@soulcode/bexio-oauth 0.0.0-stage → 0.2.0

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { createBexioOAuth } from "./client.js";
+export type { AccessToken, BexioOAuth, BexioOAuthConfig, CallbackOptions, CallbackResult, ExternalTokens, Grant, GrantSelector, RefreshIdleResult, } from "./types.js";
+export { BASE_SCOPES, BEXIO_API_BASE_URL, BEXIO_ISSUER, mapClaims, type BexioIdentity, } from "./claims.js";
+export { generateKey, type Keyring } from "./crypto.js";
+export type { Duration } from "./duration.js";
+export { BexioOAuthError, isBexioOAuthError, type BexioOAuthErrorCode, } from "./errors.js";
+export { roleFromPermissions, type Role } from "./permissions.js";
+export { migrations, type Migration } from "./sql.js";
+export { memoryStore } from "./store/memory.js";
+export { postgresStore, type SqlClient } from "./store/postgres.js";
+export type { GrantRecord, GrantRefresh, GrantStatus, GrantStore, GrantUpsert, LockRequest, } from "./store/types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,cAAc,EACd,KAAK,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+export { createBexioOAuth } from "./client.js";
+export { BASE_SCOPES, BEXIO_API_BASE_URL, BEXIO_ISSUER, mapClaims, } from "./claims.js";
+export { generateKey } from "./crypto.js";
+export { BexioOAuthError, isBexioOAuthError, } from "./errors.js";
+export { roleFromPermissions } from "./permissions.js";
+export { migrations } from "./sql.js";
+export { memoryStore } from "./store/memory.js";
+export { postgresStore } from "./store/postgres.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAY/C,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,GAEV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AAExD,OAAO,EACL,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAa,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAkB,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC"}

package/dist/migrations.generated.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "./sql.js";
+export declare const MIGRATIONS: readonly Migration[];
+//# sourceMappingURL=migrations.generated.d.ts.map

package/dist/migrations.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.generated.d.ts","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,eAAO,MAAM,UAAU,EAAE,SAAS,SAAS,EAsC1C,CAAC"}

package/dist/migrations.generated.js

@@ -0,0 +1,40 @@
+export const MIGRATIONS = [
+    {
+        number: 1,
+        name: "0001_bexio_grants.sql",
+        sql: `-- @soulcode/bexio-oauth 0001: the grants table.
+-- One row per (owner, Bexio company, Bexio user). Token columns hold JWE
+-- ciphertext; only your server-side database role should be able to read them.
+
+CREATE TABLE IF NOT EXISTS bexio_grants (
+  id                    uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+  owner_id              text        NOT NULL,
+  bexio_company_id      text        NOT NULL,
+  bexio_user_id         text        NOT NULL,
+  bexio_company_user_id integer,
+  company_name          text,
+  user_name             text,
+  user_email            text,
+  role                  text        NOT NULL DEFAULT 'member' CHECK (role IN ('admin', 'member')),
+  status                text        NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'reauth_required')),
+  access_token          text        NOT NULL,
+  refresh_token         text,
+  access_expires_at     timestamptz,
+  refresh_expires_at    timestamptz,
+  scope                 text,
+  refresh_locked_until  timestamptz,
+  refresh_lock_token    text,
+  last_refreshed_at     timestamptz NOT NULL DEFAULT now(),
+  created_at            timestamptz NOT NULL DEFAULT now(),
+  updated_at            timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT bexio_grants_owner_company_user_key UNIQUE (owner_id, bexio_company_id, bexio_user_id)
+);
+
+-- refreshIdle(): active grants by last refresh.
+CREATE INDEX IF NOT EXISTS bexio_grants_idle_idx
+  ON bexio_grants (last_refreshed_at)
+  WHERE status = 'active';
+`,
+    },
+];
+//# sourceMappingURL=migrations.generated.js.map

