@authhero/kysely-adapter 12.4.2 → 12.5.0

package/dist/types/migrate/migrations/2026-08-20T12:00:00_refresh_token_session_id.d.ts

@@ -0,0 +1,4 @@
+import { Kysely } from "kysely";
+import { Database } from "../../src/db";
+export declare function up(db: Kysely<Database>): Promise<void>;
+export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-08-21T12:00:00_refresh_token_session_id_backfill.d.ts

@@ -0,0 +1,4 @@
+import { Kysely } from "kysely";
+import { Database } from "../../src/db";
+export declare function up(db: Kysely<Database>): Promise<void>;
+export declare function down(): Promise<void>;

package/dist/types/migrate/migrations/index.d.ts

@@ -5,6 +5,8 @@ import * as userBlocked from "./2026-08-05T12:00:00_user_blocked";
 import * as promptSettingsLastUsed from "./2026-08-09T12:00:00_prompt_settings_last_used";
 import * as actionExecutionsCreatedAtIndex from "./2026-08-10T12:00:00_action_executions_created_at_index";
 import * as pageHooks from "./2026-08-11T12:00:00_page_hooks";
+import * as refreshTokenSessionId from "./2026-08-20T12:00:00_refresh_token_session_id";
+import * as refreshTokenSessionIdBackfill from "./2026-08-21T12:00:00_refresh_token_session_id_backfill";
 /**
  * Kysely runs these in key order and refuses to start if an already-executed
  * migration sorts after a pending one, so the keys must sort in execution
@@ -28,5 +30,7 @@ declare const _default: {
     "2026-08-09T12:00:00_prompt_settings_last_used": typeof promptSettingsLastUsed;
     "2026-08-10T12:00:00_action_executions_created_at_index": typeof actionExecutionsCreatedAtIndex;
     "2026-08-11T12:00:00_page_hooks": typeof pageHooks;
+    "2026-08-20T12:00:00_refresh_token_session_id": typeof refreshTokenSessionId;
+    "2026-08-21T12:00:00_refresh_token_session_id_backfill": typeof refreshTokenSessionIdBackfill;
 };
 export default _default;

package/dist/types/src/db.d.ts

@@ -238,7 +238,10 @@ declare const sqlSessionSchema: z.ZodObject<{
 }, z.core.$strip>;
 declare const sqlRefreshTokensSchema: z.ZodObject<{
     client_id: z.ZodString;
+    organization: z.ZodOptional<z.ZodString>;
+    session_id: z.ZodOptional<z.ZodString>;
     user_id: z.ZodString;
+    auth_connection: z.ZodOptional<z.ZodString>;
     id: z.ZodString;
     login_id: z.ZodString;
     token_lookup: z.ZodOptional<z.ZodString>;
@@ -249,6 +252,8 @@ declare const sqlRefreshTokensSchema: z.ZodObject<{
     device: z.ZodString;
     resource_servers: z.ZodString;
     rotating: z.ZodNumber;
+    auth_strategy_strategy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    auth_strategy_strategy_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     created_at_ts: z.ZodNumber;
     expires_at_ts: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     idle_expires_at_ts: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;

package/dist/types/src/refreshTokens/list.d.ts

@@ -1,4 +1,4 @@
-import { ListParams, ListRefreshTokenResponse } from "@authhero/adapter-interfaces";
+import { ListRefreshTokenResponse, RefreshTokenListParams } from "@authhero/adapter-interfaces";
 import { Kysely } from "kysely";
 import { Database } from "../db";
-export declare function list(db: Kysely<Database>): (tenant_id: string, params?: ListParams) => Promise<ListRefreshTokenResponse>;
+export declare function list(db: Kysely<Database>): (tenant_id: string, params?: RefreshTokenListParams) => Promise<ListRefreshTokenResponse>;

package/dist/types/src/refreshTokens/revokeByUser.d.ts

@@ -0,0 +1,13 @@
+import { Kysely } from "kysely";
+import { Database } from "../db";
+/**
+ * Soft-revoke every unrevoked refresh token belonging to a user.
+ *
+ * Exact tenant + user predicates rather than a `q` filter: the Lucene grammar
+ * splits on ` OR ` before tokenizing, so a crafted user id can widen the match
+ * to another user's rows.
+ *
+ * `revoked_at_ts IS NULL` keeps this idempotent and concurrency-safe — a second
+ * revocation cannot overwrite the audit timestamp written by the first.
+ */
+export declare function revokeByUser(db: Kysely<Database>): (tenant_id: string, user_id: string, revoked_at: string) => Promise<number>;

package/dist/types/src/refreshTokens/to-refresh-token.d.ts

@@ -0,0 +1,11 @@
+import { RefreshToken } from "@authhero/adapter-interfaces";
+import { Selectable } from "kysely";
+import { Database } from "../db";
+/**
+ * Map a `refresh_tokens` row onto the adapter shape.
+ *
+ * Shared by get / getByLookup / list so the three readers cannot drift — in
+ * particular the `auth_strategy` re-nesting, which is stored as two flat
+ * columns but exposed as one nested object.
+ */
+export declare function toRefreshToken(row: Selectable<Database["refresh_tokens"]>): RefreshToken;