nuxt-auth-utils 0.5.5 → 0.5.7

package/README.md

@@ -214,6 +214,7 @@ It can also be set using environment variables:
 - GitHub
 - GitLab
 - Google
+- Hubspot
 - Instagram
 - Keycloak
 - Linear
@@ -224,6 +225,7 @@ It can also be set using environment variables:
 - Seznam
 - Spotify
 - Steam
+- Strava
 - TikTok
 - Twitch
 - VK
@@ -231,6 +233,7 @@ It can also be set using environment variables:
 - X (Twitter)
 - XSUAA
 - Yandex
+- Zitadel
 
 You can add your favorite provider by creating a new file in [src/runtime/server/lib/oauth/](./src/runtime/server/lib/oauth/).
 

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -157,6 +157,7 @@ const module = defineNuxtModule({
       clientId: "",
       clientSecret: "",
       serverUrl: "",
+      serverUrlInternal: "",
       realm: "",
       redirectURL: ""
     });
@@ -249,6 +250,16 @@ const module = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.strava = defu(runtimeConfig.oauth.strava, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
+    runtimeConfig.oauth.hubspot = defu(runtimeConfig.oauth.hubspot, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
   }
 });
 

package/dist/runtime/app/plugins/session.client.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+declare const _default: any;
 export default _default;

package/dist/runtime/app/plugins/session.server.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+declare const _default: any;
 export default _default;

package/dist/runtime/server/lib/oauth/cognito.d.ts

@@ -35,10 +35,5 @@ export interface OAuthCognitoConfig {
      * @default process.env.NUXT_OAUTH_COGNITO_REDIRECT_URL or current URL
      */
     redirectURL?: string;
-    /**
-     * AWS Cognito App Custom Domain – some pool configurations require this
-     * @default ''
-     */
-    domain?: string;
 }
 export declare function defineOAuthCognitoEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthCognitoConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/cognito.js

@@ -1,7 +1,8 @@
+import { defu } from "defu";
 import { eventHandler, getQuery, sendRedirect } from "h3";
+import { discovery } from "openid-client";
 import { withQuery } from "ufo";
-import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -11,9 +12,16 @@ export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
     if (!config.clientId || !config.clientSecret || !config.userPoolId || !config.region) {
       return handleMissingConfiguration(event, "cognito", ["clientId", "clientSecret", "userPoolId", "region"], onError);
     }
-    const urlBase = config?.domain || `${config.userPoolId}.auth.${config.region}.amazoncognito.com`;
-    const authorizationURL = `https://${urlBase}/oauth2/authorize`;
-    const tokenURL = `https://${urlBase}/oauth2/token`;
+    const congitoDiscoveryUrl = new URL(`https://cognito-idp.${config.region}.amazonaws.com/${config.userPoolId}/.well-known/openid-configuration`);
+    const issuer = await discovery(congitoDiscoveryUrl, config.clientId, config.clientSecret);
+    const {
+      authorization_endpoint: authorizationURL,
+      token_endpoint: tokenURL,
+      userinfo_endpoint: userinfoURL,
+      // TODO: implement logout
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+      end_session_endpoint: logoutURL
+    } = issuer.serverMetadata();
     const query = getQuery(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {
@@ -46,7 +54,7 @@ export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
     }
     const tokenType = tokens.token_type;
     const accessToken = tokens.access_token;
-    const user = await $fetch(`https://${urlBase}/oauth2/userInfo`, {
+    const user = await $fetch(userinfoURL, {
       headers: {
         Authorization: `${tokenType} ${accessToken}`
       }

package/dist/runtime/server/lib/oauth/dropbox.js

@@ -11,8 +11,8 @@ export function defineOAuthDropboxEventHandler({ config, onSuccess, onError }) {
       authorizationParams: {}
     });
     const query = getQuery(event);
-    if (!config.clientId) {
-      return handleMissingConfiguration(event, "dropbox", ["clientId"], onError);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "dropbox", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {

