nuxt-huia-oidc 1.0.0-alpha.10

package/README.md

@@ -0,0 +1,69 @@
+# nuxt-huia-oidc
+
+**Nuxt 3+** authentication module for the [Huia.OpenId](https://github.com/Ayman-Elfaki/Huia)
+identity provider. OIDC Authorization Code flow with PKCE, RFC 9126 Pushed Authorization Requests,
+transparent server-side token refresh, and a dual-layer session that keeps **every token on the
+server**.
+
+Its sibling module, [`nuxt-huia-headless`](../nuxt-huia-headless), talks to `Huia.Headless` instead —
+a JSON register/login API with no OIDC redirect — for apps that own their own login form. Use this
+module when the app authenticates against a multi-tenant `Huia.OpenId` server via OIDC redirects.
+
+- Built on [`openid-client`](https://github.com/panva/openid-client) v6 (ESM, Web Crypto)
+- Requires Nuxt `>=3`, Nitro `>=2.10`, Node `>=20.11`
+- Full spec: [`SPEC.md`](./SPEC.md) · docs: <https://github.com/Ayman-Elfaki/Huia/tree/main/docs/nuxt>
+
+## Install
+
+```bash
+npm install nuxt-huia-oidc
+```
+
+```ts
+// nuxt.config.ts
+export default defineNuxtConfig({
+  modules: ['nuxt-huia-oidc'],
+  huia: {
+    baseUrl: 'https://id.example.com',
+    tenant: 'acme',
+    clientId: 'acme-web',
+    // clientSecret via NUXT_HUIA_CLIENT_SECRET
+    scopes: ['openid', 'profile', 'email', 'offline_access'],
+    par: { enabled: true },
+    // session.password via NUXT_HUIA_SESSION_PASSWORD (>= 32 chars)
+  },
+})
+```
+
+## Usage
+
+```vue
+<script setup lang="ts">
+const { user, loggedIn } = useUserSession()
+const { login, logout } = useHuia()
+</script>
+```
+
+```ts
+// server/api/me.get.ts
+export default defineEventHandler(async (event) => {
+  const { user } = await requireUserSession(event)   // 401 if anonymous
+  return { id: user.sub, name: user.name }
+})
+```
+
+The browser only ever holds a sealed, chunked `__Host-huia_sess` cookie carrying the session id and a
+whitelisted claim subset. Access / refresh / id tokens live in Nitro Storage, keyed by that id, and
+are refreshed transparently. See [`SPEC.md`](./SPEC.md) for the architecture, the cookie-chunking and
+soft-lock algorithms, the security table, and the test strategy.
+
+## Develop
+
+```bash
+npm install
+npm run dev:prepare
+npm test            # Vitest unit + integration (mocked OP)
+npm run dev         # playground on http://localhost:3000
+```
+
+`.npmrc` pins `legacy-peer-deps=true` (an npm 10 arborist crash on the nuxt peer graph).

package/dist/module.d.mts

@@ -0,0 +1,63 @@
+import * as _nuxt_schema from '@nuxt/schema';
+
+interface ModuleOptions {
+    baseUrl?: string;
+    tenant?: string;
+    issuer?: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUrl?: string;
+    scopes?: string[];
+    allowedAuthParams?: string[];
+    par?: {
+        enabled?: boolean;
+        required?: boolean;
+    };
+    session?: {
+        name?: string;
+        password?: string;
+        maxAge?: number;
+        cookie?: {
+            sameSite?: 'lax' | 'strict' | 'none';
+            secure?: boolean;
+        };
+        userClaims?: string[];
+        stateless?: boolean;
+    };
+    storage?: {
+        base?: string;
+    };
+    refresh?: {
+        enabled?: boolean;
+        earlyRefreshSeconds?: number;
+        lock?: {
+            ttlMs?: number;
+            waitMs?: number;
+            pollMs?: number;
+        };
+    };
+    cookie?: {
+        chunkSize?: number;
+        maxChunks?: number;
+    };
+    middleware?: {
+        global?: boolean;
+        exclude?: string[];
+    };
+    hydration?: 'useState' | 'asyncData';
+    routes?: {
+        login?: string;
+        callback?: string;
+        logout?: string;
+        session?: string;
+        error?: string;
+    };
+    logout?: {
+        rpInitiated?: boolean;
+    };
+    allowInsecureTls?: boolean;
+}
+declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
+
+export { _default as default };
+export type { ModuleOptions };

