@drawbridge/drawbridge-utils 0.0.128 → 0.0.129

package/dist/oauth/server.cjs

@@ -29,6 +29,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // lib/oauth/server.js
 var server_exports = {};
 __export(server_exports, {
+  ROTATION_GRACE_MS: () => ROTATION_GRACE_MS,
   createClient: () => createClient,
   createOAuthModel: () => createOAuthModel,
   createOAuthServer: () => createOAuthServer
@@ -147,6 +148,7 @@ var generateToken = () => generate(32, "base64url");
 
 // lib/oauth/server.js
 var SUPPORTED_GRANTS = ["authorization_code", "client_credentials", "refresh_token"];
+var ROTATION_GRACE_MS = 60 * 1e3;
 var createOAuthModel = ({ controller }) => ({
   getClient: async (clientId, clientSecret) => {
     var _a;
@@ -328,12 +330,16 @@ var createOAuthModel = ({ controller }) => ({
     const record = await controller.get({
       collection: "token",
       query: {
-        revoked: false,
         tokenHash,
         type: tokenTypes.refresh
       }
     });
     if (!record) return false;
+    if (record.revoked) {
+      const rotatedAt = record.rotatedAt ? new Date(record.rotatedAt).getTime() : null;
+      if (!rotatedAt || Date.now() - rotatedAt > ROTATION_GRACE_MS) return false;
+    }
+    ;
     return {
       client: { id: record.client },
       refreshToken,
@@ -345,6 +351,15 @@ var createOAuthModel = ({ controller }) => ({
   revokeToken: async (token) => {
     const rawToken = token.refreshToken ?? token.accessToken;
     const tokenHash = hashToken(rawToken);
+    await controller.update({
+      collection: "token",
+      data: {
+        $set: {
+          rotatedAt: /* @__PURE__ */ new Date()
+        }
+      },
+      query: { revoked: { $ne: true }, tokenHash }
+    });
     await controller.update({
       collection: "token",
       data: {
@@ -443,6 +458,7 @@ var createClient = async ({
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ROTATION_GRACE_MS,
   createClient,
   createOAuthModel,
   createOAuthServer

package/dist/oauth/server.d.cts

@@ -34,6 +34,11 @@ import 'crypto';
 // ever need to, store `grants` on the oauth doc and read it here.
 const SUPPORTED_GRANTS = [ 'authorization_code', 'client_credentials', 'refresh_token' ];
 
+// How long a just-rotated refresh token keeps answering (see getRefreshToken).
+// Long enough for the parallel requests of one navigation to all land; short
+// enough that a stolen token replayed later is refused like any other.
+const ROTATION_GRACE_MS = 60 * 1000;
+
 const createOAuthModel = ({ controller }) => ({
 
 	getClient : async ( clientId, clientSecret ) => {
@@ -258,7 +263,6 @@ const createOAuthModel = ({ controller }) => ({
 		const record = await controller.get({
 			collection : 'token',
 			query : {
-				revoked : false,
 				tokenHash,
 				type : tokenTypes.refresh
 			}
@@ -266,6 +270,25 @@ const createOAuthModel = ({ controller }) => ({
 
 		if( ! record ) return false;
 
+		// ROTATION GRACE. Refresh tokens are single-use, and the dashboard's
+		// middleware refreshes on whichever request arrives first — Next fires
+		// several in parallel, so the losers present a token the winner just
+		// consumed. For a short window a JUST-ROTATED token still answers,
+		// so a race mints an extra pair instead of ending the session.
+		//
+		// `rotatedAt` is written ONCE, on the transition into revoked (see
+		// revokeToken) — a replay inside the window cannot refresh it, so the
+		// window closes sixty seconds after the first rotation no matter how
+		// often the old token is replayed. A token revoked WITHOUT rotatedAt
+		// was killed on purpose — signout, an admin, a deleted client — and
+		// gets no grace: those revocations must be absolute.
+		if( record.revoked ){
+
+			const rotatedAt = record.rotatedAt ? new Date( record.rotatedAt ).getTime() : null;
+
+			if( ! rotatedAt || ( Date.now() - rotatedAt ) > ROTATION_GRACE_MS ) return false;
+
+		}
 		return {
 			client : { id : record.client },
 			refreshToken,
@@ -281,6 +304,20 @@ const createOAuthModel = ({ controller }) => ({
 		const rawToken = token.refreshToken ?? token.accessToken;
 		const tokenHash = hashToken( rawToken );
 
