@lastshotlabs/bunshot 0.0.13 → 0.0.18

package/dist/adapters/memoryAuth.d.ts

@@ -10,6 +10,10 @@ export declare const memoryGetUserSessions: (userId: string) => SessionInfo[];
 export declare const memoryGetActiveSessionCount: (userId: string) => number;
 export declare const memoryEvictOldestSession: (userId: string) => void;
 export declare const memoryUpdateSessionLastActive: (sessionId: string) => void;
+export declare const memorySetRefreshToken: (sessionId: string, refreshToken: string) => void;
+import type { RefreshResult } from "../lib/session";
+export declare const memoryGetSessionByRefreshToken: (refreshToken: string) => RefreshResult | null;
+export declare const memoryRotateRefreshToken: (sessionId: string, newRefreshToken: string, newAccessToken: string) => void;
 export declare const memoryStoreOAuthState: (state: string, codeVerifier?: string, linkUserId?: string) => void;
 export declare const memoryConsumeOAuthState: (state: string) => {
     codeVerifier?: string;
@@ -30,3 +34,6 @@ export declare const memoryConsumeResetToken: (hash: string) => {
     userId: string;
     email: string;
 } | null;
+import type { OAuthCodePayload } from "../lib/oauthCode";
+export declare const memoryStoreOAuthCode: (hash: string, payload: OAuthCodePayload, ttlSeconds: number) => void;
+export declare const memoryConsumeOAuthCode: (hash: string) => OAuthCodePayload | null;

package/dist/adapters/memoryAuth.js

@@ -1,23 +1,33 @@
 import { HttpError } from "../lib/HttpError";
 import { getPersistSessionMetadata, getIncludeInactiveSessions } from "../lib/appConfig";
+import { clearMemoryRateLimitStore } from "../lib/authRateLimit";
+import { clearMemoryMfaChallenges } from "../lib/mfaChallenge";
 const _users = new Map();
 const _byEmail = new Map();
 const _sessions = new Map(); // sessionId → session
 const _userSessionIds = new Map(); // userId → Set<sessionId>
+const _refreshTokenIndex = new Map(); // refreshToken → sessionId
 const _oauthStates = new Map();
 const _cache = new Map();
 const _verificationTokens = new Map();
 const _resetTokens = new Map();
+const _oauthCodes = new Map();
+const _tenantRoles = new Map(); // "userId:tenantId" → roles
 /** Reset all in-memory state. Useful for test isolation. */
 export const clearMemoryStore = () => {
     _users.clear();
     _byEmail.clear();
     _sessions.clear();
     _userSessionIds.clear();
+    _refreshTokenIndex.clear();
+    _tenantRoles.clear();
     _oauthStates.clear();
+    _oauthCodes.clear();
     _cache.clear();
     _verificationTokens.clear();
     _resetTokens.clear();
+    clearMemoryRateLimitStore();
+    clearMemoryMfaChallenges();
 };
 // ---------------------------------------------------------------------------
 // Auth adapter
@@ -37,7 +47,7 @@ export const memoryAuthAdapter = {
         if (_byEmail.has(normalised))
             throw new HttpError(409, "Email already registered");
         const id = crypto.randomUUID();
-        const user = { id, email: normalised, passwordHash, providerIds: [], roles: [], emailVerified: false };
+        const user = { id, email: normalised, passwordHash, providerIds: [], roles: [], emailVerified: false, mfaSecret: null, mfaEnabled: false, recoveryCodes: [], mfaMethods: [], webauthnCredentials: [] };
         _users.set(id, user);
         _byEmail.set(normalised, id);
         return { id };
@@ -63,7 +73,7 @@ export const memoryAuthAdapter = {
         }
         const id = crypto.randomUUID();
         const email = profile.email ? profile.email.toLowerCase() : null;
-        const user = { id, email, passwordHash: null, providerIds: [key], roles: [], emailVerified: false };
+        const user = { id, email, passwordHash: null, providerIds: [key], roles: [], emailVerified: false, mfaSecret: null, mfaEnabled: false, recoveryCodes: [], mfaMethods: [], webauthnCredentials: [] };