package/dist/migrations.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.generated.js","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,UAAU,GAAyB;IAC9C;QACE,MAAM,EAAE,CAAC;QACT,IAAI,EAAE,uBAAuB;QAC7B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCR;KACE;CACF,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,30 @@
+import * as oidc from "openid-client";
+import { createRemoteJWKSet } from "jose";
+/** Per HTTP request to Bexio. Kept well below the default refresh lock TTL. */
+export declare const HTTP_TIMEOUT_SECONDS = 10;
+/**
+ * A safe summary of an upstream error for `BexioOAuthError.cause`: the OAuth
+ * error code and HTTP status, never response bodies or token values.
+ */
+export declare function describe(error: unknown): {
+    name: string;
+    error?: string;
+    status?: number;
+};
+export type KeySet = ReturnType<typeof createRemoteJWKSet>;
+/** Bexio's OIDC metadata and signing keys, loaded lazily. */
+export interface Oidc {
+    /** The discovered configuration; a failed discovery is retried on the next call. */
+    config(): Promise<oidc.Configuration>;
+    /** Bexio's signing keys (cached, refetched on an unknown key id). */
+    keySet(): Promise<KeySet>;
+}
+export declare function createOidc(options: {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    /** Allow plain http (local mocks only). */
+    allowInsecure: boolean;
+    fetchImpl: typeof fetch;
+}): Oidc;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAkC,MAAM,MAAM,CAAC;AAG1E,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAeA;AAED,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE3D,6DAA6D;AAC7D,MAAM,WAAW,IAAI;IACnB,oFAAoF;IACpF,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtC,qEAAqE;IACrE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,KAAK,CAAC;CACzB,GAAG,IAAI,CA+CP"}

package/dist/oidc.js

@@ -0,0 +1,67 @@
+import * as oidc from "openid-client";
+import { createRemoteJWKSet, customFetch as joseCustomFetch } from "jose";
+import { BexioOAuthError } from "./errors.js";
+/** Per HTTP request to Bexio. Kept well below the default refresh lock TTL. */
+export const HTTP_TIMEOUT_SECONDS = 10;
+/**
+ * A safe summary of an upstream error for `BexioOAuthError.cause`: the OAuth
+ * error code and HTTP status, never response bodies or token values.
+ */
+export function describe(error) {
+    if (error instanceof oidc.ResponseBodyError) {
+        return { name: error.name, error: error.error, status: error.status };
+    }
+    if (error instanceof oidc.AuthorizationResponseError) {
+        return { name: error.name, error: error.error };
+    }
+    if (error instanceof Error) {
+        const code = error.code;
+        return {
+            name: error.name,
+            ...(typeof code === "string" ? { error: code } : {}),
+        };
+    }
+    return { name: "unknown" };
+}
+export function createOidc(options) {
+    const { issuer, clientId, clientSecret, allowInsecure, fetchImpl } = options;
+    const issuerUrl = new URL(issuer);
+    const customFetch = (url, init) => fetchImpl(url, init);
+    let discovered;
+    function config() {
+        discovered ??= oidc
+            .discovery(issuerUrl, clientId, clientSecret, undefined, {
+            execute: allowInsecure ? [oidc.allowInsecureRequests] : [],
+            // Well below the refresh lock TTL, so a slow IdP can't outlive the lock.
+            timeout: HTTP_TIMEOUT_SECONDS,
+            [oidc.customFetch]: customFetch,
+        })
+            .then((c) => {
+            c[oidc.customFetch] = customFetch;
+            oidc.enableNonRepudiationChecks(c);
+            return c;
+        })
+            .catch((cause) => {
+            discovered = undefined;
+            throw new BexioOAuthError("idp_error", `OIDC discovery failed for ${issuer}`, { cause: describe(cause) });
+        });
+        return discovered;
+    }
+    // Cached, refetched on an unknown key id, with a timeout and a cooldown so a
+    // bad token can't hammer the issuer.
+    let jwks;
+    async function keySet() {
+        if (!jwks) {
+            const uri = (await config()).serverMetadata().jwks_uri;
+            if (!uri)
+                throw new BexioOAuthError("idp_error", "issuer publishes no jwks_uri");
+            jwks = createRemoteJWKSet(new URL(uri), {
+                timeoutDuration: HTTP_TIMEOUT_SECONDS * 1000,
+                [joseCustomFetch]: fetchImpl,
+            });
+        }
+        return jwks;
+    }
+    return { config, keySet };
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,MAAM,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IAKrC,IAAI,KAAK,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,YAAY,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAYD,MAAM,UAAU,UAAU,CAAC,OAO1B;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,IAAiB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE7E,IAAI,UAAmD,CAAC;IACxD,SAAS,MAAM;QACb,UAAU,KAAK,IAAI;aAChB,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE;YACvD,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE;YAC1D,yEAAyE;YACzE,OAAO,EAAE,oBAAoB;YAC7B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW;SAChC,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC;YAClC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,UAAU,GAAG,SAAS,CAAC;YACvB,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,6BAA6B,MAAM,EAAE,EACrC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,6EAA6E;IAC7E,qCAAqC;IACrC,IAAI,IAAwB,CAAC;IAC7B,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC;YACvD,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;YACzE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;gBACtC,eAAe,EAAE,oBAAoB,GAAG,IAAI;gBAC5C,CAAC,eAAe,CAAC,EAAE,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/permissions.d.ts