package/dist/runtime/server/lib/oauth/facebook.js

@@ -24,8 +24,8 @@ export function defineOAuthFacebookEventHandler({
       if (!onError) throw error;
       return onError(event, error);
     }
-    if (!config.clientId) {
-      return handleMissingConfiguration(event, "facebook", ["clientId"], onError);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "facebook", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {

package/dist/runtime/server/lib/oauth/google.js

@@ -16,8 +16,8 @@ export function defineOAuthGoogleEventHandler({
       authorizationParams: {}
     });
     const query = getQuery(event);
-    if (!config.clientId) {
-      return handleMissingConfiguration(event, "google", ["clientId"], onError);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "google", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {

package/dist/runtime/server/lib/oauth/hubspot.d.ts

@@ -0,0 +1,26 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthHubspotConfig {
+    /**
+     * Hubspot OAuth Client ID
+     * @default process.env.NUXT_OAUTH_HUBSPOT_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Hubspot OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_HUBSPOT_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Hubspot OAuth Redirect URL
+     * @default process.env.NUXT_OAUTH_HUBSPOT_REDIRECT_URL
+     */
+    redirectURL?: string;
+    /**
+     * Hubspot OAuth Scope
+     * @default ['oauth']
+     * @see https://developers.hubspot.com/beta-docs/guides/apps/authentication/scopes
+     * @example ['accounting', 'automation', 'actions']
+     */
+    scope?: string[];
+}
+export declare function defineOAuthHubspotEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthHubspotConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/hubspot.js

@@ -0,0 +1,57 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import defu from "defu";
+import {
+  getOAuthRedirectURL,
+  handleAccessTokenErrorResponse,
+  handleMissingConfiguration,
+  requestAccessToken
+} from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthHubspotEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.hubspot);
+    if (!config.clientId || !config.clientSecret || !config.redirectURL) {
+      return handleMissingConfiguration(event, "hubspot", ["clientId", "clientSecret", "redirectURL"], onError);
+    }
+    const query = getQuery(event);
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (query.error) {
+      return handleAccessTokenErrorResponse(event, "hubspot", query, onError);
+    }
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery("https://app.hubspot.com/oauth/authorize", {
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope?.join(" ") || "oauth"
+        })
+      );
+    }
+    const tokens = await requestAccessToken(
+      "https://api.hubapi.com/oauth/v1/token",
+      {
+        body: {
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          code: query.code,
+          redirect_uri: redirectURL,
+          grant_type: "authorization_code"
+        }
+      }
+    );
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "hubspot", tokens, onError);
+    }
+    const info = await $fetch("https://api.hubapi.com/oauth/v1/access-tokens/" + tokens.access_token);
+    return onSuccess(event, {
+      user: {
+        id: info.user_id,
+        email: info.user,
+        domain: info.hub_domain
+      },
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/instagram.d.ts

@@ -12,21 +12,21 @@ export interface OAuthInstagramConfig {
     clientSecret?: string;
     /**
      * Instagram OAuth Scope
-     * @default [ 'user_profile' ]
+     * @required [ 'business_basic' ]
      * @see https://developers.facebook.com/docs/instagram-basic-display-api/overview#permissions
-     * @example [ 'user_profile', 'user_media' ],
+     * @example [ 'business_basic', 'business_manage_messages' ],
      */
-    scope?: string[];
+    scope?: ('business_basic' | 'business_content_publish' | 'business_manage_comments' | 'business_manage_messages')[];
     /**
      * Instagram OAuth User Fields
      * @default [ 'id', 'username'],
      * @see https://developers.facebook.com/docs/instagram-basic-display-api/reference/user#fields
-     * @example [ 'id', 'username', 'account_type', 'media_count' ],
+     * @example [ 'id', 'username', 'user_id', 'account_type', 'profile_picture_url' ],
      */
-    fields?: string[];
+    fields?: ('id' | 'user_id' | 'username' | 'name' | 'account_type' | 'profile_picture_url' | 'followers_count' | 'follows_count' | 'media_count')[];
     /**
      * Instagram OAuth Authorization URL
-     * @default 'https://api.instagram.com/oauth/authorize'
+     * @default 'https://www.instagram.com/oauth/authorize'
      */
     authorizationURL?: string;
     /**

