@soulcode/bexio-oauth 0.1.0 → 0.2.0

package/dist/grants.js

@@ -0,0 +1,115 @@
+import * as oidc from "openid-client";
+import { decodeJwt } from "jose";
+import { grantBinding, mapClaims } from "./claims.js";
+import { BexioOAuthError } from "./errors.js";
+import { fetchRole } from "./permissions.js";
+/** The app-facing view of a stored grant: no token material. */
+export function toGrant(r) {
+    return {
+        id: r.id,
+        ownerId: r.ownerId,
+        companyId: r.companyId,
+        companyName: r.companyName,
+        userId: r.userId,
+        userName: r.userName,
+        userEmail: r.userEmail,
+        companyUserId: r.companyUserId,
+        role: r.role,
+        status: r.status,
+        scope: r.scope,
+        accessExpiresAt: r.accessExpiresAt,
+        lastRefreshedAt: r.lastRefreshedAt,
+        createdAt: r.createdAt,
+        updatedAt: r.updatedAt,
+    };
+}
+/** The binding a grant's ciphertexts are encrypted under. */
+export function bindingOf(record) {
+    return grantBinding(record.ownerId, record.companyId, record.userId);
+}
+export function decryptFor(cipher, record, value) {
+    return cipher.decrypt(value, bindingOf(record));
+}
+/** Decrypts the grant's access token for the caller. */
+export async function issue(cipher, record) {
+    return {
+        accessToken: await decryptFor(cipher, record, record.accessToken),
+        expiresAt: record.accessExpiresAt,
+        grant: toGrant(record),
+    };
+}
+/** Exactly one grant of the owner, or `not_connected` / `ambiguous_grant`. */
+export async function resolveGrant(store, selector) {
+    if (!selector?.ownerId)
+        throw new BexioOAuthError("invalid_config", "ownerId is required");
+    const rows = await store.findGrants(selector);
+    if (rows.length === 0)
+        throw new BexioOAuthError("not_connected", "owner has no matching grant");
+    if (rows.length > 1) {
+        throw new BexioOAuthError("ambiguous_grant", "owner has several grants; pass companyId or grantId");
+    }
+    return rows[0];
+}
+/** The token's claims if it is a JWT, else none (Bexio access tokens usually are). */
+export function decodeIfJwt(token) {
+    try {
+        return decodeJwt(token);
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Adds userinfo claims, only when the tokens lack the company claims. Token
+ * claims win over userinfo; a userinfo failure keeps the token claims.
+ */
+export async function withUserInfo(ctx, claims, accessToken) {
+    if (claims.company_id !== undefined)
+        return claims;
+    try {
+        const info = await oidc.fetchUserInfo(await ctx.oidc.config(), accessToken, typeof claims.sub === "string" ? claims.sub : oidc.skipSubjectCheck);
+        return { ...info, ...claims };
+    }
+    catch {
+        return claims;
+    }
+}
+/** Encrypts the tokens, reads the role and upserts the grant for the identity in `claims`. */
+export async function saveTokens(ctx, input) {
+    const identity = mapClaims(input.claims);
+    const binding = grantBinding(input.ownerId, identity.companyId, identity.userId);
+    const role = (await fetchRole(ctx.fetchImpl, ctx.apiBaseUrl, input.accessToken)) ??
+        "member";
+    return ctx.store.upsertGrant({
+        ownerId: input.ownerId,
+        ...identity,
+        role,
+        accessToken: await ctx.cipher.encrypt(input.accessToken, binding),
+        refreshToken: input.refreshToken
+            ? await ctx.cipher.encrypt(input.refreshToken, binding)
+            : null,
+        accessExpiresAt: input.accessExpiresAt,
+        refreshExpiresAt: input.refreshExpiresAt,
+        scope: input.scope,
+        now: ctx.clock(),
+    });
+}
+export async function listGrants(store, query) {
+    if (!query?.ownerId)
+        throw new BexioOAuthError("invalid_config", "ownerId is required");
+    return (await store.findGrants({ ownerId: query.ownerId })).map(toGrant);
+}
+export async function disconnect(ctx, selector) {
+    const record = await resolveGrant(ctx.store, selector);
+    try {
+        const c = await ctx.oidc.config();
+        if (record.refreshToken && c.serverMetadata().revocation_endpoint) {
+            await oidc.tokenRevocation(c, await decryptFor(ctx.cipher, record, record.refreshToken), { token_type_hint: "refresh_token" });
+        }
+    }
+    catch {
+        // Revocation is best effort; the grant is deleted either way.
+    }
+    await ctx.store.deleteGrant(record.id);
+}
+//# sourceMappingURL=grants.js.map

