@julr/sesame 0.5.1 → 0.7.0

package/build/src/storage/drivers/lucid.d.ts

@@ -0,0 +1,162 @@
+import { DateTime } from 'luxon';
+import { OAuthAccessToken } from '../../models/oauth_access_token.js';
+import { OAuthAuthorizationCode } from '../../models/oauth_authorization_code.js';
+import { OAuthClient } from '../../models/oauth_client.js';
+import { OAuthConsent } from '../../models/oauth_consent.js';
+import { OAuthPendingAuthorizationRequest } from '../../models/oauth_pending_authorization_request.js';
+import { OAuthRefreshToken } from '../../models/oauth_refresh_token.js';
+import type { CreateAccessTokenRecord, CreateAuthorizationCodeRecord, CreateClientRecord, CreatePendingAuthorizationRequestRecord, ExchangeAuthorizationCodeOptions, IssueTokenPairOptions, OAuthAccessTokenRecord, OAuthAuthorizationCodeRecord, OAuthClientRecord, OAuthConsentRecord, OAuthPendingAuthorizationRequestRecord, OAuthRefreshTokenRecord, PurgeTokensOptions, RotateRefreshTokenOptions, SesamePurgeResult, SesameStore, UpdateClientRecord } from '../types.js';
+/**
+ * Persist OAuth records through the application's Lucid connection.
+ */
+export declare class LucidStore implements SesameStore {
+    #private;
+    /**
+     * Bind this store to a Lucid transaction when one is supplied.
+     */
+    constructor(client?: any);
+    /**
+     * Find a registered client by its public identifier.
+     */
+    findClient(clientId: string): Promise<OAuthClientRecord | null>;
+    /**
+     * List clients newest first, optionally for a single owner.
+     */
+    listClients(options?: {
+        userId?: string;
+    }): Promise<OAuthClientRecord[]>;
+    /**
+     * Insert a client and return its stored record.
+     */
+    createClient(data: CreateClientRecord): Promise<OAuthClientRecord>;
+    /**
+     * Update only the supplied public client fields.
+     */
+    updateClient(options: {
+        id: string;
+        data: UpdateClientRecord;
+    }): Promise<void>;
+    /**
+     * Replace a confidential client's stored secret hash.
+     */
+    updateClientSecret(options: {
+        id: string;
+        secret: string;
+    }): Promise<void>;
+    /**
+     * Delete a client and all its associated OAuth records atomically.
+     */
+    deleteClient(clientId: string): Promise<boolean>;
+    /**
+     * Look up an access-token hash, optionally limited to one client.
+     */
+    findAccessToken(options: {
+        hash: string;
+        clientId?: string;
+    }): Promise<OAuthAccessTokenRecord | null>;
+    /**
+     * Insert a hashed access token.
+     */
+    createAccessToken(data: CreateAccessTokenRecord): Promise<void>;
+    /**
+     * Revoke an active access token owned by the requesting client.
+     */
+    revokeAccessToken(options: {
+        hash: string;
+        clientId: string;
+        now: DateTime;
+    }): Promise<boolean>;
+    /**
+     * Look up a refresh-token hash owned by a client.
+     */
+    findRefreshToken(options: {
+        hash: string;
+        clientId: string;
+    }): Promise<OAuthRefreshTokenRecord | null>;
+    /**
+     * Revoke a refresh token and its associated active access token together.
+     */
+    revokeRefreshToken(options: {
+        hash: string;
+        clientId: string;
+        now: DateTime;
+    }): Promise<void>;
+    /**
+     * Invalidate a client's token family after refresh-token replay.
+     */
+    revokeTokenFamily(options: {
+        clientId: string;
+        userId: string;
+        now: DateTime;
+    }): Promise<void>;
+    /**
+     * Find an authorization-code hash issued to a client.
+     */
+    findAuthorizationCode(options: {
+        code: string;
+        clientId: string;
+    }): Promise<OAuthAuthorizationCodeRecord | null>;
+    /**
+     * Store a short-lived authorization-code hash.
+     */
+    createAuthorizationCode(data: CreateAuthorizationCodeRecord): Promise<void>;
+    /**
+     * Discard an expired or invalid authorization code.
+     */
+    deleteAuthorizationCode(id: string): Promise<void>;
+    /**
+     * Consume a code exactly once and issue its tokens in one transaction.
+     */
+    exchangeAuthorizationCode(options: ExchangeAuthorizationCodeOptions): Promise<boolean>;
+    /**
+     * Find a user's current consent for a client.
+     */
+    findConsent(options: {
+        clientId: string;
+        userId: string;
+    }): Promise<OAuthConsentRecord | null>;
+    /**
+     * Merge newly approved scopes into the user's consent.
+     */
+    grantConsent(options: {
+        clientId: string;
+        userId: string;
+        scopes: string[];
+    }): Promise<void>;
+    /**
+     * Persist an authorization request awaiting user consent.
+     */
+    createPendingAuthorizationRequest(data: CreatePendingAuthorizationRequestRecord): Promise<void>;
+    /**
+     * Return a valid pending request only to the process that deletes it.
+     */
+    consumePendingAuthorizationRequest(options: {
+        token: string;
+        userId: string;
+        now: DateTime;
+    }): Promise<OAuthPendingAuthorizationRequestRecord | null>;
+    /**
+     * Persist a new access/refresh pair atomically during the grace period.
+     */
+    issueTokenPair(options: IssueTokenPairOptions): Promise<void>;
+    /**
+     * Conditionally consume a refresh token and persist its replacement pair.
+     */
+    rotateRefreshToken(options: RotateRefreshTokenOptions): Promise<boolean>;
+    /**
+     * Revoke a user's tokens and remove their short-lived OAuth records.
+     */
+    revokeAllForUser(options: {
+        userId: string;
+        now: DateTime;
+    }): Promise<void>;
+    /**
+     * Remove revoked and aged OAuth records and return per-table counts.
+     */
+    purgeTokens(options: PurgeTokensOptions): Promise<SesamePurgeResult>;
+}
+/**
+ * Create a Sesame store backed by the application's Lucid connection.
+ */
+export declare function lucidStore(): SesameStore;
+export { OAuthAccessToken, OAuthAuthorizationCode, OAuthClient, OAuthConsent, OAuthPendingAuthorizationRequest, OAuthRefreshToken, };