nuxt-auth-utils 0.6.1 → 0.6.2

package/README.md

@@ -410,6 +410,38 @@ export default defineNuxtConfig({
 })
 ```
 
+#### Callback path
+
+The authorization server compares the redirect URI of the login request with the list published in the client metadata document. That document is served from `bluesky/client-metadata.json` under your app base URL (`app.baseURL`, `/` by default), so it cannot know where your login route lives.
+
+The module fills in `/auth/<provider>`, the path its playground uses, under that base URL. The login route is served under the base URL too, so a deployment that sets `app.baseURL` publishes the path its login route answers on:
+
+```text
+app.baseURL: '/my-app/'  ->  redirect_uris: ["https://example.com/my-app/auth/bluesky"]
+```
+
+Set `redirectUris` when your login route lives elsewhere; until you do, the module logs a warning in development. Both requests then use it:
+
+```ts
+export default defineNuxtConfig({
+  runtimeConfig: {
+    oauth: {
+      bluesky: {
+        redirectUris: ['/login/bluesky']
+      }
+    }
+  }
+})
+```
+
+Declare paths only, without the origin or the app base URL. The module prepends the base URL, like it does for `/auth/<provider>`, and leaves a path that already starts with it as is. It then prepends the origin of the request, because the URL origin must match the client ID:
+
+```text
+app.baseURL: '/my-app/', redirectUris: ['/login/bluesky']  ->  redirect_uris: ["https://example.com/my-app/login/bluesky"]
+```
+
+The `redirectUrl` option of `defineOAuthBlueskyEventHandler()` applies to the login request alone, also under the base URL. The metadata document cannot see it, so use `redirectUris` for a custom callback path.
+
 ### WebAuthn (passkey)
 
 WebAuthn (Web Authentication) is a web standard that enhances security by replacing passwords with passkeys using public key cryptography. Users can authenticate with biometric data (like fingerprints or facial recognition) or physical devices (like USB keys), reducing the risk of phishing and password breaches. This approach offers a more secure and user-friendly authentication method, supported by major browsers and platforms.
@@ -432,6 +464,37 @@ export default defineNuxtConfig({
 })
 ```
 
+#### Relying Party ID
+
+A passkey is bound to the domain that created it. By default, a passkey created on `example.com` cannot be used on `app.example.com`. Set `rpID` to the registrable parent domain to share passkeys between a domain and its subdomains:
+
+```ts
+export default defineNuxtConfig({
+  auth: {
+    webAuthn: {
+      rpID: 'example.com', // passkeys created on `example.com` also work on `app.example.com`
+      rpName: 'My App' // shown by the authenticator when creating a passkey
+    }
+  }
+})
+```
+
+Both options default to the hostname of the request. The module uses `rpID` to generate the options and to verify the response, and `rpName` only to label the passkey during registration. Both are read from `runtimeConfig`, which helps when one build serves several domains:
+
+```ts
+export default defineNuxtConfig({
+  runtimeConfig: {
+    webauthn: {
+      rpID: 'example.com'
+    }
+  }
+})
+```
+
+`NUXT_WEBAUTHN_RP_ID` and `NUXT_WEBAUTHN_RP_NAME` override both at runtime.
+
+When you define `getOptions`, the module calls it while generating the options and again while verifying the response. Return the same `rpID` in both calls, or verification fails with an `Unexpected RP ID hash` error. The expected origin is always the origin of the request, because that is what the browser sends back.
+
 #### Example
 
 In this example we will implement the very basic steps to register and authenticate a credential.
@@ -965,13 +1028,13 @@ Releases are automated with [uppt](https://github.com/danielroe/uppt): every pus
 
 <!-- Badges -->
 [npm-version-src]: https://img.shields.io/npm/v/nuxt-auth-utils/latest.svg?style=flat&colorA=020420&colorB=00DC82
-[npm-version-href]: https://npmjs.com/package/nuxt-auth-utils
+[npm-version-href]: https://npmx.dev/package/nuxt-auth-utils
 