package/dist/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAiB,MAAM,aAAa,CAAC;AAGrE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C,gEAAgE;AAChE,MAAM,UAAU,OAAO,CAAC,CAAc;IACpC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,MAAmB;IAC3C,OAAO,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAmB,EACnB,MAAmB,EACnB,KAAa;IAEb,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,MAAmB,EACnB,MAAmB;IAEnB,OAAO;QACL,WAAW,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC;QACjE,SAAS,EAAE,MAAM,CAAC,eAAe;QACjC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;KACvB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiB,EACjB,QAAuB;IAEvB,IAAI,CAAC,QAAQ,EAAE,OAAO;QACpB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QACnB,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;AAClB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,MAAgB,EAChB,WAAmB;IAEnB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CACnC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EACvB,WAAW,EACX,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CACpE,CAAC;QACF,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAkB,EAClB,KAQC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,YAAY,CAC1B,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,MAAM,IAAI,GACR,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACnE,QAAQ,CAAC;IACX,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,QAAQ;QACX,IAAI;QACJ,WAAW,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;QACjE,YAAY,EAAE,KAAK,CAAC,YAAY;YAC9B,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,IAAI;QACR,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAiB,EACjB,KAA0B;IAE1B,IAAI,CAAC,KAAK,EAAE,OAAO;QACjB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAkB,EAClB,QAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,mBAAmB,EAAE,CAAC;YAClE,MAAM,IAAI,CAAC,eAAe,CACxB,CAAC,EACD,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,EACzD,EAAE,eAAe,EAAE,eAAe,EAAE,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IACD,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/idle-sweep.d.ts

@@ -0,0 +1,11 @@
+import type { ClientContext } from "./config.js";
+import { type Duration } from "./duration.js";
+import type { RefreshIdleResult } from "./types.js";
+export declare const DEFAULT_IDLE_LIMIT = 100;
+/** `BexioOAuth.refreshIdle`: refreshes idle grants one after another. */
+export declare function refreshIdle(ctx: ClientContext, options: {
+    idleFor: Duration;
+    limit?: number;
+    timeBudget?: Duration;
+}): Promise<RefreshIdleResult>;
+//# sourceMappingURL=idle-sweep.d.ts.map

package/dist/idle-sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idle-sweep.d.ts","sourceRoot":"","sources":["../src/idle-sweep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC,yEAAyE;AACzE,wBAAsB,WAAW,CAC/B,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,QAAQ,CAAA;CAAE,GACpE,OAAO,CAAC,iBAAiB,CAAC,CA2D5B"}