         _users.set(id, user);
         if (email)
             _byEmail.set(email, id);
@@ -132,6 +142,106 @@ export const memoryAuthAdapter = {
     async getEmailVerified(userId) {
         return _users.get(userId)?.emailVerified ?? false;
     },
+    async deleteUser(userId) {
+        const user = _users.get(userId);
+        if (user?.email)
+            _byEmail.delete(user.email);
+        _users.delete(userId);
+    },
+    async hasPassword(userId) {
+        return !!_users.get(userId)?.passwordHash;
+    },
+    async setMfaSecret(userId, secret) {
+        const user = _users.get(userId);
+        if (user)
+            user.mfaSecret = secret;
+    },
+    async getMfaSecret(userId) {
+        return _users.get(userId)?.mfaSecret ?? null;
+    },
+    async isMfaEnabled(userId) {
+        return _users.get(userId)?.mfaEnabled ?? false;
+    },
+    async setMfaEnabled(userId, enabled) {
+        const user = _users.get(userId);
+        if (user)
+            user.mfaEnabled = enabled;
+    },
+    async setRecoveryCodes(userId, codes) {
+        const user = _users.get(userId);
+        if (user)
+            user.recoveryCodes = [...codes];
+    },
+    async getRecoveryCodes(userId) {
+        return _users.get(userId)?.recoveryCodes ?? [];
+    },
+    async removeRecoveryCode(userId, code) {
+        const user = _users.get(userId);
+        if (user)
+            user.recoveryCodes = user.recoveryCodes.filter((c) => c !== code);
+    },
+    async getMfaMethods(userId) {
+        const user = _users.get(userId);
+        if (!user)
+            return [];
+        // Backward compat: if mfaEnabled but no methods recorded, assume TOTP
+        if (user.mfaMethods.length === 0 && user.mfaEnabled)
+            return ["totp"];
+        return [...user.mfaMethods];
+    },
+    async setMfaMethods(userId, methods) {
+        const user = _users.get(userId);
+        if (user)
+            user.mfaMethods = [...methods];
+    },
+    async getWebAuthnCredentials(userId) {
+        return [...(_users.get(userId)?.webauthnCredentials ?? [])];
+    },
+    async addWebAuthnCredential(userId, credential) {
+        const user = _users.get(userId);
+        if (user)
+            user.webauthnCredentials.push({ ...credential });
+    },
+    async removeWebAuthnCredential(userId, credentialId) {
+        const user = _users.get(userId);
+        if (user)
+            user.webauthnCredentials = user.webauthnCredentials.filter((c) => c.credentialId !== credentialId);
+    },
+    async updateWebAuthnCredentialSignCount(userId, credentialId, signCount) {
+        const user = _users.get(userId);
+        if (!user)
+            return;
+        const cred = user.webauthnCredentials.find((c) => c.credentialId === credentialId);
+        if (cred)
+            cred.signCount = signCount;
+    },
+    async findUserByWebAuthnCredentialId(credentialId) {
+        for (const user of _users.values()) {
+            if (user.webauthnCredentials.some((c) => c.credentialId === credentialId))
+                return user.id;
+        }
+        return null;
+    },
+    async getTenantRoles(userId, tenantId) {
+        return _tenantRoles.get(`${userId}:${tenantId}`) ?? [];
+    },
+    async setTenantRoles(userId, tenantId, roles) {
+        _tenantRoles.set(`${userId}:${tenantId}`, [...roles]);
+    },
+    async addTenantRole(userId, tenantId, role) {
+        const key = `${userId}:${tenantId}`;
+        const current = _tenantRoles.get(key) ?? [];
+        if (!current.includes(role)) {
+            _tenantRoles.set(key, [...current, role]);
+        }
+    },
+    async removeTenantRole(userId, tenantId, role) {
+        const key = `${userId}:${tenantId}`;
+        const current = _tenantRoles.get(key);
+        if (current) {
