@soulcode/bexio-oauth 0.1.0 → 0.3.0

package/dist/grants.d.ts

@@ -0,0 +1,45 @@
+import { type ClaimBag } from "./claims.js";
+import type { ClientContext } from "./config.js";
+import type { TokenCipher } from "./crypto.js";
+import type { ConnectionRecord, GrantRecord, GrantStore } from "./store/types.js";
+import type { AccessToken, Grant, GrantSelector } from "./types.js";
+/**
+ * The app-facing view of a stored grant, with `c` (default: the grant's own)
+ * as its connection: no token material.
+ */
+export declare function toGrant(grant: GrantRecord, c?: ConnectionRecord): Grant;
+/** The binding a connection's ciphertexts are encrypted under. */
+export declare function bindingOf(connection: ConnectionRecord): string;
+export declare function decryptFor(cipher: TokenCipher, connection: ConnectionRecord, value: string): Promise<string>;
+/** Decrypts the connection's access token for the owner of `grant`. */
+export declare function issue(cipher: TokenCipher, grant: GrantRecord, connection: ConnectionRecord): Promise<AccessToken>;
+/** Exactly one grant of the owner, or `not_connected` / `ambiguous_grant`. */
+export declare function resolveGrant(store: GrantStore, selector: GrantSelector): Promise<GrantRecord>;
+/** The token's claims if it is a JWT, else none (Bexio access tokens usually are). */
+export declare function decodeIfJwt(token: string): ClaimBag;
+/**
+ * Adds userinfo claims when the tokens lack the profile claims. Bexio's access
+ * token carries `company_id` but no company name, email or person name; the
+ * ID token has them, so the extra call only happens without one (`saveGrant`
+ * with an access token alone). Token claims win over userinfo; a userinfo
+ * failure keeps the token claims.
+ */
+export declare function withUserInfo(ctx: ClientContext, claims: ClaimBag, accessToken: string): Promise<ClaimBag>;
+/**
+ * Encrypts the tokens, reads the role, and upserts the connection for the
+ * identity in `claims` and the owner's grant on it.
+ */
+export declare function saveTokens(ctx: ClientContext, input: {
+    ownerId: string;
+    claims: ClaimBag;
+    accessToken: string;
+    refreshToken: string | null;
+    accessExpiresAt: Date | null;
+    refreshExpiresAt: Date | null;
+    scope: string | null;
+}): Promise<GrantRecord>;
+export declare function listGrants(store: GrantStore, query: {
+    ownerId: string;
+}): Promise<Grant[]>;
+export declare function disconnect(ctx: ClientContext, selector: GrantSelector): Promise<void>;
+//# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgC,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EACV,gBAAgB,EAChB,WAAW,EACX,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,OAAO,CACrB,KAAK,EAAE,WAAW,EAClB,CAAC,GAAE,gBAAmC,GACrC,KAAK,CAmBP;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,CAE9D;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,gBAAgB,EAC5B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,uEAAuE;AACvE,wBAAsB,KAAK,CACzB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAAC,WAAW,CAAC,CAMtB;AAED,8EAA8E;AAC9E,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,WAAW,CAAC,CAatB;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAMnD;AAKD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAanB;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACA,OAAO,CAAC,WAAW,CAAC,CAsBtB;AAED,wBAAsB,UAAU,CAC9B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACzB,OAAO,CAAC,KAAK,EAAE,CAAC,CAMlB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/grants.js