package/dist/idle-sweep.js

@@ -0,0 +1,70 @@
+import { toMs } from "./duration.js";
+import { isBexioOAuthError } from "./errors.js";
+import { lockWindow, refreshLocked } from "./refresh.js";
+export const DEFAULT_IDLE_LIMIT = 100;
+/** `BexioOAuth.refreshIdle`: refreshes idle grants one after another. */
+export async function refreshIdle(ctx, options) {
+    const { store, clock } = ctx;
+    const idleMs = toMs(options?.idleFor, "idleFor");
+    const budgetMs = options.timeBudget === undefined
+        ? Infinity
+        : toMs(options.timeBudget, "timeBudget");
+    const startedAt = clock().getTime();
+    const result = {
+        refreshed: 0,
+        skipped: 0,
+        reauthRequired: 0,
+        failed: 0,
+        remaining: 0,
+    };
+    const refreshedBefore = new Date(startedAt - idleMs);
+    const idle = await store.listIdleGrants({
+        refreshedBefore,
+        limit: options.limit ?? DEFAULT_IDLE_LIMIT,
+    });
+    if (idle.length === 0)
+        return result;
+    try {
+        await ctx.oidc.config();
+    }
+    catch {
+        // Bexio unreachable: report, don't throw; the next run retries.
+        result.failed = idle.length;
+        return result;
+    }
+    for (const [index, grant] of idle.entries()) {
+        // Stop before taking the next lock, so a function timeout can't cut a
+        // refresh in half. The oldest grants come first, so the next run
+        // continues where this one stopped.
+        if (clock().getTime() - startedAt >= budgetMs) {
+            result.remaining = idle.length - index;
+            break;
+        }
+        const window = lockWindow(ctx, clock());
+        const locked = await store.acquireRefreshLock({
+            id: grant.id,
+            ...window,
+            refreshedBefore,
+        });
+        if (!locked) {
+            result.skipped++;
+            continue;
+        }
+        try {
+            if (await refreshLocked(ctx, locked, window.lockToken))
+                result.refreshed++;
+            else
+                result.skipped++;
+        }
+        catch (error) {
+            if (isBexioOAuthError(error, "reauth_required")) {
+                result.reauthRequired++;
+            }
+            else {
+                result.failed++;
+            }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=idle-sweep.js.map

package/dist/idle-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idle-sweep.js","sourceRoot":"","sources":["../src/idle-sweep.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAiB,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAkB,EAClB,OAAqE;IAErE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,QAAQ,GACZ,OAAO,CAAC,UAAU,KAAK,SAAS;QAC9B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAsB;QAChC,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,CAAC;QACjB,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,CAAC;KACb,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC;QACtC,eAAe;QACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,kBAAkB;KAC3C,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,sEAAsE;QACtE,iEAAiE;QACjE,oCAAoC;QACpC,IAAI,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC9C,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACvC,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC5C,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,GAAG,MAAM;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;gBACpD,MAAM,CAAC,SAAS,EAAE,CAAC;;gBAChB,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-export { createBexioOAuth, type AccessToken, type BexioOAuth, type BexioOAuthConfig, type CallbackOptions, type CallbackResult, type ExternalTokens, type Grant, type GrantSelector, type RefreshIdleResult, } from "./client.js";
+export { createBexioOAuth } from "./client.js";
+export type { AccessToken, BexioOAuth, BexioOAuthConfig, CallbackOptions, CallbackResult, ExternalTokens, Grant, GrantSelector, RefreshIdleResult, } from "./types.js";
 export { BASE_SCOPES, BEXIO_API_BASE_URL, BEXIO_ISSUER, mapClaims, type BexioIdentity, } from "./claims.js";
 export { generateKey, type Keyring } from "./crypto.js";
 export type { Duration } from "./duration.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,KAAK,EACV,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,cAAc,EACd,KAAK,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
-export { createBexioOAuth, } from "./client.js";
+export { createBexioOAuth } from "./client.js";
 export { BASE_SCOPES, BEXIO_API_BASE_URL, BEXIO_ISSUER, mapClaims, } from "./claims.js";
 export { generateKey } from "./crypto.js";
 export { BexioOAuthError, isBexioOAuthError, } from "./errors.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAUjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,GAEV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AAExD,OAAO,EACL,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAa,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAkB,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAY/C,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,GAEV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AAExD,OAAO,EACL,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAa,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAkB,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC"}

package/dist/migrations.generated.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "./sql.js";
+export declare const MIGRATIONS: readonly Migration[];
+//# sourceMappingURL=migrations.generated.d.ts.map

