@absolutejs/auth 0.30.0-beta.1 → 0.30.0-beta.3

package/dist/federation/tokenStore.d.ts

@@ -0,0 +1,29 @@
+import type { Vault } from '../vault/config';
+export type FederatedTokenSet = {
+    accessToken: string;
+    expiresAt?: number;
+    refreshToken?: string;
+    scopes?: string[];
+    storedAt: number;
+    tokenType?: string;
+};
+export type FederatedTokenStore = {
+    delete: (userId: string, provider: string, revoke?: (tokens: FederatedTokenSet) => Promise<void>) => Promise<void>;
+    get: (userId: string, provider: string) => Promise<FederatedTokenSet | undefined>;
+    list: (userId: string) => Promise<string[]>;
+    save: (userId: string, provider: string, tokens: Omit<FederatedTokenSet, 'storedAt'>) => Promise<void>;
+};
+export declare const createFederatedTokenStore: (vault: Vault) => FederatedTokenStore;
+export type FederatedTokenRefresher = (refreshToken: string) => Promise<{
+    access_token: string;
+    expires_in?: number;
+    refresh_token?: string;
+    token_type?: string;
+}>;
+export declare const getOrRefreshFederatedTokens: ({ now, provider, refresh, store, userId }: {
+    now?: number;
+    provider: string;
+    refresh?: FederatedTokenRefresher;
+    store: FederatedTokenStore;
+    userId: string;
+}) => Promise<FederatedTokenSet | undefined>;

package/dist/index.d.ts

@@ -15017,6 +15017,8 @@ export * from './vault/config';
 export * from './vault/types';
 export { createInMemoryVaultStore } from './vault/inMemoryVaultStore';
 export { createNeonVaultStore, createPostgresVaultStore, vaultEntriesTable } from './vault/postgresVaultStore';
+export { createFederatedTokenStore, getOrRefreshFederatedTokens } from './federation/tokenStore';
+export type { FederatedTokenRefresher, FederatedTokenSet, FederatedTokenStore } from './federation/tokenStore';
 export type { AuthSessionStore } from './session/types';
 export { isAuthIntent, isUserSessionId, isValidUser } from './typeGuards';
 export { AuthIdentityConflictError } from './errors';

package/dist/index.js

@@ -19048,6 +19048,69 @@ var createPostgresVaultStore = (db) => ({
     });
   }
 });
+// src/federation/tokenStore.ts
+var VAULT_NAME_PREFIX = "federated:";
+var REFRESH_EARLY_WINDOW_MS = 30000;
+var nameFor = (provider) => `${VAULT_NAME_PREFIX}${provider}`;
+var parse = (raw) => {
+  if (raw === undefined)
+    return;
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null)
+      return;
+    return parsed;
+  } catch {
+    return;
+  }
+};
+var createFederatedTokenStore = (vault) => ({
+  delete: async (userId, provider, revoke2) => {
+    const current = revoke2 === undefined ? undefined : parse(await vault.get(userId, nameFor(provider)));
+    if (current !== undefined && revoke2 !== undefined) {
+      await revoke2(current).catch(() => {
+        return;
+      });
+    }
+    await vault.delete(userId, nameFor(provider));
+  },
+  get: async (userId, provider) => parse(await vault.get(userId, nameFor(provider))),
+  list: async (userId) => (await vault.list(userId)).filter((name) => name.startsWith(VAULT_NAME_PREFIX)).map((name) => name.slice(VAULT_NAME_PREFIX.length)),
+  save: async (userId, provider, tokens) => {
+    const record = { ...tokens, storedAt: Date.now() };
+    await vault.put(userId, nameFor(provider), JSON.stringify(record));
+  }
+});
+var isExpired = (tokens, now) => {
+  if (tokens.expiresAt === undefined)
+    return false;
+  return tokens.expiresAt - REFRESH_EARLY_WINDOW_MS <= now;
+};
+var getOrRefreshFederatedTokens = async ({
+  now = Date.now(),
+  provider,
+  refresh: refresh2,
+  store,
+  userId
+}) => {
+  const current = await store.get(userId, provider);
+  if (current === undefined)
+    return;
+  if (!isExpired(current, now) || current.refreshToken === undefined || refresh2 === undefined) {
+    return current;
+  }
+  const refreshed = await refresh2(current.refreshToken);
+  const expiresIn = typeof refreshed.expires_in === "number" ? refreshed.expires_in : undefined;
+  const updated = {
+    accessToken: refreshed.access_token,
+    expiresAt: expiresIn === undefined ? undefined : now + expiresIn * 1000,
+    refreshToken: refreshed.refresh_token ?? current.refreshToken,
+    scopes: current.scopes,
+    tokenType: refreshed.token_type ?? current.tokenType
+  };
+  await store.save(userId, provider, updated);
+  return { ...updated, storedAt: now };
+};
 // src/session/inMemoryStore.ts
 var cloneSessionData = (value) => ({
   ...value
@@ -19207,7 +19270,7 @@ var createNeonAuthSessionStore = (databaseUrl) => {
 // src/session/redisStore.ts
 var SESSION_SEGMENT = "sess:";
 var UNREGISTERED_SEGMENT = "unreg:";
-var parse = (raw) => {
+var parse2 = (raw) => {
   if (raw === null)
     return;
   try {
@@ -19226,8 +19289,8 @@ var createRedisAuthSessionStore = (redis, keyPrefix = "auth:session:") => {
     return keys.map((key) => key.slice(offset)).filter(isUserSessionId);
   };
   return {
-    getSession: async (id) => parse(await redis.get(sessionKey(id))),
-    getUnregisteredSession: async (id) => parse(await redis.get(unregisteredKey(id))),
+    getSession: async (id) => parse2(await redis.get(sessionKey(id))),
+    getUnregisteredSession: async (id) => parse2(await redis.get(unregisteredKey(id))),
     listSessionIds: () => listIds(SESSION_SEGMENT),
     listUnregisteredSessionIds: () => listIds(UNREGISTERED_SEGMENT),
     removeSession: async (id) => {
@@ -20067,8 +20130,8 @@ var validateSession = ({
   if (!userSession) {
     return;
   }
-  const isExpired = userSession.expiresAt < Date.now();
-  if (isExpired) {
+  const isExpired2 = userSession.expiresAt < Date.now();
+  if (isExpired2) {
     delete session[userSessionId];
     user_session_id.remove();
     return;
@@ -23239,6 +23302,7 @@ export {
   getUserSessionId,
   getStatus,
   getRegisteredClient,
+  getOrRefreshFederatedTokens,
   generateTotpSecret,
   generateTotp,
   generateSigningKey,
@@ -23386,6 +23450,7 @@ export {
   createInMemoryApiClientStore,
   createInMemoryAccessTokenStore,
   createFgaEngine,
+  createFederatedTokenStore,
   createAuthHtmxRoutes,
   createAuditRedactor,
   createAuditEmitter,
@@ -23450,5 +23515,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=658AE7172110F24564756E2164756E21
+//# debugId=2099933871462CB064756E2164756E21
 //# sourceMappingURL=index.js.map