package/dist/module.json

@@ -0,0 +1,12 @@
+{
+  "name": "nuxt-huia-oidc",
+  "configKey": "huia",
+  "compatibility": {
+    "nuxt": ">=3.0.0"
+  },
+  "version": "1.0.0-alpha.10",
+  "builder": {
+    "@nuxt/module-builder": "1.0.3",
+    "unbuild": "3.6.1"
+  }
+}

package/dist/module.mjs

@@ -0,0 +1,123 @@
+import { defineNuxtModule, createResolver, addServerImportsDir, addImportsDir, addPlugin, addRouteMiddleware, addServerHandler, addServerPlugin } from '@nuxt/kit';
+import { defu } from 'defu';
+
+const defaults = {
+  baseUrl: "",
+  tenant: "",
+  issuer: "",
+  clientId: "",
+  redirectUrl: "/auth/oidc/callback",
+  scopes: ["openid", "profile", "email", "offline_access"],
+  allowedAuthParams: ["ui_locales", "prompt", "login_hint"],
+  par: { enabled: true, required: false },
+  session: {
+    name: "__Host-huia_sess",
+    password: "",
+    maxAge: 60 * 60 * 24 * 7,
+    cookie: { sameSite: "lax" },
+    userClaims: ["sub", "name", "email", "preferred_username", "given_name", "family_name", "roles"],
+    stateless: false
+  },
+  storage: { base: "huia-auth" },
+  refresh: {
+    enabled: true,
+    earlyRefreshSeconds: 60,
+    lock: { ttlMs: 1e4, waitMs: 8e3, pollMs: 150 }
+  },
+  cookie: { chunkSize: 3800, maxChunks: 8 },
+  middleware: { global: false, exclude: [] },
+  hydration: "useState",
+  routes: {
+    login: "/auth/oidc/login",
+    callback: "/auth/oidc/callback",
+    logout: "/auth/oidc/logout",
+    session: "/auth/session",
+    error: "/"
+  },
+  logout: { rpInitiated: true },
+  allowInsecureTls: false
+};
+const module$1 = defineNuxtModule({
+  meta: {
+    name: "nuxt-huia-oidc",
+    configKey: "huia",
+    compatibility: { nuxt: ">=3.0.0" }
+  },
+  defaults,
+  setup(options, nuxt) {
+    const { resolve } = createResolver(import.meta.url);
+    const opts = defu(options, defaults);
+    if (!opts.session.password && !process.env.NUXT_HUIA_SESSION_PASSWORD) {
+      console.warn("[huia-auth] no session password set \u2014 set NUXT_HUIA_SESSION_PASSWORD (>= 32 chars)");
+    }
+    nuxt.options.runtimeConfig.huia = defu(
+      nuxt.options.runtimeConfig.huia,
+      {
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret ?? "",
+        issuer: opts.issuer ?? "",
+        baseUrl: opts.baseUrl ?? "",
+        tenant: opts.tenant ?? "",
+        redirectUrl: opts.redirectUrl,
+        scopes: opts.scopes,
+        allowedAuthParams: opts.allowedAuthParams,
+        par: opts.par,
+        session: { ...opts.session, password: opts.session.password ?? "" },
+        storage: opts.storage,
+        refresh: opts.refresh,
+        cookie: opts.cookie,
+        routes: opts.routes,
+        logout: opts.logout,
