@soulcode/bexio-oauth 0.0.0-stage → 0.2.0

package/dist/store/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/store/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAgB,EAAe,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IAE7D,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,KAAkB;YAClC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAC3B,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBAC/B,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAC5B,CAAC;YACF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC;YACjC,MAAM,GAAG,GAAgB;gBACvB,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,UAAU,EAAE;gBAChC,GAAG,MAAM;gBACT,MAAM,EAAE,QAAQ;gBAChB,kBAAkB,EAAE,IAAI;gBACxB,eAAe,EAAE,GAAG;gBACpB,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;gBACrC,SAAS,EAAE,GAAG;aACf,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACtB,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;YAC9C,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;iBACtB,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,OAAO;gBACrB,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;gBACtD,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAC9C;iBACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;iBAC7D,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,GAAgB;YACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,GAAG;gBAC5D,OAAO,IAAI,CAAC;YACd,MAAM,YAAY,GAChB,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,GAAG,CAAC,eAAe,KAAK,IAAI;oBAC3B,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBACpD,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS;oBAChC,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;YAC/C,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAC/B,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,SAAS,CAAC;YACvC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAqB;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC1D,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACtC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC;YAC5D,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;YAC9C,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,CAAC;YACxE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;YACvC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;YACpC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;YACtB,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC9B,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC;YAClC,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,OAAO;YACrD,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,GAAG,CAAC,MAAM,GAAG,iBAAiB,CAAC;YAC/B,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC9B,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,OAAO;YACrD,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;YAC7C,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;iBACtB,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,GAAG,eAAe,CACpE;iBACA,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,CACpE;iBACA,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/store/postgres.d.ts

@@ -0,0 +1,17 @@
+import type { GrantStore } from "./types.js";
+/**
+ * The only thing the Postgres store needs from a driver. A `pg` `Pool` or
+ * `Client` matches it as is; other drivers need a few lines of wrapper.
+ */
+export interface SqlClient {
+    query(text: string, params?: unknown[]): Promise<{
+        rows: unknown[];
+    }>;
+}
+/**
+ * Grant store on the `bexio_grants` table (create it with
+ * `npx @soulcode/bexio-oauth sql`). Every operation is a single statement,
+ * so it works through transaction-mode poolers and HTTP drivers.
+ */
+export declare function postgresStore(sql: SqlClient): GrantStore;
+//# sourceMappingURL=postgres.d.ts.map

package/dist/store/postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/store/postgres.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CACvE;AAoED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CA0KxD"}