@@ -0,0 +1,9 @@
+export type Role = "admin" | "member";
+/** `admin` when Bexio reports `permissions.admin.activation === "enabled"`. */
+export declare function roleFromPermissions(body: unknown): Role;
+/**
+ * Reads the user's role from `GET /3.0/permissions`. Best effort: returns
+ * `null` on any failure so callers keep the previous role.
+ */
+export declare function fetchRole(fetchImpl: typeof fetch, apiBaseUrl: string, accessToken: string): Promise<Role | null>;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAC;AAMtC,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAIvD;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,OAAO,KAAK,EACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAetB"}

package/dist/permissions.js

@@ -0,0 +1,29 @@
+/** `admin` when Bexio reports `permissions.admin.activation === "enabled"`. */
+export function roleFromPermissions(body) {
+    const activation = body?.permissions?.admin
+        ?.activation;
+    return activation === "enabled" ? "admin" : "member";
+}
+/**
+ * Reads the user's role from `GET /3.0/permissions`. Best effort: returns
+ * `null` on any failure so callers keep the previous role.
+ */
+export async function fetchRole(fetchImpl, apiBaseUrl, accessToken) {
+    try {
+        const res = await fetchImpl(new URL("/3.0/permissions", apiBaseUrl), {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/json",
+            },
+            // Runs while the refresh lock is held: never wait long.
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok)
+            return null;
+        return roleFromPermissions(await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=permissions.js.map

package/dist/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAMA,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,MAAM,UAAU,GAAI,IAAmC,EAAE,WAAW,EAAE,KAAK;QACzE,EAAE,UAAU,CAAC;IACf,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAuB,EACvB,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,EAAE;YACnE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC3B;YACD,wDAAwD;YACxD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/refresh.d.ts

@@ -0,0 +1,30 @@
+import * as oidc from "openid-client";
+import type { ClientContext } from "./config.js";
+import type { GrantRecord } from "./store/types.js";
+import type { AccessToken, GrantSelector } from "./types.js";
+/** Refresh a little before the access token really expires. */
+export declare const EXPIRY_SKEW_MS = 30000;
+export type TokenResponse = oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers;
+/** Absolute expiries from a token response's `expires_in` / `refresh_expires_in`. */
+export declare function tokenExpiry(tokens: TokenResponse, now: Date): {
+    accessExpiresAt: Date | null;
+    refreshExpiresAt: Date | null;
+};
+/** True while the access token is valid for longer than the skew. */
+export declare function isFresh(record: GrantRecord, now: Date): boolean;
+/** A new lock holder's token and lease, starting at `now`. */
+export declare function lockWindow(ctx: ClientContext, now: Date): {
+    now: Date;
+    lockUntil: Date;
+    lockToken: `${string}-${string}-${string}-${string}-${string}`;
+};
+/**
+ * Refreshes a grant whose lock the caller holds (`lockToken`). Every write
+ * is fenced by the token: if the lock was lost (expired and taken over, or
+ * the grant was reconnected meanwhile), the write changes nothing and this
+ * returns `null`: the caller re-reads the grant.
+ */
+export declare function refreshLocked(ctx: ClientContext, record: GrantRecord, lockToken: string): Promise<GrantRecord | null>;
+/** `BexioOAuth.getAccessToken`. */
+export declare function getAccessToken(ctx: ClientContext, selector: GrantSelector): Promise<AccessToken>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../src/refresh.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE7D,+DAA+D;AAC/D,eAAO,MAAM,cAAc,QAAS,CAAC;AAIrC,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,GACpD,IAAI,CAAC,4BAA4B,CAAC;AAEpC,qFAAqF;AACrF,wBAAgB,WAAW,CACzB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,IAAI,GACR;IAAE,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAajE;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAK/D;AAED,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI;;;;EAMvD;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA0D7B;AAID,mCAAmC;AACnC,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,WAAW,CAAC,CAmDtB"}