+		// rotatedAt marks that this revocation IS a rotation — the only kind
+		// getRefreshToken graces. Guarded on the transition (revoked $ne true)
+		// so a grace-window replay re-revoking the same row cannot move the
+		// stamp and hold the window open.
+		await controller.update({
+			collection : 'token',
+			data : {
+				$set : {
+					rotatedAt : new Date()
+				}
+			},
+			query : { revoked : { $ne : true }, tokenHash }
+		});
+
 		await controller.update({
 			collection : 'token',
 			data : {
@@ -411,4 +448,4 @@ const createClient = async ({
 
 };
 
-export { createClient, createOAuthModel, createOAuthServer };
+export { ROTATION_GRACE_MS, createClient, createOAuthModel, createOAuthServer };

package/dist/oauth/server.d.ts

@@ -34,6 +34,11 @@ import 'crypto';
 // ever need to, store `grants` on the oauth doc and read it here.
 const SUPPORTED_GRANTS = [ 'authorization_code', 'client_credentials', 'refresh_token' ];
 
+// How long a just-rotated refresh token keeps answering (see getRefreshToken).
+// Long enough for the parallel requests of one navigation to all land; short
+// enough that a stolen token replayed later is refused like any other.
+const ROTATION_GRACE_MS = 60 * 1000;
+
 const createOAuthModel = ({ controller }) => ({
 
 	getClient : async ( clientId, clientSecret ) => {
@@ -258,7 +263,6 @@ const createOAuthModel = ({ controller }) => ({
 		const record = await controller.get({
 			collection : 'token',
 			query : {
-				revoked : false,
 				tokenHash,
 				type : tokenTypes.refresh
 			}
@@ -266,6 +270,25 @@ const createOAuthModel = ({ controller }) => ({
 
 		if( ! record ) return false;
 
+		// ROTATION GRACE. Refresh tokens are single-use, and the dashboard's
+		// middleware refreshes on whichever request arrives first — Next fires
+		// several in parallel, so the losers present a token the winner just
+		// consumed. For a short window a JUST-ROTATED token still answers,
+		// so a race mints an extra pair instead of ending the session.
+		//
+		// `rotatedAt` is written ONCE, on the transition into revoked (see
+		// revokeToken) — a replay inside the window cannot refresh it, so the
+		// window closes sixty seconds after the first rotation no matter how
+		// often the old token is replayed. A token revoked WITHOUT rotatedAt
+		// was killed on purpose — signout, an admin, a deleted client — and
+		// gets no grace: those revocations must be absolute.
+		if( record.revoked ){
+
+			const rotatedAt = record.rotatedAt ? new Date( record.rotatedAt ).getTime() : null;
+
+			if( ! rotatedAt || ( Date.now() - rotatedAt ) > ROTATION_GRACE_MS ) return false;
+
+		}
 		return {
 			client : { id : record.client },
 			refreshToken,
@@ -281,6 +304,20 @@ const createOAuthModel = ({ controller }) => ({
 		const rawToken = token.refreshToken ?? token.accessToken;
 		const tokenHash = hashToken( rawToken );
 
+		// rotatedAt marks that this revocation IS a rotation — the only kind
+		// getRefreshToken graces. Guarded on the transition (revoked $ne true)
+		// so a grace-window replay re-revoking the same row cannot move the
+		// stamp and hold the window open.
+		await controller.update({
+			collection : 'token',
+			data : {
+				$set : {
+					rotatedAt : new Date()
+				}
+			},
+			query : { revoked : { $ne : true }, tokenHash }
+		});
+
 		await controller.update({
 			collection : 'token',
 			data : {
@@ -411,4 +448,4 @@ const createClient = async ({
 
 };
 
-export { createClient, createOAuthModel, createOAuthServer };
+export { ROTATION_GRACE_MS, createClient, createOAuthModel, createOAuthServer };

package/dist/oauth/server.js

@@ -112,6 +112,7 @@ var generateToken = () => generate(32, "base64url");
 
