nuxt-auth-utils 0.5.8 → 0.5.10

package/README.md

@@ -16,13 +16,14 @@ Add Authentication to Nuxt applications with secured & sealed cookies sessions.
 ## Features
 
 - [Hybrid Rendering](#hybrid-rendering) support (SSR / CSR / SWR / Prerendering)
-- [20+ OAuth Providers](#supported-oauth-providers)
+- [30+ OAuth Providers](#supported-oauth-providers)
 - [Password Hashing](#password-hashing)
 - [WebAuthn (passkey)](#webauthn-passkey)
 - [`useUserSession()` Vue composable](#vue-composable)
 - [Tree-shakable server utils](#server-utils)
 - [`<AuthState>` component](#authstate-component)
 - [Extendable with hooks](#extend-session)
+- [WebSocket support](#websocket-support)
 
 It has few dependencies (only from [UnJS](https://github.com/unjs)), run on multiple JS environments (Node, Deno, Workers) and is fully typed with TypeScript.
 
@@ -204,6 +205,7 @@ It can also be set using environment variables:
 
 #### Supported OAuth Providers
 
+- Apple
 - Atlassian
 - Auth0
 - Authentik
@@ -596,6 +598,65 @@ You can use the `placeholder` slot to show a placeholder on server-side and whil
 
 If you are caching your routes with `routeRules`, please make sure to use [Nitro](https://github.com/unjs/nitro) >= `2.9.7` to support the client-side fetching of the user session.
 
+## WebSocket Support
+
+Nuxt Auth Utils is compatible with [Nitro WebSockets](https://nitro.build/guide/websocket).
+
+Make sure to enable the `experimental.websocket` option in your `nuxt.config.ts`:
+
+```ts
+export default defineNuxtConfig({
+  nitro: {
+    experimental: {
+      websocket: true
+    }
+  }
+})
+```
+
+You can use the `requireUserSession` function in the `upgrade` function to check if the user is authenticated before upgrading the WebSocket connection.
+
+```ts
+// server/routes/ws.ts
+export default defineWebSocketHandler({
+  async upgrade(request) {
+    // Make sure the user is authenticated before upgrading the WebSocket connection
+    await requireUserSession(request)
+  },
+  async open(peer) {
+    const { user } = await requireUserSession(peer)
+
+    peer.send(`Hello, ${user.name}!`)
+  },
+  message(peer, message) {
+    peer.send(`Echo: ${message}`)
+  },
+})
+```
+
+Then, in your application, you can use the [useWebSocket](https://vueuse.org/core/useWebSocket/) composable to connect to the WebSocket:
+
+```vue
+<script setup>
+const { status, data, send, open, close } = useWebSocket('/ws', { immediate: false })
+
+// Only open the websocket after the page is hydrated (client-only)
+onMounted(open)
+</script>
+
+<template>
+  <div>
+    <p>Status: {{ status }}</p>
+    <p>Data: {{ data }}</p>
+    <p>
+      <button @click="open">Open</button>
+      <button @click="close(1000, 'Closing')">Close</button>
+      <button @click="send('hello')">Send hello</button>
+    </p>
+  </div>
+</template>
+```
+
 ## Configuration
 
 We leverage `runtimeConfig.session` to give the defaults option to [h3 `useSession`](https://h3.unjs.io/examples/handle-session).

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.8",
+  "version": "0.5.10",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/module.mjs