package/dist/runtime/server/lib/oauth/instagram.js

@@ -10,8 +10,8 @@ export function defineOAuthInstagramEventHandler({
 }) {
   return eventHandler(async (event) => {
     config = defu(config, useRuntimeConfig(event).oauth?.instagram, {
-      scope: ["user_profile"],
-      authorizationURL: "https://api.instagram.com/oauth/authorize",
+      scope: ["business_basic"],
+      authorizationURL: "https://www.instagram.com/oauth/authorize",
       tokenURL: "https://api.instagram.com/oauth/access_token",
       authorizationParams: {}
     });
@@ -20,13 +20,17 @@ export function defineOAuthInstagramEventHandler({
       const error = createError({
         statusCode: 401,
         message: `Instagram login failed: ${query.error || "Unknown error"}`,
-        data: query
+        data: {
+          error: query.error,
+          error_reason: query.error_reason,
+          error_description: query.error_description
+        }
       });
       if (!onError) throw error;
       return onError(event, error);
     }
-    if (!config.clientId) {
-      return handleMissingConfiguration(event, "instagram", ["clientId"], onError);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "instagram", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {
@@ -36,7 +40,7 @@ export function defineOAuthInstagramEventHandler({
         withQuery(config.authorizationURL, {
           client_id: config.clientId,
           redirect_uri: redirectURL,
-          scope: config.scope.join(" "),
+          scope: config.scope.join(),
           response_type: "code"
         })
       );
@@ -55,9 +59,9 @@ export function defineOAuthInstagramEventHandler({
     }
     const accessToken = tokens.access_token;
     config.fields = config.fields || ["id", "username"];
-    const fields = config.fields.join(",");
+    const fields = config.fields.join();
     const user = await $fetch(
-      `https://graph.instagram.com/v20.0/me?fields=${fields}&access_token=${accessToken}`
+      `https://graph.instagram.com/v21.0/me?fields=${fields}&access_token=${accessToken}`
     );
     if (!user) {
       throw new Error("Instagram login failed: no user found");

package/dist/runtime/server/lib/oauth/keycloak.d.ts

@@ -12,10 +12,17 @@ export interface OAuthKeycloakConfig {
     clientSecret?: string;
     /**
      * Keycloak OAuth Server URL
-     * @example http://192.168.1.10:8080/auth
+     * @example http://192.168.1.10:8080
      * @default process.env.NUXT_OAUTH_KEYCLOAK_SERVER_URL
      */
     serverUrl?: string;
+    /**
+     * Optional Keycloak OAuth Server URL to use internally, e.g. if Nuxt connects to a Docker hostname while the browser
+     * redirect goes to localhost
+     * @example http://keycloak:8080
+     * @default process.env.NUXT_OAUTH_KEYCLOAK_SERVER_URL_INTERNAL
+     */
+    serverUrlInternal?: string;
     /**
      * Keycloak OAuth Realm
      * @default process.env.NUXT_OAUTH_KEYCLOAK_REALM
@@ -33,7 +40,7 @@ export interface OAuthKeycloakConfig {
      */
     authorizationParams?: Record<string, string>;
     /**
-     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
      * @default process.env.NUXT_OAUTH_KEYCLOAK_REDIRECT_URL or current URL
      */
     redirectURL?: string;

package/dist/runtime/server/lib/oauth/keycloak.js

@@ -26,8 +26,9 @@ export function defineOAuthKeycloakEventHandler({
       return handleMissingConfiguration(event, "keycloak", ["clientId", "clientSecret", "serverUrl", "realm"], onError);
     }
     const realmURL = `${config.serverUrl}/realms/${config.realm}`;
+    const realmURLInternal = `${config.serverUrlInternal || config.serverUrl}/realms/${config.realm}`;
     const authorizationURL = `${realmURL}/protocol/openid-connect/auth`;
-    const tokenURL = `${realmURL}/protocol/openid-connect/token`;
+    const tokenURL = `${realmURLInternal}/protocol/openid-connect/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {
       config.scope = config.scope || ["openid"];