+            _tenantRoles.set(key, current.filter((r) => r !== role));
+        }
+    },
 };
 // ---------------------------------------------------------------------------
 // Session helpers (used by src/lib/session.ts)
@@ -160,8 +270,16 @@ export const memoryDeleteSession = (sessionId) => {
     const entry = _sessions.get(sessionId);
     if (!entry)
         return;
+    // Clean up refresh token reverse-lookup keys
+    if (entry.refreshToken)
+        _refreshTokenIndex.delete(entry.refreshToken);
+    if (entry.prevRefreshToken)
+        _refreshTokenIndex.delete(entry.prevRefreshToken);
     if (getPersistSessionMetadata()) {
         entry.token = null;
+        entry.refreshToken = null;
+        entry.prevRefreshToken = null;
+        entry.prevTokenExpiresAt = null;
     }
     else {
         _sessions.delete(sessionId);
@@ -231,6 +349,51 @@ export const memoryUpdateSessionLastActive = (sessionId) => {
     if (entry)
         entry.lastActiveAt = Date.now();
 };
+export const memorySetRefreshToken = (sessionId, refreshToken) => {
+    const entry = _sessions.get(sessionId);
+    if (!entry)
+        return;
+    entry.refreshToken = refreshToken;
+    _refreshTokenIndex.set(refreshToken, sessionId);
+};
+import { getRotationGraceSeconds } from "../lib/appConfig";
+export const memoryGetSessionByRefreshToken = (refreshToken) => {
+    const sessionId = _refreshTokenIndex.get(refreshToken);
+    if (!sessionId)
+        return null;
+    const entry = _sessions.get(sessionId);
+    if (!entry)
+        return null;
+    // Current refresh token matches
+    if (entry.refreshToken === refreshToken) {
+        return { sessionId: entry.sessionId, userId: entry.userId, newRefreshToken: refreshToken };
+    }
+    // Check grace window
+    if (entry.prevRefreshToken === refreshToken && entry.prevTokenExpiresAt && entry.prevTokenExpiresAt > Date.now()) {
+        return { sessionId: entry.sessionId, userId: entry.userId, newRefreshToken: entry.refreshToken };
+    }
+    // Grace window expired — theft detected, invalidate session
+    if (entry.prevRefreshToken === refreshToken) {
+        memoryDeleteSession(sessionId);
+        return null;
+    }
+    return null;
+};
+export const memoryRotateRefreshToken = (sessionId, newRefreshToken, newAccessToken) => {
+    const entry = _sessions.get(sessionId);
+    if (!entry)
+        return;
+    const graceSeconds = getRotationGraceSeconds();
+    // Move current to prev
+    const oldRefreshToken = entry.refreshToken;
+    entry.prevRefreshToken = oldRefreshToken;
+    entry.prevTokenExpiresAt = Date.now() + graceSeconds * 1000;
+    entry.refreshToken = newRefreshToken;
+    entry.token = newAccessToken;
+    // Update reverse-lookup index
+    _refreshTokenIndex.set(newRefreshToken, sessionId);
+    // Old token stays in index during grace window — cleaned up on next lookup or session delete
+};
 // ---------------------------------------------------------------------------
 // OAuth state helpers (used by src/lib/oauth.ts)
 // ---------------------------------------------------------------------------
@@ -313,3 +476,15 @@ export const memoryConsumeResetToken = (hash) => {
     _resetTokens.delete(hash);
     return { userId: entry.userId, email: entry.email };
 };
+export const memoryStoreOAuthCode = (hash, payload, ttlSeconds) => {
+    _oauthCodes.set(hash, { ...payload, expiresAt: Date.now() + ttlSeconds * 1000 });
+};
+export const memoryConsumeOAuthCode = (hash) => {
+    const entry = _oauthCodes.get(hash);
+    if (!entry || entry.expiresAt <= Date.now()) {
+        _oauthCodes.delete(hash);
+        return null;
+    }
+    _oauthCodes.delete(hash);
+    return { token: entry.token, userId: entry.userId, email: entry.email, refreshToken: entry.refreshToken };
+};

package/dist/adapters/mongoAuth.js

@@ -1,4 +1,5 @@