package/dist/store/postgres.js

@@ -0,0 +1,177 @@
+import { BexioOAuthError } from "../errors.js";
+// `id` is a uuid column: any other value matches no row, and would make
+// Postgres reject the cast instead of returning nothing.
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const COLUMNS = `id, owner_id, bexio_company_id, bexio_user_id, bexio_company_user_id,
+  company_name, user_name, user_email, role, status, access_token, refresh_token,
+  access_expires_at, refresh_expires_at, scope, refresh_locked_until,
+  last_refreshed_at, created_at, updated_at`;
+function date(value) {
+    if (value === null)
+        return null;
+    return value instanceof Date ? value : new Date(value);
+}
+function toRecord(row) {
+    return {
+        id: row.id,
+        ownerId: row.owner_id,
+        companyId: row.bexio_company_id,
+        userId: row.bexio_user_id,
+        companyUserId: row.bexio_company_user_id === null
+            ? null
+            : Number(row.bexio_company_user_id),
+        companyName: row.company_name,
+        userName: row.user_name,
+        userEmail: row.user_email,
+        role: row.role,
+        status: row.status,
+        accessToken: row.access_token,
+        refreshToken: row.refresh_token,
+        accessExpiresAt: date(row.access_expires_at),
+        refreshExpiresAt: date(row.refresh_expires_at),
+        scope: row.scope,
+        refreshLockedUntil: date(row.refresh_locked_until),
+        lastRefreshedAt: date(row.last_refreshed_at),
+        createdAt: date(row.created_at),
+        updatedAt: date(row.updated_at),
+    };
+}
+/**
+ * Grant store on the `bexio_grants` table (create it with
+ * `npx @soulcode/bexio-oauth sql`). Every operation is a single statement,
+ * so it works through transaction-mode poolers and HTTP drivers.
+ */
+export function postgresStore(sql) {
+    const one = async (text, params) => {
+        const { rows } = await sql.query(text, params);
+        return rows[0] ? toRecord(rows[0]) : null;
+    };
+    const many = async (text, params) => {
+        const { rows } = await sql.query(text, params);
+        return rows.map(toRecord);
+    };
+    return {
+        async upsertGrant(g) {
+            const row = await one(`INSERT INTO bexio_grants (owner_id, bexio_company_id, bexio_user_id,
+           bexio_company_user_id, company_name, user_name, user_email, role, status,
+           access_token, refresh_token, access_expires_at, refresh_expires_at, scope,
+           refresh_locked_until, last_refreshed_at, created_at, updated_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'active', $9, $10, $11, $12, $13, NULL, $14, $14, $14)
+         ON CONFLICT (owner_id, bexio_company_id, bexio_user_id) DO UPDATE SET
+           bexio_company_user_id = EXCLUDED.bexio_company_user_id,
+           company_name = EXCLUDED.company_name,
+           user_name = EXCLUDED.user_name,
+           user_email = EXCLUDED.user_email,
+           role = EXCLUDED.role,
+           status = 'active',
+           access_token = EXCLUDED.access_token,
+           refresh_token = EXCLUDED.refresh_token,
+           access_expires_at = EXCLUDED.access_expires_at,
+           refresh_expires_at = EXCLUDED.refresh_expires_at,
+           scope = EXCLUDED.scope,
+           refresh_locked_until = NULL,
+           refresh_lock_token = NULL,
+           last_refreshed_at = EXCLUDED.last_refreshed_at,
+           updated_at = EXCLUDED.updated_at
+         RETURNING ${COLUMNS}`, [
+                g.ownerId,
+                g.companyId,
+                g.userId,
+                g.companyUserId,
+                g.companyName,
+                g.userName,
+                g.userEmail,
+                g.role,
+                g.accessToken,
+                g.refreshToken,
+                g.accessExpiresAt,
+                g.refreshExpiresAt,
+                g.scope,
+                g.now,
+            ]);
+            if (!row) {
+                throw new BexioOAuthError("invalid_config", "SqlClient returned no row for INSERT … RETURNING; check the driver wrapper");
+            }
+            return row;
+        },
+        async findGrants({ ownerId, companyId, grantId }) {
+            if (grantId !== undefined && !UUID.test(grantId))
+                return [];
+            return many(`SELECT ${COLUMNS} FROM bexio_grants
+         WHERE owner_id = $1
+           AND ($2::text IS NULL OR bexio_company_id = $2)
+           AND ($3::uuid IS NULL OR id = $3::uuid)
+         ORDER BY created_at, id`, [ownerId, companyId ?? null, grantId ?? null]);
+        },
+        async getGrant(id) {
+            if (!UUID.test(id))
+                return null;
+            return one(`SELECT ${COLUMNS} FROM bexio_grants WHERE id = $1`, [id]);
+        },
+        async acquireRefreshLock({ id, now, lockUntil, lockToken, accessExpiresBefore, refreshedBefore, }) {
+            return one(`UPDATE bexio_grants SET refresh_locked_until = $3, refresh_lock_token = $6
+         WHERE id = $1
+           AND status = 'active'
+           AND (refresh_locked_until IS NULL OR refresh_locked_until <= $2)
+           AND (
+             ($4::timestamptz IS NOT NULL AND (access_expires_at IS NULL OR access_expires_at <= $4))
+             OR ($5::timestamptz IS NOT NULL AND last_refreshed_at < $5)
+           )
+         RETURNING ${COLUMNS}`, [
+                id,
+                now,
+                lockUntil,
+                accessExpiresBefore ?? null,
+                refreshedBefore ?? null,
+                lockToken,
+            ]);
+        },
+        // Holder writes are fenced by refresh_lock_token: a holder whose lock
+        // expired or was cleared by a reconnect matches no row and changes nothing.
+        async saveRefreshed(id, lockToken, r) {
+            return one(`UPDATE bexio_grants SET
+           access_token = $2,
+           refresh_token = COALESCE($3, refresh_token),
+           access_expires_at = $4,
+           refresh_expires_at = COALESCE($5, refresh_expires_at),
+           scope = COALESCE($6, scope),
+           role = COALESCE($7, role),
+           status = 'active',
+           refresh_locked_until = NULL,
+           refresh_lock_token = NULL,
+           last_refreshed_at = $8,
+           updated_at = $8
+         WHERE id = $1 AND refresh_lock_token = $9
+         RETURNING ${COLUMNS}`, [
+                id,
+                r.accessToken,
+                r.refreshToken,
+                r.accessExpiresAt,
+                r.refreshExpiresAt,
+                r.scope,
+                r.role,
+                r.now,
+                lockToken,
+            ]);
+        },
+        async markReauthRequired(id, lockToken, now) {
+            await sql.query(`UPDATE bexio_grants SET status = 'reauth_required',
+           refresh_locked_until = NULL, refresh_lock_token = NULL, updated_at = $2
+         WHERE id = $1 AND refresh_lock_token = $3`, [id, now, lockToken]);
+        },
+        async releaseRefreshLock(id, lockToken) {
+            await sql.query(`UPDATE bexio_grants SET refresh_locked_until = NULL, refresh_lock_token = NULL
+         WHERE id = $1 AND refresh_lock_token = $2`, [id, lockToken]);
+        },
+        async deleteGrant(id) {
+            await sql.query(`DELETE FROM bexio_grants WHERE id = $1`, [id]);
+        },
+        async listIdleGrants({ refreshedBefore, limit }) {
+            return many(`SELECT ${COLUMNS} FROM bexio_grants
+         WHERE status = 'active' AND last_refreshed_at < $1
+         ORDER BY last_refreshed_at
+         LIMIT $2`, [refreshedBefore, limit]);
+        },
+    };
+}
+//# sourceMappingURL=postgres.js.map

