@owlmeans/server-auth-session 0.1.18-rc.1

package/README.md

@@ -0,0 +1,45 @@
+# @owlmeans/server-auth-session
+
+A bounded seven-day authority registry for OwlMeans bearer and OIDC sessions. It supplies an
+in-memory implementation for local/single-process applications and an atomic Redis implementation
+for multi-instance production deployments.
+
+## Installation
+
+```bash
+bun add @owlmeans/server-auth-session@^0.1.18-rc.1
+```
+
+## Usage
+
+Register the memory manager before `appendAuthService` when a local application needs immediate
+revocation or claim-refresh decisions:
+
+```typescript
+import { appendMemoryAuthSessionManager } from '@owlmeans/server-auth-session'
+import { appendAuthService } from '@owlmeans/server-auth'
+
+appendMemoryAuthSessionManager(context)
+appendAuthService(context)
+```
+
+Use `appendRedisAuthSessionManager` in a multi-instance deployment. The application must register
+its Redis resource first. Call `fence()` before changing a profile's authority, then `refresh()`
+to require fresh claims or `revoke()` to reject all affected sessions. Session expiry is absolute;
+neither manager extends it beyond seven days.
+
+<!-- owlmeans:agent-guidance:start -->
+## Agent guidance
+
+This package ships embedded agent skills under `agent-meta/`. After installing your
+`@owlmeans/*` packages, run the OwlMeans agent-skills installer to place them into
+your project's skill store (`.agents/skills/`):
+
+```sh
+npx @owlmeans/agent-skills@^0.1.18-rc.30
+```
+
+The embedded files are version-matched to this package release. Do not edit them
+directly — they are regenerated on each publish. To contribute guidance edits,
+open a PR against the source monorepo.
+<!-- owlmeans:agent-guidance:end -->

package/agent-meta/manifest.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": 2,
+  "package": "@owlmeans/server-auth-session",
+  "version": "0.1.18-rc.1",
+  "generatedAt": "2026-09-18T19:19:03.112Z",
+  "canonicalRepo": "https://github.com/owlmeans/common",
+  "entries": [
+    {
+      "kind": "skill",
+      "name": "server-auth-session",
+      "category": "package-specific",
+      "file": "skills/server-auth-session/SKILL.md",
+      "canonicalPath": ".agents/skills/server-auth-session/SKILL.md"
+    }
+  ]
+}

package/agent-meta/skills/server-auth-session/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: server-auth-session
+description: How to use @owlmeans/server-auth-session for absolute seven-day bearer/OIDC session tracking, Redis authority, local memory defaults, and profile-level fence/refresh/revoke decisions. Use when issuing, validating, revoking, or refreshing OwlMeans sessions.
+user-invocable: false
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/server-auth-session
+
+**Layer:** Server
+
+The session manager is an authorization-freshness registry, not a browser-token store. A session
+record is addressed by an opaque id; its subject is the stable `{ entityId, profileId, clientId? }`
+selector. `entityId` is storage-only and must never be placed in an authentication envelope.
+
+## Exports
+
+| Export | Purpose |
+|---|---|
+| `AUTH_SESSION_TTL` | Absolute seven-day maximum; acknowledgement never extends it. |
+| `AUTH_SESSION_MANAGER` | Context service alias. |
+| `AUTH_SESSION_RESOURCE` | Redis resource alias. |
+| `appendMemoryAuthSessionManager(context)` | Process-local default for tests, development and generated targets. |
+| `appendRedisAuthSessionManager(context)` | Shared Redis authority for a central/multi-replica issuer. |
+| `AuthSessionManager` | `register`, `inspect`, `fence`, `refresh`, `revoke` contract. |
+
+## Rules
+
+- Register the manager before `appendAuthService`. The auth service then issues an opaque session
+  id, uses the registry at every bearer decision, and rejects pre-registry tokens after rollout.
+- `register` clamps every caller-supplied expiry to `AUTH_SESSION_TTL`. Re-registering after a
+  verified claim refresh updates the subject version but preserves the original absolute expiry.
+- Before changing a profile's permissions, role, disabled flag or existence, call `fence(selector,
+  operationId)`. On a successful durable write call `refresh` for changed claims or `revoke` for
+  disablement/removal. If the write or completion fails, leave the subject pending and refuse it.
+- Use `appendRedisAuthSessionManager` for viable or any central/scaled issuer. Its Lua transition
+  owns the operation id and version atomically; do not replace it with a read-modify-save sequence.
+- The memory implementation intentionally forgets state on restart. It is suitable only when a
+  separate authority makes a live decision on each request, as viable does for generated targets'
+  required OIDC validation.
+- A registry read/write failure is an `AuthUnavailable` path (503). Never interpret it as a missing
+  session, a logout, or permission to use stale claims.

package/build/consts.d.ts

@@ -0,0 +1,5 @@
+/** Seven days is an absolute session lifetime; refreshes never extend it. */
+export declare const AUTH_SESSION_TTL: number;
+export declare const AUTH_SESSION_MANAGER = "auth-session-manager";
+export declare const AUTH_SESSION_RESOURCE = "auth-session-record";
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,QAA0B,CAAA;AAEvD,eAAO,MAAM,oBAAoB,yBAAyB,CAAA;AAE1D,eAAO,MAAM,qBAAqB,wBAAwB,CAAA"}

package/build/consts.js

@@ -0,0 +1,5 @@
+/** Seven days is an absolute session lifetime; refreshes never extend it. */
+export const AUTH_SESSION_TTL = 7 * 24 * 60 * 60 * 1000;
+export const AUTH_SESSION_MANAGER = 'auth-session-manager';
+export const AUTH_SESSION_RESOURCE = 'auth-session-record';
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAA"}

package/build/identity.d.ts

@@ -0,0 +1,4 @@
+import type { AuthSessionSelector } from './types.js';
+/** Never derive storage identity from the renameable organization slug. */
+export declare const subjectId: ({ entityId, profileId, clientId }: AuthSessionSelector) => string;
+//# sourceMappingURL=identity.d.ts.map

package/build/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAErD,2EAA2E;AAC3E,eAAO,MAAM,SAAS,sCAAuC,mBAAmB,KAAG,MAC7B,CAAA"}

package/build/identity.js

@@ -0,0 +1,3 @@
+/** Never derive storage identity from the renameable organization slug. */
+export const subjectId = ({ entityId, profileId, clientId }) => `subject:${entityId}:${profileId}:${clientId ?? ''}`;
+//# sourceMappingURL=identity.js.map

