@soulcode/bexio-oauth 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Soulcode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,67 @@
-# Temporary Holding Version
+# @soulcode/bexio-oauth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Bexio OAuth token custody for Node apps. Connect Bexio accounts, store their tokens encrypted in Postgres, and get a valid access token anywhere, including background jobs, without two server instances ever refreshing the same token at once.
+
+It is **not** an auth framework: your app keeps its own login. For "Sign in with Bexio", let your auth framework run the login and hand the tokens over with `saveGrant()`.
+
+- Full guide: [docs/integration.md](https://github.com/SoulcodeAgency/bexio-oauth/blob/main/docs/integration.md)
+- Working examples (Better Auth, Supabase Auth): [examples/](https://github.com/SoulcodeAgency/bexio-oauth/tree/main/examples)
+
+## Install
+
+```bash
+npm install @soulcode/bexio-oauth pg
+npx @soulcode/bexio-oauth sql > migrations/0001_bexio_grants.sql   # then apply it
+npx @soulcode/bexio-oauth keygen                                    # encryption key
+```
+
+Requires Node ≥ 24 and PostgreSQL.
+
+## Quickstart
+
+```ts
+// lib/bexio.ts (server-only)
+import { Pool } from "pg";
+import { createBexioOAuth, postgresStore } from "@soulcode/bexio-oauth";
+
+export const bexio = createBexioOAuth({
+  clientId: process.env.BEXIO_CLIENT_ID!,
+  clientSecret: process.env.BEXIO_CLIENT_SECRET!,
+  redirectUri: process.env.BEXIO_REDIRECT_URI!, // e.g. https://app.example.com/api/bexio/callback
+  scopes: ["contact_show"],
+  keys: JSON.parse(process.env.BEXIO_TOKEN_KEYS!), // {"current":"k1","keys":{"k1":"<keygen>"}}
+  store: postgresStore(
+    new Pool({ connectionString: process.env.DATABASE_URL }),
+  ),
+});
+```
+
+```ts
+// GET /api/bexio/connect
+export const GET = async (req: Request) =>
+  bexio.start({
+    ownerId: await currentWorkspaceId(req),
+    returnTo: "/settings",
+  });
+
+// GET /api/bexio/callback  (your redirectUri)
+export const GET = async (req: Request) =>
+  bexio.callback(req, { ownerId: await currentWorkspaceId(req) });
+```
+
+```ts
+// anywhere on the server, including cron jobs
+const { accessToken } = await bexio.getAccessToken({ ownerId: workspaceId });
+await fetch("https://api.bexio.com/2.0/contact", {
+  headers: {
+    Authorization: `Bearer ${accessToken}`,
+    Accept: "application/json",
+  },
+});
+```
+
+Also: `listGrants`, `disconnect`, `refreshIdle` (keep idle grants alive), `saveGrant` (tokens from your auth framework). Every error is a `BexioOAuthError` with a stable `code`.
+
+## License
+
+MIT

package/dist/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":""}

package/dist/bin.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { run } from "./cli.js";
+process.exitCode = await run(process.argv.slice(2), (s) => process.stdout.write(s), (s) => process.stderr.write(s));
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,CAC1B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EACrB,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC/B,CAAC"}