 [npm-downloads-src]: https://img.shields.io/npm/dm/nuxt-auth-utils.svg?style=flat&colorA=020420&colorB=00DC82
-[npm-downloads-href]: https://npm.chart.dev/nuxt-auth-utils
+[npm-downloads-href]: https://npmx.dev/package-stats/nuxt-auth-utils/v/latest?granularity=monthly
 
 [license-src]: https://img.shields.io/npm/l/nuxt-auth-utils.svg?style=flat&colorA=020420&colorB=00DC82
-[license-href]: https://npmjs.com/package/nuxt-auth-utils
+[license-href]: https://github.com/atinux/nuxt-auth-utils/blob/main/LICENSE
 
 [nuxt-src]: https://img.shields.io/badge/Nuxt-020420?logo=nuxt.js
 [nuxt-href]: https://nuxt.com

package/dist/module.d.mts

@@ -1,12 +1,28 @@
 import { ScryptConfig } from '@adonisjs/hash/types';
+import { GenerateRegistrationOptionsOpts, GenerateAuthenticationOptionsOpts } from '@simplewebauthn/server';
 import { SessionConfig } from 'nuxt/server';
+import { OAuthRuntimeConfig } from '../dist/runtime/types/oauth-runtime-config.js';
 
+interface WebAuthnOptions {
+    /**
+     * Relying Party ID the passkeys are bound to.
+     *
+     * Set the registrable parent domain (such as `example.com`) to create and use passkeys across subdomains.
+     * @default the request hostname
+     */
+    rpID?: string;
+    /**
+     * Relying Party name shown by the authenticator when creating a passkey
+     * @default the request hostname
+     */
+    rpName?: string;
+}
 interface ModuleOptions {
     /**
      * Enable WebAuthn (Passkeys)
      * @default false
      */
-    webAuthn?: boolean;
+    webAuthn?: boolean | WebAuthnOptions;
     /**
      * Enable atproto OAuth (Bluesky, etc.)
      * @default false
@@ -36,6 +52,24 @@ declare module 'nuxt/schema' {
          * Session configuration, the session is sealed with a secret derived from `appSecret` (`NUXT_APP_SECRET`)
          */
         session: Omit<SessionConfig, 'password'>;
+        /**
+         * WebAuthn settings, `rpID` and `rpName` are set from the `webAuthn` module option.
+         *
+         * Both can be overridden at runtime with `NUXT_WEBAUTHN_RP_ID` and `NUXT_WEBAUTHN_RP_NAME`.
+         *
+         * `register` and `authenticate` are merged into the options passed to
+         * `generateRegistrationOptions()` and `generateAuthenticationOptions()`.
+         */
+        webauthn: {
+            rpID: string;
+            rpName: string;
+            register: Partial<GenerateRegistrationOptionsOpts>;
+            authenticate: Partial<GenerateAuthenticationOptionsOpts>;
+        };
+        /**
+         * OAuth providers configuration, one key per provider (`github`, `google`, `keycloak`, ...).
+         */
+        oauth: OAuthRuntimeConfig;
     }
     interface PublicRuntimeConfig {
         auth: {
@@ -46,4 +80,4 @@ declare module 'nuxt/schema' {
 declare const _default: any;
 
 export { _default as default };
-export type { ModuleOptions };
+export type { ModuleOptions, WebAuthnOptions };