package/build/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAEA,2EAA2E;AAC3E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAuB,EAAU,EAAE,CAC1F,WAAW,QAAQ,IAAI,SAAS,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,5 @@
+export * from './consts.js';
+export * from './memory.js';
+export * from './redis.js';
+export type * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,mBAAmB,YAAY,CAAA"}

package/build/index.js

@@ -0,0 +1,4 @@
+export * from './consts.js';
+export * from './memory.js';
+export * from './redis.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA"}

package/build/memory.d.ts

@@ -0,0 +1,9 @@
+import type { BasicContext } from '@owlmeans/context';
+import type { AuthSessionManager, AuthSessionManagerOptions } from './types.js';
+/**
+ * Process-local implementation for development and generated targets. It deliberately loses
+ * state on restart and is therefore never the authority for viable's centrally issued sessions.
+ */
+export declare const makeMemoryAuthSessionManager: (options?: AuthSessionManagerOptions) => AuthSessionManager;
+export declare const appendMemoryAuthSessionManager: <C extends BasicContext<any>>(context: C, options?: AuthSessionManagerOptions) => C;
+//# sourceMappingURL=memory.d.ts.map

package/build/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGrD,OAAO,KAAK,EACW,kBAAkB,EAAE,yBAAyB,EAEnE,MAAM,YAAY,CAAA;AAInB;;;GAGG;AACH,eAAO,MAAM,4BAA4B,aAC9B,yBAAyB,KACjC,kBAiFF,CAAA;AAED,eAAO,MAAM,8BAA8B,GAAI,CAAC,SAAS,YAAY,CAAC,GAAG,CAAC,WAC/D,CAAC,YAAY,yBAAyB,KAC9C,CAIF,CAAA"}

package/build/memory.js

@@ -0,0 +1,103 @@
+import { createService } from '@owlmeans/context';
+import { AUTH_SESSION_MANAGER, AUTH_SESSION_TTL } from './consts.js';
+import { subjectId } from './identity.js';
+const missing = { state: 'missing' };
+/**
+ * Process-local implementation for development and generated targets. It deliberately loses
+ * state on restart and is therefore never the authority for viable's centrally issued sessions.
+ */
+export const makeMemoryAuthSessionManager = (options = {}) => {
+    const now = options.now ?? Date.now;
+    const sessions = new Map();
+    const subjects = new Map();
+    const activeSubject = (selector, at) => {
+        const id = subjectId(selector);
+        const current = subjects.get(id);
+        if (current != null && current.expiresAt > at)
+            return current;
+        const created = {
+            id, record: 'subject', entityId: selector.entityId, profileId: selector.profileId,
+            ...(selector.clientId != null ? { clientId: selector.clientId } : {}),
+            state: 'active', version: 1, expiresAt: at + AUTH_SESSION_TTL
+        };
+        subjects.set(id, created);
+        return created;
+    };
+    const decision = (session) => {
+        const at = now();
+        if (session == null)
+            return missing;
+        if (session.expiresAt <= at) {
+            sessions.delete(session.id);
+            return { state: 'expired' };
+        }
+        const subject = subjects.get(subjectId(session));
+        if (subject == null || subject.expiresAt <= at)
+            return missing;
+        if (subject.state === 'pending')
+            return { state: 'pending' };
+        if (subject.state === 'revoked')
+            return { state: 'revoked' };
+        return {
+            state: subject.version > session.version ? 'refresh' : 'active',
+            version: subject.version,
+            expiresAt: session.expiresAt
+        };
+    };
+    const service = createService(options.alias ?? AUTH_SESSION_MANAGER, {
+        register: async (session) => {
+            const at = now();
+            // Compute the individual token's absolute end before looking up the profile subject. A
+            // subject is shared by successive logins, so it must survive at least as long as its newest
+            // still-valid session; otherwise a login near the first session's seventh day would be
+            // rejected early when the original subject record expired.
+            const expiresAt = Math.min(session.expiresAt ?? at + AUTH_SESSION_TTL, at + AUTH_SESSION_TTL);
+            if (expiresAt <= at)
+                return { state: 'expired' };
+            const subject = activeSubject(session, at);
+            if (subject.state === 'pending')
+                return { state: 'pending' };
+            if (subject.state === 'revoked')
+                return { state: 'revoked' };
+            if (subject.expiresAt < expiresAt) {
+                subjects.set(subject.id, { ...subject, expiresAt });
+            }
+            // Callers may request a shorter session, never a longer one. The registry is the last
+            // line of defence for the absolute seven-day cap, not a convention callers can bypass.
+            sessions.set(session.id, { ...session, issuedAt: session.issuedAt ?? at, expiresAt, version: subject.version });
+            return { state: 'active', version: subject.version, expiresAt };
+        },
+        inspect: async (id) => decision(sessions.get(id)),
+        fence: async (selector, operationId) => {
+            const at = now();
+            const subject = activeSubject(selector, at);
+            subjects.set(subject.id, { ...subject, state: 'pending', operationId, expiresAt: Math.max(subject.expiresAt, at + AUTH_SESSION_TTL) });
+        },
+        refresh: async (selector, operationId) => {
+            const at = now();
+            const subject = activeSubject(selector, at);
+            if (subject.state === 'pending' && subject.operationId !== operationId)
+                return subject.version;
+            const version = subject.version + 1;
+            subjects.set(subject.id, { ...subject, state: 'active', version, operationId: undefined, expiresAt: Math.max(subject.expiresAt, at + AUTH_SESSION_TTL) });
+            return version;
+        },
+        revoke: async (selector, operationId) => {
+            const at = now();
+            const subject = activeSubject(selector, at);
+            if (subject.state === 'pending' && subject.operationId !== operationId)
+                return subject.version;
+            const version = subject.version + 1;
+            subjects.set(subject.id, { ...subject, state: 'revoked', version, operationId: undefined, expiresAt: Math.max(subject.expiresAt, at + AUTH_SESSION_TTL) });
+            return version;
+        }
+    });
+    return service;
+};
+export const appendMemoryAuthSessionManager = (context, options) => {
+    const alias = options?.alias ?? AUTH_SESSION_MANAGER;
+    if (!context.hasService(alias))
+        context.registerService(makeMemoryAuthSessionManager(options));
+    return context;
+};
+//# sourceMappingURL=memory.js.map