package/dist/refresh.js

@@ -0,0 +1,139 @@
+import { randomUUID } from "node:crypto";
+import * as oidc from "openid-client";
+import { BexioOAuthError, isBexioOAuthError } from "./errors.js";
+import { bindingOf, decryptFor, issue, resolveGrant } from "./grants.js";
+import { describe } from "./oidc.js";
+import { fetchRole } from "./permissions.js";
+/** Refresh a little before the access token really expires. */
+export const EXPIRY_SKEW_MS = 30_000;
+/** Extra time `getAccessToken` waits for a concurrent refresh beyond the lock TTL. */
+const WAIT_GRACE_MS = 5_000;
+/** Absolute expiries from a token response's `expires_in` / `refresh_expires_in`. */
+export function tokenExpiry(tokens, now) {
+    const expiresIn = tokens.expiresIn();
+    const refreshExpiresIn = Number(tokens.refresh_expires_in);
+    return {
+        accessExpiresAt: expiresIn === undefined
+            ? null
+            : new Date(now.getTime() + expiresIn * 1000),
+        refreshExpiresAt: Number.isFinite(refreshExpiresIn) && refreshExpiresIn > 0
+            ? new Date(now.getTime() + refreshExpiresIn * 1000)
+            : null,
+    };
+}
+/** True while the access token is valid for longer than the skew. */
+export function isFresh(record, now) {
+    return (record.accessExpiresAt !== null &&
+        record.accessExpiresAt.getTime() - EXPIRY_SKEW_MS > now.getTime());
+}
+/** A new lock holder's token and lease, starting at `now`. */
+export function lockWindow(ctx, now) {
+    return {
+        now,
+        lockUntil: new Date(now.getTime() + ctx.lockTtlMs),
+        lockToken: randomUUID(),
+    };
+}
+/**
+ * Refreshes a grant whose lock the caller holds (`lockToken`). Every write
+ * is fenced by the token: if the lock was lost (expired and taken over, or
+ * the grant was reconnected meanwhile), the write changes nothing and this
+ * returns `null`: the caller re-reads the grant.
+ */
+export async function refreshLocked(ctx, record, lockToken) {
+    const { store, cipher, clock } = ctx;
+    if (!record.refreshToken) {
+        await store.markReauthRequired(record.id, lockToken, clock());
+        throw new BexioOAuthError("reauth_required", "grant has no refresh token; reconnect required");
+    }
+    let refreshToken;
+    try {
+        refreshToken = await decryptFor(cipher, record, record.refreshToken);
+    }
+    catch (error) {
+        // Usually a keyring mistake (a key removed too early): don't burn the
+        // grant, so restoring the key fixes it.
+        await store.releaseRefreshLock(record.id, lockToken);
+        throw error;
+    }
+    let tokens;
+    try {
+        tokens = await oidc.refreshTokenGrant(await ctx.oidc.config(), refreshToken);
+    }
+    catch (error) {
+        if (error instanceof oidc.ResponseBodyError &&
+            error.error === "invalid_grant") {
+            await store.markReauthRequired(record.id, lockToken, clock());
+            throw new BexioOAuthError("reauth_required", "Bexio rejected the refresh token; reconnect required", { cause: describe(error) });
+        }
+        await store.releaseRefreshLock(record.id, lockToken);
+        if (isBexioOAuthError(error))
+            throw error;
+        throw new BexioOAuthError("idp_error", "token refresh failed", {
+            cause: describe(error),
+        });
+    }
+    const now = clock();
+    const binding = bindingOf(record);
+    // null: lock lost while refreshing (someone reconnected, or our lock
+    // expired and another caller took over). Their write wins.
+    return store.saveRefreshed(record.id, lockToken, {
+        accessToken: await cipher.encrypt(tokens.access_token, binding),
+        refreshToken: tokens.refresh_token
+            ? await cipher.encrypt(tokens.refresh_token, binding)
+            : null,
+        ...tokenExpiry(tokens, now),
+        scope: tokens.scope ?? null,
+        role: await fetchRole(ctx.fetchImpl, ctx.apiBaseUrl, tokens.access_token),
+        now,
+    });
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** `BexioOAuth.getAccessToken`. */
+export async function getAccessToken(ctx, selector) {
+    const { store, clock } = ctx;
+    let record = await resolveGrant(store, selector);
+    const deadline = clock().getTime() + ctx.lockTtlMs + WAIT_GRACE_MS;
+    let wait = 50;
+    const reread = async (id) => {
+        const current = await store.getGrant(id);
+        if (!current)
+            throw new BexioOAuthError("not_connected", "grant was deleted");
+        return current;
+    };
+    for (;;) {
+        if (record.status === "reauth_required") {
+            throw new BexioOAuthError("reauth_required", "grant needs to be reconnected");
+        }
+        const now = clock();
+        if (isFresh(record, now))
+            return issue(ctx.cipher, record);
+        // Every iteration that would do more work is bounded, whether the last
+        // one waited for another refresher or lost its own lock.
+        if (now.getTime() > deadline) {
+            throw new BexioOAuthError("idp_error", "timed out waiting for a concurrent token refresh");
+        }
+        // Discovery outside the lock, so a cold start doesn't eat into it.
+        await ctx.oidc.config();
+        const window = lockWindow(ctx, clock());
+        const locked = await store.acquireRefreshLock({
+            id: record.id,
+            ...window,
+            accessExpiresBefore: new Date(now.getTime() + EXPIRY_SKEW_MS),
+        });
+        if (locked) {
+            const refreshed = await refreshLocked(ctx, locked, window.lockToken);
+            if (refreshed)
+                return issue(ctx.cipher, refreshed);
+            // Lost the lock to a reconnect or another refresher: look at their
+            // result before anything else (it may be fresh, or reauth_required).
+            record = await reread(record.id);
+            continue;
+        }
+        // Someone else is refreshing (or just did): wait for their result.
+        await sleep(wait);
+        wait = Math.min(wait * 2, 1_000);
+        record = await reread(record.id);
+    }
+}
+//# sourceMappingURL=refresh.js.map