@@ -0,0 +1,143 @@
+import * as oidc from "openid-client";
+import { decodeJwt } from "jose";
+import { connectionBinding, mapClaims } from "./claims.js";
+import { BexioOAuthError } from "./errors.js";
+import { fetchRole } from "./permissions.js";
+/**
+ * The app-facing view of a stored grant, with `c` (default: the grant's own)
+ * as its connection: no token material.
+ */
+export function toGrant(grant, c = grant.connection) {
+    return {
+        id: grant.id,
+        ownerId: grant.ownerId,
+        connectionId: c.id,
+        companyId: c.companyId,
+        companyName: c.companyName,
+        userId: c.userId,
+        userName: c.userName,
+        userEmail: c.userEmail,
+        companyUserId: c.companyUserId,
+        role: c.role,
+        status: c.status,
+        scope: c.scope,
+        accessExpiresAt: c.accessExpiresAt,
+        lastRefreshedAt: c.lastRefreshedAt,
+        createdAt: grant.createdAt,
+        updatedAt: c.updatedAt,
+    };
+}
+/** The binding a connection's ciphertexts are encrypted under. */
+export function bindingOf(connection) {
+    return connectionBinding(connection.companyId, connection.userId);
+}
+export function decryptFor(cipher, connection, value) {
+    return cipher.decrypt(value, bindingOf(connection));
+}
+/** Decrypts the connection's access token for the owner of `grant`. */
+export async function issue(cipher, grant, connection) {
+    return {
+        accessToken: await decryptFor(cipher, connection, connection.accessToken),
+        expiresAt: connection.accessExpiresAt,
+        grant: toGrant(grant, connection),
+    };
+}
+/** Exactly one grant of the owner, or `not_connected` / `ambiguous_grant`. */
+export async function resolveGrant(store, selector) {
+    if (!selector?.ownerId)
+        throw new BexioOAuthError("invalid_config", "ownerId is required");
+    const rows = await store.findGrants(selector);
+    if (rows.length === 0)
+        throw new BexioOAuthError("not_connected", "owner has no matching grant");
+    if (rows.length > 1) {
+        throw new BexioOAuthError("ambiguous_grant", "owner has several grants; pass companyId or grantId");
+    }
+    return rows[0];
+}
+/** The token's claims if it is a JWT, else none (Bexio access tokens usually are). */
+export function decodeIfJwt(token) {
+    try {
+        return decodeJwt(token);
+    }
+    catch {
+        return {};
+    }
+}
+/** Claims a connection needs beyond the ids (see `mapClaims`). */
+const PROFILE_CLAIMS = ["company_id", "company_name", "email"];
+/**
+ * Adds userinfo claims when the tokens lack the profile claims. Bexio's access
+ * token carries `company_id` but no company name, email or person name; the
+ * ID token has them, so the extra call only happens without one (`saveGrant`
+ * with an access token alone). Token claims win over userinfo; a userinfo
+ * failure keeps the token claims.
+ */
+export async function withUserInfo(ctx, claims, accessToken) {
+    if (PROFILE_CLAIMS.every((claim) => claims[claim] !== undefined))
+        return claims;
+    try {
+        const info = await oidc.fetchUserInfo(await ctx.oidc.config(), accessToken, typeof claims.sub === "string" ? claims.sub : oidc.skipSubjectCheck);
+        return { ...info, ...claims };
+    }
+    catch {
+        return claims;
+    }
+}
+/**
+ * Encrypts the tokens, reads the role, and upserts the connection for the
+ * identity in `claims` and the owner's grant on it.
+ */
+export async function saveTokens(ctx, input) {
+    const identity = mapClaims(input.claims);
+    const binding = connectionBinding(identity.companyId, identity.userId);
+    const role = (await fetchRole(ctx.fetchImpl, ctx.apiBaseUrl, input.accessToken)) ??
+        "member";
+    const issuedAt = decodeIfJwt(input.accessToken).iat;
+    return ctx.store.upsertGrant({
+        ownerId: input.ownerId,
+        ...identity,
+        role,
+        accessToken: await ctx.cipher.encrypt(input.accessToken, binding),
+        refreshToken: input.refreshToken
+            ? await ctx.cipher.encrypt(input.refreshToken, binding)
+            : null,
+        accessExpiresAt: input.accessExpiresAt,
+        refreshExpiresAt: input.refreshExpiresAt,
+        scope: input.scope,
+        authorizedAt: typeof issuedAt === "number" ? new Date(issuedAt * 1000) : ctx.clock(),
+        now: ctx.clock(),
+    });
+}
+export async function listGrants(store, query) {
+    if (!query?.ownerId)
+        throw new BexioOAuthError("invalid_config", "ownerId is required");
+    return (await store.findGrants({ ownerId: query.ownerId })).map((g) => toGrant(g));
+}
+export async function disconnect(ctx, selector) {
+    const grant = await resolveGrant(ctx.store, selector);
+    // Delete first, revoke after: revoking ends the one refresh token chain
+    // all owners of this identity share, so it may only happen once the store
+    // has confirmed that no grant (not even a concurrent one) uses it.
+    await ctx.store.deleteGrant(grant.id);
+    const deleted = await ctx.store.deleteUnusedConnection(grant.connection.id);
+    if (!deleted)
+        return;
+    const { connection, userHasOtherConnections } = deleted;
+    // Revoking ends all of the user's chains at Bexio, whichever token it
+    // names: a stale (reauth_required) token would still end the chain the user
+    // authorized since, and any token the user's other company's connection.
+    if (!connection.refreshToken ||
+        connection.status !== "active" ||
+        userHasOtherConnections)
+        return;
+    try {
+        const c = await ctx.oidc.config();
+        if (c.serverMetadata().revocation_endpoint) {
+            await oidc.tokenRevocation(c, await decryptFor(ctx.cipher, connection, connection.refreshToken), { token_type_hint: "refresh_token" });
+        }
+    }
+    catch {
+        // Revocation is best effort; the connection is deleted either way.
+    }
+}
+//# sourceMappingURL=grants.js.map