package/build/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAMzC,MAAM,OAAO,GAAwB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,OAAO,GAA8B,EAAE,EACnB,EAAE;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwE,CAAA;IAChG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEtD,MAAM,aAAa,GAAG,CAAC,QAA6B,EAAE,EAAU,EAAsB,EAAE;QACtF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChC,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG,EAAE;YAAE,OAAO,OAAO,CAAA;QAC7D,MAAM,OAAO,GAAuB;YAClC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;YACjF,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,gBAAgB;SAC9D,CAAA;QACD,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QACzB,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC,OAAmF,EAAuB,EAAE;QAC5H,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;QAChB,IAAI,OAAO,IAAI,IAAI;YAAE,OAAO,OAAO,CAAA;QACnC,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YAC5B,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC7B,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QAChD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE;YAAE,OAAO,OAAO,CAAA;QAC9D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC5D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC5D,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YAC/D,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAA;IACH,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,aAAa,CAAqB,OAAO,CAAC,KAAK,IAAI,oBAAoB,EAAE;QACvF,QAAQ,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACxB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;YAChB,uFAAuF;YACvF,4FAA4F;YAC5F,uFAAuF;YACvF,2DAA2D;YAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,GAAG,gBAAgB,EAAE,EAAE,GAAG,gBAAgB,CAAC,CAAA;YAC7F,IAAI,SAAS,IAAI,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YAChD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YAC5D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YAC5D,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,EAAE,CAAC;gBAClC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;YACrD,CAAC;YACD,sFAAsF;YACtF,uFAAuF;YACvF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/G,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,CAAA;QACjE,CAAC;QACD,OAAO,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/C,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YACrC,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;YAChB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YAC3C,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACxI,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YACvC,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;YAChB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YAC3C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAA;YAC9F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,GAAG,CAAC,CAAA;YACnC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;YACzJ,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YACtC,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;YAChB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YAC3C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAA;YAC9F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,GAAG,CAAC,CAAA;YACnC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;YAC1J,OAAO,OAAO,CAAA;QAChB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,OAAU,EAAE,OAAmC,EAC5C,EAAE;IACL,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,oBAAoB,CAAA;IACpD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,eAAe,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9F,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/redis.d.ts

@@ -0,0 +1,12 @@
+import type { BasicContext } from '@owlmeans/context';
+import type { RedisResource } from '@owlmeans/redis-resource';
+import type { AuthSessionManager, AuthSessionManagerOptions } from './types.js';
+/** Redis-backed manager. Redis `create` is SET NX, so first session registration is atomic. */
+export declare const makeRedisAuthSessionManager: (resourceAlias?: string, options?: AuthSessionManagerOptions) => AuthSessionManager;
+export declare const appendRedisAuthSessionManager: <C extends BasicContext<any>>(context: C, options?: AuthSessionManagerOptions & {
+    resourceAlias?: string;
+    dbAlias?: string;
+    serviceAlias?: string;
+}) => C;
+export type { RedisResource };
+//# sourceMappingURL=redis.d.ts.map

package/build/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../src/redis.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAI7D,OAAO,KAAK,EACW,kBAAkB,EAAE,yBAAyB,EAEnE,MAAM,YAAY,CAAA;AAkDnB,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B,mBACvB,MAAM,YAAmC,yBAAyB,KAChF,kBA4GF,CAAA;AAED,eAAO,MAAM,6BAA6B,GAAI,CAAC,SAAS,YAAY,CAAC,GAAG,CAAC,WAC9D,CAAC,YAAY,yBAAyB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KACpH,CAQF,CAAA;AAED,YAAY,EAAE,aAAa,EAAE,CAAA"}