package/dist/claims.d.ts

@@ -0,0 +1,31 @@
+/** Bexio's production OIDC issuer (Keycloak realm). */
+export declare const BEXIO_ISSUER = "https://auth.bexio.com/realms/bexio";
+/** Bexio's production API base URL. */
+export declare const BEXIO_API_BASE_URL = "https://api.bexio.com";
+/**
+ * Always requested. `company_profile` adds the company claims; `offline_access`
+ * issues a refresh token that keeps working without the user present.
+ */
+export declare const BASE_SCOPES: readonly string[];
+export type ClaimBag = Record<string, unknown>;
+/** Who granted access, as read from Bexio's ID token, access token and userinfo. */
+export interface BexioIdentity {
+    /** OIDC `sub`. */
+    userId: string;
+    /** `company_id` (company_profile scope). */
+    companyId: string;
+    companyName: string | null;
+    /** `company_user_id` (access token): the user's id inside the company. */
+    companyUserId: number | null;
+    userName: string | null;
+    userEmail: string | null;
+}
+/**
+ * Maps a merged claim bag (ID token + access token + userinfo) to a
+ * `BexioIdentity`. Throws `invalid_callback` when `sub` or `company_id` is
+ * missing.
+ */
+export declare function mapClaims(claims: ClaimBag): BexioIdentity;
+/** The value a grant's ciphertext is bound to (see `TokenCipher`). */
+export declare function grantBinding(ownerId: string, companyId: string, userId: string): string;
+//# sourceMappingURL=claims.d.ts.map

package/dist/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAEA,uDAAuD;AACvD,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAClE,uCAAuC;AACvC,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAC1D;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAMvC,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE/C,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAaD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,CAwBzD;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,MAAM,CAER"}

package/dist/claims.js

@@ -0,0 +1,58 @@
+import { BexioOAuthError } from "./errors.js";
+/** Bexio's production OIDC issuer (Keycloak realm). */
+export const BEXIO_ISSUER = "https://auth.bexio.com/realms/bexio";
+/** Bexio's production API base URL. */
+export const BEXIO_API_BASE_URL = "https://api.bexio.com";
+/**
+ * Always requested. `company_profile` adds the company claims; `offline_access`
+ * issues a refresh token that keeps working without the user present.
+ */
+export const BASE_SCOPES = Object.freeze([
+    "openid",
+    "profile",
+    "email",
+    "company_profile",
+    "offline_access",
+]);
+function text(value) {
+    if (typeof value === "string" && value.length > 0)
+        return value;
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return null;
+}
+function integer(value) {
+    const parsed = typeof value === "string" ? Number.parseInt(value, 10) : value;
+    return typeof parsed === "number" && Number.isInteger(parsed) ? parsed : null;
+}
+/**
+ * Maps a merged claim bag (ID token + access token + userinfo) to a
+ * `BexioIdentity`. Throws `invalid_callback` when `sub` or `company_id` is
+ * missing.
+ */
+export function mapClaims(claims) {
+    const userId = text(claims.sub);
+    if (!userId)
+        throw new BexioOAuthError("invalid_callback", "missing sub claim");
+    const companyId = text(claims.company_id);
+    if (!companyId) {
+        throw new BexioOAuthError("invalid_callback", "missing company_id claim (is the company_profile scope requested?)");
+    }
+    const given = text(claims.given_name);
+    const family = text(claims.family_name);
+    return {
+        userId,
+        companyId,
+        companyName: text(claims.company_name),
+        companyUserId: integer(claims.company_user_id),
+        userName: given && family
+            ? `${given} ${family}`
+            : (text(claims.name) ?? given ?? family),
+        userEmail: text(claims.email),
+    };
+}
+/** The value a grant's ciphertext is bound to (see `TokenCipher`). */
+export function grantBinding(ownerId, companyId, userId) {
+    return `${ownerId}\u0000${companyId}\u0000${userId}`;
+}
+//# sourceMappingURL=claims.js.map

package/dist/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAClE,uCAAuC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1D,QAAQ;IACR,SAAS;IACT,OAAO;IACP,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAiBH,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAgB;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO;QACL,MAAM;QACN,SAAS;QACT,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACtC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QAC9C,QAAQ,EACN,KAAK,IAAI,MAAM;YACb,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,OAAO,GAAG,OAAO,SAAS,SAAS,SAAS,MAAM,EAAE,CAAC;AACvD,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+export declare function run(argv: string[], out: (s: string) => void, err: (s: string) => void): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAWA,wBAAsB,GAAG,CACvB,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EACxB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GACvB,OAAO,CAAC,MAAM,CAAC,CAgCjB"}