package/dist/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAiB,MAAM,aAAa,CAAC;AAG1E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAQ7C;;;GAGG;AACH,MAAM,UAAU,OAAO,CACrB,KAAkB,EAClB,IAAsB,KAAK,CAAC,UAAU;IAEtC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,CAAC,CAAC,EAAE;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,UAA4B;IACpD,OAAO,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAmB,EACnB,UAA4B,EAC5B,KAAa;IAEb,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,MAAmB,EACnB,KAAkB,EAClB,UAA4B;IAE5B,OAAO;QACL,WAAW,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,CAAC;QACzE,SAAS,EAAE,UAAU,CAAC,eAAe;QACrC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiB,EACjB,QAAuB;IAEvB,IAAI,CAAC,QAAQ,EAAE,OAAO;QACpB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QACnB,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;AAClB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,MAAgB,EAChB,WAAmB;IAEnB,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CACnC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EACvB,WAAW,EACX,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CACpE,CAAC;QACF,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAkB,EAClB,KAQC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,IAAI,GACR,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACnE,QAAQ,CAAC;IACX,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC;IACpD,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,QAAQ;QACX,IAAI;QACJ,WAAW,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;QACjE,YAAY,EAAE,KAAK,CAAC,YAAY;YAC9B,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,IAAI;QACR,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EACV,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE;QACxE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAiB,EACjB,KAA0B;IAE1B,IAAI,CAAC,KAAK,EAAE,OAAO;QACjB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpE,OAAO,CAAC,CAAC,CAAC,CACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAkB,EAClB,QAAuB;IAEvB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtD,wEAAwE;IACxE,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,EAAE,UAAU,EAAE,uBAAuB,EAAE,GAAG,OAAO,CAAC;IACxD,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,IACE,CAAC,UAAU,CAAC,YAAY;QACxB,UAAU,CAAC,MAAM,KAAK,QAAQ;QAC9B,uBAAuB;QAEvB,OAAO;IACT,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,mBAAmB,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,eAAe,CACxB,CAAC,EACD,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,EACjE,EAAE,eAAe,EAAE,eAAe,EAAE,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;AACH,CAAC"}

package/dist/idle-sweep.d.ts

@@ -0,0 +1,11 @@
+import type { ClientContext } from "./config.js";
+import { type Duration } from "./duration.js";
+import type { RefreshIdleResult } from "./types.js";
+export declare const DEFAULT_IDLE_LIMIT = 100;
+/** `BexioOAuth.refreshIdle`: refreshes idle connections one after another. */
+export declare function refreshIdle(ctx: ClientContext, options: {
+    idleFor: Duration;
+    limit?: number;
+    timeBudget?: Duration;
+}): Promise<RefreshIdleResult>;
+//# sourceMappingURL=idle-sweep.d.ts.map