package/build/redis.js

@@ -0,0 +1,173 @@
+import { createService } from '@owlmeans/context';
+import { makeRedisResource } from '@owlmeans/redis-resource';
+import { RecordExists } from '@owlmeans/resource';
+import { AUTH_SESSION_MANAGER, AUTH_SESSION_RESOURCE, AUTH_SESSION_TTL } from './consts.js';
+import { subjectId } from './identity.js';
+const missing = { state: 'missing' };
+/**
+ * One Redis script owns each subject transition. A read-modify-save sequence lets competing
+ * grant/revoke operations overwrite a pending fence; this compares the fence id and increments
+ * the version in the same Redis command instead.
+ */
+const transitionSubject = `
+local current = redis.call('GET', KEYS[1])
+local subject = current and cjson.decode(current) or cjson.decode(ARGV[1])
+local now = tonumber(ARGV[2])
+local expires = tonumber(ARGV[3])
+local state = ARGV[4]
+local operation = ARGV[5]
+if tonumber(subject.expiresAt) <= now then
+  subject = cjson.decode(ARGV[1])
+end
+if state == 'pending' then
+  subject.state = 'pending'
+  subject.operationId = operation
+else
+  if subject.state == 'pending' and subject.operationId ~= operation then
+    return -1
+  end
+  subject.state = state
+  subject.operationId = cjson.null
+  subject.version = tonumber(subject.version) + 1
+end
+subject.expiresAt = math.max(tonumber(subject.expiresAt), expires)
+redis.call('SET', KEYS[1], cjson.encode(subject), 'PXAT', subject.expiresAt)
+return tonumber(subject.version)
+`;
+/** Extend only the subject's expiry without overwriting a concurrent fence or revocation. */
+const extendSubjectExpiry = `
+local current = redis.call('GET', KEYS[1])
+if not current then return 0 end
+local subject = cjson.decode(current)
+local expires = tonumber(ARGV[1])
+if tonumber(subject.expiresAt) < expires then
+  subject.expiresAt = expires
+  redis.call('SET', KEYS[1], cjson.encode(subject), 'PXAT', subject.expiresAt)
+end
+return 1
+`;
+/** Redis-backed manager. Redis `create` is SET NX, so first session registration is atomic. */
+export const makeRedisAuthSessionManager = (resourceAlias = AUTH_SESSION_RESOURCE, options = {}) => {
+    const now = options.now ?? Date.now;
+    const resource = (context) => context.resource(resourceAlias);
+    const loadSubject = async (ctx, selector, at) => {
+        const id = subjectId(selector);
+        const found = await resource(ctx).load(id);
+        if (found != null && found.record === 'subject' && found.expiresAt > at)
+            return found;
+        const created = {
+            id, record: 'subject', entityId: selector.entityId, profileId: selector.profileId,
+            ...(selector.clientId != null ? { clientId: selector.clientId } : {}),
+            state: 'active', version: 1, expiresAt: at + AUTH_SESSION_TTL
+        };
+        try {
+            await resource(ctx).create(created, { ttl: new Date(created.expiresAt) });
+            return created;
+        }
+        catch (error) {
+            if (!(error instanceof RecordExists))
+                throw error;
+            const raced = await resource(ctx).load(id);
+            if (raced == null || raced.record !== 'subject')
+                throw error;
+            return raced;
+        }
+    };
+    const transition = async (ctx, selector, state, operationId) => {
+        const at = now();
+        const id = subjectId(selector);
+        const seed = {
+            id, record: 'subject', entityId: selector.entityId, profileId: selector.profileId,
+            ...(selector.clientId != null ? { clientId: selector.clientId } : {}),
+            state: 'active', version: 1, expiresAt: at + AUTH_SESSION_TTL
+        };
+        const expiresAt = at + AUTH_SESSION_TTL;
+        const value = await resource(ctx).db.client.eval(transitionSubject, 1, resource(ctx).key(id), JSON.stringify(seed), at, expiresAt, state, operationId);
+        const version = Number(value);
+        if (!Number.isInteger(version) || version < 0) {
+            throw new Error('auth-session:transition-conflict');
+        }
+        return version;
+    };
+    let service;
+    service = createService(options.alias ?? AUTH_SESSION_MANAGER, {
+        register: async (session) => {
+            const ctx = service.assertCtx();
+            const at = now();
+            // Do not trust a caller to choose the maximum session TTL. It may choose a shorter expiry.
+            const expiresAt = Math.min(session.expiresAt ?? at + AUTH_SESSION_TTL, at + AUTH_SESSION_TTL);
+            if (expiresAt <= at)
+                return { state: 'expired' };
+            const subject = await loadSubject(ctx, session, at);
+            if (subject.state === 'pending')
+                return { state: 'pending' };
+            if (subject.state === 'revoked')
+                return { state: 'revoked' };
+            // Session records have their own absolute expiry. Keep the shared subject alive until the
+            // newest one expires, but use a script so an expiry extension cannot replace a concurrent
+            // pending/revoked state with this older active object.
+            if (subject.expiresAt < expiresAt) {
+                await resource(ctx).db.client.eval(extendSubjectExpiry, 1, resource(ctx).key(subject.id), expiresAt);
+            }
+            const stored = {
+                ...session, record: 'session', issuedAt: session.issuedAt ?? at, expiresAt,
+                version: subject.version
+            };
+            try {
+                await resource(ctx).create(stored, { ttl: new Date(expiresAt) });
+            }
+            catch (error) {
+                if (!(error instanceof RecordExists))
+                    throw error;
+                // A subject version may have advanced since its original session record was minted.
+                // A successful revalidation acknowledges that version without extending the absolute TTL.
+                const current = await resource(ctx).load(session.id);
+                if (current == null || current.record !== 'session')
+                    throw error;
+                await resource(ctx).save({ ...stored, expiresAt: current.expiresAt }, { ttl: new Date(current.expiresAt) });
+            }
+            return { state: 'active', version: subject.version, expiresAt };
+        },
+        inspect: async (id) => {
+            const ctx = service.assertCtx();
+            const at = now();
+            const session = await resource(ctx).load(id);
+            if (session == null || session.record !== 'session')
+                return missing;
+            if (session.expiresAt <= at)
+                return { state: 'expired' };
+            const subject = await resource(ctx).load(subjectId(session));
+            if (subject == null || subject.record !== 'subject' || subject.expiresAt <= at)
+                return missing;
+            if (subject.state === 'pending')
+                return { state: 'pending' };
+            if (subject.state === 'revoked')
+                return { state: 'revoked' };
+            return { state: subject.version > session.version ? 'refresh' : 'active', version: subject.version, expiresAt: session.expiresAt };
+        },
+        fence: async (selector, operationId) => {
+            const ctx = service.assertCtx();
+            await transition(ctx, selector, 'pending', operationId);
+        },
+        refresh: async (selector, operationId) => {
+            const ctx = service.assertCtx();
+            return await transition(ctx, selector, 'active', operationId);
+        },
+        revoke: async (selector, operationId) => {
+            const ctx = service.assertCtx();
+            return await transition(ctx, selector, 'revoked', operationId);
+        }
+    });
+    return service;
+};
+export const appendRedisAuthSessionManager = (context, options) => {
+    const resourceAlias = options?.resourceAlias ?? AUTH_SESSION_RESOURCE;
+    if (!context.hasResource(resourceAlias)) {
+        context.registerResource(makeRedisResource(resourceAlias, options?.dbAlias, options?.serviceAlias));
+    }
+    const alias = options?.alias ?? AUTH_SESSION_MANAGER;
+    if (!context.hasService(alias))
+        context.registerService(makeRedisAuthSessionManager(resourceAlias, options));
+    return context;
+};
+//# sourceMappingURL=redis.js.map