package/dist/store/postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../src/store/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAW/C,wEAAwE;AACxE,yDAAyD;AACzD,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,MAAM,OAAO,GAAG;;;4CAG4B,CAAC;AA2B7C,SAAS,IAAI,CAAC,KAA2B;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAQ;IACxB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,SAAS,EAAE,GAAG,CAAC,gBAAgB;QAC/B,MAAM,EAAE,GAAG,CAAC,aAAa;QACzB,aAAa,EACX,GAAG,CAAC,qBAAqB,KAAK,IAAI;YAChC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACvC,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC9C,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClD,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAQ,IAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,CAAC;YACjB,MAAM,GAAG,GAAG,MAAM,GAAG,CACnB;;;;;;;;;;;;;;;;;;;;;qBAqBa,OAAO,EAAE,EACtB;gBACE,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG;aACN,CACF,CAAC;YACF,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;YAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC5D,OAAO,IAAI,CACT,UAAU,OAAO;;;;iCAIQ,EACzB,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,CAC9C,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,GAAG,CAAC,UAAU,OAAO,kCAAkC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,EAAE,EACF,GAAG,EACH,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,eAAe,GAChB;YACC,OAAO,GAAG,CACR;;;;;;;;qBAQa,OAAO,EAAE,EACtB;gBACE,EAAE;gBACF,GAAG;gBACH,SAAS;gBACT,mBAAmB,IAAI,IAAI;gBAC3B,eAAe,IAAI,IAAI;gBACvB,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,4EAA4E;QAC5E,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;YAClC,OAAO,GAAG,CACR;;;;;;;;;;;;;qBAaa,OAAO,EAAE,EACtB;gBACE,EAAE;gBACF,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,GAAG;gBACL,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG;YACzC,MAAM,GAAG,CAAC,KAAK,CACb;;mDAE2C,EAC3C,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CACrB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS;YACpC,MAAM,GAAG,CAAC,KAAK,CACb;mDAC2C,EAC3C,CAAC,EAAE,EAAE,SAAS,CAAC,CAChB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,MAAM,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;YAC7C,OAAO,IAAI,CACT,UAAU,OAAO;;;kBAGP,EACV,CAAC,eAAe,EAAE,KAAK,CAAC,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/store/types.d.ts