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=4.6.0"
   },
-  "version": "0.6.1",
+  "version": "0.6.2",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -91,7 +91,10 @@ const module$1 = defineNuxtModule({
     runtimeConfig.public.auth = defu(runtimeConfig.public.auth, {
       loadStrategy: options.loadStrategy ?? "server-first"
     });
+    const webAuthnOptions = typeof options.webAuthn === "object" ? options.webAuthn : void 0;
     runtimeConfig.webauthn = defu(runtimeConfig.webauthn, {
+      rpID: webAuthnOptions?.rpID ?? "",
+      rpName: webAuthnOptions?.rpName ?? "",
       register: {},
       authenticate: {}
     });
@@ -145,7 +148,7 @@ const module$1 = defineNuxtModule({
       clientId: "",
       clientSecret: "",
       connectionId: "",
-      screenHint: "",
+      screenHint: "sign-in",
       redirectURL: ""
     });
     runtimeConfig.oauth.microsoft = defu(runtimeConfig.oauth.microsoft, {
@@ -360,25 +363,25 @@ const module$1 = defineNuxtModule({
       redirectURL: "",
       baseURL: "",
       userURL: "",
-      scope: ""
+      scope: []
     });
     runtimeConfig.oauth.slack = defu(runtimeConfig.oauth.slack, {
       clientId: "",
       clientSecret: "",
       redirectURL: "",
-      scope: ""
+      scope: []
     });
     runtimeConfig.oauth.heroku = defu(runtimeConfig.oauth.heroku, {
       clientId: "",
       clientSecret: "",
       redirectURL: "",
-      scope: ""
+      scope: []
     });
     runtimeConfig.oauth.roblox = defu(runtimeConfig.oauth.roblox, {
       clientId: "",
       clientSecret: "",
       redirectURL: "",
-      scope: ""
+      scope: []
     });
     runtimeConfig.oauth.okta = defu(runtimeConfig.oauth.okta, {
       clientId: "",

package/dist/runtime/server/lib/atproto/bluesky.js

@@ -1,10 +1,12 @@
-import { defineEventHandler, createError, deleteCookie, getCookie, getQuery, sendRedirect, setCookie } from "nuxt/server";
+import { defineEventHandler, createError, deleteCookie, getCookie, getQuery, getRequestURL, sendRedirect, setCookie, useRuntimeConfig } from "nuxt/server";
 import { NodeOAuthClient, OAuthCallbackError, OAuthResolverError, OAuthResponseError } from "@atproto/oauth-client-node";
 import { Agent } from "@atproto/api";
+import { withoutBase } from "ufo";
 import { getAtprotoClientMetadata } from "../../utils/atproto.js";
 export function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }) {
   return defineEventHandler(async (event) => {
     const clientMetadata = getAtprotoClientMetadata(event, "bluesky", config);
+    if (import.meta.dev && !config?.redirectUrl) warnUnpublishedLoginPath(event, clientMetadata.redirect_uris[0]);
     const scopes = clientMetadata.scope?.split(" ") ?? [];
     const sessionStore = new SessionStore();
     const stateStore = new StateStore(event);
@@ -65,6 +67,17 @@ export function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }) {
     }
   });
 }
+let warnedUnpublishedLoginPath = false;
+function warnUnpublishedLoginPath(event, redirectUri) {
+  if (warnedUnpublishedLoginPath) return;
+  const runtimeConfig = useRuntimeConfig();
+  if (runtimeConfig.oauth.bluesky.redirectUris?.length) return;
+  const loginPath = getRequestURL(event).pathname;
+  const callbackPath = new URL(redirectUri).pathname;
+  if (loginPath === callbackPath) return;
+  warnedUnpublishedLoginPath = true;
+  console.warn(`[nuxt-auth-utils] The Bluesky login route is served from \`${loginPath}\`, but Bluesky redirects back to \`${callbackPath}\`. Set \`runtimeConfig.oauth.bluesky.redirectUris\` to \`['${withoutBase(loginPath, runtimeConfig.app.baseURL)}']\`.`);
+}
 export class StateStore {
   constructor(event) {
     this.event = event;

package/dist/runtime/server/lib/oauth/heroku.js

@@ -32,7 +32,7 @@ export function defineOAuthHerokuEventHandler({
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     const state = await handleState(event);
     if (!query.code) {
-      config.scope = config.scope || ["identity"];
+      config.scope = config.scope?.length ? config.scope : ["identity"];
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {

