@absolutejs/auth 0.79.0 → 0.80.0

package/dist/cli/setup.d.ts

@@ -0,0 +1,12 @@
+import { runMigrations } from '../migrations';
+/** A missing or unknown selection must never silently become ephemeral storage. */
+export declare const setupStorage: (configuration: unknown) => "memory" | "neon";
+export declare const runSetup: ({ configuration, databaseUrl, migrate, log }?: {
+    configuration?: unknown;
+    databaseUrl?: string;
+    migrate?: typeof runMigrations;
+    log?: (message: string) => void;
+}) => Promise<{
+    migrated: boolean;
+    storage: string;
+}>;

package/dist/index.d.ts

@@ -4209,7 +4209,7 @@ export { readSessionCookie } from './session/cookieReader';
 export { AuthIdentityConflictError } from './errors';
 export { sessionStore } from './session/state';
 export { createInMemoryAuthSessionStore } from './session/inMemoryStore';
-export { createNeonAuthSessionStore } from './session/neonStore';
+export { createNeonAuthSessionStore, createPostgresAuthSessionStore } from './session/neonStore';
 export { providersFromEnv, type ProviderSelection } from './providersFromEnv';
 export { createRedisAuthSessionStore, type RedisSessionClient } from './session/redisStore';
 export { createLinkedProviderCredentialResolver, type CreateLinkedProviderCredentialResolverOptions, type LinkedProviderRefreshResult } from './linkedProviders/resolver';