package/dist/idle-sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idle-sweep.d.ts","sourceRoot":"","sources":["../src/idle-sweep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC,8EAA8E;AAC9E,wBAAsB,WAAW,CAC/B,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,QAAQ,CAAA;CAAE,GACpE,OAAO,CAAC,iBAAiB,CAAC,CA2D5B"}

package/dist/idle-sweep.js

@@ -0,0 +1,70 @@
+import { toMs } from "./duration.js";
+import { isBexioOAuthError } from "./errors.js";
+import { lockWindow, refreshLocked } from "./refresh.js";
+export const DEFAULT_IDLE_LIMIT = 100;
+/** `BexioOAuth.refreshIdle`: refreshes idle connections one after another. */
+export async function refreshIdle(ctx, options) {
+    const { store, clock } = ctx;
+    const idleMs = toMs(options?.idleFor, "idleFor");
+    const budgetMs = options.timeBudget === undefined
+        ? Infinity
+        : toMs(options.timeBudget, "timeBudget");
+    const startedAt = clock().getTime();
+    const result = {
+        refreshed: 0,
+        skipped: 0,
+        reauthRequired: 0,
+        failed: 0,
+        remaining: 0,
+    };
+    const refreshedBefore = new Date(startedAt - idleMs);
+    const idle = await store.listIdleConnections({
+        refreshedBefore,
+        limit: options.limit ?? DEFAULT_IDLE_LIMIT,
+    });
+    if (idle.length === 0)
+        return result;
+    try {
+        await ctx.oidc.config();
+    }
+    catch {
+        // Bexio unreachable: report, don't throw; the next run retries.
+        result.failed = idle.length;
+        return result;
+    }
+    for (const [index, connection] of idle.entries()) {
+        // Stop before taking the next lock, so a function timeout can't cut a
+        // refresh in half. The oldest connections come first, so the next run
+        // continues where this one stopped.
+        if (clock().getTime() - startedAt >= budgetMs) {
+            result.remaining = idle.length - index;
+            break;
+        }
+        const window = lockWindow(ctx, clock());
+        const locked = await store.acquireRefreshLock({
+            id: connection.id,
+            ...window,
+            refreshedBefore,
+        });
+        if (!locked) {
+            result.skipped++;
+            continue;
+        }
+        try {
+            if (await refreshLocked(ctx, locked, window.lockToken))
+                result.refreshed++;
+            else
+                result.skipped++;
+        }
+        catch (error) {
+            if (isBexioOAuthError(error, "reauth_required")) {
+                result.reauthRequired++;
+            }
+            else {
+                result.failed++;
+            }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=idle-sweep.js.map