package/dist/runtime/server/lib/oauth/hubspot.js

@@ -1,5 +1,4 @@
-import { defineEventHandler, getQuery, sendRedirect, useRuntimeConfig } from "nuxt/server";
-import { $fetch } from "ofetch";
+import { createError, defineEventHandler, getQuery, sendRedirect, useRuntimeConfig } from "nuxt/server";
 import { withQuery } from "ufo";
 import defu from "defu";
 import {
@@ -37,7 +36,7 @@ export function defineOAuthHubspotEventHandler({ config, onSuccess, onError }) {
       return handleInvalidState(event, "hubspot", onError);
     }
     const tokens = await requestAccessToken(
-      "https://api.hubapi.com/oauth/v1/token",
+      "https://api.hubapi.com/oauth/2026-09/token",
       {
         body: {
           client_id: config.clientId,
@@ -51,7 +50,29 @@ export function defineOAuthHubspotEventHandler({ config, onSuccess, onError }) {
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "hubspot", tokens, onError);
     }
-    const info = await $fetch("https://api.hubapi.com/oauth/v1/access-tokens/" + tokens.access_token);
+    const info = await requestAccessToken(
+      "https://api.hubapi.com/oauth/2026-09/token/introspect",
+      {
+        params: {
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          token: tokens.access_token,
+          token_type_hint: "access_token"
+        }
+      }
+    );
+    if (info.error) {
+      return handleAccessTokenErrorResponse(event, "hubspot", info, onError);
+    }
+    if (!info.active) {
+      const error = createError({
+        status: 401,
+        message: "Hubspot login failed: the access token is not active",
+        data: info
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
     return onSuccess(event, {
       user: {
         id: info.user_id,

package/dist/runtime/server/lib/oauth/salesforce.js

@@ -33,7 +33,7 @@ export function defineOAuthSalesforceEventHandler({
     const pkce = await handlePkceVerifier(event);
     const state = await handleState(event);
     if (!query.code) {
-      config.scope = config.scope || ["id"];
+      config.scope = config.scope?.length ? config.scope : ["id"];
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {

package/dist/runtime/server/lib/oauth/slack.js

@@ -32,7 +32,7 @@ export function defineOAuthSlackEventHandler({
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     const state = await handleState(event);
     if (!query.code) {
-      config.scope = config.scope || ["openid", "email", "profile"];
+      config.scope = config.scope?.length ? config.scope : ["openid", "email", "profile"];
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {

package/dist/runtime/server/lib/webauthn/authenticate.js

@@ -15,8 +15,9 @@ export function defineWebAuthnAuthenticateEventHandler({
   return defineEventHandler(async (event) => {
     const url = getRequestURL(event, { xForwardedProto: true });
     const body = await readBody(event);
-    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig().webauthn.authenticate, {
-      rpID: url.hostname
+    const runtimeConfig = useRuntimeConfig();
+    const _config = defu(await getOptions?.(event, body) ?? {}, runtimeConfig.webauthn.authenticate, {
+      rpID: runtimeConfig.webauthn.rpID || url.hostname
     });
     if (!storeChallenge) {
       _config.challenge = "";
@@ -47,7 +48,7 @@ export function defineWebAuthnAuthenticateEventHandler({
         response: body.response,
         expectedChallenge,
         expectedOrigin: url.origin,
-        expectedRPID: url.hostname,
+        expectedRPID: _config.rpID,
         requireUserVerification: false,
         // TODO: make configurable https://simplewebauthn.dev/docs/advanced/passkeys#verifyauthenticationresponse
         credential: {