package/build/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../src/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAMzC,MAAM,OAAO,GAAwB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AAIzD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBzB,CAAA;AAED,6FAA6F;AAC7F,MAAM,mBAAmB,GAAG;;;;;;;;;;CAU3B,CAAA;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,aAAa,GAAW,qBAAqB,EAAE,OAAO,GAA8B,EAAE,EAClE,EAAE;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,QAAQ,GAAG,CAAC,OAA0B,EAAmB,EAAE,CAC/D,OAAO,CAAC,QAAQ,CAAkB,aAAa,CAAC,CAAA;IAElD,MAAM,WAAW,GAAG,KAAK,EAAE,GAAsB,EAAE,QAA6B,EAAE,EAAU,EAA+B,EAAE;QAC3H,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC9B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAA8B,CAAA;QACvE,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,EAAE;YAAE,OAAO,KAAK,CAAA;QACrF,MAAM,OAAO,GAAuB;YAClC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;YACjF,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,gBAAgB;SAC9D,CAAA;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACzE,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;gBAAE,MAAM,KAAK,CAAA;YACjD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAA8B,CAAA;YACvE,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,KAAK,CAAA;YAC5D,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,KAAK,EACtB,GAAsB,EAAE,QAA6B,EACrD,KAAuC,EAAE,WAAmB,EAC3C,EAAE;QACnB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;QAChB,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC9B,MAAM,IAAI,GAAuB;YAC/B,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;YACjF,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,gBAAgB;SAC9D,CAAA;QACD,MAAM,SAAS,GAAG,EAAE,GAAG,gBAAgB,CAAA;QACvC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAC9C,iBAAiB,EAAE,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CACrG,CAAA;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrD,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,IAAI,OAA2B,CAAA;IAC/B,OAAO,GAAG,aAAa,CAAqB,OAAO,CAAC,KAAK,IAAI,oBAAoB,EAAE;QACjF,QAAQ,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACxB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;YAC/B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;YAChB,2FAA2F;YAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,GAAG,gBAAgB,EAAE,EAAE,GAAG,gBAAgB,CAAC,CAAA;YAC7F,IAAI,SAAS,IAAI,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YAChD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;YACnD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YAC5D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YAC5D,0FAA0F;YAC1F,0FAA0F;YAC1F,uDAAuD;YACvD,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,EAAE,CAAC;gBAClC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAChC,mBAAmB,EAAE,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,SAAS,CACjE,CAAA;YACH,CAAC;YACD,MAAM,MAAM,GAAG;gBACb,GAAG,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,SAAS;gBACnF,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAA;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAClE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;oBAAE,MAAM,KAAK,CAAA;gBACjD,oFAAoF;gBACpF,0FAA0F;gBAC1F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACpD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,KAAK,CAAA;gBAChE,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAC7G,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,CAAA;QACjE,CAAC;QACD,OAAO,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAClB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;YAC/B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;YAChB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5C,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAA;YACnE,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YACxD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;YAC5D,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE;gBAAE,OAAO,OAAO,CAAA;YAC9F,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YAC5D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;YAC5D,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;QACpI,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;YAC/B,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACzD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YACvC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;YAC/B,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;YAC/B,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QAChE,CAAC;KACF,CAAC,CAAA;IACF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,OAAU,EAAE,OAAyG,EAClH,EAAE;IACL,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,qBAAqB,CAAA;IACrE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,CAAC,gBAAgB,CAAC,iBAAiB,CAA0B,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;IAC9H,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,oBAAoB,CAAA;IACpD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,eAAe,CAAC,2BAA2B,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAA;IAC5G,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,55 @@
+import type { InitializedService } from '@owlmeans/context';
+import type { ResourceRecord } from '@owlmeans/resource';
+export type AuthSessionKind = 'bearer' | 'oidc-access' | 'oidc-refresh' | 'oidc-provider-session';
+export type AuthSessionState = 'active' | 'pending' | 'refresh' | 'revoked';
+/** Stable storage selector. `entityId` never travels in an authentication envelope. */
+export interface AuthSessionSelector {
+    entityId: string;
+    profileId: string;
+    clientId?: string;
+}
+export interface AuthSessionRecord extends ResourceRecord, AuthSessionSelector {
+    id: string;
+    record: 'session';
+    kind: AuthSessionKind;
+    version: number;
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface AuthSessionSubject extends ResourceRecord, AuthSessionSelector {
+    id: string;
+    record: 'subject';
+    state: AuthSessionState;
+    version: number;
+    expiresAt: number;
+    operationId?: string;
+}
+export type AuthSessionStoredRecord = AuthSessionRecord | AuthSessionSubject;
+export type AuthSessionDecision = {
+    state: 'active' | 'refresh';
+    version: number;
+    expiresAt: number;
+} | {
+    state: 'pending' | 'revoked' | 'missing' | 'expired';
+};
+export interface RegisterAuthSession extends AuthSessionSelector {
+    id: string;
+    kind: AuthSessionKind;
+    issuedAt?: number;
+    expiresAt?: number;
+}
+export interface AuthSessionManager extends InitializedService {
+    register: (session: RegisterAuthSession) => Promise<AuthSessionDecision>;
+    inspect: (id: string) => Promise<AuthSessionDecision>;
+    /** Fences all sessions for a profile/client before its authority is changed. */
+    fence: (selector: AuthSessionSelector, operationId: string) => Promise<void>;
+    /** Completes a fence as a claim refresh. */
+    refresh: (selector: AuthSessionSelector, operationId: string) => Promise<number>;
+    /** Completes a fence as a session revocation. */
+    revoke: (selector: AuthSessionSelector, operationId: string) => Promise<number>;
+}
+export interface AuthSessionManagerOptions {
+    alias?: string;
+    now?: () => number;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,aAAa,GAAG,cAAc,GAAG,uBAAuB,CAAA;AAEjG,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;AAE3E,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,cAAc,EAAE,mBAAmB;IAC5E,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,SAAS,CAAA;IACjB,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,cAAc,EAAE,mBAAmB;IAC7E,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,SAAS,CAAA;IACjB,KAAK,EAAE,gBAAgB,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;AAE5E,MAAM,MAAM,mBAAmB,GAC3B;IAAE,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAA;AAE5D,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACxE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACrD,gFAAgF;IAChF,KAAK,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5E,4CAA4C;IAC5C,OAAO,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAChF,iDAAiD;IACjD,MAAM,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAChF;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@owlmeans/server-auth-session",
+  "version": "0.1.18-rc.1",
+  "license": "MIT",
+  "description": "Short-lived OwlMeans session registry with memory and Redis implementations.",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "test": "bun test ./tests"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "@owlmeans/context": "^0.1.18-rc.26",
+    "@owlmeans/redis-resource": "^0.1.18-rc.29",
+    "@owlmeans/resource": "^0.1.18-rc.28",
+    "@owlmeans/server-context": "^0.1.18-rc.29"
+  },
+  "devDependencies": {
+    "@owlmeans/dep-config": "workspace:*",
+    "@types/bun": "^1.4.0",
+    "typescript": "^7.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/consts.ts

