@authhero/adapter-interfaces 4.9.0 → 4.11.0

package/dist/types/adapters/RefreshTokens.d.ts

@@ -28,6 +28,23 @@ export interface UpdateRefreshTokenOptions {
         expires_at: string;
     };
 }
+/**
+ * Update payload for a refresh token.
+ *
+ * The two expiry columns are three-valued on the way in: `undefined` leaves
+ * the stored value alone, a string overwrites it, and `null` clears it — the
+ * token stops expiring on that axis.
+ *
+ * Clearing exists for the in-place refresh exchange. A rotating client
+ * reconciles a changed refresh-token config for free, because the child row is
+ * minted from the current lifetimes; a non-rotating one keeps handing back the
+ * row it was given, so switching a client to non-expiring has to be able to
+ * drop the expiries that row was stamped with.
+ */
+export type RefreshTokenUpdate = Partial<Omit<RefreshToken, "expires_at" | "idle_expires_at">> & {
+    expires_at?: string | null;
+    idle_expires_at?: string | null;
+};
 export interface RefreshTokensAdapter {
     create: (tenant_id: string, refresh_token: RefreshTokenInsert) => Promise<RefreshToken>;
     get: (tenant_id: string, id: string) => Promise<RefreshToken | null>;
@@ -38,7 +55,7 @@ export interface RefreshTokensAdapter {
      */
     getByLookup: (tenant_id: string, token_lookup: string) => Promise<RefreshToken | null>;
     list(tenant_id: string, params?: RefreshTokenListParams): Promise<ListRefreshTokenResponse>;
-    update: (tenant_id: string, id: string, refresh_token: Partial<RefreshToken>, options?: UpdateRefreshTokenOptions) => Promise<boolean>;
+    update: (tenant_id: string, id: string, refresh_token: RefreshTokenUpdate, options?: UpdateRefreshTokenOptions) => Promise<boolean>;
     remove: (tenant_id: string, id: string) => Promise<boolean>;
     /**
      * Soft-revoke every refresh token belonging to a user that isn't already
@@ -53,6 +70,23 @@ export interface RefreshTokensAdapter {
      */
     revokeByUser: (tenant_id: string, user_id: string, revoked_at: string) => Promise<number>;
     revokeByLoginSession: (tenant_id: string, login_session_id: string, revoked_at: string) => Promise<number>;
+    /**
+     * Soft-revoke every refresh token owned by a session that isn't already
+     * revoked. This is the cascade behind "revoking a session revokes its
+     * refresh tokens" — deliberate revocation only.
+     *
+     * It must never be called for a session that merely *expired* or that
+     * cleanup removed: a refresh token is designed to outlive its session, and
+     * killing tokens on an SSO timeout would log out every long-lived native
+     * client. Lifetime does not couple; revocation does.
+     *
+     * Rows minted before `session_id` existed carry no value here and are not
+     * matched — callers sweep `revokeByLoginSession` alongside this until those
+     * rows have aged out (#1259).
+     *
+     * Returns the number of tokens revoked.
+     */
+    revokeBySession: (tenant_id: string, session_id: string, revoked_at: string) => Promise<number>;
     /**
      * Soft-revoke every refresh token that shares `family_id` and isn't already
      * revoked. Used for reuse detection (entire rotation chain torched) and for

package/dist/types/utils/lucene.d.ts

@@ -1,7 +1,13 @@
 /**
  * Shared pieces of the Lucene-style `q` filter handling. The SQL generation
  * itself is ORM-specific and lives in each adapter; what is shared here is
- * the query-string sanitization that enforces the tenant boundary.
+ * the tokenizer (including the OR split) and the query-string sanitization
+ * that enforces the tenant boundary.
  */
+export declare function tokenizeLuceneQuery(query: string): string[];
+export declare function unescapeLuceneValue(value: string): string;
+export declare function escapeLuceneValue(value: string): string;
+export declare function unquoteLuceneValue(value: string): string;
+export declare function splitLuceneOrGroups(query: string): string[][];
 export declare function sanitizeLuceneQuery(query: string, allowedFields: string[]): string;
 export declare function isEmailSearchTerm(value: string): boolean;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "4.9.0",
+  "version": "4.11.0",
   "files": [
     "dist"
   ],