package/dist/runtime/server/lib/webauthn/register.js

@@ -24,9 +24,10 @@ export function defineWebAuthnRegisterEventHandler({
     if (validateUser) {
       user = await validateUserData(body.user, event, validateUser);
     }
-    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig().webauthn.register, {
-      rpID: url.hostname,
-      rpName: url.hostname,
+    const runtimeConfig = useRuntimeConfig();
+    const _config = defu(await getOptions?.(event, body) ?? {}, runtimeConfig.webauthn.register, {
+      rpID: runtimeConfig.webauthn.rpID || url.hostname,
+      rpName: runtimeConfig.webauthn.rpName || url.hostname,
       userName: user.userName,
       userDisplayName: user.displayName,
       authenticatorSelection: {
@@ -65,7 +66,7 @@ export function defineWebAuthnRegisterEventHandler({
         response: body.response,
         expectedChallenge,
         expectedOrigin: url.origin,
-        expectedRPID: url.hostname,
+        expectedRPID: _config.rpID,
         requireUserVerification: false,
         // TODO: make configurable https://simplewebauthn.dev/docs/advanced/passkeys#verifyregistrationresponse
         supportedAlgorithmIDs: _config.supportedAlgorithmIDs

package/dist/runtime/server/utils/atproto.js

@@ -1,22 +1,23 @@
 import { getRequestURL, useRuntimeConfig } from "nuxt/server";
-import { getOAuthRedirectURL } from "../lib/utils.js";
+import { withBase } from "ufo";
 import { getClientMetadataFilename } from "../../utils/atproto.js";
 export function getAtprotoClientMetadata(event, provider, config) {
-  const providerRuntimeConfig = useRuntimeConfig().oauth[provider];
+  const runtimeConfig = useRuntimeConfig();
+  const providerRuntimeConfig = runtimeConfig.oauth[provider];
   const scopes = [.../* @__PURE__ */ new Set(["atproto", ...config?.scope ?? [], ...providerRuntimeConfig.scope ?? []])];
   const scope = scopes.join(" ");
   const grantTypes = [.../* @__PURE__ */ new Set(["authorization_code", ...providerRuntimeConfig.grantTypes ?? []])];
   const requestURL = getRequestURL(event, { xForwardedProto: true });
   const baseUrl = `${requestURL.protocol}//${requestURL.host}`;
-  const redirectURL = new URL(
-    config?.redirectUrl && baseUrl + config.redirectUrl || providerRuntimeConfig.redirectUris[0] && baseUrl + providerRuntimeConfig.redirectUris[0] || getOAuthRedirectURL(event)
-  );
+  const withAppBase = (path) => withBase(path, runtimeConfig.app.baseURL);
+  const callbackPaths = (providerRuntimeConfig.redirectUris?.length ? providerRuntimeConfig.redirectUris : [`/auth/${provider}`]).map(withAppBase);
+  const redirectURL = new URL(baseUrl + (config?.redirectUrl ? withAppBase(config.redirectUrl) : callbackPaths[0]));
   const dev = import.meta.dev;
   if (dev && redirectURL.hostname === "localhost") {
     redirectURL.hostname = "127.0.0.1";
   }
-  const redirectUris = (providerRuntimeConfig.redirectUris.length ? providerRuntimeConfig.redirectUris : [requestURL.pathname]).map((uri) => new URL(`${redirectURL.protocol}//${redirectURL.host}${uri}`).toString());
-  const clientId = dev ? `http://localhost?redirect_uri=${encodeURIComponent(redirectURL.toString())}&scope=${encodeURIComponent(scope)}` : `${baseUrl}/${getClientMetadataFilename("bluesky", providerRuntimeConfig)}`;
+  const redirectUris = callbackPaths.map((uri) => new URL(`${redirectURL.protocol}//${redirectURL.host}${uri}`).toString());
+  const clientId = dev ? `http://localhost?redirect_uri=${encodeURIComponent(redirectURL.toString())}&scope=${encodeURIComponent(scope)}` : `${baseUrl}${withBase(`/${getClientMetadataFilename(provider, providerRuntimeConfig)}`, runtimeConfig.app.baseURL)}`;
   const clientMetadata = {
     client_name: providerRuntimeConfig.clientName || void 0,
     client_uri: providerRuntimeConfig.clientUri || void 0,