@@ -0,0 +1,6 @@
+/** Seven days is an absolute session lifetime; refreshes never extend it. */
+export const AUTH_SESSION_TTL = 7 * 24 * 60 * 60 * 1000
+
+export const AUTH_SESSION_MANAGER = 'auth-session-manager'
+
+export const AUTH_SESSION_RESOURCE = 'auth-session-record'

package/src/identity.ts

@@ -0,0 +1,5 @@
+import type { AuthSessionSelector } from './types.js'
+
+/** Never derive storage identity from the renameable organization slug. */
+export const subjectId = ({ entityId, profileId, clientId }: AuthSessionSelector): string =>
+  `subject:${entityId}:${profileId}:${clientId ?? ''}`

package/src/index.ts

@@ -0,0 +1,4 @@
+export * from './consts.js'
+export * from './memory.js'
+export * from './redis.js'
+export type * from './types.js'

package/src/memory.ts

@@ -0,0 +1,107 @@
+import { createService } from '@owlmeans/context'
+import type { BasicContext } from '@owlmeans/context'
+import { AUTH_SESSION_MANAGER, AUTH_SESSION_TTL } from './consts.js'
+import { subjectId } from './identity.js'
+import type {
+  AuthSessionDecision, AuthSessionManager, AuthSessionManagerOptions, AuthSessionSelector,
+  AuthSessionSubject, RegisterAuthSession
+} from './types.js'
+
+const missing: AuthSessionDecision = { state: 'missing' }
+
+/**
+ * Process-local implementation for development and generated targets. It deliberately loses
+ * state on restart and is therefore never the authority for viable's centrally issued sessions.
+ */
+export const makeMemoryAuthSessionManager = (
+  options: AuthSessionManagerOptions = {}
+): AuthSessionManager => {
+  const now = options.now ?? Date.now
+  const sessions = new Map<string, RegisterAuthSession & { version: number, expiresAt: number }>()
+  const subjects = new Map<string, AuthSessionSubject>()
+
+  const activeSubject = (selector: AuthSessionSelector, at: number): AuthSessionSubject => {
+    const id = subjectId(selector)
+    const current = subjects.get(id)
+    if (current != null && current.expiresAt > at) return current
+    const created: AuthSessionSubject = {
+      id, record: 'subject', entityId: selector.entityId, profileId: selector.profileId,
+      ...(selector.clientId != null ? { clientId: selector.clientId } : {}),
+      state: 'active', version: 1, expiresAt: at + AUTH_SESSION_TTL
+    }
+    subjects.set(id, created)
+    return created
+  }
+
+  const decision = (session: (RegisterAuthSession & { version: number, expiresAt: number }) | undefined): AuthSessionDecision => {
+    const at = now()
+    if (session == null) return missing
+    if (session.expiresAt <= at) {
+      sessions.delete(session.id)
+      return { state: 'expired' }
+    }
+    const subject = subjects.get(subjectId(session))
+    if (subject == null || subject.expiresAt <= at) return missing
+    if (subject.state === 'pending') return { state: 'pending' }
+    if (subject.state === 'revoked') return { state: 'revoked' }
+    return {
+      state: subject.version > session.version ? 'refresh' : 'active',
+      version: subject.version,
+      expiresAt: session.expiresAt
+    }
+  }
+
+  const service = createService<AuthSessionManager>(options.alias ?? AUTH_SESSION_MANAGER, {
+    register: async session => {
+      const at = now()
+      // Compute the individual token's absolute end before looking up the profile subject. A
+      // subject is shared by successive logins, so it must survive at least as long as its newest
+      // still-valid session; otherwise a login near the first session's seventh day would be
+      // rejected early when the original subject record expired.
+      const expiresAt = Math.min(session.expiresAt ?? at + AUTH_SESSION_TTL, at + AUTH_SESSION_TTL)
+      if (expiresAt <= at) return { state: 'expired' }
+      const subject = activeSubject(session, at)
+      if (subject.state === 'pending') return { state: 'pending' }
+      if (subject.state === 'revoked') return { state: 'revoked' }
+      if (subject.expiresAt < expiresAt) {
+        subjects.set(subject.id, { ...subject, expiresAt })
+      }
+      // Callers may request a shorter session, never a longer one. The registry is the last
+      // line of defence for the absolute seven-day cap, not a convention callers can bypass.
+      sessions.set(session.id, { ...session, issuedAt: session.issuedAt ?? at, expiresAt, version: subject.version })
+      return { state: 'active', version: subject.version, expiresAt }
+    },
+    inspect: async id => decision(sessions.get(id)),
+    fence: async (selector, operationId) => {
+      const at = now()
+      const subject = activeSubject(selector, at)
+      subjects.set(subject.id, { ...subject, state: 'pending', operationId, expiresAt: Math.max(subject.expiresAt, at + AUTH_SESSION_TTL) })
+    },
+    refresh: async (selector, operationId) => {
+      const at = now()
+      const subject = activeSubject(selector, at)
+      if (subject.state === 'pending' && subject.operationId !== operationId) return subject.version
+      const version = subject.version + 1
+      subjects.set(subject.id, { ...subject, state: 'active', version, operationId: undefined, expiresAt: Math.max(subject.expiresAt, at + AUTH_SESSION_TTL) })
+      return version
+    },
+    revoke: async (selector, operationId) => {
+      const at = now()
+      const subject = activeSubject(selector, at)
+      if (subject.state === 'pending' && subject.operationId !== operationId) return subject.version
+      const version = subject.version + 1
+      subjects.set(subject.id, { ...subject, state: 'revoked', version, operationId: undefined, expiresAt: Math.max(subject.expiresAt, at + AUTH_SESSION_TTL) })
+      return version
+    }
+  })
+
+  return service
+}
+
+export const appendMemoryAuthSessionManager = <C extends BasicContext<any>>(
+  context: C, options?: AuthSessionManagerOptions
+): C => {
+  const alias = options?.alias ?? AUTH_SESSION_MANAGER
+  if (!context.hasService(alias)) context.registerService(makeMemoryAuthSessionManager(options))
+  return context
+}