 import { AuthUser } from "../models/AuthUser";
+import { TenantRole } from "../models/TenantRole";
 import { HttpError } from "../lib/HttpError";
 export const mongoAuthAdapter = {
     async findByEmail(email) {
@@ -90,4 +91,97 @@ export const mongoAuthAdapter = {
         const user = await AuthUser.findById(userId, "emailVerified").lean();
         return user?.emailVerified ?? false;
     },
+    async deleteUser(userId) {
+        await AuthUser.findByIdAndDelete(userId);
+    },
+    async hasPassword(userId) {
+        const user = await AuthUser.findById(userId, "password").lean();
+        return !!user?.password;
+    },
+    async setMfaSecret(userId, secret) {
+        await AuthUser.findByIdAndUpdate(userId, { mfaSecret: secret });
+    },
+    async getMfaSecret(userId) {
+        const user = await AuthUser.findById(userId, "mfaSecret").lean();
+        return user?.mfaSecret ?? null;
+    },
+    async isMfaEnabled(userId) {
+        const user = await AuthUser.findById(userId, "mfaEnabled").lean();
+        return user?.mfaEnabled ?? false;
+    },
+    async setMfaEnabled(userId, enabled) {
+        await AuthUser.findByIdAndUpdate(userId, { mfaEnabled: enabled });
+    },
+    async setRecoveryCodes(userId, codes) {
+        await AuthUser.findByIdAndUpdate(userId, { recoveryCodes: codes });
+    },
+    async getRecoveryCodes(userId) {
+        const user = await AuthUser.findById(userId, "recoveryCodes").lean();
+        return user?.recoveryCodes ?? [];
+    },
+    async removeRecoveryCode(userId, code) {
+        await AuthUser.findByIdAndUpdate(userId, { $pull: { recoveryCodes: code } });
+    },
+    async getMfaMethods(userId) {
+        const user = await AuthUser.findById(userId, "mfaMethods mfaEnabled").lean();
+        const methods = user?.mfaMethods ?? [];
+        // Backward compat: if mfaEnabled but no methods recorded, assume TOTP
+        if (methods.length === 0 && user?.mfaEnabled)
+            return ["totp"];
+        return methods;
+    },
+    async setMfaMethods(userId, methods) {
+        await AuthUser.findByIdAndUpdate(userId, { mfaMethods: methods });
+    },
+    async getWebAuthnCredentials(userId) {
+        const user = await AuthUser.findById(userId, "webauthnCredentials").lean();
+        const creds = user?.webauthnCredentials ?? [];
+        return creds.map((c) => ({
+            credentialId: c.credentialId,
+            publicKey: c.publicKey,
+            signCount: c.signCount,
+            transports: c.transports,
+            name: c.name,
+            createdAt: c.createdAt instanceof Date ? c.createdAt.getTime() : c.createdAt,
+        }));
+    },
+    async addWebAuthnCredential(userId, credential) {
+        await AuthUser.findByIdAndUpdate(userId, {
+            $push: {
+                webauthnCredentials: {
+                    credentialId: credential.credentialId,
+                    publicKey: credential.publicKey,
+                    signCount: credential.signCount,
+                    transports: credential.transports,
+                    name: credential.name,
+                    createdAt: new Date(credential.createdAt),
+                },
+            },
+        });
+    },
+    async removeWebAuthnCredential(userId, credentialId) {
+        await AuthUser.findByIdAndUpdate(userId, {
+            $pull: { webauthnCredentials: { credentialId } },
+        });
+    },
+    async updateWebAuthnCredentialSignCount(userId, credentialId, signCount) {
+        await AuthUser.findOneAndUpdate({ _id: userId, "webauthnCredentials.credentialId": credentialId }, { $set: { "webauthnCredentials.$.signCount": signCount } });
+    },
+    async findUserByWebAuthnCredentialId(credentialId) {
+        const user = await AuthUser.findOne({ "webauthnCredentials.credentialId": credentialId }, "_id").lean();