 // lib/oauth/server.js
 var SUPPORTED_GRANTS = ["authorization_code", "client_credentials", "refresh_token"];
+var ROTATION_GRACE_MS = 60 * 1e3;
 var createOAuthModel = ({ controller }) => ({
   getClient: async (clientId, clientSecret) => {
     var _a;
@@ -293,12 +294,16 @@ var createOAuthModel = ({ controller }) => ({
     const record = await controller.get({
       collection: "token",
       query: {
-        revoked: false,
         tokenHash,
         type: tokenTypes.refresh
       }
     });
     if (!record) return false;
+    if (record.revoked) {
+      const rotatedAt = record.rotatedAt ? new Date(record.rotatedAt).getTime() : null;
+      if (!rotatedAt || Date.now() - rotatedAt > ROTATION_GRACE_MS) return false;
+    }
+    ;
     return {
       client: { id: record.client },
       refreshToken,
@@ -310,6 +315,15 @@ var createOAuthModel = ({ controller }) => ({
   revokeToken: async (token) => {
     const rawToken = token.refreshToken ?? token.accessToken;
     const tokenHash = hashToken(rawToken);
+    await controller.update({
+      collection: "token",
+      data: {
+        $set: {
+          rotatedAt: /* @__PURE__ */ new Date()
+        }
+      },
+      query: { revoked: { $ne: true }, tokenHash }
+    });
     await controller.update({
       collection: "token",
       data: {
@@ -407,6 +421,7 @@ var createClient = async ({
   };
 };
 export {
+  ROTATION_GRACE_MS,
   createClient,
   createOAuthModel,
   createOAuthServer

package/dist/pricing.cjs

@@ -40,6 +40,7 @@ __export(pricing_exports, {
   channels: () => channels,
   conversionRate: () => conversionRate,
   free: () => free,
+  numbers: () => numbers,
   plans: () => plans,
   resolvePlan: () => resolvePlan,
   scrape: () => scrape,
@@ -883,6 +884,11 @@ var channels = {
     includedInAllowance: false
   }
 };
+var numbers = {
+  sms: {
+    monthlyCents: 500
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   LOCAL_FLAT_CENTS,
@@ -896,6 +902,7 @@ var channels = {
   channels,
   conversionRate,
   free,
+  numbers,
   plans,
   resolvePlan,
   scrape,

package/dist/pricing.d.cts

@@ -189,4 +189,18 @@ const channels = {
 	}
 };
 
-export { channels, sending };
+// The dedicated SMS number — a RECURRING SUBSCRIPTION ITEM, not an action:
+// the carrier bills for holding the number whether or not it sends, so it
+// joins the organization's subscription as its own line and leaves when the
+// number is released. CENTS per month, like every stored money value.
+//
+// The amount was not settled in the item-6 plan (only the mechanism was);
+// $5 covers the ~$1.15 carrier cost with room for A2P registration fees.
+// Changing it is this one line plus the matching Stripe Price.
+const numbers = {
+	sms : {
+		monthlyCents : 500
+	}
+};
+
+export { channels, numbers, sending };

package/dist/pricing.d.ts

@@ -189,4 +189,18 @@ const channels = {
 	}
 };
 
-export { channels, sending };
+// The dedicated SMS number — a RECURRING SUBSCRIPTION ITEM, not an action:
+// the carrier bills for holding the number whether or not it sends, so it
+// joins the organization's subscription as its own line and leaves when the
+// number is released. CENTS per month, like every stored money value.
+//
+// The amount was not settled in the item-6 plan (only the mechanism was);
+// $5 covers the ~$1.15 carrier cost with room for A2P registration fees.
+// Changing it is this one line plus the matching Stripe Price.
+const numbers = {
+	sms : {
+		monthlyCents : 500
+	}
+};
+
+export { channels, numbers, sending };

package/dist/pricing.js

@@ -833,6 +833,11 @@ var channels = {
     includedInAllowance: false
   }
 };
+var numbers = {
+  sms: {
+    monthlyCents: 500
+  }
+};
 export {
   LOCAL_FLAT_CENTS,
   MARKUP,
@@ -845,6 +850,7 @@ export {
   channels,
   conversionRate,
   free,
+  numbers,
   plans,
   resolvePlan,
   scrape,