package/dist/index.js

@@ -25793,10 +25793,9 @@ var toUnregisteredSessionData = (row) => ({
   sessionInformation: cloneRecord(row.session_information_json ?? undefined),
   userIdentity: cloneRecord(row.user_identity_json ?? undefined)
 });
-var createNeonAuthSessionStore = (databaseUrl, decodeUser) => {
-  const sql2 = as(databaseUrl);
-  const db = drizzle({ client: sql2 });
-  return {
+var createNeonAuthSessionStore = (databaseUrl, decodeUser) => createPostgresAuthSessionStore(drizzle({ client: as(databaseUrl) }), decodeUser);
+var createPostgresAuthSessionStore = (db, decodeUser) => {
+  const store = {
     deleteExpired: async () => {
       const rows = await db.delete(authSessionsTable).where(lt(authSessionsTable.expires_at_ms, Date.now())).returning({ id: authSessionsTable.id });
       return rows.length;
@@ -25874,6 +25873,7 @@ var createNeonAuthSessionStore = (databaseUrl, decodeUser) => {
       });
     }
   };
+  return store;
 };
 // src/providersFromEnv.ts
 var envKey = (provider, suffix) => `${provider.replace(/[^a-zA-Z0-9]/g, "_").toUpperCase()}_${suffix}`;
@@ -33970,6 +33970,30 @@ var createRedisAuthSessionStore = (redis, decodeUser, keyPrefix = "auth:session:
     }
   };
 };
+// src/linkedProviders/credentialError.ts
+class LinkedProviderCredentialError extends Error {
+  code;
+  recovery;
+  constructor(code, recovery, message, cause) {
+    super(message, { cause });
+    this.code = code;
+    this.recovery = recovery;
+    this.name = "LinkedProviderCredentialError";
+  }
+}
+var credentialRefreshError = (error2) => {
+  if (error2 instanceof LinkedProviderCredentialError)
+    return error2;
+  const message = error2 instanceof Error ? error2.message : "";
+  if (/\binvalid_grant\b/.test(message)) {
+    return new LinkedProviderCredentialError("invalid_grant", "reconnect", "Authorization has expired or was revoked. Reconnect your account.", error2);
+  }
+  if (/\b(invalid_client|unauthorized_client)\b/.test(message)) {
+    return new LinkedProviderCredentialError("invalid_client", "configuration", "The provider connection is misconfigured. Contact support.", error2);
+  }
+  return new LinkedProviderCredentialError("refresh_failed", "retry", "The provider could not refresh the connection. Try again.", error2);
+};
+
 // src/linkedProviders/resolver.ts
 var uniqueStrings = (values) => [...new Set(values)];
 var getEffectiveScopes = (grant, binding) => {
@@ -34067,6 +34091,30 @@ var resolveBindingCredential = async (grantStore, binding, input) => {
   }
   return buildResolvedCredential(grant, binding);
 };
+var refreshAndRecord = async (grant, input, refresh2, grantStore, now) => {
+  let refreshed;
+  try {
+    const result = await refresh2(grant, input);
+    if (!result)
+      throw new Error("Linked provider access token refresh failed");
+    refreshed = result;
+  } catch (cause) {
+    const error2 = credentialRefreshError(cause);
+    await grantStore.saveGrant({
+      ...grant,
+      lastRefreshError: error2.message,
+      metadata: { ...grant.metadata, credentialFailureCode: error2.code, credentialRecovery: error2.recovery },
+      status: "refresh_required",
+      updatedAt: now()
+    });
+    throw error2;
+  }
+  const metadata = { ...refreshed.grant.metadata };
+  delete metadata.credentialRecovery;
+  delete metadata.credentialFailureCode;
+  await grantStore.saveGrant({ ...refreshed.grant, lastRefreshError: undefined, metadata });
+  return refreshed;
+};
 var createLinkedProviderCredentialResolver = ({
   grantStore,
   bindingStore,
@@ -34096,11 +34144,7 @@ var createLinkedProviderCredentialResolver = ({
       if (!refreshAccessTokenLease) {
         throw new Error("Linked provider access token lease requires refresh");
       }
-      const refreshed = await refreshAccessTokenLease(grant, input);
-      if (!refreshed) {
-        throw new Error("Linked provider access token refresh failed");
-      }
-      await grantStore.saveGrant(refreshed.grant);
+      const refreshed = await refreshAndRecord(grant, input, refreshAccessTokenLease, grantStore, now);
       ({ lease } = refreshed);
     }
     if (!lease) {
@@ -34193,8 +34237,11 @@ var createOAuthLinkedProviderCredentialResolver = async ({
       tokenType: grant.tokenType
     } : null,
     refreshAccessTokenLease: async (grant) => {
-      if (!isValidProviderOption(grant.authProviderKey) || !grant.refreshTokenCiphertext) {
-        return null;
+      if (!grant.refreshTokenCiphertext) {
+        throw new LinkedProviderCredentialError("missing_refresh_token", "reconnect", "Authorization cannot renew automatically. Reconnect your account.");
+      }
+      if (!isValidProviderOption(grant.authProviderKey)) {
+        throw new LinkedProviderCredentialError("unsupported_provider", "configuration", "This provider cannot renew the connection. Contact support.");
       }
       const providerKey = grant.authProviderKey;
       const providerClientName = typeof grant.metadata?.providerClient === "string" && grant.metadata.providerClient.trim().length > 0 ? grant.metadata.providerClient.trim() : undefined;
@@ -34204,11 +34251,11 @@ var createOAuthLinkedProviderCredentialResolver = async ({
         providersConfiguration
       });
       if ("error" in resolvedProviderClientConfiguration || !resolvedProviderClientConfiguration.config) {
-        return null;
+        throw new LinkedProviderCredentialError("provider_configuration", "configuration", "The provider connection is misconfigured. Contact support.");
       }
       const providerClient = await createOAuth2Client(providerKey, resolvedProviderClientConfiguration.config.credentials);
       if (!providerClient || !isRefreshableOAuth2Client(providerKey, providerClient)) {
-        return null;
+        throw new LinkedProviderCredentialError("unsupported_refresh", "configuration", "This provider cannot renew the connection. Contact support.");
       }
       const tokenResponse2 = await providerClient.refreshAccessToken(grant.refreshTokenCiphertext);
       const refreshedAt = Date.now();
@@ -41145,6 +41192,7 @@ export {
   createPostgresApiClientStore,
   createPostgresApiKeyStore,
   createPostgresAuditSink,
+  createPostgresAuthSessionStore,
   createPostgresAuthorizationCodeStore,
   createPostgresBackchannelAuthStore,
   createPostgresClientAssertionJtiStore,
@@ -41457,5 +41505,5 @@ export {
   writeWarrant
 };
 
-//# debugId=7BA88CF5784F986664756E2164756E21
+//# debugId=637E1C97D77705DC64756E2164756E21
 //# sourceMappingURL=index.js.map