@@ -0,0 +1,105 @@
+import type { Role } from "../permissions.js";
+export type GrantStatus = "active" | "reauth_required";
+/** A stored grant. Token fields hold JWE ciphertext, never plaintext. */
+export interface GrantRecord {
+    id: string;
+    ownerId: string;
+    companyId: string;
+    userId: string;
+    companyUserId: number | null;
+    companyName: string | null;
+    userName: string | null;
+    userEmail: string | null;
+    role: Role;
+    status: GrantStatus;
+    accessToken: string;
+    refreshToken: string | null;
+    accessExpiresAt: Date | null;
+    refreshExpiresAt: Date | null;
+    scope: string | null;
+    refreshLockedUntil: Date | null;
+    lastRefreshedAt: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** Insert, or overwrite the tokens of, the grant for (owner, company, user). */
+export interface GrantUpsert {
+    ownerId: string;
+    companyId: string;
+    userId: string;
+    companyUserId: number | null;
+    companyName: string | null;
+    userName: string | null;
+    userEmail: string | null;
+    role: Role;
+    accessToken: string;
+    refreshToken: string | null;
+    accessExpiresAt: Date | null;
+    refreshExpiresAt: Date | null;
+    scope: string | null;
+    now: Date;
+}
+export interface GrantRefresh {
+    accessToken: string;
+    /** `null` keeps the stored refresh token (the IdP didn't rotate it). */
+    refreshToken: string | null;
+    accessExpiresAt: Date | null;
+    /** `null` keeps the stored value. */
+    refreshExpiresAt: Date | null;
+    /** `null` keeps the stored value. */
+    scope: string | null;
+    /** `null` keeps the stored role. */
+    role: Role | null;
+    now: Date;
+}
+export interface LockRequest {
+    id: string;
+    now: Date;
+    lockUntil: Date;
+    /**
+     * Random value identifying this lock holder. Writes that need the lock pass
+     * it back, so a holder whose lock expired (or was cleared by a reconnect)
+     * can't overwrite newer data.
+     */
+    lockToken: string;
+    /** Lock only if the access token expires before this instant (lazy refresh)… */
+    accessExpiresBefore?: Date;
+    /** …or only if the grant was last refreshed before this instant (idle sweep). */
+    refreshedBefore?: Date;
+}
+/**
+ * Persistence for grants. Every method must be atomic on its own: the
+ * library never needs multi-statement transactions.
+ */
+export interface GrantStore {
+    upsertGrant(input: GrantUpsert): Promise<GrantRecord>;
+    findGrants(query: {
+        ownerId: string;
+        companyId?: string;
+        grantId?: string;
+    }): Promise<GrantRecord[]>;
+    getGrant(id: string): Promise<GrantRecord | null>;
+    /**
+     * Takes the refresh lock if the grant is active, not locked (or the lock
+     * expired), and still matches the `accessExpiresBefore` / `refreshedBefore`
+     * condition. Returns the locked row, or `null` if someone else holds the
+     * lock or the grant no longer needs a refresh.
+     */
+    acquireRefreshLock(request: LockRequest): Promise<GrantRecord | null>;
+    /**
+     * Stores refreshed tokens, sets `lastRefreshedAt`, and releases the lock.
+     * Returns `null` (and changes nothing) unless `lockToken` still holds it.
+     */
+    saveRefreshed(id: string, lockToken: string, refresh: GrantRefresh): Promise<GrantRecord | null>;
+    /** Sets `status = reauth_required` and releases the lock, if `lockToken` holds it. */
+    markReauthRequired(id: string, lockToken: string, now: Date): Promise<void>;
+    /** Releases the lock, if `lockToken` holds it. */
+    releaseRefreshLock(id: string, lockToken: string): Promise<void>;
+    deleteGrant(id: string): Promise<void>;
+    /** Active grants last refreshed before `refreshedBefore`, oldest first. */
+    listIdleGrants(query: {
+        refreshedBefore: Date;
+        limit: number;
+    }): Promise<GrantRecord[]>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/store/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAEvD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,qCAAqC;IACrC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,qCAAqC;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oCAAoC;IACpC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,IAAI,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,IAAI,CAAC;IAC3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,IAAI,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,UAAU,CAAC,KAAK,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAClD;;;;;OAKG;IACH,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,aAAa,CACX,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC/B,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,2EAA2E;IAC3E,cAAc,CAAC,KAAK,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAC5B"}

package/dist/store/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/store/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":""}

