@soulcode/bexio-oauth 0.0.0-stage → 0.1.0

package/dist/store/postgres.js

@@ -0,0 +1,168 @@
+const COLUMNS = `id, owner_id, bexio_company_id, bexio_user_id, bexio_company_user_id,
+  company_name, user_name, user_email, role, status, access_token, refresh_token,
+  access_expires_at, refresh_expires_at, scope, refresh_locked_until,
+  last_refreshed_at, created_at, updated_at`;
+function date(value) {
+    if (value === null)
+        return null;
+    return value instanceof Date ? value : new Date(value);
+}
+function toRecord(row) {
+    return {
+        id: row.id,
+        ownerId: row.owner_id,
+        companyId: row.bexio_company_id,
+        userId: row.bexio_user_id,
+        companyUserId: row.bexio_company_user_id === null
+            ? null
+            : Number(row.bexio_company_user_id),
+        companyName: row.company_name,
+        userName: row.user_name,
+        userEmail: row.user_email,
+        role: row.role,
+        status: row.status,
+        accessToken: row.access_token,
+        refreshToken: row.refresh_token,
+        accessExpiresAt: date(row.access_expires_at),
+        refreshExpiresAt: date(row.refresh_expires_at),
+        scope: row.scope,
+        refreshLockedUntil: date(row.refresh_locked_until),
+        lastRefreshedAt: date(row.last_refreshed_at),
+        createdAt: date(row.created_at),
+        updatedAt: date(row.updated_at),
+    };
+}
+/**
+ * Grant store on the `bexio_grants` table (create it with
+ * `npx @soulcode/bexio-oauth sql`). Every operation is a single statement,
+ * so it works through transaction-mode poolers and HTTP drivers.
+ */
+export function postgresStore(sql) {
+    const one = async (text, params) => {
+        const { rows } = await sql.query(text, params);
+        return rows[0] ? toRecord(rows[0]) : null;
+    };
+    const many = async (text, params) => {
+        const { rows } = await sql.query(text, params);
+        return rows.map(toRecord);
+    };
+    return {
+        async upsertGrant(g) {
+            const row = await one(`INSERT INTO bexio_grants (owner_id, bexio_company_id, bexio_user_id,
+           bexio_company_user_id, company_name, user_name, user_email, role, status,
+           access_token, refresh_token, access_expires_at, refresh_expires_at, scope,
+           refresh_locked_until, last_refreshed_at, created_at, updated_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'active', $9, $10, $11, $12, $13, NULL, $14, $14, $14)
+         ON CONFLICT (owner_id, bexio_company_id, bexio_user_id) DO UPDATE SET
+           bexio_company_user_id = EXCLUDED.bexio_company_user_id,
+           company_name = EXCLUDED.company_name,
+           user_name = EXCLUDED.user_name,
+           user_email = EXCLUDED.user_email,
+           role = EXCLUDED.role,
+           status = 'active',
+           access_token = EXCLUDED.access_token,
+           refresh_token = EXCLUDED.refresh_token,
+           access_expires_at = EXCLUDED.access_expires_at,
+           refresh_expires_at = EXCLUDED.refresh_expires_at,
+           scope = EXCLUDED.scope,
+           refresh_locked_until = NULL,
+           refresh_lock_token = NULL,
+           last_refreshed_at = EXCLUDED.last_refreshed_at,
+           updated_at = EXCLUDED.updated_at
+         RETURNING ${COLUMNS}`, [
+                g.ownerId,
+                g.companyId,
+                g.userId,
+                g.companyUserId,
+                g.companyName,
+                g.userName,
+                g.userEmail,
+                g.role,
+                g.accessToken,
+                g.refreshToken,
+                g.accessExpiresAt,
+                g.refreshExpiresAt,
+                g.scope,
+                g.now,
+            ]);
+            if (!row)
+                throw new Error("upsert returned no row");
+            return row;
+        },
+        async findGrants({ ownerId, companyId, grantId }) {
+            return many(`SELECT ${COLUMNS} FROM bexio_grants
+         WHERE owner_id = $1
+           AND ($2::text IS NULL OR bexio_company_id = $2)
+           AND ($3::uuid IS NULL OR id = $3::uuid)