package/src/redis.ts

@@ -0,0 +1,186 @@
+import { createService } from '@owlmeans/context'
+import type { BasicContext } from '@owlmeans/context'
+import { makeRedisResource } from '@owlmeans/redis-resource'
+import type { RedisResource } from '@owlmeans/redis-resource'
+import { RecordExists } from '@owlmeans/resource'
+import { AUTH_SESSION_MANAGER, AUTH_SESSION_RESOURCE, AUTH_SESSION_TTL } from './consts.js'
+import { subjectId } from './identity.js'
+import type {
+  AuthSessionDecision, AuthSessionManager, AuthSessionManagerOptions, AuthSessionSelector,
+  AuthSessionStoredRecord, AuthSessionSubject
+} from './types.js'
+
+const missing: AuthSessionDecision = { state: 'missing' }
+
+type SessionResource = RedisResource<AuthSessionStoredRecord>
+
+/**
+ * One Redis script owns each subject transition. A read-modify-save sequence lets competing
+ * grant/revoke operations overwrite a pending fence; this compares the fence id and increments
+ * the version in the same Redis command instead.
+ */
+const transitionSubject = `
+local current = redis.call('GET', KEYS[1])
+local subject = current and cjson.decode(current) or cjson.decode(ARGV[1])
+local now = tonumber(ARGV[2])
+local expires = tonumber(ARGV[3])
+local state = ARGV[4]
+local operation = ARGV[5]
+if tonumber(subject.expiresAt) <= now then
+  subject = cjson.decode(ARGV[1])
+end
+if state == 'pending' then
+  subject.state = 'pending'
+  subject.operationId = operation
+else
+  if subject.state == 'pending' and subject.operationId ~= operation then
+    return -1
+  end
+  subject.state = state
+  subject.operationId = cjson.null
+  subject.version = tonumber(subject.version) + 1
+end
+subject.expiresAt = math.max(tonumber(subject.expiresAt), expires)
+redis.call('SET', KEYS[1], cjson.encode(subject), 'PXAT', subject.expiresAt)
+return tonumber(subject.version)
+`
+
+/** Extend only the subject's expiry without overwriting a concurrent fence or revocation. */
+const extendSubjectExpiry = `
+local current = redis.call('GET', KEYS[1])
+if not current then return 0 end
+local subject = cjson.decode(current)
+local expires = tonumber(ARGV[1])
+if tonumber(subject.expiresAt) < expires then
+  subject.expiresAt = expires
+  redis.call('SET', KEYS[1], cjson.encode(subject), 'PXAT', subject.expiresAt)
+end
+return 1
+`
+
+/** Redis-backed manager. Redis `create` is SET NX, so first session registration is atomic. */
+export const makeRedisAuthSessionManager = (
+  resourceAlias: string = AUTH_SESSION_RESOURCE, options: AuthSessionManagerOptions = {}
+): AuthSessionManager => {
+  const now = options.now ?? Date.now
+  const resource = (context: BasicContext<any>): SessionResource =>
+    context.resource<SessionResource>(resourceAlias)
+
+  const loadSubject = async (ctx: BasicContext<any>, selector: AuthSessionSelector, at: number): Promise<AuthSessionSubject> => {
+    const id = subjectId(selector)
+    const found = await resource(ctx).load(id) as AuthSessionSubject | null
+    if (found != null && found.record === 'subject' && found.expiresAt > at) return found
+    const created: AuthSessionSubject = {
+      id, record: 'subject', entityId: selector.entityId, profileId: selector.profileId,
+      ...(selector.clientId != null ? { clientId: selector.clientId } : {}),
+      state: 'active', version: 1, expiresAt: at + AUTH_SESSION_TTL
+    }
+    try {
+      await resource(ctx).create(created, { ttl: new Date(created.expiresAt) })
+      return created
+    } catch (error) {
+      if (!(error instanceof RecordExists)) throw error
+      const raced = await resource(ctx).load(id) as AuthSessionSubject | null
+      if (raced == null || raced.record !== 'subject') throw error
+      return raced
+    }
+  }
+
+  const transition = async (
+    ctx: BasicContext<any>, selector: AuthSessionSelector,
+    state: 'pending' | 'active' | 'revoked', operationId: string
+  ): Promise<number> => {
+    const at = now()
+    const id = subjectId(selector)
+    const seed: AuthSessionSubject = {
+      id, record: 'subject', entityId: selector.entityId, profileId: selector.profileId,
+      ...(selector.clientId != null ? { clientId: selector.clientId } : {}),
+      state: 'active', version: 1, expiresAt: at + AUTH_SESSION_TTL
+    }
+    const expiresAt = at + AUTH_SESSION_TTL
+    const value = await resource(ctx).db.client.eval(
+      transitionSubject, 1, resource(ctx).key(id), JSON.stringify(seed), at, expiresAt, state, operationId
+    )
+    const version = Number(value)
+    if (!Number.isInteger(version) || version < 0) {
+      throw new Error('auth-session:transition-conflict')
+    }
+    return version
+  }
+
+  let service: AuthSessionManager
+  service = createService<AuthSessionManager>(options.alias ?? AUTH_SESSION_MANAGER, {
+    register: async session => {
+      const ctx = service.assertCtx()
+      const at = now()
+      // Do not trust a caller to choose the maximum session TTL. It may choose a shorter expiry.
+      const expiresAt = Math.min(session.expiresAt ?? at + AUTH_SESSION_TTL, at + AUTH_SESSION_TTL)
+      if (expiresAt <= at) return { state: 'expired' }
+      const subject = await loadSubject(ctx, session, at)
+      if (subject.state === 'pending') return { state: 'pending' }
+      if (subject.state === 'revoked') return { state: 'revoked' }
+      // Session records have their own absolute expiry. Keep the shared subject alive until the
+      // newest one expires, but use a script so an expiry extension cannot replace a concurrent
+      // pending/revoked state with this older active object.
+      if (subject.expiresAt < expiresAt) {
+        await resource(ctx).db.client.eval(
+          extendSubjectExpiry, 1, resource(ctx).key(subject.id), expiresAt
+        )
+      }
+      const stored = {
+        ...session, record: 'session' as const, issuedAt: session.issuedAt ?? at, expiresAt,
+        version: subject.version
+      }
+      try {
+        await resource(ctx).create(stored, { ttl: new Date(expiresAt) })
+      } catch (error) {
+        if (!(error instanceof RecordExists)) throw error
+        // A subject version may have advanced since its original session record was minted.
+        // A successful revalidation acknowledges that version without extending the absolute TTL.
+        const current = await resource(ctx).load(session.id)
+        if (current == null || current.record !== 'session') throw error
+        await resource(ctx).save({ ...stored, expiresAt: current.expiresAt }, { ttl: new Date(current.expiresAt) })
+      }
+      return { state: 'active', version: subject.version, expiresAt }
+    },
+    inspect: async id => {
+      const ctx = service.assertCtx()
+      const at = now()
+      const session = await resource(ctx).load(id)
+      if (session == null || session.record !== 'session') return missing
+      if (session.expiresAt <= at) return { state: 'expired' }
+      const subject = await resource(ctx).load(subjectId(session))
+      if (subject == null || subject.record !== 'subject' || subject.expiresAt <= at) return missing
+      if (subject.state === 'pending') return { state: 'pending' }
+      if (subject.state === 'revoked') return { state: 'revoked' }
+      return { state: subject.version > session.version ? 'refresh' : 'active', version: subject.version, expiresAt: session.expiresAt }
+    },
+    fence: async (selector, operationId) => {
+      const ctx = service.assertCtx()
+      await transition(ctx, selector, 'pending', operationId)
+    },
+    refresh: async (selector, operationId) => {
+      const ctx = service.assertCtx()
+      return await transition(ctx, selector, 'active', operationId)
+    },
+    revoke: async (selector, operationId) => {
+      const ctx = service.assertCtx()
+      return await transition(ctx, selector, 'revoked', operationId)
+    }
+  })
+  return service
+}
+
+export const appendRedisAuthSessionManager = <C extends BasicContext<any>>(
+  context: C, options?: AuthSessionManagerOptions & { resourceAlias?: string, dbAlias?: string, serviceAlias?: string }
+): C => {
+  const resourceAlias = options?.resourceAlias ?? AUTH_SESSION_RESOURCE
+  if (!context.hasResource(resourceAlias)) {
+    context.registerResource(makeRedisResource<AuthSessionStoredRecord>(resourceAlias, options?.dbAlias, options?.serviceAlias))
+  }
+  const alias = options?.alias ?? AUTH_SESSION_MANAGER
+  if (!context.hasService(alias)) context.registerService(makeRedisAuthSessionManager(resourceAlias, options))
+  return context
+}
+
+export type { RedisResource }