package/dist/idle-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idle-sweep.js","sourceRoot":"","sources":["../src/idle-sweep.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAiB,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAkB,EAClB,OAAqE;IAErE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,QAAQ,GACZ,OAAO,CAAC,UAAU,KAAK,SAAS;QAC9B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAsB;QAChC,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,CAAC;QACjB,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,CAAC;KACb,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC;QAC3C,eAAe;QACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,kBAAkB;KAC3C,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,sEAAsE;QACtE,sEAAsE;QACtE,oCAAoC;QACpC,IAAI,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC9C,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACvC,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC5C,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,GAAG,MAAM;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;gBACpD,MAAM,CAAC,SAAS,EAAE,CAAC;;gBAChB,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-export { createBexioOAuth, type AccessToken, type BexioOAuth, type BexioOAuthConfig, type CallbackOptions, type CallbackResult, type ExternalTokens, type Grant, type GrantSelector, type RefreshIdleResult, } from "./client.js";
+export { createBexioOAuth } from "./client.js";
+export type { AccessToken, BexioOAuth, BexioOAuthConfig, CallbackOptions, CallbackResult, ExternalTokens, Grant, GrantSelector, RefreshIdleResult, } from "./types.js";
 export { BASE_SCOPES, BEXIO_API_BASE_URL, BEXIO_ISSUER, mapClaims, type BexioIdentity, } from "./claims.js";
 export { generateKey, type Keyring } from "./crypto.js";
 export type { Duration } from "./duration.js";
@@ -7,5 +8,5 @@ export { roleFromPermissions, type Role } from "./permissions.js";
 export { migrations, type Migration } from "./sql.js";
 export { memoryStore } from "./store/memory.js";
 export { postgresStore, type SqlClient } from "./store/postgres.js";
-export type { GrantRecord, GrantRefresh, GrantStatus, GrantStore, GrantUpsert, LockRequest, } from "./store/types.js";
+export type { ConnectionRecord, ConnectionRefresh, GrantRecord, GrantStatus, GrantStore, GrantUpsert, LockRequest, } from "./store/types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,KAAK,EACV,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,cAAc,EACd,KAAK,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
-export { createBexioOAuth, } from "./client.js";
+export { createBexioOAuth } from "./client.js";
 export { BASE_SCOPES, BEXIO_API_BASE_URL, BEXIO_ISSUER, mapClaims, } from "./claims.js";
 export { generateKey } from "./crypto.js";
 export { BexioOAuthError, isBexioOAuthError, } from "./errors.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAUjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,GAEV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AAExD,OAAO,EACL,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAa,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAkB,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAY/C,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,GAEV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AAExD,OAAO,EACL,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAa,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAkB,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC"}

package/dist/migrations.generated.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "./sql.js";
+export declare const MIGRATIONS: readonly Migration[];
+//# sourceMappingURL=migrations.generated.d.ts.map

package/dist/migrations.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.generated.d.ts","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,eAAO,MAAM,UAAU,EAAE,SAAS,SAAS,EAsD1C,CAAC"}

package/dist/migrations.generated.js

@@ -0,0 +1,56 @@
+export const MIGRATIONS = [
+    {
+        number: 1,
+        name: "0001_bexio_oauth.sql",
+        sql: `-- @soulcode/bexio-oauth 0001: connections and grants.
+-- Token columns hold JWE ciphertext; only your server-side database role
+-- should be able to read these tables.
+
+-- One row per Bexio identity (company, user): the tokens of its one refresh
+-- token chain, shared by every owner that connected this identity.
+CREATE TABLE IF NOT EXISTS bexio_connections (
+  id                    uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+  bexio_company_id      text        NOT NULL,
+  bexio_user_id         text        NOT NULL,
+  bexio_company_user_id integer,
+  company_name          text,
+  user_name             text,
+  user_email            text,
+  role                  text        NOT NULL DEFAULT 'member' CHECK (role IN ('admin', 'member')),
+  status                text        NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'reauth_required')),
+  access_token          text        NOT NULL,
+  refresh_token         text,
+  access_expires_at     timestamptz,
+  refresh_expires_at    timestamptz,
+  scope                 text,
+  refresh_locked_until  timestamptz,
+  refresh_lock_token    text,
+  authorized_at         timestamptz NOT NULL,
+  last_refreshed_at     timestamptz NOT NULL DEFAULT now(),
+  created_at            timestamptz NOT NULL DEFAULT now(),
+  updated_at            timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT bexio_connections_company_user_key UNIQUE (bexio_company_id, bexio_user_id)
+);
+
+-- refreshIdle(): active connections by last refresh.
+CREATE INDEX IF NOT EXISTS bexio_connections_idle_idx
+  ON bexio_connections (last_refreshed_at)
+  WHERE status = 'active';
+
+-- One row per (owner, connection): an owner's access to a connection. A
+-- connection is deleted only once no grant references it (RESTRICT).
+CREATE TABLE IF NOT EXISTS bexio_grants (
+  id            uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+  owner_id      text        NOT NULL,
+  connection_id uuid        NOT NULL REFERENCES bexio_connections (id) ON DELETE RESTRICT,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT bexio_grants_owner_connection_key UNIQUE (owner_id, connection_id)
+);
+
+-- Disconnect checks whether a connection has grants left.
+CREATE INDEX IF NOT EXISTS bexio_grants_connection_idx
+  ON bexio_grants (connection_id);
+`,
+    },
+];
+//# sourceMappingURL=migrations.generated.js.map