package/dist/types.d.ts

@@ -0,0 +1,150 @@
+import type { Keyring } from "./crypto.js";
+import type { Duration } from "./duration.js";
+import type { Role } from "./permissions.js";
+import type { GrantStatus, GrantStore } from "./store/types.js";
+export interface BexioOAuthConfig {
+    /** From your Bexio OAuth app. */
+    clientId: string;
+    clientSecret: string;
+    /** Must exactly match a redirect URI registered at Bexio. */
+    redirectUri: string;
+    /** Bexio API scopes your app needs; `BASE_SCOPES` are always added. */
+    scopes?: string[];
+    /** Encryption keyring (see `generateKey`). */
+    keys: Keyring;
+    store: GrantStore;
+    /** Defaults to Bexio's production issuer. Override only to point at a mock. */
+    issuer?: string;
+    /** Defaults to `https://api.bexio.com`. Override only to point at a mock. */
+    apiBaseUrl?: string;
+    /** How long one refresh may hold a grant's lock. Default `"30s"`. */
+    refreshLockTtl?: Duration;
+    /** Where `callback` redirects when the flow cookie is gone. Default `"/"`. */
+    defaultReturnTo?: string;
+    /** Custom `fetch` for every outgoing request (tests, proxies). */
+    fetch?: typeof fetch;
+    /** Clock override for tests. */
+    clock?: () => Date;
+}
+/** A grant as the app sees it: no token material. */
+export interface Grant {
+    id: string;
+    ownerId: string;
+    companyId: string;
+    companyName: string | null;
+    userId: string;
+    userName: string | null;
+    userEmail: string | null;
+    companyUserId: number | null;
+    role: Role;
+    status: GrantStatus;
+    scope: string | null;
+    accessExpiresAt: Date | null;
+    lastRefreshedAt: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** Identifies one grant of an owner. */
+export interface GrantSelector {
+    ownerId: string;
+    companyId?: string;
+    grantId?: string;
+}
+export interface AccessToken {
+    accessToken: string;
+    expiresAt: Date | null;
+    grant: Grant;
+}
+/** Tokens obtained by your auth framework, for `saveGrant`. */
+export interface ExternalTokens {
+    accessToken: string;
+    refreshToken?: string | null;
+    idToken?: string | null;
+    /** Access-token expiry; defaults to the access token's `exp` claim. */
+    expiresAt?: Date | null;
+    scope?: string | null;
+}
+export interface RefreshIdleResult {
+    refreshed: number;
+    /** Idle grants another process was refreshing at the same time. */
+    skipped: number;
+    reauthRequired: number;
+    failed: number;
+    /**
+     * Idle grants not attempted because `timeBudget` ran out (0 when every idle
+     * grant of this run was attempted). The next run picks them up first.
+     */
+    remaining: number;
+}
+/**
+ * How the callback checks the owner. Either the `ownerId` your app derives
+ * from the signed-in session (must equal the one passed to `start`), or
+ * `authorizeOwner`, which receives the owner recorded at `start` and returns
+ * whether the signed-in user may connect Bexio for it. Use the latter when
+ * one callback URL serves many owners (e.g. workspaces).
+ */
+export type CallbackOptions = {
+    ownerId: string;
+} | {
+    authorizeOwner: (ownerId: string) => boolean | Promise<boolean>;
+};
+export interface CallbackResult {
+    grant: Grant;
+    returnTo: string;
+    /** Contains the `Set-Cookie` that deletes the flow cookie; copy it onto your response. */
+    headers: Headers;
+}
+/** The client returned by `createBexioOAuth`. */
+export interface BexioOAuth {
+    /**
+     * Starts the Connect flow: returns a redirect to Bexio that sets the
+     * encrypted flow cookie. Derive `ownerId` from your authenticated session.
+     * `returnTo` must be a relative path (default: `defaultReturnTo`).
+     */
+    start(options: {
+        ownerId: string;
+        returnTo?: string;
+    }): Promise<Response>;
+    /**
+     * Handles the redirect back from Bexio, saves the grant, and redirects to
+     * `returnTo` (or `returnTo?bexio_error=<code>` on failure). Only
+     * `invalid_config` and non-library errors are thrown.
+     */
+    callback(request: Request, options: CallbackOptions): Promise<Response>;
+    /**
+     * Handles the redirect back from Bexio and saves the grant. Throws a
+     * `BexioOAuthError` on failure; use `callback` for a ready-made redirect.
+     */
+    handleCallback(request: Request, options: CallbackOptions): Promise<CallbackResult>;
+    /**
+     * Saves tokens obtained by your auth framework ("Sign in with Bexio").
+     * Verifies the tokens' signatures against Bexio's keys first.
+     */
+    saveGrant(input: {
+        ownerId: string;
+        tokens: ExternalTokens;
+    }): Promise<Grant>;
+    /**
+     * A valid access token for the owner's grant, refreshed when needed.
+     * Safe to call from background jobs and from many instances at once.
+     */
+    getAccessToken(selector: GrantSelector): Promise<AccessToken>;
+    /** The owner's grants, without token material. */
+    listGrants(query: {
+        ownerId: string;
+    }): Promise<Grant[]>;
+    /** Revokes the refresh token at Bexio (best effort) and deletes the grant. */
+    disconnect(selector: GrantSelector): Promise<void>;
+    /**
+     * Refreshes active grants not refreshed for `idleFor`, so Bexio doesn't end
+     * their offline sessions. Run it on a schedule. `limit` (default 100) caps
+     * the grants one run looks at; `timeBudget` stops the run before the next
+     * grant once that much time has passed.
+     */
+    refreshIdle(options: {
+        idleFor: Duration;
+        limit?: number;
+        timeBudget?: Duration;
+    }): Promise<RefreshIdleResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,cAAc,CAAC,EAAE,QAAQ,CAAC;IAC1B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB;AAED,qDAAqD;AACrD,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;CACd;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE1E;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExE;;;OAGG;IACH,cAAc,CACZ,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9E;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAE9D,kDAAkD;IAClD,UAAU,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAEzD,8EAA8E;IAC9E,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,OAAO,EAAE,QAAQ,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,QAAQ,CAAC;KACvB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,62 @@
 {
   "name": "@soulcode/bexio-oauth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Bexio OAuth token custody for Node apps: connect Bexio accounts, store tokens encrypted in Postgres, get a valid access token anywhere.",
+  "keywords": [
+    "bexio",
+    "oauth",
+    "oidc",
+    "openid-connect",
+    "postgres",
+    "token"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SoulcodeAgency/bexio-oauth.git",
+    "directory": "packages/bexio-oauth"
+  },
+  "homepage": "https://github.com/SoulcodeAgency/bexio-oauth/blob/main/docs/integration.md",
+  "bugs": "https://github.com/SoulcodeAgency/bexio-oauth/issues",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "bexio-oauth": "./dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "sql"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "sql:generate": "node ../../scripts/generate-migrations.mjs",
+    "prebuild": "node ../../scripts/generate-migrations.mjs --check",
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "jose": "^6.2.13",
+    "openid-client": "^6.8.8"
+  },
+  "devDependencies": {
+    "@types/pg": "8.23.1",
+    "mock-bexio": "*",
+    "pg": "8.23.1",
+    "vitest": "5.0.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/sql/0001_bexio_grants.sql