+        allowInsecureTls: opts.allowInsecureTls
+      }
+    );
+    nuxt.options.runtimeConfig.public.huia = defu(
+      nuxt.options.runtimeConfig.public.huia,
+      {
+        loginPath: opts.routes.login,
+        logoutPath: opts.routes.logout,
+        sessionPath: opts.routes.session,
+        // The module's own auth routes are never protected by its own middleware, regardless of
+        // `middleware.exclude` — applying "must be logged in" to the routes that exist precisely for
+        // the logged-out flow is never correct, and was the mechanism behind the infinite-redirect
+        // risk of turning on `middleware.global` with no exclusions configured.
+        middlewareExclude: [
+          ...opts.middleware.exclude,
+          opts.routes.login,
+          opts.routes.callback,
+          opts.routes.logout,
+          opts.routes.session
+        ]
+      }
+    );
+    nuxt.options.alias["#huia-auth"] = resolve("runtime/types");
+    nuxt.options.imports = nuxt.options.imports || {};
+    nuxt.options.imports.exclude = [...nuxt.options.imports.exclude || [], /[\\/]huia-auth-core[\\/]/];
+    nuxt.hook("nitro:config", (nitroConfig) => {
+      nitroConfig.imports = nitroConfig.imports || {};
+      nitroConfig.imports.exclude = nitroConfig.imports.exclude || [];
+      nitroConfig.imports.exclude.push(/[\\/]huia-auth-core[\\/]/);
+    });
+    addServerImportsDir(resolve("runtime/server/utils"));
+    addImportsDir(resolve("runtime/app/composables"));
+    if (opts.hydration === "useState") {
+      addPlugin({ src: resolve("runtime/app/plugins/session.server"), mode: "server" });
+    }
+    addRouteMiddleware({
+      name: "auth",
+      path: resolve("runtime/app/middleware/auth"),
+      global: opts.middleware.global
+    });
+    addServerHandler({ route: opts.routes.login, method: "get", handler: resolve("runtime/server/routes/auth/oidc/login.get") });
+    addServerHandler({ route: opts.routes.callback, method: "get", handler: resolve("runtime/server/routes/auth/oidc/callback.get") });
+    addServerHandler({ route: opts.routes.logout, method: "get", handler: resolve("runtime/server/routes/auth/oidc/logout.get") });
+    addServerHandler({ route: opts.routes.session, method: "get", handler: resolve("runtime/server/routes/auth/session.get") });
+    addServerHandler({ middleware: true, handler: resolve("runtime/server/middleware/session.context") });
+    addServerPlugin(resolve("runtime/server/plugins/oidc.discovery"));
+    nuxt.hook("prepare:types", ({ references }) => {
+      references.push({ path: resolve("runtime/types.d.ts") });
+    });
+  }
+});
+
+export { module$1 as default };