package/dist/cli.js

@@ -0,0 +1,44 @@
+import { generateKey } from "./crypto.js";
+import { migrations } from "./sql.js";
+const HELP = `Usage: bexio-oauth <command>
+
+Commands:
+  sql [--from <n>]   Print the schema SQL (all migrations, or from migration <n> on)
+  keygen             Print a new random 32-byte encryption key (base64url)
+  help               Show this help
+`;
+export async function run(argv, out, err) {
+    const [command, ...rest] = argv;
+    switch (command) {
+        case "sql": {
+            let from = 1;
+            if (rest[0] === "--from") {
+                from = Number.parseInt(rest[1] ?? "", 10);
+                if (!Number.isInteger(from) || from < 1) {
+                    err("--from needs a migration number, e.g. --from 2\n");
+                    return 1;
+                }
+            }
+            else if (rest.length > 0) {
+                err(HELP);
+                return 1;
+            }
+            const selected = (await migrations()).filter((m) => m.number >= from);
+            out(selected.map((m) => `-- ${m.name}\n${m.sql.trimEnd()}\n`).join("\n"));
+            return 0;
+        }
+        case "keygen":
+            out(`${generateKey()}\n`);
+            return 0;
+        case undefined:
+        case "help":
+        case "--help":
+        case "-h":
+            out(HELP);
+            return 0;
+        default:
+            err(`Unknown command: ${command}\n\n${HELP}`);
+            return 1;
+    }
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,IAAI,GAAG;;;;;;CAMZ,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAAc,EACd,GAAwB,EACxB,GAAwB;IAExB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACzB,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;oBACxC,GAAG,CAAC,kDAAkD,CAAC,CAAC;oBACxD,OAAO,CAAC,CAAC;gBACX,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,CAAC;gBACV,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;YACtE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ;YACX,GAAG,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,CAAC;YAC1B,OAAO,CAAC,CAAC;QACX,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,OAAO,CAAC,CAAC;QACX;YACE,GAAG,CAAC,oBAAoB,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,7 @@
+import type { BexioOAuth, BexioOAuthConfig } from "./types.js";
+/**
+ * Creates the client. Validates the config up front (throws `invalid_config`);
+ * OIDC discovery runs lazily on first use.
+ */
+export declare function createBexioOAuth(config: BexioOAuthConfig): BexioOAuth;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE/D;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAYrE"}

package/dist/client.js

@@ -0,0 +1,24 @@
+import { resolveConfig } from "./config.js";
+import { callback, handleCallback, start } from "./connect-flow.js";
+import { saveGrant } from "./external-tokens.js";
+import { disconnect, listGrants } from "./grants.js";
+import { refreshIdle } from "./idle-sweep.js";
+import { getAccessToken } from "./refresh.js";
+/**
+ * Creates the client. Validates the config up front (throws `invalid_config`);
+ * OIDC discovery runs lazily on first use.
+ */
+export function createBexioOAuth(config) {
+    const ctx = resolveConfig(config);
+    return {
+        start: (options) => start(ctx, options),
+        callback: (request, options) => callback(ctx, request, options),
+        handleCallback: (request, options) => handleCallback(ctx, request, options),
+        saveGrant: (input) => saveGrant(ctx, input),
+        getAccessToken: (selector) => getAccessToken(ctx, selector),
+        listGrants: (query) => listGrants(ctx.store, query),
+        disconnect: (selector) => disconnect(ctx, selector),
+        refreshIdle: (options) => refreshIdle(ctx, options),
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;QACvC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC;QAC/D,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC;QAC3E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;QAC3C,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC3D,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;QACnD,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;QACnD,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,22 @@
+import { TokenCipher } from "./crypto.js";
+import { type Oidc } from "./oidc.js";
+import type { GrantStore } from "./store/types.js";
+import type { BexioOAuthConfig } from "./types.js";
+/** The validated configuration and shared services every client method uses. */
+export interface ClientContext {
+    clientId: string;
+    cipher: TokenCipher;
+    store: GrantStore;
+    clock: () => Date;
+    fetchImpl: typeof fetch;
+    oidc: Oidc;
+    apiBaseUrl: string;
+    redirectUri: URL;
+    /** Space-separated, `BASE_SCOPES` included. */
+    scope: string;
+    lockTtlMs: number;
+    defaultReturnTo: string;
+}
+/** Validates the config (throws `invalid_config`) and builds the shared context. */
+export declare function resolveConfig(config: BexioOAuthConfig): ClientContext;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,GAAG,CAAC;IACjB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAYD,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,aAAa,CAiDrE"}