+         ORDER BY created_at, id`, [ownerId, companyId ?? null, grantId ?? null]);
+        },
+        async getGrant(id) {
+            return one(`SELECT ${COLUMNS} FROM bexio_grants WHERE id = $1`, [id]);
+        },
+        async acquireRefreshLock({ id, now, lockUntil, lockToken, accessExpiresBefore, refreshedBefore, }) {
+            return one(`UPDATE bexio_grants SET refresh_locked_until = $3, refresh_lock_token = $6
+         WHERE id = $1
+           AND status = 'active'
+           AND (refresh_locked_until IS NULL OR refresh_locked_until <= $2)
+           AND (
+             ($4::timestamptz IS NOT NULL AND (access_expires_at IS NULL OR access_expires_at <= $4))
+             OR ($5::timestamptz IS NOT NULL AND last_refreshed_at < $5)
+           )
+         RETURNING ${COLUMNS}`, [
+                id,
+                now,
+                lockUntil,
+                accessExpiresBefore ?? null,
+                refreshedBefore ?? null,
+                lockToken,
+            ]);
+        },
+        // Holder writes are fenced by refresh_lock_token: a holder whose lock
+        // expired or was cleared by a reconnect matches no row and changes nothing.
+        async saveRefreshed(id, lockToken, r) {
+            return one(`UPDATE bexio_grants SET
+           access_token = $2,
+           refresh_token = COALESCE($3, refresh_token),
+           access_expires_at = $4,
+           refresh_expires_at = COALESCE($5, refresh_expires_at),
+           scope = COALESCE($6, scope),
+           role = COALESCE($7, role),
+           status = 'active',
+           refresh_locked_until = NULL,
+           refresh_lock_token = NULL,
+           last_refreshed_at = $8,
+           updated_at = $8
+         WHERE id = $1 AND refresh_lock_token = $9
+         RETURNING ${COLUMNS}`, [
+                id,
+                r.accessToken,
+                r.refreshToken,
+                r.accessExpiresAt,
+                r.refreshExpiresAt,
+                r.scope,
+                r.role,
+                r.now,
+                lockToken,
+            ]);
+        },
+        async markReauthRequired(id, lockToken, now) {
+            await sql.query(`UPDATE bexio_grants SET status = 'reauth_required',
+           refresh_locked_until = NULL, refresh_lock_token = NULL, updated_at = $2
+         WHERE id = $1 AND refresh_lock_token = $3`, [id, now, lockToken]);
+        },
+        async releaseRefreshLock(id, lockToken) {
+            await sql.query(`UPDATE bexio_grants SET refresh_locked_until = NULL, refresh_lock_token = NULL
+         WHERE id = $1 AND refresh_lock_token = $2`, [id, lockToken]);
+        },
+        async deleteGrant(id) {
+            await sql.query(`DELETE FROM bexio_grants WHERE id = $1`, [id]);
+        },
+        async listIdleGrants({ refreshedBefore, limit }) {
+            return many(`SELECT ${COLUMNS} FROM bexio_grants
+         WHERE status = 'active' AND last_refreshed_at < $1
+         ORDER BY last_refreshed_at
+         LIMIT $2`, [refreshedBefore, limit]);
+        },
+    };
+}
+//# sourceMappingURL=postgres.js.map

package/dist/store/postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../src/store/postgres.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,GAAG;;;4CAG4B,CAAC;AA2B7C,SAAS,IAAI,CAAC,KAA2B;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAQ;IACxB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,SAAS,EAAE,GAAG,CAAC,gBAAgB;QAC/B,MAAM,EAAE,GAAG,CAAC,aAAa;QACzB,aAAa,EACX,GAAG,CAAC,qBAAqB,KAAK,IAAI;YAChC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACvC,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC9C,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClD,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAQ,IAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,CAAC;YACjB,MAAM,GAAG,GAAG,MAAM,GAAG,CACnB;;;;;;;;;;;;;;;;;;;;;qBAqBa,OAAO,EAAE,EACtB;gBACE,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG;aACN,CACF,CAAC;YACF,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACpD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;YAC9C,OAAO,IAAI,CACT,UAAU,OAAO;;;;iCAIQ,EACzB,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