package/dist/migrations.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.generated.js","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,UAAU,GAAyB;IAC9C;QACE,MAAM,EAAE,CAAC;QACT,IAAI,EAAE,sBAAsB;QAC5B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDR;KACE;CACF,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,30 @@
+import * as oidc from "openid-client";
+import { createRemoteJWKSet } from "jose";
+/** Per HTTP request to Bexio. Kept well below the default refresh lock TTL. */
+export declare const HTTP_TIMEOUT_SECONDS = 10;
+/**
+ * A safe summary of an upstream error for `BexioOAuthError.cause`: the OAuth
+ * error code and HTTP status, never response bodies or token values.
+ */
+export declare function describe(error: unknown): {
+    name: string;
+    error?: string;
+    status?: number;
+};
+export type KeySet = ReturnType<typeof createRemoteJWKSet>;
+/** Bexio's OIDC metadata and signing keys, loaded lazily. */
+export interface Oidc {
+    /** The discovered configuration; a failed discovery is retried on the next call. */
+    config(): Promise<oidc.Configuration>;
+    /** Bexio's signing keys (cached, refetched on an unknown key id). */
+    keySet(): Promise<KeySet>;
+}
+export declare function createOidc(options: {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    /** Allow plain http (local mocks only). */
+    allowInsecure: boolean;
+    fetchImpl: typeof fetch;
+}): Oidc;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAkC,MAAM,MAAM,CAAC;AAG1E,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAeA;AAED,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE3D,6DAA6D;AAC7D,MAAM,WAAW,IAAI;IACnB,oFAAoF;IACpF,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtC,qEAAqE;IACrE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,KAAK,CAAC;CACzB,GAAG,IAAI,CA+CP"}

package/dist/oidc.js

@@ -0,0 +1,67 @@
+import * as oidc from "openid-client";
+import { createRemoteJWKSet, customFetch as joseCustomFetch } from "jose";
+import { BexioOAuthError } from "./errors.js";
+/** Per HTTP request to Bexio. Kept well below the default refresh lock TTL. */
+export const HTTP_TIMEOUT_SECONDS = 10;
+/**
+ * A safe summary of an upstream error for `BexioOAuthError.cause`: the OAuth
+ * error code and HTTP status, never response bodies or token values.
+ */
+export function describe(error) {
+    if (error instanceof oidc.ResponseBodyError) {
+        return { name: error.name, error: error.error, status: error.status };
+    }
+    if (error instanceof oidc.AuthorizationResponseError) {
+        return { name: error.name, error: error.error };
+    }
+    if (error instanceof Error) {
+        const code = error.code;
+        return {
+            name: error.name,
+            ...(typeof code === "string" ? { error: code } : {}),
+        };
+    }
+    return { name: "unknown" };
+}
+export function createOidc(options) {
+    const { issuer, clientId, clientSecret, allowInsecure, fetchImpl } = options;
+    const issuerUrl = new URL(issuer);
+    const customFetch = (url, init) => fetchImpl(url, init);
+    let discovered;
+    function config() {
+        discovered ??= oidc
+            .discovery(issuerUrl, clientId, clientSecret, undefined, {
+            execute: allowInsecure ? [oidc.allowInsecureRequests] : [],
+            // Well below the refresh lock TTL, so a slow IdP can't outlive the lock.
+            timeout: HTTP_TIMEOUT_SECONDS,
+            [oidc.customFetch]: customFetch,
+        })
+            .then((c) => {
+            c[oidc.customFetch] = customFetch;
+            oidc.enableNonRepudiationChecks(c);
+            return c;
+        })
+            .catch((cause) => {
+            discovered = undefined;
+            throw new BexioOAuthError("idp_error", `OIDC discovery failed for ${issuer}`, { cause: describe(cause) });
+        });
+        return discovered;
+    }
+    // Cached, refetched on an unknown key id, with a timeout and a cooldown so a
+    // bad token can't hammer the issuer.
+    let jwks;
+    async function keySet() {
+        if (!jwks) {
+            const uri = (await config()).serverMetadata().jwks_uri;
+            if (!uri)
+                throw new BexioOAuthError("idp_error", "issuer publishes no jwks_uri");
+            jwks = createRemoteJWKSet(new URL(uri), {
+                timeoutDuration: HTTP_TIMEOUT_SECONDS * 1000,
+                [joseCustomFetch]: fetchImpl,
+            });
+        }
+        return jwks;
+    }
+    return { config, keySet };
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,MAAM,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IAKrC,IAAI,KAAK,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,YAAY,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAYD,MAAM,UAAU,UAAU,CAAC,OAO1B;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,IAAiB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE7E,IAAI,UAAmD,CAAC;IACxD,SAAS,MAAM;QACb,UAAU,KAAK,IAAI;aAChB,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE;YACvD,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE;YAC1D,yEAAyE;YACzE,OAAO,EAAE,oBAAoB;YAC7B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW;SAChC,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC;YAClC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,UAAU,GAAG,SAAS,CAAC;YACvB,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,6BAA6B,MAAM,EAAE,EACrC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,6EAA6E;IAC7E,qCAAqC;IACrC,IAAI,IAAwB,CAAC;IAC7B,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC;YACvD,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;YACzE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;gBACtC,eAAe,EAAE,oBAAoB,GAAG,IAAI;gBAC5C,CAAC,eAAe,CAAC,EAAE,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/refresh.d.ts