+        return user ? String(user._id) : null;
+    },
+    async getTenantRoles(userId, tenantId) {
+        const doc = await TenantRole.findOne({ userId, tenantId }, "roles").lean();
+        return doc?.roles ?? [];
+    },
+    async setTenantRoles(userId, tenantId, roles) {
+        await TenantRole.findOneAndUpdate({ userId, tenantId }, { $set: { roles } }, { upsert: true });
+    },
+    async addTenantRole(userId, tenantId, role) {
+        await TenantRole.findOneAndUpdate({ userId, tenantId }, { $addToSet: { roles: role } }, { upsert: true });
+    },
+    async removeTenantRole(userId, tenantId, role) {
+        await TenantRole.findOneAndUpdate({ userId, tenantId }, { $pull: { roles: role } });
+    },
 };

package/dist/adapters/sqliteAuth.d.ts

@@ -1,5 +1,7 @@
+import { Database } from "bun:sqlite";
 import type { AuthAdapter } from "../lib/authAdapter";
 export declare const setSqliteDb: (path: string) => void;
+export declare function getDb(): Database;
 export declare const sqliteAuthAdapter: AuthAdapter;
 import type { SessionMetadata, SessionInfo } from "../lib/session";
 export declare const sqliteCreateSession: (userId: string, token: string, sessionId: string, metadata?: SessionMetadata) => void;
@@ -9,6 +11,10 @@ export declare const sqliteGetUserSessions: (userId: string) => SessionInfo[];
 export declare const sqliteGetActiveSessionCount: (userId: string) => number;
 export declare const sqliteEvictOldestSession: (userId: string) => void;
 export declare const sqliteUpdateSessionLastActive: (sessionId: string) => void;
+import type { RefreshResult } from "../lib/session";
+export declare const sqliteSetRefreshToken: (sessionId: string, refreshToken: string) => void;
+export declare const sqliteGetSessionByRefreshToken: (refreshToken: string) => RefreshResult | null;
+export declare const sqliteRotateRefreshToken: (sessionId: string, newRefreshToken: string, newAccessToken: string) => void;
 export declare const sqliteStoreOAuthState: (state: string, codeVerifier?: string, linkUserId?: string) => void;
 export declare const sqliteConsumeOAuthState: (state: string) => {
     codeVerifier?: string;
@@ -30,4 +36,7 @@ export declare const sqliteConsumeResetToken: (hash: string) => {
     userId: string;
     email: string;
 } | null;
+import type { OAuthCodePayload } from "../lib/oauthCode";
+export declare const sqliteStoreOAuthCode: (hash: string, payload: OAuthCodePayload, ttlSeconds: number) => void;
+export declare const sqliteConsumeOAuthCode: (hash: string) => OAuthCodePayload | null;
 export declare const startSqliteCleanup: (intervalMs?: number) => ReturnType<typeof setInterval>;

package/dist/adapters/sqliteAuth.js

@@ -10,7 +10,7 @@ export const setSqliteDb = (path) => {
     _db.run("PRAGMA foreign_keys = ON");
     initSchema(_db);
 };
-function getDb() {
+export function getDb() {
     if (!_db)
         throw new Error("SQLite not initialized — call setSqliteDb(path) before using sqliteAuthAdapter or sessionStore: 'sqlite'");
     return _db;
@@ -32,6 +32,23 @@ function initSchema(db) {
         db.run("ALTER TABLE users ADD COLUMN emailVerified INTEGER NOT NULL DEFAULT 0");
     }
     catch { /* already exists */ }
+    // Add MFA columns to pre-existing databases
+    try {
+        db.run("ALTER TABLE users ADD COLUMN mfaSecret TEXT");
+    }
+    catch { /* already exists */ }
+    try {
+        db.run("ALTER TABLE users ADD COLUMN mfaEnabled INTEGER NOT NULL DEFAULT 0");
+    }
+    catch { /* already exists */ }
+    try {
+        db.run("ALTER TABLE users ADD COLUMN recoveryCodes TEXT NOT NULL DEFAULT '[]'");
+    }
+    catch { /* already exists */ }
+    try {
+        db.run("ALTER TABLE users ADD COLUMN mfaMethods TEXT NOT NULL DEFAULT '[]'");
+    }
+    catch { /* already exists */ }
     // Migrate legacy sessions table (userId PK) to new multi-session schema (sessionId PK)