package/dist/runtime/types/atproto.d.ts

@@ -1,5 +1,5 @@
 import type { OAuthClientMetadata } from '@atproto/oauth-client-node';
-export interface AtprotoProviderClientMetadata {
+export type AtprotoProviderClientMetadata = {
     /**
      * The name of the client metadata file. This is used to construct the client ID.
      * @example 'client-metadata.json'
@@ -46,10 +46,12 @@ export interface AtprotoProviderClientMetadata {
      */
     responseTypes?: OAuthClientMetadata['response_types'];
     /**
-     * At least one redirect URI is required. The URL origin must match that of the `clientId`, so declare only the path.
+     * At least one redirect URI is required. The URL origin must match that of the `clientId`, so declare only the path. Paths are resolved under the app base URL.
+     *
+     * Empty by default, in which case `/auth/<provider>` under the app base URL is used.
      * @example ['/auth/callback']
      */
-    redirectUris: OAuthClientMetadata['redirect_uris'];
+    redirectUris?: `/${string}`[];
     /**
      * The token endpoint authentication method. `none` is the default, and the only supported value at this time.
      * @default 'none'
@@ -59,4 +61,4 @@ export interface AtprotoProviderClientMetadata {
      * DPoP is mandatory for all clients, so this must be present and true.
      */
     dpopBoundAccessTokens?: OAuthClientMetadata['dpop_bound_access_tokens'];
-}
+};

package/dist/runtime/types/index.d.ts

@@ -1,4 +1,4 @@
 export type { User, UserSession, UserSessionRequired, UserSessionComposable, SecureSessionData } from './session.js';
 export type { RequestEvent, SessionEvent, LegacyH3Event, WebSocketSessionEvent } from './event.js';
-export type { OAuthConfig, OAuthProvider, ATProtoProvider, OnError } from './oauth-config.js';
+export type { OAuthConfig, OAuthProvider, ATProtoProvider, OAuthRuntimeConfigExtension, OnError } from './oauth-config.js';
 export type { WebAuthnCredential, WebAuthnRegisterEventHandlerOptions, WebAuthnAuthenticateEventHandlerOptions, WebAuthnComposable, WebAuthnUser, } from './webauthn.js';

package/dist/runtime/types/oauth-config.d.ts

@@ -2,6 +2,20 @@ import type { NuxtError, RequestEvent } from 'nuxt/server';
 export type ATProtoProvider = 'bluesky';
 export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cloudflare' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'mastodon' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'wechat' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | 'zendesk' | (string & {});
 export type OnError = (event: RequestEvent, error: NuxtError) => unknown;
+/**
+ * Augment this interface to type the runtime configuration of OAuth providers that are not
+ * shipped with the module, such as providers added by another module.
+ *
+ * ```ts
+ * declare module '#auth-utils' {
+ *   interface OAuthRuntimeConfigExtension {
+ *     myProvider: { clientId: string, clientSecret: string }
+ *   }
+ * }
+ * ```
+ */
+export interface OAuthRuntimeConfigExtension {
+}
 export interface OAuthConfig<TConfig, TResult = {
     user: any;
     tokens: any;