package/dist/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../src/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,sFAAsF;AACtF,MAAM,aAAa,GAAG,KAAK,CAAC;AAK5B,qFAAqF;AACrF,MAAM,UAAU,WAAW,CACzB,MAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC3D,OAAO;QACL,eAAe,EACb,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QAChD,gBAAgB,EACd,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC;YACvD,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;YACnD,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,OAAO,CAAC,MAAmB,EAAE,GAAS;IACpD,OAAO,CACL,MAAM,CAAC,eAAe,KAAK,IAAI;QAC/B,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,GAAG,CAAC,OAAO,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,UAAU,CAAC,GAAkB,EAAE,GAAS;IACtD,OAAO;QACL,GAAG;QACH,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;QAClD,SAAS,EAAE,UAAU,EAAE;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAkB,EAClB,MAAmB,EACnB,SAAiB;IAEjB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,wCAAwC;QACxC,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACnC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EACvB,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,IAAI,CAAC,iBAAiB;YACvC,KAAK,CAAC,KAAK,KAAK,eAAe,EAC/B,CAAC;YACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,sDAAsD,EACtD,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,sBAAsB,EAAE;YAC7D,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,qEAAqE;IACrE,2DAA2D;IAC3D,OAAO,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE;QAC/C,WAAW,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC;QAC/D,YAAY,EAAE,MAAM,CAAC,aAAa;YAChC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC;YACrD,CAAC,CAAC,IAAI;QACR,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,IAAI,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC;QACzE,GAAG;KACJ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhF,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAkB,EAClB,QAAuB;IAEvB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAC7B,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,GAAG,aAAa,CAAC;IACnE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,MAAM,GAAG,KAAK,EAAE,EAAU,EAAE,EAAE;QAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,SAAS,CAAC;QACR,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3D,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,kDAAkD,CACnD,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC5C,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,GAAG,MAAM;YACT,mBAAmB,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrE,IAAI,SAAS;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACnD,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,mEAAmE;QACnE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;AACH,CAAC"}