@@ -0,0 +1,30 @@
+import * as oidc from "openid-client";
+import type { ClientContext } from "./config.js";
+import type { ConnectionRecord } from "./store/types.js";
+import type { AccessToken, GrantSelector } from "./types.js";
+/** Refresh a little before the access token really expires. */
+export declare const EXPIRY_SKEW_MS = 30000;
+export type TokenResponse = oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers;
+/** Absolute expiries from a token response's `expires_in` / `refresh_expires_in`. */
+export declare function tokenExpiry(tokens: TokenResponse, now: Date): {
+    accessExpiresAt: Date | null;
+    refreshExpiresAt: Date | null;
+};
+/** True while the access token is valid for longer than the skew. */
+export declare function isFresh(connection: ConnectionRecord, now: Date): boolean;
+/** A new lock holder's token and lease, starting at `now`. */
+export declare function lockWindow(ctx: ClientContext, now: Date): {
+    now: Date;
+    lockUntil: Date;
+    lockToken: `${string}-${string}-${string}-${string}-${string}`;
+};
+/**
+ * Refreshes a connection whose lock the caller holds (`lockToken`). Every
+ * write is fenced by the token: if the lock was lost (expired and taken over,
+ * or the connection was reconnected meanwhile), the write changes nothing and
+ * this returns `null`: the caller re-reads the connection.
+ */
+export declare function refreshLocked(ctx: ClientContext, connection: ConnectionRecord, lockToken: string): Promise<ConnectionRecord | null>;
+/** `BexioOAuth.getAccessToken`. */
+export declare function getAccessToken(ctx: ClientContext, selector: GrantSelector): Promise<AccessToken>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../src/refresh.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE7D,+DAA+D;AAC/D,eAAO,MAAM,cAAc,QAAS,CAAC;AAIrC,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,GACpD,IAAI,CAAC,4BAA4B,CAAC;AAEpC,qFAAqF;AACrF,wBAAgB,WAAW,CACzB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,IAAI,GACR;IAAE,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAajE;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,UAAU,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAKxE;AAED,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI;;;;EAMvD;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,aAAa,EAClB,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoElC;AAID,mCAAmC;AACnC,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,WAAW,CAAC,CAqDtB"}