package/dist/runtime/app/composables/useHuia.d.ts

@@ -0,0 +1,41 @@
+export declare function useHuia(): {
+    user: import("vue").ComputedRef<import("../../types.js").UserClaims | null>;
+    loggedIn: import("vue").ComputedRef<boolean>;
+    session: Readonly<import("vue").Ref<{
+        readonly user?: {
+            readonly [x: string]: Readonly<unknown>;
+            readonly sub: string;
+            readonly name?: string | undefined;
+            readonly email?: string | undefined;
+            readonly preferred_username?: string | undefined;
+            readonly given_name?: string | undefined;
+            readonly family_name?: string | undefined;
+            readonly roles?: readonly string[] | undefined;
+        } | undefined;
+        readonly loggedIn?: boolean | undefined;
+        readonly expiresAt?: number | undefined;
+    }, {
+        readonly user?: {
+            readonly [x: string]: Readonly<unknown>;
+            readonly sub: string;
+            readonly name?: string | undefined;
+            readonly email?: string | undefined;
+            readonly preferred_username?: string | undefined;
+            readonly given_name?: string | undefined;
+            readonly family_name?: string | undefined;
+            readonly roles?: readonly string[] | undefined;
+        } | undefined;
+        readonly loggedIn?: boolean | undefined;
+        readonly expiresAt?: number | undefined;
+    }>>;
+    hasRole: (role: string) => boolean;
+    hasAnyRole: (...roles: string[]) => boolean;
+    login(opts?: {
+        returnTo?: string;
+        locale?: string;
+        prompt?: string;
+    }): string | false | void | import("vue-router").RouteLocationAsRelativeGeneric | import("vue-router").RouteLocationAsPathGeneric | Promise<false | void | import("vue-router").NavigationFailure>;
+    logout(opts?: {
+        returnTo?: string;
+    }): string | false | void | import("vue-router").RouteLocationAsRelativeGeneric | import("vue-router").RouteLocationAsPathGeneric | Promise<false | void | import("vue-router").NavigationFailure>;
+};

package/dist/runtime/app/composables/useHuia.js

@@ -0,0 +1,25 @@
+import { navigateTo, useRoute, useRuntimeConfig } from "#imports";
+import { useUserSession } from "./useUserSession.js";
+export function useHuia() {
+  const { user, loggedIn, session, hasRole, hasAnyRole } = useUserSession();
+  const paths = useRuntimeConfig().public.huia;
+  return {
+    user,
+    loggedIn,
+    session,
+    hasRole,
+    hasAnyRole,
+    login(opts = {}) {
+      const query = { returnTo: opts.returnTo ?? useRoute().fullPath };
+      if (opts.locale) query.ui_locales = opts.locale;
+      if (opts.prompt) query.prompt = opts.prompt;
+      return navigateTo({ path: paths.loginPath, query }, { external: true });
+    },
+    logout(opts = {}) {
+      return navigateTo(
+        { path: paths.logoutPath, query: { returnTo: opts.returnTo ?? "/" } },
+        { external: true }
+      );
+    }
+  };
+}

package/dist/runtime/app/composables/useUserSession.d.ts

@@ -0,0 +1,45 @@
+import type { UserClaims } from '../../types.js';
+export declare function useUserSession(): {
+    session: Readonly<import("vue").Ref<{
+        readonly user?: {
+            readonly [x: string]: Readonly<unknown>;
+            readonly sub: string;
+            readonly name?: string | undefined;
+            readonly email?: string | undefined;
+            readonly preferred_username?: string | undefined;
+            readonly given_name?: string | undefined;
+            readonly family_name?: string | undefined;
+            readonly roles?: readonly string[] | undefined;
+        } | undefined;
+        readonly loggedIn?: boolean | undefined;
+        readonly expiresAt?: number | undefined;
+    }, {
+        readonly user?: {
+            readonly [x: string]: Readonly<unknown>;
+            readonly sub: string;
+            readonly name?: string | undefined;
+            readonly email?: string | undefined;
+            readonly preferred_username?: string | undefined;
+            readonly given_name?: string | undefined;
+            readonly family_name?: string | undefined;
+            readonly roles?: readonly string[] | undefined;
+        } | undefined;
+        readonly loggedIn?: boolean | undefined;
+        readonly expiresAt?: number | undefined;
+    }>>;
+    user: import("vue").ComputedRef<UserClaims | null>;
+    loggedIn: import("vue").ComputedRef<boolean>;
+    expiresAt: import("vue").ComputedRef<number | undefined>;
+    /** Re-read the server session (after returning from login, on tab focus, …). */
+    fetch(): Promise<void>;
+    /** Full logout via the server route (clears storage + cookies, hits the OP end_session). */
+    clear(opts?: {
+        returnTo?: string;
+    }): Promise<void>;
+    /** Optimistic local reset only (UI); does not touch the server. */
+    clearLocal(): void;
+    /** Whether the signed-in user has `role` (from the `roles` claim — requires the `roles` scope). */
+    hasRole(role: string): boolean;
+    /** Whether the signed-in user has at least one of `roles`. */
+    hasAnyRole(...roles: string[]): boolean;
+};