package/dist/return-to.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Only same-origin relative paths: blocks open redirects via `returnTo`.
+ * Parsed with the URL parser (the same one the redirect will go through), so
+ * tricks like `/\t/evil.example` are caught, and normalized to path+query+hash.
+ * Returns `fallback` for an empty value; throws `invalid_config` otherwise.
+ */
+export declare function safeReturnTo(value: string | undefined, fallback: string): string;
+//# sourceMappingURL=return-to.d.ts.map

package/dist/return-to.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-to.d.ts","sourceRoot":"","sources":["../src/return-to.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,MAAM,GACf,MAAM,CAqBR"}

package/dist/return-to.js

@@ -0,0 +1,31 @@
+import { BexioOAuthError } from "./errors.js";
+const RETURN_TO_BASE = "https://return-to.invalid";
+/**
+ * Only same-origin relative paths: blocks open redirects via `returnTo`.
+ * Parsed with the URL parser (the same one the redirect will go through), so
+ * tricks like `/\t/evil.example` are caught, and normalized to path+query+hash.
+ * Returns `fallback` for an empty value; throws `invalid_config` otherwise.
+ */
+export function safeReturnTo(value, fallback) {
+    if (!value)
+        return fallback;
+    const invalid = () => new BexioOAuthError("invalid_config", "returnTo must be a relative path like /settings");
+    // eslint-disable-next-line no-control-regex
+    if (!value.startsWith("/") || /[\u0000-\u001f\\]/.test(value))
+        throw invalid();
+    let url;
+    try {
+        url = new URL(value, RETURN_TO_BASE);
+    }
+    catch {
+        throw invalid();
+    }
+    if (url.origin !== RETURN_TO_BASE)
+        throw invalid();
+    // Dot segments can collapse to "//host" (e.g. "/.//evil.example"), which a
+    // browser reads as protocol-relative: check the normalized result too.
+    if (url.pathname.startsWith("//"))
+        throw invalid();
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+//# sourceMappingURL=return-to.js.map

package/dist/return-to.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-to.js","sourceRoot":"","sources":["../src/return-to.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAyB,EACzB,QAAgB;IAEhB,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,eAAe,CACjB,gBAAgB,EAChB,iDAAiD,CAClD,CAAC;IACJ,4CAA4C;IAC5C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3D,MAAM,OAAO,EAAE,CAAC;IAClB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc;QAAE,MAAM,OAAO,EAAE,CAAC;IACnD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACnD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC"}

package/dist/sql.d.ts

@@ -0,0 +1,14 @@
+export interface Migration {
+    /** Sequence number, from the file name prefix (`0001_…` → 1). */
+    number: number;
+    name: string;
+    sql: string;
+}
+/**
+ * The schema migrations shipped with this version, in order.
+ *
+ * The SQL is embedded in the build (generated from `sql/*.sql`), not read from
+ * disk, so this works unchanged when a bundler inlines the library.
+ */
+export declare function migrations(): Promise<Migration[]>;
+//# sourceMappingURL=sql.d.ts.map

package/dist/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAEvD"}

package/dist/sql.js

@@ -0,0 +1,11 @@
+import { MIGRATIONS } from "./migrations.generated.js";
+/**
+ * The schema migrations shipped with this version, in order.
+ *
+ * The SQL is embedded in the build (generated from `sql/*.sql`), not read from
+ * disk, so this works unchanged when a bundler inlines the library.
+ */
+export async function migrations() {
+    return MIGRATIONS.map((m) => ({ ...m }));
+}
+//# sourceMappingURL=sql.js.map

package/dist/sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AASvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/store/memory.d.ts