package/dist/config.js

@@ -0,0 +1,57 @@
+import { BASE_SCOPES, BEXIO_API_BASE_URL, BEXIO_ISSUER } from "./claims.js";
+import { TokenCipher } from "./crypto.js";
+import { toMs } from "./duration.js";
+import { BexioOAuthError } from "./errors.js";
+import { createOidc } from "./oidc.js";
+import { safeReturnTo } from "./return-to.js";
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * One refresh makes up to three Bexio calls inside the lock: token (10 s), the
+ * JWKS fetch for the refreshed ID token (10 s), and the role (5 s).
+ */
+const MIN_LOCK_TTL_MS = 30_000;
+const isLoopbackHttp = (url) => url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+/** Validates the config (throws `invalid_config`) and builds the shared context. */
+export function resolveConfig(config) {
+    for (const key of ["clientId", "clientSecret", "redirectUri"]) {
+        if (!config[key])
+            throw new BexioOAuthError("invalid_config", `${key} is required`);
+    }
+    if (!config.store)
+        throw new BexioOAuthError("invalid_config", "store is required");
+    const cipher = new TokenCipher(config.keys);
+    const fetchImpl = config.fetch ?? fetch;
+    const issuer = config.issuer ?? BEXIO_ISSUER;
+    const redirectUri = new URL(config.redirectUri);
+    // Plain http only for local development: the flow cookie would otherwise
+    // travel without `Secure`.
+    if (redirectUri.protocol !== "https:" && !isLoopbackHttp(redirectUri)) {
+        throw new BexioOAuthError("invalid_config", "redirectUri must use https (http is allowed for loopback hosts only)");
+    }
+    const lockTtlMs = toMs(config.refreshLockTtl ?? "30s", "refreshLockTtl");
+    if (lockTtlMs < MIN_LOCK_TTL_MS) {
+        throw new BexioOAuthError("invalid_config", `refreshLockTtl must be at least ${MIN_LOCK_TTL_MS / 1000}s`);
+    }
+    const defaultReturnTo = safeReturnTo(config.defaultReturnTo, "/");
+    return {
+        clientId: config.clientId,
+        cipher,
+        store: config.store,
+        clock: config.clock ?? (() => new Date()),
+        fetchImpl,
+        oidc: createOidc({
+            issuer,
+            clientId: config.clientId,
+            clientSecret: config.clientSecret,
+            // http is allowed only for local mocks; real issuers must use https.
+            allowInsecure: isLoopbackHttp(new URL(issuer)),
+            fetchImpl,
+        }),
+        apiBaseUrl: config.apiBaseUrl ?? BEXIO_API_BASE_URL,
+        redirectUri,
+        scope: [...new Set([...BASE_SCOPES, ...(config.scopes ?? [])])].join(" "),
+        lockTtlMs,
+        defaultReturnTo,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAoB9C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE;;;GAGG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,EAAE,CAClC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAE/D,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,MAAwB;IACpD,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,CAAU,EAAE,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACd,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,GAAG,GAAG,cAAc,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK;QACf,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAEnE,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,yEAAyE;IACzE,2BAA2B;IAC3B,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACzE,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,mCAAmC,eAAe,GAAG,IAAI,GAAG,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAElE,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QACzC,SAAS;QACT,IAAI,EAAE,UAAU,CAAC;YACf,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,qEAAqE;YACrE,aAAa,EAAE,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,SAAS;SACV,CAAC;QACF,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,kBAAkB;QACnD,WAAW;QACX,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACzE,SAAS;QACT,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/dist/connect-flow.d.ts