package/dist/runtime/types/oauth-runtime-config.d.ts

@@ -0,0 +1,119 @@
+import type { AtprotoProviderClientMetadata } from './atproto.js';
+import type { OAuthRuntimeConfigExtension } from './oauth-config.js';
+import type { LiveChatConfig } from '../server/lib/oauth/livechat.js';
+import type { OAuthAppleConfig } from '../server/lib/oauth/apple.js';
+import type { OAuthAtlassianConfig } from '../server/lib/oauth/atlassian.js';
+import type { OAuthAuth0Config } from '../server/lib/oauth/auth0.js';
+import type { OAuthAuthentikConfig } from '../server/lib/oauth/authentik.js';
+import type { OAuthAzureB2CConfig } from '../server/lib/oauth/azureb2c.js';
+import type { OAuthBattledotnetConfig } from '../server/lib/oauth/battledotnet.js';
+import type { OAuthBoxConfig } from '../server/lib/oauth/box.js';
+import type { OAuthCloudflareConfig } from '../server/lib/oauth/cloudflare.js';
+import type { OAuthCognitoConfig } from '../server/lib/oauth/cognito.js';
+import type { OAuthDiscordConfig } from '../server/lib/oauth/discord.js';
+import type { OAuthDropboxConfig } from '../server/lib/oauth/dropbox.js';
+import type { OAuthFacebookConfig } from '../server/lib/oauth/facebook.js';
+import type { OAuthGitHubConfig } from '../server/lib/oauth/github.js';
+import type { OAuthGitLabConfig } from '../server/lib/oauth/gitlab.js';
+import type { OAuthGiteaConfig } from '../server/lib/oauth/gitea.js';
+import type { OAuthGoogleConfig } from '../server/lib/oauth/google.js';
+import type { OAuthHerokuConfig } from '../server/lib/oauth/heroku.js';
+import type { OAuthHubspotConfig } from '../server/lib/oauth/hubspot.js';
+import type { OAuthInstagramConfig } from '../server/lib/oauth/instagram.js';
+import type { OAuthKeycloakConfig } from '../server/lib/oauth/keycloak.js';
+import type { OAuthKickConfig } from '../server/lib/oauth/kick.js';
+import type { OAuthLineConfig } from '../server/lib/oauth/line.js';
+import type { OAuthLinearConfig } from '../server/lib/oauth/linear.js';
+import type { OAuthLinkedInConfig } from '../server/lib/oauth/linkedin.js';
+import type { OAuthMastodonConfig } from '../server/lib/oauth/mastodon.js';
+import type { OAuthMicrosoftConfig } from '../server/lib/oauth/microsoft.js';
+import type { OAuthOidcConfig } from '../server/lib/oauth/oidc.js';
+import type { OAuthOktaConfig } from '../server/lib/oauth/okta.js';
+import type { OAuthOryConfig } from '../server/lib/oauth/ory.js';
+import type { OAuthOsuConfig } from '../server/lib/oauth/osu.js';
+import type { OAuthPaypalConfig } from '../server/lib/oauth/paypal.js';
+import type { OAuthPolarConfig } from '../server/lib/oauth/polar.js';
+import type { OAuthRiotGamesConfig } from '../server/lib/oauth/riotgames.js';
+import type { OAuthRobloxConfig } from '../server/lib/oauth/roblox.js';
+import type { OAuthSalesforceConfig } from '../server/lib/oauth/salesforce.js';
+import type { OAuthSeznamConfig } from '../server/lib/oauth/seznam.js';
+import type { OAuthShopifyCustomerConfig } from '../server/lib/oauth/shopifyCustomer.js';
+import type { OAuthSlackConfig } from '../server/lib/oauth/slack.js';
+import type { OAuthSpotifyConfig } from '../server/lib/oauth/spotify.js';
+import type { OAuthSteamConfig } from '../server/lib/oauth/steam.js';
+import type { OAuthStravaConfig } from '../server/lib/oauth/strava.js';
+import type { OAuthTikTokConfig } from '../server/lib/oauth/tiktok.js';
+import type { OAuthTwitchConfig } from '../server/lib/oauth/twitch.js';
+import type { OAuthVKConfig } from '../server/lib/oauth/vk.js';