package/dist/migrations.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.generated.d.ts","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,eAAO,MAAM,UAAU,EAAE,SAAS,SAAS,EAsC1C,CAAC"}

package/dist/migrations.generated.js

@@ -0,0 +1,40 @@
+export const MIGRATIONS = [
+    {
+        number: 1,
+        name: "0001_bexio_grants.sql",
+        sql: `-- @soulcode/bexio-oauth 0001: the grants table.
+-- One row per (owner, Bexio company, Bexio user). Token columns hold JWE
+-- ciphertext; only your server-side database role should be able to read them.
+
+CREATE TABLE IF NOT EXISTS bexio_grants (
+  id                    uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+  owner_id              text        NOT NULL,
+  bexio_company_id      text        NOT NULL,
+  bexio_user_id         text        NOT NULL,
+  bexio_company_user_id integer,
+  company_name          text,
+  user_name             text,
+  user_email            text,
+  role                  text        NOT NULL DEFAULT 'member' CHECK (role IN ('admin', 'member')),
+  status                text        NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'reauth_required')),
+  access_token          text        NOT NULL,
+  refresh_token         text,
+  access_expires_at     timestamptz,
+  refresh_expires_at    timestamptz,
+  scope                 text,
+  refresh_locked_until  timestamptz,
+  refresh_lock_token    text,
+  last_refreshed_at     timestamptz NOT NULL DEFAULT now(),
+  created_at            timestamptz NOT NULL DEFAULT now(),
+  updated_at            timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT bexio_grants_owner_company_user_key UNIQUE (owner_id, bexio_company_id, bexio_user_id)
+);
+
+-- refreshIdle(): active grants by last refresh.
+CREATE INDEX IF NOT EXISTS bexio_grants_idle_idx
+  ON bexio_grants (last_refreshed_at)
+  WHERE status = 'active';
+`,
+    },
+];
+//# sourceMappingURL=migrations.generated.js.map

package/dist/migrations.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.generated.js","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,UAAU,GAAyB;IAC9C;QACE,MAAM,EAAE,CAAC;QACT,IAAI,EAAE,uBAAuB;QAC7B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCR;KACE;CACF,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,30 @@
+import * as oidc from "openid-client";
+import { createRemoteJWKSet } from "jose";
+/** Per HTTP request to Bexio. Kept well below the default refresh lock TTL. */
+export declare const HTTP_TIMEOUT_SECONDS = 10;
+/**
+ * A safe summary of an upstream error for `BexioOAuthError.cause`: the OAuth
+ * error code and HTTP status, never response bodies or token values.
+ */
+export declare function describe(error: unknown): {
+    name: string;
+    error?: string;
+    status?: number;
+};
+export type KeySet = ReturnType<typeof createRemoteJWKSet>;
+/** Bexio's OIDC metadata and signing keys, loaded lazily. */
+export interface Oidc {
+    /** The discovered configuration; a failed discovery is retried on the next call. */
+    config(): Promise<oidc.Configuration>;
+    /** Bexio's signing keys (cached, refetched on an unknown key id). */
+    keySet(): Promise<KeySet>;
+}
+export declare function createOidc(options: {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    /** Allow plain http (local mocks only). */
+    allowInsecure: boolean;
+    fetchImpl: typeof fetch;
+}): Oidc;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAkC,MAAM,MAAM,CAAC;AAG1E,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAeA;AAED,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE3D,6DAA6D;AAC7D,MAAM,WAAW,IAAI;IACnB,oFAAoF;IACpF,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtC,qEAAqE;IACrE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,KAAK,CAAC;CACzB,GAAG,IAAI,CA+CP"}