package/dist/runtime/server/lib/oauth/paypal.js

@@ -12,8 +12,8 @@ export function defineOAuthPaypalEventHandler({ config, onSuccess, onError }) {
       authorizationParams: {}
     });
     const query = getQuery(event);
-    if (!config.clientId) {
-      return handleMissingConfiguration(event, "paypal", ["clientId"], onError);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "paypal", ["clientId", "clientSecret"], onError);
     }
     let paypalAPI = "api-m.paypal.com";
     if (config.sandbox) {

package/dist/runtime/server/lib/oauth/seznam.d.ts

@@ -92,4 +92,4 @@ export interface OAuthSeznamUser {
      */
     gender?: string | null;
 }
-export declare function defineOAUthSeznamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSeznamConfig, OAuthSeznamUser>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export declare function defineOAuthSeznamEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthSeznamConfig, OAuthSeznamUser>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/seznam.js

@@ -3,16 +3,16 @@ import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
-export function defineOAUthSeznamEventHandler({ config, onSuccess, onError }) {
+export function defineOAuthSeznamEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
-    config = defu(config, useRuntimeConfig(event).oauth?.google, {
+    config = defu(config, useRuntimeConfig(event).oauth?.seznam, {
       authorizationURL: "https://login.szn.cz/api/v1/oauth/auth",
       tokenURL: "https://login.szn.cz/api/v1/oauth/token",
       userURL: "https://login.szn.cz/api/v1/user"
     });
     const query = getQuery(event);
-    if (!config.clientId) {
-      return handleMissingConfiguration(event, "seznam", ["clientId"], onError);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "seznam", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {

package/dist/runtime/server/lib/oauth/strava.d.ts

@@ -0,0 +1,116 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthStravaConfig {
+    /**
+     * Strava OAuth Client ID
+     * @default process.env.NUXT_OAUTH_STRAVA_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Strava OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_STRAVA_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Strava OAuth Scope
+     * @default []
+     * @see https://developers.strava.com/docs/authentication/ # Details About Requesting Access
+     * @example ['read', 'read_all', 'profile:read_all', 'profile:write', 'activity:read', 'activity:read_all', 'activity:write']
+     */
+    scope?: string[];
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_STRAVA_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+    /**
+     * To show the authorization prompt to the user, 'force' will always show the prompt
+     * @default 'auto'
+     * @see https://developers.strava.com/docs/authentication/ # Details About Requesting Access
+     */
+    approvalPrompt?: 'auto' | 'force';
+}
+export interface OAuthStravaUser {
+    /**
+     * The unique identifier of the athlete
+     */
+    id: number;
+    /**
+     * The username of the athlete
+     */
+    username: string;
+    /**
+     * Resource state, indicates level of detail.
+     * - Meta (1): Basic information
+     * - Summary (2): Summary information
+     * - Detail (3): Detailed information
+     * @see https://developers.strava.com/docs/reference/#api-models-DetailedAthlete
+     */
+    resource_state: 1 | 2 | 3;
+    /**
+     * The athlete's first name
+     */
+    firstname: string;
+    /**
+     * The athlete's last name
+     */
+    lastname: string;
+    /**
+     * The athlete's bio
+     */
+    bio: string;
+    /**
+     * The athlete's city
+     */
+    city: string;
+    /**
+     * The athlete's state or geographical region
+     */
+    state: string;
+    /**
+     * The athlete's country
+     */
+    country: string;
+    /**
+     * The athlete's sex
+     */
+    sex: string;
+    /**
+     * Whether the athlete has any Summit subscription
+     * @see https://developers.strava.com/docs/reference/#api-models-DetailedAthlete
+     */
+    summit: boolean;
+    /**
+     * The time at which the athlete was created
+     */
+    created_at: Date;
+    /**
+     * The time at which the athlete was last updated
+     */
+    updated_at: Date;
+    /**
+     * The athlete's weight
+     */
+    weight: number;
+    /**
+     * URL to a 124x124 pixel profile picture
+     */
+    profile_medium: string;
+    /**
+     * URL to a 62x62 pixel profile picture
+     */
+    profile: string;
+    /**
+     * The athlete's timezone
+     */
+    timezone: string;
+}
+export interface OAuthStravaTokens {
+    token_type: 'Bearer';
+    expires_at: number;
+    expires_in: number;
+    access_token: string;
+    refresh_token: string;
+    athlete: OAuthStravaUser;
+    error?: string;
+}
+export declare function defineOAuthStravaEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthStravaConfig, OAuthStravaUser>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/strava.js

