@absolutejs/auth 0.79.0 → 0.80.1

package/dist/manifest.json

@@ -47,7 +47,7 @@
 					}
 				]
 			},
-			"title": "Your Postgres database (recommended)",
+			"title": "Neon Postgres (persistent sessions)",
 			"wiring": {
 				"code": "createNeonAuthSessionStore(${env.DATABASE_URL} ?? \"\", decodeSessionUserRecord)",
 				"imports": [
@@ -81,19 +81,19 @@
 	],
 	"lifecycle": [
 		{
-			"command": "bunx absolute-auth migrate",
+			"command": "bunx absolute-auth setup",
 			"id": "migrate",
 			"idempotent": true,
 			"kind": "migration",
-			"title": "Set up the sign-in tables in your database",
+			"title": "Set up the selected sign-in storage",
 			"when": "after-install"
 		},
 		{
-			"command": "bunx absolute-auth migrate",
+			"command": "bunx absolute-auth setup",
 			"id": "migrate-upgrade",
 			"idempotent": true,
 			"kind": "migration",
-			"title": "Apply new sign-in tables after upgrading",
+			"title": "Upgrade the selected sign-in storage",
 			"when": "after-upgrade"
 		}
 	],
@@ -111,12 +111,6 @@
 	],
 	"requires": {
 		"env": [
-			{
-				"description": "Postgres connection string (sign-in tables live here)",
-				"example": "postgres://user:pass@host/db",
-				"key": "DATABASE_URL",
-				"secret": true
-			},
 			{
 				"description": "Absolutejs OAuth client id",
 				"docsUrl": "https://absolutejs.ai/dashboard",
@@ -258,7 +252,8 @@
 		"services": [
 			{
 				"description": "Stores accounts, sessions, and audit events",
-				"id": "postgres"
+				"id": "postgres",
+				"optional": true
 			}
 		]
 	},
@@ -321,8 +316,8 @@
 			"contract": "auth/session-store",
 			"description": "Where live sign-in sessions are kept",
 			"known": [
-				"@absolutejs/auth#postgres",
-				"@absolutejs/auth#memory"
+				"@absolutejs/auth#createNeonAuthSessionStore",
+				"@absolutejs/auth#createInMemoryAuthSessionStore"
 			],
 			"required": true
 		},