     try {
         db.run("ALTER TABLE sessions RENAME TO sessions_legacy");
@@ -48,6 +65,20 @@ function initSchema(db) {
     userAgent    TEXT
   )`);
     db.run("CREATE INDEX IF NOT EXISTS idx_sessions_userId ON sessions(userId)");
+    // Add refresh token columns to pre-existing databases
+    try {
+        db.run("ALTER TABLE sessions ADD COLUMN refreshToken TEXT");
+    }
+    catch { /* already exists */ }
+    try {
+        db.run("ALTER TABLE sessions ADD COLUMN prevRefreshToken TEXT");
+    }
+    catch { /* already exists */ }
+    try {
+        db.run("ALTER TABLE sessions ADD COLUMN prevTokenExpiresAt INTEGER");
+    }
+    catch { /* already exists */ }
+    db.run("CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_refreshToken ON sessions(refreshToken) WHERE refreshToken IS NOT NULL");
     db.run(`CREATE TABLE IF NOT EXISTS oauth_states (
     state        TEXT PRIMARY KEY,
     codeVerifier TEXT,
@@ -71,6 +102,31 @@ function initSchema(db) {
     email     TEXT NOT NULL,
     expiresAt INTEGER NOT NULL
   )`);
+    db.run(`CREATE TABLE IF NOT EXISTS tenant_roles (
+    userId    TEXT NOT NULL,
+    tenantId  TEXT NOT NULL,
+    role      TEXT NOT NULL,
+    PRIMARY KEY (userId, tenantId, role)
+  )`);
+    db.run("CREATE INDEX IF NOT EXISTS idx_tenant_roles_tenant ON tenant_roles(tenantId)");
+    db.run(`CREATE TABLE IF NOT EXISTS webauthn_credentials (
+    credentialId TEXT PRIMARY KEY,
+    userId       TEXT NOT NULL,
+    publicKey    TEXT NOT NULL,
+    signCount    INTEGER NOT NULL DEFAULT 0,
+    transports   TEXT NOT NULL DEFAULT '[]',
+    name         TEXT,
+    createdAt    INTEGER NOT NULL
+  )`);
+    db.run("CREATE INDEX IF NOT EXISTS idx_webauthn_userId ON webauthn_credentials(userId)");
+    db.run(`CREATE TABLE IF NOT EXISTS oauth_codes (
+    codeHash     TEXT PRIMARY KEY,
+    token        TEXT NOT NULL,
+    userId       TEXT NOT NULL,
+    email        TEXT,
+    refreshToken TEXT,
+    expiresAt    INTEGER NOT NULL
+  )`);
 }
 // ---------------------------------------------------------------------------
 // Auth adapter
@@ -177,6 +233,98 @@ export const sqliteAuthAdapter = {
         const row = getDb().query("SELECT emailVerified FROM users WHERE id = ?").get(userId);
         return row?.emailVerified === 1;
     },
+    async deleteUser(userId) {
+        getDb().run("DELETE FROM users WHERE id = ?", [userId]);
+    },
+    async hasPassword(userId) {
+        const row = getDb().query("SELECT passwordHash FROM users WHERE id = ?").get(userId);
+        return !!row?.passwordHash;
+    },
+    async setMfaSecret(userId, secret) {
+        getDb().run("UPDATE users SET mfaSecret = ? WHERE id = ?", [secret, userId]);
+    },
+    async getMfaSecret(userId) {
+        const row = getDb().query("SELECT mfaSecret FROM users WHERE id = ?").get(userId);
+        return row?.mfaSecret ?? null;
+    },
+    async isMfaEnabled(userId) {
+        const row = getDb().query("SELECT mfaEnabled FROM users WHERE id = ?").get(userId);
+        return row?.mfaEnabled === 1;
+    },
+    async setMfaEnabled(userId, enabled) {
+        getDb().run("UPDATE users SET mfaEnabled = ? WHERE id = ?", [enabled ? 1 : 0, userId]);
+    },
+    async setRecoveryCodes(userId, codes) {
+        getDb().run("UPDATE users SET recoveryCodes = ? WHERE id = ?", [JSON.stringify(codes), userId]);
+    },
+    async getRecoveryCodes(userId) {
+        const row = getDb().query("SELECT recoveryCodes FROM users WHERE id = ?").get(userId);
+        return row?.recoveryCodes ? JSON.parse(row.recoveryCodes) : [];
+    },
+    async removeRecoveryCode(userId, code) {
+        const current = await sqliteAuthAdapter.getRecoveryCodes(userId);
+        const idx = current.indexOf(code);
+        if (idx !== -1) {
+            current.splice(idx, 1);