@@ -0,0 +1,73 @@
+import { eventHandler, getQuery, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import {
+  getOAuthRedirectURL,
+  handleAccessTokenErrorResponse,
+  handleMissingConfiguration,
+  requestAccessToken
+} from "../utils.js";
+import { useRuntimeConfig, createError } from "#imports";
+export function defineOAuthStravaEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.strava);
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Strava login failed: ${query.error || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(
+        event,
+        "strava",
+        ["clientId", "clientSecret"],
+        onError
+      );
+    }
+    const authorizationURL = "https://www.strava.com/oauth/authorize";
+    const tokenURL = "https://www.strava.com/oauth/token";
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery(authorizationURL, {
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          response_type: "code",
+          approval_prompt: config.approvalPrompt || "auto",
+          scope: config.scope
+        })
+      );
+    }
+    const tokens = await requestAccessToken(tokenURL, {
+      body: {
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code: query.code,
+        grant_type: "authorization_code",
+        redirect_uri: redirectURL
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "strava", tokens, onError);
+    }
+    const user = await $fetch("https://www.strava.com/api/v3/athlete", {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/twitch.js

@@ -11,8 +11,8 @@ export function defineOAuthTwitchEventHandler({ config, onSuccess, onError }) {
       authorizationParams: {}
     });
     const query = getQuery(event);
-    if (!config.clientId) {
-      return handleMissingConfiguration(event, "twitch", ["clientId"], onError);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "twitch", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {

package/dist/runtime/server/lib/oauth/workos.d.ts

@@ -5,22 +5,27 @@ import type { OAuthConfig } from '#auth-utils';
  */
 export interface OAuthWorkOSConfig {
     /**
-     * WorkOS OAuth Client ID
+     * WorkOS OAuth Client ID *required
      * @default process.env.NUXT_OAUTH_WORKOS_CLIENT_ID
      */
     clientId?: string;
     /**
-     * WorkOS OAuth Client Secret (API Key)
+     * WorkOS OAuth Client Secret (API Key) *required
      * @default process.env.NUXT_OAUTH_WORKOS_CLIENT_SECRET
      */
     clientSecret?: string;
     /**
-     * WorkOS OAuth Connection ID (Not required for WorkOS)
+     * WorkOS OAuth Organization ID *not required
+     * @default process.env.NUXT_OAUTH_WORKOS_ORGANIZATION_ID
+     */
+    organizationId?: string;
+    /**
+     * WorkOS OAuth Connection ID *not required
      * @default process.env.NUXT_OAUTH_WORKOS_CONNECTION_ID
      */
     connectionId?: string;
     /**
-     * WorkOS OAuth screen hint
+     * WorkOS OAuth screen hint *not required
      * @default 'sign-in'
      */
     screenHint?: 'sign-in' | 'sign-up';