+import type { OAuthWechatConfig } from '../server/lib/oauth/wechat.js';
+import type { OAuthWorkOSConfig } from '../server/lib/oauth/workos.js';
+import type { OAuthXConfig } from '../server/lib/oauth/x.js';
+import type { OAuthXSUAAConfig } from '../server/lib/oauth/xsuaa.js';
+import type { OAuthYandexConfig } from '../server/lib/oauth/yandex.js';
+import type { OAuthZendeskConfig } from '../server/lib/oauth/zendesk.js';
+import type { OAuthZitadelConfig } from '../server/lib/oauth/zitadel.js';
+/**
+ * Runtime configuration of every OAuth provider supported by the module, exposed as `runtimeConfig.oauth`.
+ *
+ * Keys are the provider names accepted by `defineOAuth<Provider>EventHandler()`, and they are always
+ * set by the module, so server code can read them without checking for `undefined`. In `nuxt.config`,
+ * `runtimeConfig` is deep-partial, so you only write the providers you use.
+ * Providers contributed by other modules can add themselves through the `OAuthRuntimeConfigExtension`
+ * interface, and any other key stays `unknown`.
+ */
+export interface OAuthRuntimeConfig extends OAuthRuntimeConfigExtension {
+    [provider: string]: unknown;
+    apple: OAuthAppleConfig;
+    atlassian: OAuthAtlassianConfig;
+    auth0: OAuthAuth0Config;
+    authentik: OAuthAuthentikConfig;
+    azureb2c: OAuthAzureB2CConfig;
+    battledotnet: OAuthBattledotnetConfig;
+    bluesky: AtprotoProviderClientMetadata;
+    box: OAuthBoxConfig;
+    cloudflare: OAuthCloudflareConfig;
+    cognito: OAuthCognitoConfig;
+    discord: OAuthDiscordConfig;
+    dropbox: OAuthDropboxConfig;
+    facebook: OAuthFacebookConfig;
+    gitea: OAuthGiteaConfig;
+    github: OAuthGitHubConfig;
+    gitlab: OAuthGitLabConfig;
+    google: OAuthGoogleConfig;
+    heroku: OAuthHerokuConfig;
+    hubspot: OAuthHubspotConfig;
+    instagram: OAuthInstagramConfig;
+    keycloak: OAuthKeycloakConfig;
+    kick: OAuthKickConfig;
+    line: OAuthLineConfig;
+    linear: OAuthLinearConfig;
+    linkedin: OAuthLinkedInConfig;
+    livechat: LiveChatConfig;
+    mastodon: OAuthMastodonConfig;
+    microsoft: OAuthMicrosoftConfig;
+    oidc: OAuthOidcConfig;
+    okta: OAuthOktaConfig;
+    ory: OAuthOryConfig;
+    osu: OAuthOsuConfig;
+    paypal: OAuthPaypalConfig;
+    polar: OAuthPolarConfig;
+    riotgames: OAuthRiotGamesConfig;
+    roblox: OAuthRobloxConfig;
+    salesforce: OAuthSalesforceConfig;
+    seznam: OAuthSeznamConfig;
+    shopifyCustomer: OAuthShopifyCustomerConfig;
+    slack: OAuthSlackConfig;
+    spotify: OAuthSpotifyConfig;
+    steam: OAuthSteamConfig;
+    strava: OAuthStravaConfig;
+    tiktok: OAuthTikTokConfig;
+    twitch: OAuthTwitchConfig;
+    vk: OAuthVKConfig;
+    wechat: OAuthWechatConfig;
+    workos: OAuthWorkOSConfig;
+    x: OAuthXConfig;
+    xsuaa: OAuthXSUAAConfig;
+    yandex: OAuthYandexConfig;
+    zendesk: OAuthZendeskConfig;
+    zitadel: OAuthZitadelConfig;
+}

package/dist/runtime/utils/atproto.js

@@ -10,8 +10,7 @@ export const atprotoProviderDefaultClientMetadata = {
   grantTypes: ["authorization_code"],
   responseTypes: ["code"],
   applicationType: "web",
-  // @ts-expect-error TypeScript is too smart for its own good
-  redirectUris: void 0,
+  redirectUris: [],
   dpopBoundAccessTokens: true,
   tokenEndpointAuthMethod: "none"
 };

package/dist/types.d.mts

@@ -1,3 +1,3 @@
 export { default } from './module.mjs'
 
-export { type ModuleOptions } from './module.mjs'
+export { type ModuleOptions, type WebAuthnOptions } from './module.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",