@@ -0,0 +1,32 @@
+-- @soulcode/bexio-oauth 0001: the grants table.
+-- One row per (owner, Bexio company, Bexio user). Token columns hold JWE
+-- ciphertext; only your server-side database role should be able to read them.
+
+CREATE TABLE IF NOT EXISTS bexio_grants (
+  id                    uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+  owner_id              text        NOT NULL,
+  bexio_company_id      text        NOT NULL,
+  bexio_user_id         text        NOT NULL,
+  bexio_company_user_id integer,
+  company_name          text,
+  user_name             text,
+  user_email            text,
+  role                  text        NOT NULL DEFAULT 'member' CHECK (role IN ('admin', 'member')),
+  status                text        NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'reauth_required')),
+  access_token          text        NOT NULL,
+  refresh_token         text,
+  access_expires_at     timestamptz,
+  refresh_expires_at    timestamptz,
+  scope                 text,
+  refresh_locked_until  timestamptz,
+  refresh_lock_token    text,
+  last_refreshed_at     timestamptz NOT NULL DEFAULT now(),
+  created_at            timestamptz NOT NULL DEFAULT now(),
+  updated_at            timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT bexio_grants_owner_company_user_key UNIQUE (owner_id, bexio_company_id, bexio_user_id)
+);
+
+-- refreshIdle(): active grants by last refresh.
+CREATE INDEX IF NOT EXISTS bexio_grants_idle_idx
+  ON bexio_grants (last_refreshed_at)
+  WHERE status = 'active';