package/dist/runtime/app/composables/useUserSession.js

@@ -0,0 +1,36 @@
+import { computed, readonly } from "vue";
+import { useState, useRequestFetch, navigateTo, useRuntimeConfig } from "#imports";
+export function useUserSession() {
+  const session = useState("huia-auth:session", () => ({}));
+  const paths = useRuntimeConfig().public.huia;
+  return {
+    session: readonly(session),
+    user: computed(() => session.value.user ?? null),
+    loggedIn: computed(() => !!session.value.user),
+    expiresAt: computed(() => session.value.expiresAt),
+    /** Re-read the server session (after returning from login, on tab focus, …). */
+    async fetch() {
+      session.value = await useRequestFetch()(paths.sessionPath);
+    },
+    /** Full logout via the server route (clears storage + cookies, hits the OP end_session). */
+    async clear(opts = {}) {
+      await navigateTo(
+        { path: paths.logoutPath, query: { returnTo: opts.returnTo ?? "/" } },
+        { external: true }
+      );
+    },
+    /** Optimistic local reset only (UI); does not touch the server. */
+    clearLocal() {
+      session.value = {};
+    },
+    /** Whether the signed-in user has `role` (from the `roles` claim — requires the `roles` scope). */
+    hasRole(role) {
+      return !!session.value.user?.roles?.includes(role);
+    },
+    /** Whether the signed-in user has at least one of `roles`. */
+    hasAnyRole(...roles) {
+      const userRoles = session.value.user?.roles;
+      return !!userRoles && roles.some((role) => userRoles.includes(role));
+    }
+  };
+}

package/dist/runtime/app/middleware/auth.d.ts

@@ -0,0 +1,3 @@
+import type { RouteMiddleware } from 'nuxt/app';
+declare const _default: RouteMiddleware;
+export default _default;

package/dist/runtime/app/middleware/auth.js

@@ -0,0 +1,14 @@
+import { defineNuxtRouteMiddleware, navigateTo, useRuntimeConfig } from "#imports";
+import { useUserSession } from "../composables/useUserSession.js";
+import { isExcluded } from "../utils/route-match.js";
+const middleware = (to) => {
+  const { loginPath, middlewareExclude } = useRuntimeConfig().public.huia;
+  if (isExcluded(to.path, middlewareExclude)) return;
+  const { loggedIn } = useUserSession();
+  if (loggedIn.value) return;
+  return navigateTo(
+    { path: loginPath, query: { returnTo: to.fullPath } },
+    { external: true, replace: true }
+  );
+};
+export default defineNuxtRouteMiddleware(middleware);

package/dist/runtime/app/plugins/session.server.d.ts

@@ -0,0 +1,8 @@
+import type { Plugin } from 'nuxt/app';
+/**
+ * SSR only. Copies the session resolved by the Nitro middleware (`event.context.huia`) into
+ * `useState('huia-auth:session')`, which Nuxt serialises into the payload. The client then reads the
+ * identical value on first render — no fetch, no hydration mismatch, no flash.
+ */
+declare const plugin: Plugin;
+export default plugin;

package/dist/runtime/app/plugins/session.server.js

@@ -0,0 +1,8 @@
+import { defineNuxtPlugin, useState, useRequestEvent } from "#imports";
+const plugin = defineNuxtPlugin(() => {
+  const event = useRequestEvent();
+  const state = useState("huia-auth:session", () => ({}));
+  const ctx = event?.context;
+  state.value = ctx?.huia ?? {};
+});
+export default plugin;