,CAC9C,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,OAAO,GAAG,CAAC,UAAU,OAAO,kCAAkC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,EAAE,EACF,GAAG,EACH,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,eAAe,GAChB;YACC,OAAO,GAAG,CACR;;;;;;;;qBAQa,OAAO,EAAE,EACtB;gBACE,EAAE;gBACF,GAAG;gBACH,SAAS;gBACT,mBAAmB,IAAI,IAAI;gBAC3B,eAAe,IAAI,IAAI;gBACvB,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,4EAA4E;QAC5E,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;YAClC,OAAO,GAAG,CACR;;;;;;;;;;;;;qBAaa,OAAO,EAAE,EACtB;gBACE,EAAE;gBACF,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,GAAG;gBACL,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG;YACzC,MAAM,GAAG,CAAC,KAAK,CACb;;mDAE2C,EAC3C,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CACrB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS;YACpC,MAAM,GAAG,CAAC,KAAK,CACb;mDAC2C,EAC3C,CAAC,EAAE,EAAE,SAAS,CAAC,CAChB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,MAAM,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;YAC7C,OAAO,IAAI,CACT,UAAU,OAAO;;;kBAGP,EACV,CAAC,eAAe,EAAE,KAAK,CAAC,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/store/types.d.ts

@@ -0,0 +1,105 @@
+import type { Role } from "../permissions.js";
+export type GrantStatus = "active" | "reauth_required";
+/** A stored grant. Token fields hold JWE ciphertext, never plaintext. */
+export interface GrantRecord {
+    id: string;
+    ownerId: string;
+    companyId: string;
+    userId: string;
+    companyUserId: number | null;
+    companyName: string | null;
+    userName: string | null;
+    userEmail: string | null;
+    role: Role;
+    status: GrantStatus;
+    accessToken: string;
+    refreshToken: string | null;
+    accessExpiresAt: Date | null;
+    refreshExpiresAt: Date | null;
+    scope: string | null;
+    refreshLockedUntil: Date | null;
+    lastRefreshedAt: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** Insert, or overwrite the tokens of, the grant for (owner, company, user). */
+export interface GrantUpsert {
+    ownerId: string;
+    companyId: string;
+    userId: string;
+    companyUserId: number | null;
+    companyName: string | null;
+    userName: string | null;
+    userEmail: string | null;
+    role: Role;
+    accessToken: string;
+    refreshToken: string | null;
+    accessExpiresAt: Date | null;
+    refreshExpiresAt: Date | null;
+    scope: string | null;
+    now: Date;
+}
+export interface GrantRefresh {
+    accessToken: string;
+    /** `null` keeps the stored refresh token (the IdP didn't rotate it). */
+    refreshToken: string | null;
+    accessExpiresAt: Date | null;
+    /** `null` keeps the stored value. */
+    refreshExpiresAt: Date | null;
+    /** `null` keeps the stored value. */
+    scope: string | null;
+    /** `null` keeps the stored role. */
+    role: Role | null;
+    now: Date;
+}
+export interface LockRequest {
+    id: string;
+    now: Date;
+    lockUntil: Date;
+    /**
+     * Random value identifying this lock holder. Writes that need the lock pass
+     * it back, so a holder whose lock expired (or was cleared by a reconnect)
+     * can't overwrite newer data.
+     */
+    lockToken: string;
+    /** Lock only if the access token expires before this instant (lazy refresh)… */
+    accessExpiresBefore?: Date;
+    /** …or only if the grant was last refreshed before this instant (idle sweep). */
+    refreshedBefore?: Date;
+}
+/**
+ * Persistence for grants. Every method must be atomic on its own: the
+ * library never needs multi-statement transactions.
+ */
+export interface GrantStore {
+    upsertGrant(input: GrantUpsert): Promise<GrantRecord>;
+    findGrants(query: {
+        ownerId: string;
+        companyId?: string;
+        grantId?: string;
+    }): Promise<GrantRecord[]>;
+    getGrant(id: string): Promise<GrantRecord | null>;
+    /**
+     * Takes the refresh lock if the grant is active, not locked (or the lock
+     * expired), and still matches the `accessExpiresBefore` / `refreshedBefore`
+     * condition. Returns the locked row, or `null` if someone else holds the
+     * lock or the grant no longer needs a refresh.