package/dist/oidc.js

@@ -0,0 +1,67 @@
+import * as oidc from "openid-client";
+import { createRemoteJWKSet, customFetch as joseCustomFetch } from "jose";
+import { BexioOAuthError } from "./errors.js";
+/** Per HTTP request to Bexio. Kept well below the default refresh lock TTL. */
+export const HTTP_TIMEOUT_SECONDS = 10;
+/**
+ * A safe summary of an upstream error for `BexioOAuthError.cause`: the OAuth
+ * error code and HTTP status, never response bodies or token values.
+ */
+export function describe(error) {
+    if (error instanceof oidc.ResponseBodyError) {
+        return { name: error.name, error: error.error, status: error.status };
+    }
+    if (error instanceof oidc.AuthorizationResponseError) {
+        return { name: error.name, error: error.error };
+    }
+    if (error instanceof Error) {
+        const code = error.code;
+        return {
+            name: error.name,
+            ...(typeof code === "string" ? { error: code } : {}),
+        };
+    }
+    return { name: "unknown" };
+}
+export function createOidc(options) {
+    const { issuer, clientId, clientSecret, allowInsecure, fetchImpl } = options;
+    const issuerUrl = new URL(issuer);
+    const customFetch = (url, init) => fetchImpl(url, init);
+    let discovered;
+    function config() {
+        discovered ??= oidc
+            .discovery(issuerUrl, clientId, clientSecret, undefined, {
+            execute: allowInsecure ? [oidc.allowInsecureRequests] : [],
+            // Well below the refresh lock TTL, so a slow IdP can't outlive the lock.
+            timeout: HTTP_TIMEOUT_SECONDS,
+            [oidc.customFetch]: customFetch,
+        })
+            .then((c) => {
+            c[oidc.customFetch] = customFetch;
+            oidc.enableNonRepudiationChecks(c);
+            return c;
+        })
+            .catch((cause) => {
+            discovered = undefined;
+            throw new BexioOAuthError("idp_error", `OIDC discovery failed for ${issuer}`, { cause: describe(cause) });
+        });
+        return discovered;
+    }
+    // Cached, refetched on an unknown key id, with a timeout and a cooldown so a
+    // bad token can't hammer the issuer.
+    let jwks;
+    async function keySet() {
+        if (!jwks) {
+            const uri = (await config()).serverMetadata().jwks_uri;
+            if (!uri)
+                throw new BexioOAuthError("idp_error", "issuer publishes no jwks_uri");
+            jwks = createRemoteJWKSet(new URL(uri), {
+                timeoutDuration: HTTP_TIMEOUT_SECONDS * 1000,
+                [joseCustomFetch]: fetchImpl,
+            });
+        }
+        return jwks;
+    }
+    return { config, keySet };
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,MAAM,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IAKrC,IAAI,KAAK,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,YAAY,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAYD,MAAM,UAAU,UAAU,CAAC,OAO1B;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,IAAiB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE7E,IAAI,UAAmD,CAAC;IACxD,SAAS,MAAM;QACb,UAAU,KAAK,IAAI;aAChB,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE;YACvD,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE;YAC1D,yEAAyE;YACzE,OAAO,EAAE,oBAAoB;YAC7B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW;SAChC,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC;YAClC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,UAAU,GAAG,SAAS,CAAC;YACvB,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,6BAA6B,MAAM,EAAE,EACrC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,6EAA6E;IAC7E,qCAAqC;IACrC,IAAI,IAAwB,CAAC;IAC7B,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC;YACvD,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;YACzE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;gBACtC,eAAe,EAAE,oBAAoB,GAAG,IAAI;gBAC5C,CAAC,eAAe,CAAC,EAAE,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/refresh.d.ts