package/dist/server.js

@@ -26789,10 +26789,9 @@ var toUnregisteredSessionData = (row) => ({
   sessionInformation: cloneRecord(row.session_information_json ?? undefined),
   userIdentity: cloneRecord(row.user_identity_json ?? undefined)
 });
-var createNeonAuthSessionStore = (databaseUrl, decodeUser) => {
-  const sql2 = as(databaseUrl);
-  const db = drizzle({ client: sql2 });
-  return {
+var createNeonAuthSessionStore = (databaseUrl, decodeUser) => createPostgresAuthSessionStore(drizzle({ client: as(databaseUrl) }), decodeUser);
+var createPostgresAuthSessionStore = (db, decodeUser) => {
+  const store = {
     deleteExpired: async () => {
       const rows = await db.delete(authSessionsTable).where(lt(authSessionsTable.expires_at_ms, Date.now())).returning({ id: authSessionsTable.id });
       return rows.length;
@@ -26870,6 +26869,7 @@ var createNeonAuthSessionStore = (databaseUrl, decodeUser) => {
       });
     }
   };
+  return store;
 };
 // src/providersFromEnv.ts
 var envKey = (provider, suffix) => `${provider.replace(/[^a-zA-Z0-9]/g, "_").toUpperCase()}_${suffix}`;
@@ -34966,6 +34966,30 @@ var createRedisAuthSessionStore = (redis, decodeUser, keyPrefix = "auth:session:
     }
   };
 };
+// src/linkedProviders/credentialError.ts
+class LinkedProviderCredentialError extends Error {
+  code;
+  recovery;
+  constructor(code, recovery, message, cause) {
+    super(message, { cause });
+    this.code = code;
+    this.recovery = recovery;
+    this.name = "LinkedProviderCredentialError";
+  }
+}
+var credentialRefreshError = (error2) => {
+  if (error2 instanceof LinkedProviderCredentialError)
+    return error2;
+  const message = error2 instanceof Error ? error2.message : "";
+  if (/\binvalid_grant\b/.test(message)) {
+    return new LinkedProviderCredentialError("invalid_grant", "reconnect", "Authorization has expired or was revoked. Reconnect your account.", error2);
+  }
+  if (/\b(invalid_client|unauthorized_client)\b/.test(message)) {
+    return new LinkedProviderCredentialError("invalid_client", "configuration", "The provider connection is misconfigured. Contact support.", error2);
+  }
+  return new LinkedProviderCredentialError("refresh_failed", "retry", "The provider could not refresh the connection. Try again.", error2);
+};
+
 // src/linkedProviders/resolver.ts
 var uniqueStrings = (values) => [...new Set(values)];
 var getEffectiveScopes = (grant, binding) => {
@@ -35063,6 +35087,30 @@ var resolveBindingCredential = async (grantStore, binding, input) => {
   }
   return buildResolvedCredential(grant, binding);
 };
+var refreshAndRecord = async (grant, input, refresh2, grantStore, now) => {
+  let refreshed;
+  try {
+    const result = await refresh2(grant, input);
+    if (!result)
+      throw new Error("Linked provider access token refresh failed");
+    refreshed = result;
+  } catch (cause) {
+    const error2 = credentialRefreshError(cause);
+    await grantStore.saveGrant({
+      ...grant,
+      lastRefreshError: error2.message,
+      metadata: { ...grant.metadata, credentialFailureCode: error2.code, credentialRecovery: error2.recovery },
+      status: "refresh_required",
+      updatedAt: now()
+    });
+    throw error2;
+  }
+  const metadata = { ...refreshed.grant.metadata };
+  delete metadata.credentialRecovery;
+  delete metadata.credentialFailureCode;
+  await grantStore.saveGrant({ ...refreshed.grant, lastRefreshError: undefined, metadata });
+  return refreshed;
+};
 var createLinkedProviderCredentialResolver = ({
   grantStore,
   bindingStore,
@@ -35092,11 +35140,7 @@ var createLinkedProviderCredentialResolver = ({
       if (!refreshAccessTokenLease) {
         throw new Error("Linked provider access token lease requires refresh");
       }
-      const refreshed = await refreshAccessTokenLease(grant, input);
-      if (!refreshed) {
-        throw new Error("Linked provider access token refresh failed");
-      }
-      await grantStore.saveGrant(refreshed.grant);
+      const refreshed = await refreshAndRecord(grant, input, refreshAccessTokenLease, grantStore, now);
       ({ lease } = refreshed);
     }
     if (!lease) {
@@ -35189,8 +35233,11 @@ var createOAuthLinkedProviderCredentialResolver = async ({
       tokenType: grant.tokenType
     } : null,
     refreshAccessTokenLease: async (grant) => {
-      if (!isValidProviderOption(grant.authProviderKey) || !grant.refreshTokenCiphertext) {
-        return null;
+      if (!grant.refreshTokenCiphertext) {
+        throw new LinkedProviderCredentialError("missing_refresh_token", "reconnect", "Authorization cannot renew automatically. Reconnect your account.");
+      }
+      if (!isValidProviderOption(grant.authProviderKey)) {
+        throw new LinkedProviderCredentialError("unsupported_provider", "configuration", "This provider cannot renew the connection. Contact support.");
       }
       const providerKey = grant.authProviderKey;
       const providerClientName = typeof grant.metadata?.providerClient === "string" && grant.metadata.providerClient.trim().length > 0 ? grant.metadata.providerClient.trim() : undefined;
@@ -35200,11 +35247,11 @@ var createOAuthLinkedProviderCredentialResolver = async ({
         providersConfiguration
       });
       if ("error" in resolvedProviderClientConfiguration || !resolvedProviderClientConfiguration.config) {
-        return null;
+        throw new LinkedProviderCredentialError("provider_configuration", "configuration", "The provider connection is misconfigured. Contact support.");
       }
       const providerClient = await createOAuth2Client(providerKey, resolvedProviderClientConfiguration.config.credentials);
       if (!providerClient || !isRefreshableOAuth2Client(providerKey, providerClient)) {
-        return null;
+        throw new LinkedProviderCredentialError("unsupported_refresh", "configuration", "This provider cannot renew the connection. Contact support.");
       }
       const tokenResponse2 = await providerClient.refreshAccessToken(grant.refreshTokenCiphertext);
       const refreshedAt = Date.now();
@@ -42097,5 +42144,5 @@ export {
   userSessionIdTypebox
 };
 
-//# debugId=56F634EDC9043EB964756E2164756E21
+//# debugId=DE4780E5239C13EA64756E2164756E21
 //# sourceMappingURL=server.js.map