+            await sqliteAuthAdapter.setRecoveryCodes(userId, current);
+        }
+    },
+    async getMfaMethods(userId) {
+        const row = getDb().query("SELECT mfaMethods, mfaEnabled FROM users WHERE id = ?").get(userId);
+        const methods = row?.mfaMethods ? JSON.parse(row.mfaMethods) : [];
+        // Backward compat: if mfaEnabled but no methods recorded, assume TOTP
+        if (methods.length === 0 && row?.mfaEnabled === 1)
+            return ["totp"];
+        return methods;
+    },
+    async setMfaMethods(userId, methods) {
+        getDb().run("UPDATE users SET mfaMethods = ? WHERE id = ?", [JSON.stringify(methods), userId]);
+    },
+    async getWebAuthnCredentials(userId) {
+        const rows = getDb().query("SELECT credentialId, publicKey, signCount, transports, name, createdAt FROM webauthn_credentials WHERE userId = ?").all(userId);
+        return rows.map((r) => ({
+            credentialId: r.credentialId,
+            publicKey: r.publicKey,
+            signCount: r.signCount,
+            transports: JSON.parse(r.transports),
+            name: r.name ?? undefined,
+            createdAt: r.createdAt,
+        }));
+    },
+    async addWebAuthnCredential(userId, credential) {
+        getDb().run("INSERT INTO webauthn_credentials (credentialId, userId, publicKey, signCount, transports, name, createdAt) VALUES (?, ?, ?, ?, ?, ?, ?)", [credential.credentialId, userId, credential.publicKey, credential.signCount, JSON.stringify(credential.transports ?? []), credential.name ?? null, credential.createdAt]);
+    },
+    async removeWebAuthnCredential(userId, credentialId) {
+        getDb().run("DELETE FROM webauthn_credentials WHERE credentialId = ? AND userId = ?", [credentialId, userId]);
+    },
+    async updateWebAuthnCredentialSignCount(userId, credentialId, signCount) {
+        getDb().run("UPDATE webauthn_credentials SET signCount = ? WHERE credentialId = ? AND userId = ?", [signCount, credentialId, userId]);
+    },
+    async findUserByWebAuthnCredentialId(credentialId) {
+        const row = getDb().query("SELECT userId FROM webauthn_credentials WHERE credentialId = ?").get(credentialId);
+        return row?.userId ?? null;
+    },
+    async getTenantRoles(userId, tenantId) {
+        const rows = getDb().query("SELECT role FROM tenant_roles WHERE userId = ? AND tenantId = ?").all(userId, tenantId);
+        return rows.map((r) => r.role);
+    },
+    async setTenantRoles(userId, tenantId, roles) {
+        const db = getDb();
+        db.run("DELETE FROM tenant_roles WHERE userId = ? AND tenantId = ?", [userId, tenantId]);
+        const stmt = db.prepare("INSERT INTO tenant_roles (userId, tenantId, role) VALUES (?, ?, ?)");
+        for (const role of roles) {
+            stmt.run(userId, tenantId, role);
+        }
+    },
+    async addTenantRole(userId, tenantId, role) {
+        try {
+            getDb().run("INSERT INTO tenant_roles (userId, tenantId, role) VALUES (?, ?, ?)", [userId, tenantId, role]);
+        }
+        catch { /* already exists */ }
+    },
+    async removeTenantRole(userId, tenantId, role) {
+        getDb().run("DELETE FROM tenant_roles WHERE userId = ? AND tenantId = ? AND role = ?", [userId, tenantId, role]);
+    },
 };
 import { getPersistSessionMetadata, getIncludeInactiveSessions } from "../lib/appConfig";
 const SESSION_TTL_MS = 60 * 60 * 24 * 7 * 1000; // 7 days
@@ -193,7 +341,7 @@ export const sqliteGetSession = (sessionId) => {
 };
 export const sqliteDeleteSession = (sessionId) => {
     if (getPersistSessionMetadata()) {
-        getDb().run("UPDATE sessions SET token = NULL WHERE sessionId = ?", [sessionId]);
+        getDb().run("UPDATE sessions SET token = NULL, refreshToken = NULL, prevRefreshToken = NULL, prevTokenExpiresAt = NULL WHERE sessionId = ?", [sessionId]);