@@ -0,0 +1,30 @@
+import * as oidc from "openid-client";
+import type { ClientContext } from "./config.js";
+import type { GrantRecord } from "./store/types.js";
+import type { AccessToken, GrantSelector } from "./types.js";
+/** Refresh a little before the access token really expires. */
+export declare const EXPIRY_SKEW_MS = 30000;
+export type TokenResponse = oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers;
+/** Absolute expiries from a token response's `expires_in` / `refresh_expires_in`. */
+export declare function tokenExpiry(tokens: TokenResponse, now: Date): {
+    accessExpiresAt: Date | null;
+    refreshExpiresAt: Date | null;
+};
+/** True while the access token is valid for longer than the skew. */
+export declare function isFresh(record: GrantRecord, now: Date): boolean;
+/** A new lock holder's token and lease, starting at `now`. */
+export declare function lockWindow(ctx: ClientContext, now: Date): {
+    now: Date;
+    lockUntil: Date;
+    lockToken: `${string}-${string}-${string}-${string}-${string}`;
+};
+/**
+ * Refreshes a grant whose lock the caller holds (`lockToken`). Every write
+ * is fenced by the token: if the lock was lost (expired and taken over, or
+ * the grant was reconnected meanwhile), the write changes nothing and this
+ * returns `null`: the caller re-reads the grant.
+ */
+export declare function refreshLocked(ctx: ClientContext, record: GrantRecord, lockToken: string): Promise<GrantRecord | null>;
+/** `BexioOAuth.getAccessToken`. */
+export declare function getAccessToken(ctx: ClientContext, selector: GrantSelector): Promise<AccessToken>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../src/refresh.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE7D,+DAA+D;AAC/D,eAAO,MAAM,cAAc,QAAS,CAAC;AAIrC,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,GACpD,IAAI,CAAC,4BAA4B,CAAC;AAEpC,qFAAqF;AACrF,wBAAgB,WAAW,CACzB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,IAAI,GACR;IAAE,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAajE;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAK/D;AAED,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI;;;;EAMvD;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA0D7B;AAID,mCAAmC;AACnC,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,WAAW,CAAC,CAmDtB"}