@@ -0,0 +1,15 @@
+import type { ClientContext } from "./config.js";
+import type { CallbackOptions, CallbackResult } from "./types.js";
+/** `BexioOAuth.start`. */
+export declare function start(ctx: ClientContext, options: {
+    ownerId: string;
+    returnTo?: string;
+}): Promise<Response>;
+/** `BexioOAuth.handleCallback`. */
+export declare function handleCallback(ctx: ClientContext, request: Request, options: CallbackOptions): Promise<CallbackResult>;
+/**
+ * `BexioOAuth.callback`: reads the flow cookie once, so a failure can still
+ * redirect to the `returnTo` it recorded.
+ */
+export declare function callback(ctx: ClientContext, request: Request, options: CallbackOptions): Promise<Response>;
+//# sourceMappingURL=connect-flow.d.ts.map

package/dist/connect-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-flow.d.ts","sourceRoot":"","sources":["../src/connect-flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAajD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAElE,0BAA0B;AAC1B,wBAAsB,KAAK,CACzB,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,OAAO,CAAC,QAAQ,CAAC,CA8BnB;AAED,mCAAmC;AACnC,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAQzB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,QAAQ,CAAC,CAkBnB"}

package/dist/connect-flow.js

@@ -0,0 +1,123 @@
+import * as oidc from "openid-client";
+import { BexioOAuthError, isBexioOAuthError } from "./errors.js";
+import { FLOW_TTL_SECONDS, flowCookie, readFlow, sealFlow, } from "./flow-cookie.js";
+import { decodeIfJwt, saveTokens, toGrant, withUserInfo } from "./grants.js";
+import { describe } from "./oidc.js";
+import { tokenExpiry } from "./refresh.js";
+import { safeReturnTo } from "./return-to.js";
+/** `BexioOAuth.start`. */
+export async function start(ctx, options) {
+    if (!options?.ownerId)
+        throw new BexioOAuthError("invalid_config", "ownerId is required");
+    const returnTo = safeReturnTo(options.returnTo, ctx.defaultReturnTo);
+    const c = await ctx.oidc.config();
+    const verifier = oidc.randomPKCECodeVerifier();
+    const state = oidc.randomState();
+    const nonce = oidc.randomNonce();
+    const url = oidc.buildAuthorizationUrl(c, {
+        redirect_uri: ctx.redirectUri.href,
+        scope: ctx.scope,
+        code_challenge: await oidc.calculatePKCECodeChallenge(verifier),
+        code_challenge_method: "S256",
+        state,
+        nonce,
+    });
+    const sealed = await sealFlow(ctx.cipher, { s: state, v: verifier, n: nonce, o: options.ownerId, r: returnTo }, ctx.clock());
+    const headers = new Headers({
+        Location: url.href,
+        "Cache-Control": "no-store",
+    });
+    headers.append("Set-Cookie", flowCookie(ctx.redirectUri, sealed, FLOW_TTL_SECONDS));
+    return new Response(null, { status: 302, headers });
+}
+/** `BexioOAuth.handleCallback`. */
+export async function handleCallback(ctx, request, options) {
+    assertCallbackOptions(options);
+    return completeCallback(ctx, request, options, await readFlow(ctx.cipher, request, ctx.clock()));
+}
+/**
+ * `BexioOAuth.callback`: reads the flow cookie once, so a failure can still
+ * redirect to the `returnTo` it recorded.
+ */
+export async function callback(ctx, request, options) {
+    const headers = new Headers({ "Cache-Control": "no-store" });
+    headers.append("Set-Cookie", flowCookie(ctx.redirectUri, "", 0));
+    const origin = ctx.redirectUri.origin;
+    assertCallbackOptions(options);