package/dist/runtime/app/utils/route-match.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Matches `path` against a glob-ish exclude pattern: `**` matches any depth (including zero
+ * segments), `*` matches exactly one path segment, everything else is a literal. `/auth/**` matches
+ * `/auth`, `/auth/oidc/login` and anything else under `/auth`; `/about` matches only `/about`.
+ */
+export declare function matchesPattern(path: string, pattern: string): boolean;
+/** Whether `path` matches any pattern in `exclude`. */
+export declare function isExcluded(path: string, exclude: string[]): boolean;

package/dist/runtime/app/utils/route-match.js

@@ -0,0 +1,9 @@
+export function matchesPattern(path, pattern) {
+  const regexSource = pattern.split("/").map(
+    (segment) => segment === "**" ? ".*" : segment.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*")
+  ).join("/").replace(/\/\.\*$/, "(?:/.*)?");
+  return new RegExp(`^${regexSource}$`).test(path);
+}
+export function isExcluded(path, exclude) {
+  return exclude.some((pattern) => matchesPattern(path, pattern));
+}

package/dist/runtime/server/middleware/session.context.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Runs on every request. Populates `event.context.huia` (memoised inside `getUserSession`) so the
+ * Nuxt server plugin can seed `useState('huia-auth:session')` synchronously during SSR. Errors are
+ * swallowed here so a transient storage/OP hiccup never 500s an otherwise-anonymous request.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/middleware/session.context.js

@@ -0,0 +1,6 @@
+import { defineEventHandler } from "h3";
+import { getUserSession } from "../utils/session.js";
+export default defineEventHandler(async (event) => {
+  await getUserSession(event).catch(() => {
+  });
+});

package/dist/runtime/server/plugins/oidc.discovery.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nitropack").NitroAppPlugin;
+export default _default;

package/dist/runtime/server/plugins/oidc.discovery.js

@@ -0,0 +1,5 @@
+import { defineNitroPlugin } from "nitropack/runtime";
+import { warmDiscovery } from "../utils/oidc.js";
+export default defineNitroPlugin(() => {
+  warmDiscovery();
+});

package/dist/runtime/server/routes/auth/oidc/callback.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/routes/auth/oidc/callback.get.js

@@ -0,0 +1,16 @@
+import { defineEventHandler, sendRedirect } from "h3";
+import { resolveAuthConfig } from "../../../utils/config.js";
+import { completeAuthorization } from "../../../utils/oidc.js";
+import { setUserSession } from "../../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const cfg = resolveAuthConfig(event);
+  try {
+    const { tokens, claims, returnTo } = await completeAuthorization(event);
+    await setUserSession(event, { tokens, claims });
+    return sendRedirect(event, returnTo || "/", 302);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "";
+    const code = /state/i.test(message) ? "state_mismatch" : /issuer/i.test(message) ? "issuer_mismatch" : /par_expired|request_uri/i.test(message) ? "par_expired" : "callback_failed";
+    return sendRedirect(event, `${cfg.errorPath}?auth_error=${code}`, 302);
+  }
+});

package/dist/runtime/server/routes/auth/oidc/login.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/routes/auth/oidc/login.get.js

@@ -0,0 +1,21 @@
+import { defineEventHandler, getQuery, sendRedirect } from "h3";
+import { resolveAuthConfig } from "../../../utils/config.js";
+import { beginAuthorization } from "../../../utils/oidc.js";
+import { sanitizeReturnTo } from "../../../utils/tokens.js";
+export default defineEventHandler(async (event) => {
+  const cfg = resolveAuthConfig(event);
+  const q = getQuery(event);
+  const returnTo = sanitizeReturnTo(typeof q.returnTo === "string" ? q.returnTo : void 0);
+  const extra = {};
+  for (const key of cfg.allowedAuthParams) {
+    const v = q[key];
+    if (typeof v === "string" && v.length > 0) extra[key] = v;
+  }
+  try {
+    const { redirectTo } = await beginAuthorization(event, { returnTo, extra });
+    return sendRedirect(event, redirectTo, 302);
+  } catch (err) {
+    const reason = err instanceof Error && err.message.startsWith("par_required") ? "par_required" : "login_failed";
+    return sendRedirect(event, `${cfg.errorPath}?auth_error=${reason}`, 302);
+  }
+});

package/dist/runtime/server/routes/auth/oidc/logout.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/routes/auth/oidc/logout.get.js