+     */
+    acquireRefreshLock(request: LockRequest): Promise<GrantRecord | null>;
+    /**
+     * Stores refreshed tokens, sets `lastRefreshedAt`, and releases the lock.
+     * Returns `null` (and changes nothing) unless `lockToken` still holds it.
+     */
+    saveRefreshed(id: string, lockToken: string, refresh: GrantRefresh): Promise<GrantRecord | null>;
+    /** Sets `status = reauth_required` and releases the lock, if `lockToken` holds it. */
+    markReauthRequired(id: string, lockToken: string, now: Date): Promise<void>;
+    /** Releases the lock, if `lockToken` holds it. */
+    releaseRefreshLock(id: string, lockToken: string): Promise<void>;
+    deleteGrant(id: string): Promise<void>;
+    /** Active grants last refreshed before `refreshedBefore`, oldest first. */
+    listIdleGrants(query: {
+        refreshedBefore: Date;
+        limit: number;
+    }): Promise<GrantRecord[]>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/store/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAEvD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,qCAAqC;IACrC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,qCAAqC;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oCAAoC;IACpC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,IAAI,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,IAAI,CAAC;IAC3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,IAAI,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,UAAU,CAAC,KAAK,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAClD;;;;;OAKG;IACH,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,aAAa,CACX,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC/B,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,2EAA2E;IAC3E,cAAc,CAAC,KAAK,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAC5B"}

package/dist/store/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/store/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "@soulcode/bexio-oauth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Bexio OAuth token custody for Node apps: connect Bexio accounts, store tokens encrypted in Postgres, get a valid access token anywhere.",
+  "keywords": [
+    "bexio",
+    "oauth",
+    "oidc",
+    "openid-connect",
+    "postgres",
+    "token"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SoulcodeAgency/bexio-oauth.git",
+    "directory": "packages/bexio-oauth"
+  },
+  "homepage": "https://github.com/SoulcodeAgency/bexio-oauth/blob/main/docs/integration.md",
+  "bugs": "https://github.com/SoulcodeAgency/bexio-oauth/issues",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "bexio-oauth": "./dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "sql"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "jose": "^6.2.13",
+    "openid-client": "^6.8.8"
+  },
+  "devDependencies": {
+    "@types/pg": "8.23.1",
+    "mock-bexio": "*",
+    "pg": "8.23.1",
+    "vitest": "5.0.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/sql/0001_bexio_grants.sql

@@ -0,0 +1,32 @@
+-- @soulcode/bexio-oauth 0001: the grants table.
+-- One row per (owner, Bexio company, Bexio user). Token columns hold JWE
+-- ciphertext; only your server-side database role should be able to read them.
+
+CREATE TABLE IF NOT EXISTS bexio_grants (
+  id                    uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+  owner_id              text        NOT NULL,
+  bexio_company_id      text        NOT NULL,
+  bexio_user_id         text        NOT NULL,
+  bexio_company_user_id integer,
+  company_name          text,
+  user_name             text,
+  user_email            text,
+  role                  text        NOT NULL DEFAULT 'member' CHECK (role IN ('admin', 'member')),
+  status                text        NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'reauth_required')),
+  access_token          text        NOT NULL,
+  refresh_token         text,
+  access_expires_at     timestamptz,
+  refresh_expires_at    timestamptz,
+  scope                 text,
+  refresh_locked_until  timestamptz,
+  refresh_lock_token    text,
+  last_refreshed_at     timestamptz NOT NULL DEFAULT now(),
+  created_at            timestamptz NOT NULL DEFAULT now(),
+  updated_at            timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT bexio_grants_owner_company_user_key UNIQUE (owner_id, bexio_company_id, bexio_user_id)
+);
+
+-- refreshIdle(): active grants by last refresh.
+CREATE INDEX IF NOT EXISTS bexio_grants_idle_idx
+  ON bexio_grants (last_refreshed_at)
+  WHERE status = 'active';