package/src/types.ts

@@ -0,0 +1,60 @@
+import type { InitializedService } from '@owlmeans/context'
+import type { ResourceRecord } from '@owlmeans/resource'
+
+export type AuthSessionKind = 'bearer' | 'oidc-access' | 'oidc-refresh' | 'oidc-provider-session'
+
+export type AuthSessionState = 'active' | 'pending' | 'refresh' | 'revoked'
+
+/** Stable storage selector. `entityId` never travels in an authentication envelope. */
+export interface AuthSessionSelector {
+  entityId: string
+  profileId: string
+  clientId?: string
+}
+
+export interface AuthSessionRecord extends ResourceRecord, AuthSessionSelector {
+  id: string
+  record: 'session'
+  kind: AuthSessionKind
+  version: number
+  issuedAt: number
+  expiresAt: number
+}
+
+export interface AuthSessionSubject extends ResourceRecord, AuthSessionSelector {
+  id: string
+  record: 'subject'
+  state: AuthSessionState
+  version: number
+  expiresAt: number
+  operationId?: string
+}
+
+export type AuthSessionStoredRecord = AuthSessionRecord | AuthSessionSubject
+
+export type AuthSessionDecision =
+  | { state: 'active' | 'refresh'; version: number; expiresAt: number }
+  | { state: 'pending' | 'revoked' | 'missing' | 'expired' }
+
+export interface RegisterAuthSession extends AuthSessionSelector {
+  id: string
+  kind: AuthSessionKind
+  issuedAt?: number
+  expiresAt?: number
+}
+
+export interface AuthSessionManager extends InitializedService {
+  register: (session: RegisterAuthSession) => Promise<AuthSessionDecision>
+  inspect: (id: string) => Promise<AuthSessionDecision>
+  /** Fences all sessions for a profile/client before its authority is changed. */
+  fence: (selector: AuthSessionSelector, operationId: string) => Promise<void>
+  /** Completes a fence as a claim refresh. */
+  refresh: (selector: AuthSessionSelector, operationId: string) => Promise<number>
+  /** Completes a fence as a session revocation. */
+  revoke: (selector: AuthSessionSelector, operationId: string) => Promise<number>
+}
+
+export interface AuthSessionManagerOptions {
+  alias?: string
+  now?: () => number
+}

package/tests/service.spec.ts

@@ -0,0 +1,48 @@
+import { describe, expect, test } from 'bun:test'
+import { makeMemoryAuthSessionManager } from '../src/memory.js'
+
+describe('memory auth session manager', () => {
+  test('refreshes and revokes an existing seven-day session', async () => {
+    let now = 1_000
+    const manager = makeMemoryAuthSessionManager({ now: () => now })
+    await manager.init()
+    const selector = { entityId: 'entity-1', profileId: 'profile-1', clientId: 'client-1' }
+    const issued = await manager.register({ ...selector, id: 'session-1', kind: 'bearer' })
+    expect(issued.state).toBe('active')
+    await manager.fence(selector, 'change-1')
+    expect((await manager.inspect('session-1')).state).toBe('pending')
+    await manager.refresh(selector, 'change-1')
+    expect((await manager.inspect('session-1')).state).toBe('refresh')
+    await manager.revoke(selector, 'change-2')
+    expect((await manager.inspect('session-1')).state).toBe('revoked')
+    now += 7 * 24 * 60 * 60 * 1000 + 1
+    expect((await manager.inspect('session-1')).state).toBe('expired')
+  })
+
+  test('caps a caller-supplied expiry at seven days', async () => {
+    const now = 2_000
+    const manager = makeMemoryAuthSessionManager({ now: () => now })
+    await manager.init()
+
+    const issued = await manager.register({
+      id: 'session-cap', kind: 'bearer', entityId: 'entity-1', profileId: 'profile-1',
+      expiresAt: now + 30 * 24 * 60 * 60 * 1000,
+    })
+
+    expect(issued).toMatchObject({ state: 'active', expiresAt: now + 7 * 24 * 60 * 60 * 1000 })
+  })
+
+  test('keeps the shared subject until a later independently bounded session expires', async () => {
+    let now = 5_000
+    const manager = makeMemoryAuthSessionManager({ now: () => now })
+    await manager.init()
+    const selector = { entityId: 'entity-1', profileId: 'profile-1' }
+    await manager.register({ ...selector, id: 'first', kind: 'bearer' })
+
+    now += 6 * 24 * 60 * 60 * 1000
+    await manager.register({ ...selector, id: 'second', kind: 'bearer' })
+
+    now += 24 * 60 * 60 * 1000 + 1
+    expect((await manager.inspect('second')).state).toBe('active')
+  })
+})

package/tests/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.node.json"
+  ],
+  "compilerOptions": {
+    "types": ["bun"],
+    "rootDir": "../",
+    "noEmit": true
+  },
+  "include": ["./**/*", "../src/**/*"]
+}

package/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.node.json"
+  ],
+  "compilerOptions": {
+    "rootDir": "./src/",
+    "outDir": "./build/"
+  },
+  "exclude": ["./build/**/*", "./tests/**/*", "./*.ts"]
+}