@@ -0,0 +1,22 @@
+import { defineEventHandler, getQuery, getRequestURL, sendRedirect } from "h3";
+import { resolveAuthConfig } from "../../../utils/config.js";
+import { buildLogoutUrl } from "../../../utils/oidc.js";
+import { clearUserSession, getSecureTokenRecord } from "../../../utils/session.js";
+import { sanitizeReturnTo, isJwtExpired } from "../../../utils/tokens.js";
+export default defineEventHandler(async (event) => {
+  const cfg = resolveAuthConfig(event);
+  const returnTo = sanitizeReturnTo(String(getQuery(event).returnTo ?? "/"));
+  const postLogoutRedirectUri = new URL(returnTo, getRequestURL(event).origin).href;
+  const record = await getSecureTokenRecord(event);
+  await clearUserSession(event);
+  if (cfg.logout.rpInitiated && record?.idToken && !isJwtExpired(record.idToken)) {
+    return sendRedirect(event, await buildLogoutUrl(event, {
+      idTokenHint: record.idToken,
+      postLogoutRedirectUri
+    }), 302);
+  }
+  if (cfg.logout.rpInitiated) {
+    return sendRedirect(event, await buildLogoutUrl(event, { postLogoutRedirectUri }), 302);
+  }
+  return sendRedirect(event, postLogoutRedirectUri, 302);
+});

package/dist/runtime/server/routes/auth/session.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<import("../../../types.js").UserSession>>;
+export default _default;

package/dist/runtime/server/routes/auth/session.get.js

@@ -0,0 +1,6 @@
+import { defineEventHandler, setResponseHeader } from "h3";
+import { getUserSession } from "../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  setResponseHeader(event, "Cache-Control", "no-store");
+  return getUserSession(event);
+});

package/dist/runtime/server/utils/config.d.ts

@@ -0,0 +1,58 @@
+import { type H3Event } from 'h3';
+import type { ResolvedAuthConfig } from './internal-types.js';
+interface RawHuiaAuth {
+    clientId: string;
+    clientSecret: string;
+    issuer: string;
+    baseUrl: string;
+    tenant: string;
+    redirectUrl: string;
+    scopes: string[];
+    allowedAuthParams: string[];
+    par: {
+        enabled: boolean;
+        required: boolean;
+    };
+    session: {
+        name: string;
+        password: string;
+        maxAge: number;
+        cookie: {
+            sameSite?: string;
+            secure?: boolean;
+        };
+        userClaims: string[];
+    };
+    storage: {
+        base: string;
+    };
+    refresh: {
+        enabled: boolean;
+        earlyRefreshSeconds: number;
+        lock: {
+            ttlMs: number;
+            waitMs: number;
+            pollMs: number;
+        };
+    };
+    cookie: {
+        chunkSize: number;
+        maxChunks: number;
+    };
+    routes: {
+        login: string;
+        callback: string;
+        logout: string;
+        session: string;
+        error: string;
+    };
+    allowInsecureTls: boolean;
+    logout?: {
+        rpInitiated?: boolean;
+    };
+}
+/** `{baseUrl}/{tenant}` (or an explicit `issuer`), with any trailing slash stripped. */
+export declare function resolveIssuer(raw: Pick<RawHuiaAuth, 'issuer' | 'baseUrl' | 'tenant'>): string;
+export declare function discoveryCacheKey(issuer: string): string;
+export declare function resolveAuthConfig(event: H3Event): ResolvedAuthConfig;
+export {};