+    const flow = await readFlow(ctx.cipher, request, ctx.clock());
+    let location;
+    try {
+        const result = await completeCallback(ctx, request, options, flow);
+        location = new URL(result.returnTo, origin);
+    }
+    catch (error) {
+        if (!isBexioOAuthError(error) || error.code === "invalid_config")
+            throw error;
+        location = new URL(flow?.r ?? ctx.defaultReturnTo, origin);
+        location.searchParams.set("bexio_error", error.code);
+    }
+    headers.set("Location", location.href);
+    return new Response(null, { status: 302, headers });
+}
+function assertCallbackOptions(options) {
+    if (!options ||
+        ("ownerId" in options
+            ? !options.ownerId
+            : typeof options.authorizeOwner !== "function")) {
+        throw new BexioOAuthError("invalid_config", "pass ownerId or authorizeOwner");
+    }
+}
+/** The callback after the flow cookie was read (`flow` is null when unreadable). */
+async function completeCallback(ctx, request, options, flow) {
+    const params = new URL(request.url).searchParams;
+    if (!flow || params.get("state") !== flow.s) {
+        throw new BexioOAuthError("state_mismatch", "flow cookie missing or expired, or state mismatch");
+    }
+    const ownerAllowed = "ownerId" in options
+        ? flow.o === options.ownerId
+        : (await options.authorizeOwner(flow.o)) === true;
+    if (!ownerAllowed) {
+        throw new BexioOAuthError("owner_mismatch", "the signed-in user may not connect Bexio for the owner used at start");
+    }
+    const error = params.get("error");
+    if (error) {
+        throw new BexioOAuthError(error === "access_denied" ? "access_denied" : "idp_error", `Bexio returned ${error}`);
+    }
+    // Rebuild the URL on the registered redirect URI, so a proxy that rewrites
+    // the host doesn't change the redirect_uri sent to the token endpoint.
+    const currentUrl = new URL(ctx.redirectUri.href);
+    currentUrl.search = params.toString();
+    const c = await ctx.oidc.config();
+    let tokens;
+    try {
+        tokens = await oidc.authorizationCodeGrant(c, currentUrl, {
+            pkceCodeVerifier: flow.v,
+            expectedState: flow.s,
+            expectedNonce: flow.n,
+            idTokenExpected: true,
+        });
+    }
+    catch (cause) {
+        if (cause instanceof oidc.AuthorizationResponseError) {
+            throw new BexioOAuthError(cause.error === "access_denied" ? "access_denied" : "idp_error", `Bexio returned ${cause.error}`, { cause: describe(cause) });
+        }
+        if (cause instanceof TypeError) {
+            throw new BexioOAuthError("idp_error", "Bexio token endpoint unreachable", { cause: describe(cause) });
+        }
+        throw new BexioOAuthError("invalid_callback", "authorization code exchange or ID token validation failed", { cause: describe(cause) });
+    }
+    const now = ctx.clock();
+    const claims = await withUserInfo(ctx, { ...decodeIfJwt(tokens.access_token), ...(tokens.claims() ?? {}) }, tokens.access_token);
+    const record = await saveTokens(ctx, {
+        ownerId: flow.o,
+        claims,
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token ?? null,
+        ...tokenExpiry(tokens, now),
+        scope: tokens.scope ?? null,
+    });
+    const headers = new Headers();
+    headers.append("Set-Cookie", flowCookie(ctx.redirectUri, "", 0));
+    return { grant: toGrant(record), returnTo: flow.r, headers };
+}
+//# sourceMappingURL=connect-flow.js.map