@@ -33,6 +33,9 @@ const module = defineNuxtModule({
     addPlugin(resolver.resolve("./runtime/app/plugins/session.client"));
     addServerPlugin(resolver.resolve("./runtime/server/plugins/oauth"));
     addServerImportsDir(resolver.resolve("./runtime/server/lib/oauth"));
+    if (nuxt.options.nitro?.experimental?.websocket) {
+      addServerPlugin(resolver.resolve("./runtime/server/plugins/ws"));
+    }
     if (options.webAuthn) {
       const missingDeps = [];
       const peerDeps = ["@simplewebauthn/server", "@simplewebauthn/browser"];
@@ -271,6 +274,13 @@ const module = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.apple = defu(runtimeConfig.oauth.apple, {
+      teamId: "",
+      keyId: "",
+      privateKey: "",
+      redirectURL: "",
+      clientId: ""
+    });
   }
 });
 

package/dist/runtime/server/lib/oauth/apple.d.ts

@@ -0,0 +1,73 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthAppleConfig {
+    /**
+     * Apple OAuth Client ID
+     * @default process.env.NUXT_OAUTH_APPLE_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Apple OAuth team ID
+     * @default process.env.NUXT_OAUTH_APPLE_TEAM_ID
+     */
+    teamId?: string;
+    /**
+     * Apple OAuth key identifier
+     * @default process.env.NUXT_OAUTH_APPLE_KEY_ID
+     */
+    keyId?: string;
+    /**
+     * Apple OAuth Private Key. Linebreaks must be replaced with \n
+     * @example '-----BEGIN PRIVATE KEY-----\nMIGTAgEAMBMGByqGSM...\n-----END PRIVATE KEY-----'
+     * @default process.env.NUXT_OAUTH_APPLE_PRIVATE_KEY
+     */
+    privateKey?: string;
+    /**
+     * Apple OAuth Scope. Apple wants this to be a string separated by spaces, but for consistency with other providers, we also allow an array of strings.
+     * @default ''
+     * @see https://developer.apple.com/documentation/sign_in_with_apple/clientconfigi/3230955-scope
+     * @example 'name email'
+     */
+    scope?: string | string[];
+    /**
+     * Apple OAuth Authorization URL
+     * @default 'https://appleid.apple.com/auth/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://developer.apple.com/documentation/sign_in_with_apple/clientconfigi/3230955-scope
+     * @example { usePop: true }
+     */
+    authorizationParams?: Record<string, string | boolean>;
+    /**
+     * Apple OAuth Token URL
+     * @default 'https://appleid.apple.com/auth/token'
+     */
+    tokenURL?: string;
+    /**
+     * Redirect URL to to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_APPLE_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+export interface OAuthAppleTokens {
+    iss: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    sub: string;
+    at_hash: string;
+    email: string;
+    email_verified: boolean;
+    is_private_email: boolean;
+    auth_time: number;
+    nonce_supported: boolean;
+}
+export interface OAuthAppleUser {
+    name?: {
+        firstName?: string;
+        lastName?: string;
+    };
+    email?: string;
+}
+export declare function defineOAuthAppleEventHandler({ config, onSuccess, onError, }: OAuthConfig<OAuthAppleConfig>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;

package/dist/runtime/server/lib/oauth/apple.js

@@ -0,0 +1,77 @@
+import { eventHandler, getRequestHeader, readBody, sendRedirect } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, signJwt, verifyJwt } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthAppleEventHandler({
+  config,
+  onSuccess,
+  onError
+}) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.apple, {
+      authorizationURL: config?.authorizationURL || "https://appleid.apple.com/auth/authorize",
+      authorizationParams: {}
+    });
+    if (!config.teamId || !config.keyId || !config.privateKey || !config.clientId) {
+      return handleMissingConfiguration(event, "apple", ["teamId", "keyId", "privateKey", "clientId"], onError);
+    }
+    const isPost = getRequestHeader(event, "content-type") === "application/x-www-form-urlencoded";
+    let code;
+    let user;
+    if (isPost) {
+      ({ code, user } = await readBody(event));
+    }
+    if (!isPost || !code) {
+      const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+      config.scope = Array.isArray(config.scope) ? config.scope.join(" ") : config.scope || "name email";
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          response_mode: "form_post",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope,
+          ...config.authorizationParams
+        })
+      );
+    }
+    try {
+      const secret = await signJwt(
+        {
+          iss: config.teamId,
+          aud: "https://appleid.apple.com",
+          sub: config.clientId
+        },
+        {
+          privateKey: config.privateKey,
+          keyId: config.keyId,
+          teamId: config.teamId,
+          clientId: config.clientId,
+          expiresIn: "5m"
+        }
+      );
+      const accessTokenResult = await requestAccessToken(config.tokenURL || "https://appleid.apple.com/auth/token", {
+        params: {
+          client_id: config.clientId,
+          client_secret: secret,
+          code,
+          grant_type: "authorization_code",
+          redirect_uri: config.redirectURL
+        }
+      });
+      const tokens = await verifyJwt(accessTokenResult.id_token, {
+        publicJwkUrl: "https://appleid.apple.com/auth/keys",
+        audience: config.clientId,
+        issuer: "https://appleid.apple.com"
+      });
+      if (!tokens) {
+        return handleAccessTokenErrorResponse(event, "apple", tokens, onError);
+      }
+      return onSuccess(event, { user, tokens });
+    } catch (error) {
+      return handleAccessTokenErrorResponse(event, "apple", error, onError);
+    }
+  });
+}

