@absolutejs/auth 0.78.0 → 0.80.0

package/dist/linkedProviders/credentialError.d.ts

@@ -0,0 +1,7 @@
+/** Safe recovery information; raw provider responses stay in the cause. */
+export declare class LinkedProviderCredentialError extends Error {
+    readonly code: string;
+    readonly recovery: 'reconnect' | 'retry' | 'configuration';
+    constructor(code: string, recovery: 'reconnect' | 'retry' | 'configuration', message: string, cause?: unknown);
+}
+export declare const credentialRefreshError: (error: unknown) => LinkedProviderCredentialError;

package/dist/linkedProviders/index.d.ts

@@ -1,3 +1,4 @@
+export { LinkedProviderCredentialError } from './credentialError';
 export { createOAuthAccountLinkedProviderCredentialResolver, type OAuthLinkedProviderAccount, type OAuthLinkedProviderAccountStore } from './oauthAccountResolver';
 export { createOAuthLinkedProviderCredentialResolver } from './oauthResolver';
 export { createLinkedProviderCredentialResolver, type CreateLinkedProviderCredentialResolverOptions, type LinkedProviderRefreshResult } from './resolver';

package/dist/linkedProviders/index.js

@@ -48,6 +48,29 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
+// src/linkedProviders/credentialError.ts
+class LinkedProviderCredentialError extends Error {
+  code;
+  recovery;
+  constructor(code, recovery, message, cause) {
+    super(message, { cause });
+    this.code = code;
+    this.recovery = recovery;
+    this.name = "LinkedProviderCredentialError";
+  }
+}
+var credentialRefreshError = (error) => {
+  if (error instanceof LinkedProviderCredentialError)
+    return error;
+  const message = error instanceof Error ? error.message : "";
+  if (/\binvalid_grant\b/.test(message)) {
+    return new LinkedProviderCredentialError("invalid_grant", "reconnect", "Authorization has expired or was revoked. Reconnect your account.", error);
+  }
+  if (/\b(invalid_client|unauthorized_client)\b/.test(message)) {
+    return new LinkedProviderCredentialError("invalid_client", "configuration", "The provider connection is misconfigured. Contact support.", error);
+  }
+  return new LinkedProviderCredentialError("refresh_failed", "retry", "The provider could not refresh the connection. Try again.", error);
+};
 // node_modules/citra/dist/index.js
 var BASE64_BLOCK_SIZE = 4;
 var NUM_GENERATOR_BYTES = 32;
@@ -3141,6 +3164,30 @@ var resolveBindingCredential = async (grantStore, binding, input) => {
   }
   return buildResolvedCredential(grant, binding);
 };
+var refreshAndRecord = async (grant, input, refresh, grantStore, now) => {
+  let refreshed;
+  try {
+    const result = await refresh(grant, input);
+    if (!result)
+      throw new Error("Linked provider access token refresh failed");
+    refreshed = result;
+  } catch (cause) {
+    const error = credentialRefreshError(cause);
+    await grantStore.saveGrant({
+      ...grant,
+      lastRefreshError: error.message,
+      metadata: { ...grant.metadata, credentialFailureCode: error.code, credentialRecovery: error.recovery },
+      status: "refresh_required",
+      updatedAt: now()
+    });
+    throw error;
+  }
+  const metadata = { ...refreshed.grant.metadata };
+  delete metadata.credentialRecovery;
+  delete metadata.credentialFailureCode;
+  await grantStore.saveGrant({ ...refreshed.grant, lastRefreshError: undefined, metadata });
+  return refreshed;
+};
 var createLinkedProviderCredentialResolver = ({
   grantStore,
   bindingStore,
@@ -3170,11 +3217,7 @@ var createLinkedProviderCredentialResolver = ({
       if (!refreshAccessTokenLease) {
         throw new Error("Linked provider access token lease requires refresh");
       }
-      const refreshed = await refreshAccessTokenLease(grant, input);
-      if (!refreshed) {
-        throw new Error("Linked provider access token refresh failed");
-      }
-      await grantStore.saveGrant(refreshed.grant);
+      const refreshed = await refreshAndRecord(grant, input, refreshAccessTokenLease, grantStore, now);
       ({ lease } = refreshed);
     }
     if (!lease) {
@@ -3268,8 +3311,11 @@ var createOAuthLinkedProviderCredentialResolver = async ({
       tokenType: grant.tokenType
     } : null,
     refreshAccessTokenLease: async (grant) => {
-      if (!isValidProviderOption(grant.authProviderKey) || !grant.refreshTokenCiphertext) {
-        return null;
+      if (!grant.refreshTokenCiphertext) {
+        throw new LinkedProviderCredentialError("missing_refresh_token", "reconnect", "Authorization cannot renew automatically. Reconnect your account.");
+      }
+      if (!isValidProviderOption(grant.authProviderKey)) {
+        throw new LinkedProviderCredentialError("unsupported_provider", "configuration", "This provider cannot renew the connection. Contact support.");
       }
       const providerKey = grant.authProviderKey;
       const providerClientName = typeof grant.metadata?.providerClient === "string" && grant.metadata.providerClient.trim().length > 0 ? grant.metadata.providerClient.trim() : undefined;
@@ -3279,11 +3325,11 @@ var createOAuthLinkedProviderCredentialResolver = async ({
         providersConfiguration
       });
       if ("error" in resolvedProviderClientConfiguration || !resolvedProviderClientConfiguration.config) {
-        return null;
+        throw new LinkedProviderCredentialError("provider_configuration", "configuration", "The provider connection is misconfigured. Contact support.");
       }
       const providerClient = await createOAuth2Client(providerKey, resolvedProviderClientConfiguration.config.credentials);
       if (!providerClient || !isRefreshableOAuth2Client(providerKey, providerClient)) {
-        return null;
+        throw new LinkedProviderCredentialError("unsupported_refresh", "configuration", "This provider cannot renew the connection. Contact support.");
       }
       const tokenResponse = await providerClient.refreshAccessToken(grant.refreshTokenCiphertext);
       const refreshedAt = Date.now();
@@ -15387,6 +15433,7 @@ var createInMemoryLinkedProviderStores = (input = {}) => {
   return { bindingStore, grantStore };
 };
 export {
+  LinkedProviderCredentialError,
   createInMemoryLinkedProviderStores,
   createLinkedProviderBindingStore,
   createLinkedProviderCredentialResolver,
@@ -15399,5 +15446,5 @@ export {
   linkedProviderGrantsTable
 };
 
-//# debugId=C2863A61B7F5183B64756E2164756E21
+//# debugId=0587E5ADD426B10B64756E2164756E21
 //# sourceMappingURL=index.js.map