package/dist/refresh.js

@@ -0,0 +1,139 @@
+import { randomUUID } from "node:crypto";
+import * as oidc from "openid-client";
+import { BexioOAuthError, isBexioOAuthError } from "./errors.js";
+import { bindingOf, decryptFor, issue, resolveGrant } from "./grants.js";
+import { describe } from "./oidc.js";
+import { fetchRole } from "./permissions.js";
+/** Refresh a little before the access token really expires. */
+export const EXPIRY_SKEW_MS = 30_000;
+/** Extra time `getAccessToken` waits for a concurrent refresh beyond the lock TTL. */
+const WAIT_GRACE_MS = 5_000;
+/** Absolute expiries from a token response's `expires_in` / `refresh_expires_in`. */
+export function tokenExpiry(tokens, now) {
+    const expiresIn = tokens.expiresIn();
+    const refreshExpiresIn = Number(tokens.refresh_expires_in);
+    return {
+        accessExpiresAt: expiresIn === undefined
+            ? null
+            : new Date(now.getTime() + expiresIn * 1000),
+        refreshExpiresAt: Number.isFinite(refreshExpiresIn) && refreshExpiresIn > 0
+            ? new Date(now.getTime() + refreshExpiresIn * 1000)
+            : null,
+    };
+}
+/** True while the access token is valid for longer than the skew. */
+export function isFresh(record, now) {
+    return (record.accessExpiresAt !== null &&
+        record.accessExpiresAt.getTime() - EXPIRY_SKEW_MS > now.getTime());
+}
+/** A new lock holder's token and lease, starting at `now`. */
+export function lockWindow(ctx, now) {
+    return {
+        now,
+        lockUntil: new Date(now.getTime() + ctx.lockTtlMs),
+        lockToken: randomUUID(),
+    };
+}
+/**
+ * Refreshes a grant whose lock the caller holds (`lockToken`). Every write
+ * is fenced by the token: if the lock was lost (expired and taken over, or
+ * the grant was reconnected meanwhile), the write changes nothing and this
+ * returns `null`: the caller re-reads the grant.
+ */
+export async function refreshLocked(ctx, record, lockToken) {
+    const { store, cipher, clock } = ctx;
+    if (!record.refreshToken) {
+        await store.markReauthRequired(record.id, lockToken, clock());
+        throw new BexioOAuthError("reauth_required", "grant has no refresh token; reconnect required");
+    }
+    let refreshToken;
+    try {
+        refreshToken = await decryptFor(cipher, record, record.refreshToken);
+    }
+    catch (error) {
+        // Usually a keyring mistake (a key removed too early): don't burn the
+        // grant, so restoring the key fixes it.
+        await store.releaseRefreshLock(record.id, lockToken);
+        throw error;
+    }
+    let tokens;
+    try {
+        tokens = await oidc.refreshTokenGrant(await ctx.oidc.config(), refreshToken);
+    }
+    catch (error) {
+        if (error instanceof oidc.ResponseBodyError &&
+            error.error === "invalid_grant") {
+            await store.markReauthRequired(record.id, lockToken, clock());
+            throw new BexioOAuthError("reauth_required", "Bexio rejected the refresh token; reconnect required", { cause: describe(error) });
+        }
+        await store.releaseRefreshLock(record.id, lockToken);
+        if (isBexioOAuthError(error))
+            throw error;
+        throw new BexioOAuthError("idp_error", "token refresh failed", {
+            cause: describe(error),
+        });
+    }
+    const now = clock();
+    const binding = bindingOf(record);
+    // null: lock lost while refreshing (someone reconnected, or our lock
+    // expired and another caller took over). Their write wins.
+    return store.saveRefreshed(record.id, lockToken, {
+        accessToken: await cipher.encrypt(tokens.access_token, binding),
+        refreshToken: tokens.refresh_token
+            ? await cipher.encrypt(tokens.refresh_token, binding)
+            : null,
+        ...tokenExpiry(tokens, now),
+        scope: tokens.scope ?? null,
+        role: await fetchRole(ctx.fetchImpl, ctx.apiBaseUrl, tokens.access_token),
+        now,
+    });
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** `BexioOAuth.getAccessToken`. */
+export async function getAccessToken(ctx, selector) {
+    const { store, clock } = ctx;
+    let record = await resolveGrant(store, selector);
+    const deadline = clock().getTime() + ctx.lockTtlMs + WAIT_GRACE_MS;
+    let wait = 50;
+    const reread = async (id) => {
+        const current = await store.getGrant(id);
+        if (!current)
+            throw new BexioOAuthError("not_connected", "grant was deleted");
+        return current;
+    };
+    for (;;) {
+        if (record.status === "reauth_required") {
+            throw new BexioOAuthError("reauth_required", "grant needs to be reconnected");
+        }
+        const now = clock();
+        if (isFresh(record, now))
+            return issue(ctx.cipher, record);
+        // Every iteration that would do more work is bounded, whether the last
+        // one waited for another refresher or lost its own lock.
+        if (now.getTime() > deadline) {
+            throw new BexioOAuthError("idp_error", "timed out waiting for a concurrent token refresh");
+        }
+        // Discovery outside the lock, so a cold start doesn't eat into it.
+        await ctx.oidc.config();
+        const window = lockWindow(ctx, clock());
+        const locked = await store.acquireRefreshLock({
+            id: record.id,
+            ...window,
+            accessExpiresBefore: new Date(now.getTime() + EXPIRY_SKEW_MS),
+        });
+        if (locked) {
+            const refreshed = await refreshLocked(ctx, locked, window.lockToken);
+            if (refreshed)
+                return issue(ctx.cipher, refreshed);
+            // Lost the lock to a reconnect or another refresher: look at their
+            // result before anything else (it may be fresh, or reauth_required).
+            record = await reread(record.id);
+            continue;
+        }
+        // Someone else is refreshing (or just did): wait for their result.
+        await sleep(wait);
+        wait = Math.min(wait * 2, 1_000);
+        record = await reread(record.id);
+    }
+}
+//# sourceMappingURL=refresh.js.map