     }
     else {
         getDb().run("DELETE FROM sessions WHERE sessionId = ?", [sessionId]);
@@ -236,6 +384,35 @@ export const sqliteEvictOldestSession = (userId) => {
 export const sqliteUpdateSessionLastActive = (sessionId) => {
     getDb().run("UPDATE sessions SET lastActiveAt = ? WHERE sessionId = ?", [Date.now(), sessionId]);
 };
+import { getRotationGraceSeconds } from "../lib/appConfig";
+export const sqliteSetRefreshToken = (sessionId, refreshToken) => {
+    getDb().run("UPDATE sessions SET refreshToken = ? WHERE sessionId = ?", [refreshToken, sessionId]);
+};
+export const sqliteGetSessionByRefreshToken = (refreshToken) => {
+    const db = getDb();
+    // Check current refresh token
+    let row = db.query("SELECT sessionId, userId, refreshToken FROM sessions WHERE refreshToken = ?").get(refreshToken);
+    if (row) {
+        return { sessionId: row.sessionId, userId: row.userId, newRefreshToken: refreshToken };
+    }
+    // Check previous refresh token (grace window)
+    row = db.query("SELECT sessionId, userId, refreshToken, prevTokenExpiresAt FROM sessions WHERE prevRefreshToken = ?").get(refreshToken);
+    if (!row)
+        return null;
+    const prevExpiry = row.prevTokenExpiresAt;
+    if (prevExpiry && prevExpiry > Date.now()) {
+        // Within grace window — return current refresh token
+        return { sessionId: row.sessionId, userId: row.userId, newRefreshToken: row.refreshToken };
+    }
+    // Grace window expired — theft detected, invalidate session
+    sqliteDeleteSession(row.sessionId);
+    return null;
+};
+export const sqliteRotateRefreshToken = (sessionId, newRefreshToken, newAccessToken) => {
+    const graceSeconds = getRotationGraceSeconds();
+    const prevTokenExpiresAt = Date.now() + graceSeconds * 1000;
+    getDb().run("UPDATE sessions SET prevRefreshToken = refreshToken, prevTokenExpiresAt = ?, refreshToken = ?, token = ? WHERE sessionId = ?", [prevTokenExpiresAt, newRefreshToken, newAccessToken, sessionId]);
+};
 // ---------------------------------------------------------------------------
 // OAuth state helpers (used by src/lib/oauth.ts)
 // ---------------------------------------------------------------------------
@@ -298,6 +475,16 @@ export const sqliteConsumeResetToken = (hash) => {
     const row = getDb().query("DELETE FROM password_resets WHERE token = ? AND expiresAt > ? RETURNING userId, email").get(hash, Date.now());
     return row ?? null;
 };
+export const sqliteStoreOAuthCode = (hash, payload, ttlSeconds) => {
+    const expiresAt = Date.now() + ttlSeconds * 1000;
+    getDb().run("INSERT INTO oauth_codes (codeHash, token, userId, email, refreshToken, expiresAt) VALUES (?, ?, ?, ?, ?, ?)", [hash, payload.token, payload.userId, payload.email ?? null, payload.refreshToken ?? null, expiresAt]);
+};
+export const sqliteConsumeOAuthCode = (hash) => {
+    const row = getDb().query("DELETE FROM oauth_codes WHERE codeHash = ? AND expiresAt > ? RETURNING token, userId, email, refreshToken").get(hash, Date.now());
+    if (!row)
+        return null;
+    return { token: row.token, userId: row.userId, email: row.email ?? undefined, refreshToken: row.refreshToken ?? undefined };
+};
 // ---------------------------------------------------------------------------
 // Optional periodic cleanup of expired rows
 // ---------------------------------------------------------------------------
@@ -316,5 +503,6 @@ export const startSqliteCleanup = (intervalMs = 3_600_000) => {
         db.run("DELETE FROM cache_entries WHERE expiresAt IS NOT NULL AND expiresAt <= ?", [now]);
         db.run("DELETE FROM email_verifications WHERE expiresAt <= ?", [now]);
         db.run("DELETE FROM password_resets WHERE expiresAt <= ?", [now]);
+        db.run("DELETE FROM oauth_codes WHERE expiresAt <= ?", [now]);
     }, intervalMs);
 };