package/dist/runtime/server/lib/utils.d.ts

@@ -34,4 +34,29 @@ export declare function requestAccessToken(url: string, options: RequestAccessTo
  */
 export declare function handleAccessTokenErrorResponse(event: H3Event, oauthProvider: OAuthProvider, oauthError: any, onError?: OnError): void | Promise<void>;
 export declare function handleMissingConfiguration(event: H3Event, provider: OAuthProvider, missingKeys: string[], onError?: OnError): void | Promise<void>;
+/**
+ * JWT signing using jose
+ *
+ * @see https://github.com/panva/jose
+ */
+interface JWTSignOptions {
+    privateKey: string;
+    keyId: string;
+    teamId?: string;
+    clientId?: string;
+    algorithm?: 'ES256' | 'RS256';
+    expiresIn?: string;
+}
+export declare function signJwt<T extends Record<string, unknown>>(payload: T, options: JWTSignOptions): Promise<string>;
+/**
+ * Verify a JWT token using jose - will throw error if invalid
+ *
+ * @see https://github.com/panva/jose
+ */
+interface JWTVerifyOptions {
+    publicJwkUrl: string;
+    audience: string;
+    issuer: string;
+}
+export declare function verifyJwt<T>(token: string, options: JWTVerifyOptions): Promise<T>;
 export {};

package/dist/runtime/server/lib/utils.js

@@ -1,6 +1,7 @@
 import { getRequestURL } from "h3";
 import { FetchError } from "ofetch";
 import { snakeCase, upperFirst } from "scule";
+import * as jose from "jose";
 import { createError } from "#imports";
 export function getOAuthRedirectURL(event) {
   const requestURL = getRequestURL(event);
@@ -44,3 +45,19 @@ export function handleMissingConfiguration(event, provider, missingKeys, onError
   if (!onError) throw error;
   return onError(event, error);
 }
+export async function signJwt(payload, options) {
+  const now = Math.floor(Date.now() / 1e3);
+  const privateKey = await jose.importPKCS8(
+    options.privateKey.replace(/\\n/g, "\n"),
+    options.algorithm || "ES256"
+  );
+  return new jose.SignJWT(payload).setProtectedHeader({ alg: options.algorithm || "ES256", kid: options.keyId }).setIssuedAt(now).setExpirationTime(options.expiresIn || "5m").sign(privateKey);
+}
+export async function verifyJwt(token, options) {
+  const JWKS = jose.createRemoteJWKSet(new URL(options.publicJwkUrl));
+  const { payload } = await jose.jwtVerify(token, JWKS, {
+    audience: options.audience,
+    issuer: options.issuer
+  });
+  return payload;
+}

package/dist/runtime/server/plugins/ws.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nitropack/types").NitroAppPlugin;
+export default _default;