package/dist/twilio.cjs

@@ -113,7 +113,7 @@ var twilio = {
   //          body: PhoneNumber (E.164), SmsUrl, SmsMethod
   //   DELETE /2010-04-01/Accounts/{AccountSid}/IncomingPhoneNumbers/{Sid}.json
   // Basic auth throughout, like Messages.
-  searchNumbers: async ({ accountSid, areaCode, authToken, country = "US", limit = 10, request: request2 = request }) => {
+  searchNumbers: async ({ accountSid, areaCode, authToken, contains, country = "US", limit = 10, request: request2 = request }) => {
     if (!accountSid || !authToken) throw new Error("Twilio credentials missing \u2014 accountSid, authToken");
     const result = await request2({
       method: "GET",
@@ -124,7 +124,11 @@ var twilio = {
       query: {
         SmsEnabled: true,
         PageSize: limit,
-        ...areaCode && { AreaCode: areaCode }
+        ...areaCode && { AreaCode: areaCode },
+        // `Contains` is the vendor's matching-pattern filter — digits
+        // match anywhere in the number, so one search box serves "my
+        // area code" and "ends in 7777" alike.
+        ...contains && { Contains: contains }
       }
     });
     return ((result == null ? void 0 : result.available_phone_numbers) || []).map((entry) => ({

package/dist/twilio.d.cts

@@ -77,7 +77,7 @@ const twilio = {
 	//   DELETE /2010-04-01/Accounts/{AccountSid}/IncomingPhoneNumbers/{Sid}.json
 	// Basic auth throughout, like Messages.
 
-	searchNumbers : async ({ accountSid, areaCode, authToken, country = 'US', limit = 10, request: request$1 = request }) => {
+	searchNumbers : async ({ accountSid, areaCode, authToken, contains, country = 'US', limit = 10, request: request$1 = request }) => {
 
 		if( ! accountSid || ! authToken ) throw new Error( 'Twilio credentials missing — accountSid, authToken' );
 
@@ -90,7 +90,11 @@ const twilio = {
 			query : {
 				SmsEnabled : true,
 				PageSize : limit,
-				...( areaCode && { AreaCode : areaCode } )
+				...( areaCode && { AreaCode : areaCode } ),
+				// `Contains` is the vendor's matching-pattern filter — digits
+				// match anywhere in the number, so one search box serves "my
+				// area code" and "ends in 7777" alike.
+				...( contains && { Contains : contains } )
 			}
 		});
 

package/dist/twilio.d.ts

@@ -77,7 +77,7 @@ const twilio = {
 	//   DELETE /2010-04-01/Accounts/{AccountSid}/IncomingPhoneNumbers/{Sid}.json
 	// Basic auth throughout, like Messages.
 
-	searchNumbers : async ({ accountSid, areaCode, authToken, country = 'US', limit = 10, request: request$1 = request }) => {
+	searchNumbers : async ({ accountSid, areaCode, authToken, contains, country = 'US', limit = 10, request: request$1 = request }) => {
 
 		if( ! accountSid || ! authToken ) throw new Error( 'Twilio credentials missing — accountSid, authToken' );
 
@@ -90,7 +90,11 @@ const twilio = {
 			query : {
 				SmsEnabled : true,
 				PageSize : limit,
-				...( areaCode && { AreaCode : areaCode } )
+				...( areaCode && { AreaCode : areaCode } ),
+				// `Contains` is the vendor's matching-pattern filter — digits
+				// match anywhere in the number, so one search box serves "my
+				// area code" and "ends in 7777" alike.
+				...( contains && { Contains : contains } )
 			}
 		});
 

package/dist/twilio.js

@@ -88,7 +88,7 @@ var twilio = {
   //          body: PhoneNumber (E.164), SmsUrl, SmsMethod
   //   DELETE /2010-04-01/Accounts/{AccountSid}/IncomingPhoneNumbers/{Sid}.json
   // Basic auth throughout, like Messages.
-  searchNumbers: async ({ accountSid, areaCode, authToken, country = "US", limit = 10, request: request2 = request }) => {
+  searchNumbers: async ({ accountSid, areaCode, authToken, contains, country = "US", limit = 10, request: request2 = request }) => {
     if (!accountSid || !authToken) throw new Error("Twilio credentials missing \u2014 accountSid, authToken");
     const result = await request2({
       method: "GET",
@@ -99,7 +99,11 @@ var twilio = {
       query: {
         SmsEnabled: true,
         PageSize: limit,
-        ...areaCode && { AreaCode: areaCode }
+        ...areaCode && { AreaCode: areaCode },
+        // `Contains` is the vendor's matching-pattern filter — digits
+        // match anywhere in the number, so one search box serves "my
+        // area code" and "ends in 7777" alike.
+        ...contains && { Contains: contains }
       }
     });
     return ((result == null ? void 0 : result.available_phone_numbers) || []).map((entry) => ({

package/package.json

@@ -215,5 +215,5 @@
     "test": ". \"$HOME/.nvm/nvm.sh\" && nvm use && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.128"
+  "version": "0.0.129"
 }