package/dist/runtime/server/lib/oauth/workos.js

@@ -21,14 +21,13 @@ export function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }) {
           response_type: "code",
           provider: "authkit",
           client_id: config.clientId,
-          redirect_uri: redirectURL,
-          connection_id: config.connectionId,
-          screen_hint: config.screenHint
+          redirect_uri: redirectURL || void 0,
+          connection_id: config.connectionId || void 0,
+          screen_hint: config.screenHint || "sign-in",
+          organization_id: config.organizationId || void 0
         })
       );
     }
-    const ip_address = getRequestIP(event);
-    const user_agent = getRequestHeader(event, "user-agent");
     const authenticateResponse = await requestAccessToken("https://api.workos.com/user_management/authenticate", {
       headers: {
         "Content-Type": "application/json"
@@ -38,8 +37,8 @@ export function defineOAuthWorkOSEventHandler({ config, onSuccess, onError }) {
         client_id: config.clientId,
         client_secret: config.clientSecret,
         redirect_uri: redirectURL,
-        ip_address,
-        user_agent,
+        ip_address: getRequestIP(event),
+        user_agent: getRequestHeader(event, "user-agent"),
         code: query.code
       }
     });

package/dist/runtime/server/lib/oauth/x.js

@@ -25,8 +25,8 @@ export function defineOAuthXEventHandler({
       }
     });
     const query = getQuery(event);
-    if (!config.clientId) {
-      return handleMissingConfiguration(event, "x", ["clientId"], onError);
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "x", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {

package/dist/runtime/server/lib/oauth/zitadel.js

@@ -59,7 +59,6 @@ export function defineOAuthZitadelEventHandler({ config, onSuccess, onError }) {
         Accept: "application/json"
       }
     });
-    console.log("Zitadel user:", user);
     if (!user) {
       const error = createError({
         statusCode: 500,

package/dist/runtime/types/oauth-config.d.ts

@@ -1,5 +1,5 @@
 import type { H3Event, H3Error } from 'h3';
-export type OAuthProvider = 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'instagram' | 'keycloak' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | (string & {});
+export type OAuthProvider = 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'keycloak' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@9.13.2",
+  "packageManager": "pnpm@9.15.0",
   "exports": {
     ".": {
       "types": "./dist/types.d.ts",
@@ -36,12 +36,13 @@
   },
   "dependencies": {
     "@adonisjs/hash": "^9.0.5",
-    "@nuxt/kit": "^3.14.159",
+    "@nuxt/kit": "^3.14.1592",
     "defu": "^6.1.4",
     "h3": "^1.13.0",
     "hookable": "^5.5.3",
     "ofetch": "^1.4.1",
     "ohash": "^1.1.4",
+    "openid-client": "^6.1.7",
     "pathe": "^1.1.2",
     "scule": "^1.3.0",
     "uncrypto": "^0.1.3"
@@ -59,20 +60,20 @@
     }
   },
   "devDependencies": {
-    "@iconify-json/simple-icons": "^1.2.11",
+    "@iconify-json/simple-icons": "^1.2.15",
     "@nuxt/devtools": "latest",
-    "@nuxt/eslint-config": "^0.6.1",
+    "@nuxt/eslint-config": "^0.7.3",
     "@nuxt/module-builder": "^0.8.4",
-    "@nuxt/schema": "^3.14.159",
-    "@nuxt/test-utils": "^3.14.4",
-    "@nuxt/ui": "^2.19.2",
-    "@nuxt/ui-pro": "^1.5.0",
+    "@nuxt/schema": "^3.14.1592",
+    "@nuxt/test-utils": "^3.15.1",
+    "@nuxt/ui": "^2.20.0",
+    "@nuxt/ui-pro": "^1.6.0",
     "@simplewebauthn/types": "^11.0.0",
     "changelogen": "^0.5.7",
-    "eslint": "^9.14.0",
-    "nuxt": "^3.14.159",
+    "eslint": "^9.16.0",
+    "nuxt": "^3.14.1592",
     "typescript": "^5.6.3",
-    "vitest": "^2.1.5",
+    "vitest": "^2.1.8",
     "vue-tsc": "^2.1.10"
   }
 }