package/dist/connect-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-flow.js","sourceRoot":"","sources":["../src/connect-flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,QAAQ,EACR,QAAQ,GAET,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,WAAW,EAAsB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,0BAA0B;AAC1B,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,GAAkB,EAClB,OAA+C;IAE/C,IAAI,CAAC,OAAO,EAAE,OAAO;QACnB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE;QACxC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI;QAClC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;QAC/D,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,KAAK;KACN,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,GAAG,CAAC,MAAM,EACV,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EACpE,GAAG,CAAC,KAAK,EAAE,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,QAAQ,EAAE,GAAG,CAAC,IAAI;QAClB,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,CACtD,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAkB,EAClB,OAAgB,EAChB,OAAwB;IAExB,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,gBAAgB,CACrB,GAAG,EACH,OAAO,EACP,OAAO,EACP,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAkB,EAClB,OAAgB,EAChB,OAAwB;IAExB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC;IACtC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACnE,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAC9D,MAAM,KAAK,CAAC;QACd,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC3D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAwB;IACrD,IACE,CAAC,OAAO;QACR,CAAC,SAAS,IAAI,OAAO;YACnB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO;YAClB,CAAC,CAAC,OAAO,OAAO,CAAC,cAAc,KAAK,UAAU,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,gBAAgB,CAC7B,GAAkB,EAClB,OAAgB,EAChB,OAAwB,EACxB,IAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjD,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAChB,SAAS,IAAI,OAAO;QAClB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO;QAC5B,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IACtD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CACvB,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,EACzD,kBAAkB,KAAK,EAAE,CAC1B,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACjD,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAEtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAClC,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,UAAU,EAAE;YACxD,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACxB,aAAa,EAAE,IAAI,CAAC,CAAC;YACrB,aAAa,EAAE,IAAI,CAAC,CAAC;YACrB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CACvB,KAAK,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,EAC/D,kBAAkB,KAAK,CAAC,KAAK,EAAE,EAC/B,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,kCAAkC,EAClC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,2DAA2D,EAC3D,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,GAAG,EACH,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EACnE,MAAM,CAAC,YAAY,CACpB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;QACnC,OAAO,EAAE,IAAI,CAAC,CAAC;QACf,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;QAC1C,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/D,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,27 @@
+import type { JWTPayload } from "jose";
+/**
+ * Encryption keys, by key id. `current` is used for new writes; every key in
+ * `keys` can still decrypt. Keys are 32 random bytes, base64url-encoded
+ * (`npx @soulcode/bexio-oauth keygen`).
+ */
+export interface Keyring {
+    current: string;
+    keys: Record<string, string>;
+}
+/** A new random key for the keyring, base64url-encoded. */
+export declare function generateKey(): string;
+/**
+ * Encrypts tokens at rest as compact JWE (`dir` + `A256GCM`) and seals the
+ * short-lived flow cookie. The `bxg` protected header binds a token to the
+ * grant it belongs to, so ciphertext copied to another row fails to decrypt.
+ */
+export declare class TokenCipher {
+    #private;
+    constructor(keyring: Keyring);
+    encrypt(plaintext: string, binding: string): Promise<string>;
+    decrypt(jwe: string, binding: string): Promise<string>;
+    seal(payload: JWTPayload, ttlSeconds: number, now: Date): Promise<string>;
+    /** Returns the payload, or `null` when the value is invalid or expired. */
+    unseal(token: string, now: Date): Promise<JWTPayload | null>;
+}
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA8B,UAAU,EAAE,MAAM,MAAM,CAAC;AAGnE;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAUD,2DAA2D;AAC3D,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAMD;;;;GAIG;AACH,qBAAa,WAAW;;gBAKV,OAAO,EAAE,OAAO;IA6BtB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAW5D,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBtD,IAAI,CACR,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,MAAM,CAAC;IASlB,2EAA2E;IACrE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;CAyCnE"}