package/dist/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../src/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,sFAAsF;AACtF,MAAM,aAAa,GAAG,KAAK,CAAC;AAK5B,qFAAqF;AACrF,MAAM,UAAU,WAAW,CACzB,MAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC3D,OAAO;QACL,eAAe,EACb,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QAChD,gBAAgB,EACd,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC;YACvD,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;YACnD,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,OAAO,CAAC,MAAmB,EAAE,GAAS;IACpD,OAAO,CACL,MAAM,CAAC,eAAe,KAAK,IAAI;QAC/B,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,GAAG,CAAC,OAAO,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,UAAU,CAAC,GAAkB,EAAE,GAAS;IACtD,OAAO;QACL,GAAG;QACH,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;QAClD,SAAS,EAAE,UAAU,EAAE;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAkB,EAClB,MAAmB,EACnB,SAAiB;IAEjB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,wCAAwC;QACxC,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACnC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EACvB,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,IAAI,CAAC,iBAAiB;YACvC,KAAK,CAAC,KAAK,KAAK,eAAe,EAC/B,CAAC;YACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,sDAAsD,EACtD,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,sBAAsB,EAAE;YAC7D,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,qEAAqE;IACrE,2DAA2D;IAC3D,OAAO,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE;QAC/C,WAAW,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC;QAC/D,YAAY,EAAE,MAAM,CAAC,aAAa;YAChC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC;YACrD,CAAC,CAAC,IAAI;QACR,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,IAAI,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC;QACzE,GAAG;KACJ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhF,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAkB,EAClB,QAAuB;IAEvB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAC7B,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,GAAG,aAAa,CAAC;IACnE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,MAAM,GAAG,KAAK,EAAE,EAAU,EAAE,EAAE;QAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,SAAS,CAAC;QACR,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3D,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,kDAAkD,CACnD,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC5C,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,GAAG,MAAM;YACT,mBAAmB,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrE,IAAI,SAAS;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACnD,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,mEAAmE;QACnE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;AACH,CAAC"}

package/dist/return-to.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Only same-origin relative paths: blocks open redirects via `returnTo`.
+ * Parsed with the URL parser (the same one the redirect will go through), so
+ * tricks like `/\t/evil.example` are caught, and normalized to path+query+hash.
+ * Returns `fallback` for an empty value; throws `invalid_config` otherwise.
+ */
+export declare function safeReturnTo(value: string | undefined, fallback: string): string;
+//# sourceMappingURL=return-to.d.ts.map

package/dist/return-to.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-to.d.ts","sourceRoot":"","sources":["../src/return-to.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,MAAM,GACf,MAAM,CAqBR"}

package/dist/return-to.js

@@ -0,0 +1,31 @@
+import { BexioOAuthError } from "./errors.js";
+const RETURN_TO_BASE = "https://return-to.invalid";
+/**
+ * Only same-origin relative paths: blocks open redirects via `returnTo`.
+ * Parsed with the URL parser (the same one the redirect will go through), so
+ * tricks like `/\t/evil.example` are caught, and normalized to path+query+hash.
+ * Returns `fallback` for an empty value; throws `invalid_config` otherwise.
+ */
+export function safeReturnTo(value, fallback) {
+    if (!value)
+        return fallback;
+    const invalid = () => new BexioOAuthError("invalid_config", "returnTo must be a relative path like /settings");
+    // eslint-disable-next-line no-control-regex
+    if (!value.startsWith("/") || /[\u0000-\u001f\\]/.test(value))
+        throw invalid();
+    let url;
+    try {
+        url = new URL(value, RETURN_TO_BASE);
+    }
+    catch {
+        throw invalid();
+    }
+    if (url.origin !== RETURN_TO_BASE)
+        throw invalid();
+    // Dot segments can collapse to "//host" (e.g. "/.//evil.example"), which a
+    // browser reads as protocol-relative: check the normalized result too.
+    if (url.pathname.startsWith("//"))
+        throw invalid();
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+//# sourceMappingURL=return-to.js.map