package/dist/runtime/server/plugins/ws.js

@@ -0,0 +1,7 @@
+import { defineNitroPlugin } from "nitropack/runtime";
+import { getUserSession } from "../utils/session.js";
+export default defineNitroPlugin((nitroApp) => {
+  nitroApp.hooks.hook("request", async (event) => {
+    await getUserSession(event);
+  });
+});

package/dist/runtime/server/utils/session.d.ts

@@ -1,5 +1,7 @@
 import type { H3Event, SessionConfig } from 'h3';
+import { useSession } from 'h3';
 import type { UserSession, UserSessionRequired } from '#auth-utils';
+type UseSessionEvent = Parameters<typeof useSession>[0];
 export interface SessionHooks {
     /**
      * Called when fetching the session from the API
@@ -18,7 +20,7 @@ export declare const sessionHooks: import("hookable").Hookable<SessionHooks, imp
  * @param event The Request (h3) event
  * @returns The user session
  */
-export declare function getUserSession(event: H3Event): Promise<UserSession>;
+export declare function getUserSession(event: UseSessionEvent): Promise<UserSession>;
 /**
  * Set a user session
  * @param event The Request (h3) event
@@ -46,7 +48,8 @@ export declare function clearUserSession(event: H3Event, config?: Partial<Sessio
  * @param opts.message The message to use for the error (defaults to Unauthorized)
  * @see https://github.com/atinux/nuxt-auth-utils
  */
-export declare function requireUserSession(event: H3Event, opts?: {
+export declare function requireUserSession(event: UseSessionEvent, opts?: {
     statusCode?: number;
     message?: string;
 }): Promise<UserSessionRequired>;
+export {};

package/dist/runtime/server/utils/session.js

@@ -1,4 +1,4 @@
-import { useSession, createError } from "h3";
+import { useSession, createError, isEvent } from "h3";
 import { defu } from "defu";
 import { createHooks } from "hookable";
 import { useRuntimeConfig } from "#imports";
@@ -26,17 +26,23 @@ export async function clearUserSession(event, config) {
 export async function requireUserSession(event, opts = {}) {
   const userSession = await getUserSession(event);
   if (!userSession.user) {
-    throw createError({
-      statusCode: opts.statusCode || 401,
-      message: opts.message || "Unauthorized"
-    });
+    if (isEvent(event)) {
+      throw createError({
+        statusCode: opts.statusCode || 401,
+        message: opts.message || "Unauthorized"
+      });
+    } else {
+      throw new Response(opts.message || "Unauthorized", {
+        status: opts.statusCode || 401
+      });
+    }
   }
   return userSession;
 }
 let sessionConfig;
 function _useSession(event, config = {}) {
   if (!sessionConfig) {
-    const runtimeConfig = useRuntimeConfig(event);
+    const runtimeConfig = useRuntimeConfig(isEvent(event) ? event : void 0);
     const envSessionPassword = `${runtimeConfig.nitro?.envPrefix || "NUXT_"}SESSION_PASSWORD`;
     sessionConfig = defu({ password: process.env[envSessionPassword] }, runtimeConfig.session);
   }

package/dist/runtime/types/oauth-config.d.ts

@@ -1,5 +1,5 @@
 import type { H3Event, H3Error } from 'h3';
-export type OAuthProvider = 'atlassian' | 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | (string & {});
+export type OAuthProvider = 'atlassian' | 'auth0' | 'authentik' | 'battledotnet' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | (string & {});
 export type OnError = (event: H3Event, error: H3Error) => Promise<void> | void;
 export interface OAuthConfig<TConfig, TUser = any, TTokens = any> {
     config?: TConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.5.8",
+  "version": "0.5.10",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",
@@ -38,8 +38,9 @@
     "@adonisjs/hash": "^9.0.5",
     "@nuxt/kit": "^3.15.2",
     "defu": "^6.1.4",
-    "h3": "^1.13.1",
+    "h3": "^1.14.0",
     "hookable": "^5.5.3",
+    "jose": "^5.9.6",
     "ofetch": "^1.4.1",
     "ohash": "^1.1.4",
     "openid-client": "^6.1.7",