@@ -0,0 +1,7 @@
+import type { GrantStore } from "./types.js";
+/**
+ * In-memory store for tests. Same semantics as `postgresStore`, but data
+ * lives in this process only.
+ */
+export declare function memoryStore(): GrantStore;
+//# sourceMappingURL=memory.d.ts.map

package/dist/store/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/store/memory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAGV,UAAU,EAGX,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,wBAAgB,WAAW,IAAI,UAAU,CAgHxC"}

package/dist/store/memory.js

@@ -0,0 +1,104 @@
+import { randomUUID } from "node:crypto";
+/**
+ * In-memory store for tests. Same semantics as `postgresStore`, but data
+ * lives in this process only.
+ */
+export function memoryStore() {
+    const rows = new Map();
+    const lockTokens = new Map();
+    const copy = (row) => ({ ...row });
+    return {
+        async upsertGrant(input) {
+            const existing = [...rows.values()].find((r) => r.ownerId === input.ownerId &&
+                r.companyId === input.companyId &&
+                r.userId === input.userId);
+            const { now, ...fields } = input;
+            const row = {
+                id: existing?.id ?? randomUUID(),
+                ...fields,
+                status: "active",
+                refreshLockedUntil: null,
+                lastRefreshedAt: now,
+                createdAt: existing?.createdAt ?? now,
+                updatedAt: now,
+            };
+            rows.set(row.id, row);
+            lockTokens.delete(row.id);
+            return copy(row);
+        },
+        async findGrants({ ownerId, companyId, grantId }) {
+            return [...rows.values()]
+                .filter((r) => r.ownerId === ownerId &&
+                (companyId === undefined || r.companyId === companyId) &&
+                (grantId === undefined || r.id === grantId))
+                .sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime())
+                .map(copy);
+        },
+        async getGrant(id) {
+            const row = rows.get(id);
+            return row ? copy(row) : null;
+        },
+        async acquireRefreshLock(req) {
+            const row = rows.get(req.id);
+            if (!row || row.status !== "active")
+                return null;
+            if (row.refreshLockedUntil && row.refreshLockedUntil > req.now)
+                return null;
+            const needsRefresh = (req.accessExpiresBefore !== undefined &&
+                (row.accessExpiresAt === null ||
+                    row.accessExpiresAt <= req.accessExpiresBefore)) ||
+                (req.refreshedBefore !== undefined &&
+                    row.lastRefreshedAt < req.refreshedBefore);
+            if (!needsRefresh)
+                return null;
+            row.refreshLockedUntil = req.lockUntil;
+            lockTokens.set(row.id, req.lockToken);
+            return copy(row);
+        },
+        async saveRefreshed(id, lockToken, refresh) {
+            const row = rows.get(id);
+            if (!row || lockTokens.get(id) !== lockToken)
+                return null;
+            lockTokens.delete(id);
+            row.accessToken = refresh.accessToken;
+            row.refreshToken = refresh.refreshToken ?? row.refreshToken;
+            row.accessExpiresAt = refresh.accessExpiresAt;
+            row.refreshExpiresAt = refresh.refreshExpiresAt ?? row.refreshExpiresAt;
+            row.scope = refresh.scope ?? row.scope;
+            row.role = refresh.role ?? row.role;
+            row.status = "active";
+            row.refreshLockedUntil = null;
+            row.lastRefreshedAt = refresh.now;
+            row.updatedAt = refresh.now;
+            return copy(row);
+        },
+        async markReauthRequired(id, lockToken, now) {
+            const row = rows.get(id);
+            if (!row || lockTokens.get(id) !== lockToken)
+                return;
+            lockTokens.delete(id);
+            row.status = "reauth_required";
+            row.refreshLockedUntil = null;
+            row.updatedAt = now;
+        },
+        async releaseRefreshLock(id, lockToken) {
+            const row = rows.get(id);
+            if (!row || lockTokens.get(id) !== lockToken)
+                return;
+            lockTokens.delete(id);
+            row.refreshLockedUntil = null;
+        },
+        async deleteGrant(id) {
+            rows.delete(id);
+            lockTokens.delete(id);
+        },
+        async listIdleGrants({ refreshedBefore, limit }) {
+            return [...rows.values()]
+                .filter((r) => r.status === "active" && r.lastRefreshedAt < refreshedBefore)
+                .sort((a, b) => a.lastRefreshedAt.getTime() - b.lastRefreshedAt.getTime())
+                .slice(0, limit)
+                .map(copy);
+        },
+    };
+}
+//# sourceMappingURL=memory.js.map