ export function defineOAuthXSUAAEventHandler({ config, onSuccess, onError }) {
       }
     });
     if (tokens.error) {
-      return handleAccessTokenErrorResponse(event, "auth0", tokens, onError);
+      return handleAccessTokenErrorResponse(event, "xsuaa", tokens, onError);
     }
     const tokenType = tokens.token_type;
     const accessToken = tokens.access_token;

package/dist/runtime/server/lib/utils.d.ts

@@ -12,6 +12,7 @@ export interface RequestAccessTokenBody {
     redirect_uri: string;
     client_id: string;
     client_secret?: string;
+    [key: string]: string | undefined;
 }
 interface RequestAccessTokenOptions {
     body?: RequestAccessTokenBody;

package/dist/runtime/server/lib/webauthn/register.d.ts

@@ -1,7 +1,8 @@
-import type { ValidateFunction } from 'h3';
+import type { H3Event } from 'h3';
 import type { WebAuthnUser, WebAuthnRegisterEventHandlerOptions } from '#auth-utils';
+import type { ValidateUserFunction } from '~/src/runtime/types/webauthn';
 export declare function defineWebAuthnRegisterEventHandler<T extends WebAuthnUser>({ storeChallenge, getChallenge, getOptions, validateUser, excludeCredentials, onSuccess, onError, }: WebAuthnRegisterEventHandlerOptions<T>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void | import("@simplewebauthn/server").VerifiedRegistrationResponse | {
     creationOptions: import("@simplewebauthn/types").PublicKeyCredentialCreationOptionsJSON;
     attemptId: string;
 }>>;
-export declare function validateUserData<T>(data: unknown, fn: ValidateFunction<T>): Promise<T>;
+export declare function validateUserData<T>(userBody: WebAuthnUser, event: H3Event, fn: ValidateUserFunction<T>): Promise<T>;

package/dist/runtime/server/lib/webauthn/register.js

@@ -23,7 +23,7 @@ export function defineWebAuthnRegisterEventHandler({
       });
     let user = body.user;
     if (validateUser) {
-      user = await validateUserData(body.user, validateUser);
+      user = await validateUserData(body.user, event, validateUser);
     }
     const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig(event).webauthn.register, {
       rpID: url.hostname,
@@ -97,24 +97,24 @@ export function defineWebAuthnRegisterEventHandler({
     }
   });
 }
-export async function validateUserData(data, fn) {
+export async function validateUserData(userBody, event, fn) {
   try {
-    const res = await fn(data);
+    const res = await fn(userBody, event);
     if (res === false) {
       throw createUserValidationError();
     }
     if (res === true) {
-      return data;
+      return userBody;
     }
-    return res ?? data;
+    return res ?? userBody;
   } catch (error) {
     throw createUserValidationError(error);
   }
 }
 function createUserValidationError(validateError) {
   throw createError({
-    status: 400,
-    message: "User Validation Error",
+    status: validateError?.statusCode || 400,
+    message: validateError?.message || "User Validation Error",
     data: validateError
   });
 }

package/dist/runtime/types/oauth-config.d.ts

@@ -1,5 +1,5 @@
 import type { H3Event, H3Error } from 'h3';
-export type OAuthProvider = 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | (string & {});
+export type OAuthProvider = 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/dist/runtime/types/webauthn.d.ts

@@ -1,6 +1,6 @@
 import type { AuthenticationResponseJSON, AuthenticatorTransportFuture, RegistrationResponseJSON } from '@simplewebauthn/types';
 import type { Ref } from 'vue';
-import type { H3Event, H3Error, ValidateFunction } from 'h3';
+import type { H3Event, H3Error, ValidateResult } from 'h3';
 import type { GenerateAuthenticationOptionsOpts, GenerateRegistrationOptionsOpts, VerifiedAuthenticationResponse, VerifiedRegistrationResponse } from '@simplewebauthn/server';
 export interface WebAuthnCredential {
     id: string;
@@ -36,13 +36,14 @@ export type RegistrationBody<T extends WebAuthnUser> = {
     attemptId: string;
     response: RegistrationResponseJSON;
 };
+export type ValidateUserFunction<T> = (userBody: WebAuthnUser, event: H3Event) => ValidateResult<T> | Promise<ValidateResult<T>>;
 export type WebAuthnRegisterEventHandlerOptions<T extends WebAuthnUser> = WebAuthnEventHandlerBase<{
     user: T;
     credential: WebAuthnCredential;
     registrationInfo: Exclude<VerifiedRegistrationResponse['registrationInfo'], undefined>;
 }> & {
     getOptions?: (event: H3Event, body: RegistrationBody<T>) => Partial<GenerateRegistrationOptionsOpts> | Promise<Partial<GenerateRegistrationOptionsOpts>>;
-    validateUser?: ValidateFunction<T>;
+    validateUser?: ValidateUserFunction<T>;
     excludeCredentials?: (event: H3Event, userName: string) => CredentialsList | Promise<CredentialsList>;
 };
 export type AuthenticationBody = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.13.0",
+  "packageManager": "pnpm@9.13.2",
   "exports": {
     ".": {
       "types": "./dist/types.d.ts",