@soulcode/bexio-oauth 0.1.0 → 0.3.0

package/dist/refresh.js

@@ -0,0 +1,147 @@
+import { randomUUID } from "node:crypto";
+import * as oidc from "openid-client";
+import { BexioOAuthError, isBexioOAuthError } from "./errors.js";
+import { bindingOf, decryptFor, issue, resolveGrant } from "./grants.js";
+import { describe } from "./oidc.js";
+import { fetchRole } from "./permissions.js";
+/** Refresh a little before the access token really expires. */
+export const EXPIRY_SKEW_MS = 30_000;
+/** Extra time `getAccessToken` waits for a concurrent refresh beyond the lock TTL. */
+const WAIT_GRACE_MS = 5_000;
+/** Absolute expiries from a token response's `expires_in` / `refresh_expires_in`. */
+export function tokenExpiry(tokens, now) {
+    const expiresIn = tokens.expiresIn();
+    const refreshExpiresIn = Number(tokens.refresh_expires_in);
+    return {
+        accessExpiresAt: expiresIn === undefined
+            ? null
+            : new Date(now.getTime() + expiresIn * 1000),
+        refreshExpiresAt: Number.isFinite(refreshExpiresIn) && refreshExpiresIn > 0
+            ? new Date(now.getTime() + refreshExpiresIn * 1000)
+            : null,
+    };
+}
+/** True while the access token is valid for longer than the skew. */
+export function isFresh(connection, now) {
+    return (connection.accessExpiresAt !== null &&
+        connection.accessExpiresAt.getTime() - EXPIRY_SKEW_MS > now.getTime());
+}
+/** A new lock holder's token and lease, starting at `now`. */
+export function lockWindow(ctx, now) {
+    return {
+        now,
+        lockUntil: new Date(now.getTime() + ctx.lockTtlMs),
+        lockToken: randomUUID(),
+    };
+}
+/**
+ * Refreshes a connection whose lock the caller holds (`lockToken`). Every
+ * write is fenced by the token: if the lock was lost (expired and taken over,
+ * or the connection was reconnected meanwhile), the write changes nothing and
+ * this returns `null`: the caller re-reads the connection.
+ */
+export async function refreshLocked(ctx, connection, lockToken) {
+    const { store, cipher, clock } = ctx;
+    if (!connection.refreshToken) {
+        if (!(await store.markReauthRequired(connection.id, lockToken, clock())))
+            return null;
+        throw new BexioOAuthError("reauth_required", "connection has no refresh token; reconnect required");
+    }
+    let refreshToken;
+    try {
+        refreshToken = await decryptFor(cipher, connection, connection.refreshToken);
+    }
+    catch (error) {
+        // Usually a keyring mistake (a key removed too early): don't burn the
+        // connection, so restoring the key fixes it.
+        await store.releaseRefreshLock(connection.id, lockToken);
+        throw error;
+    }
+    let tokens;
+    try {
+        tokens = await oidc.refreshTokenGrant(await ctx.oidc.config(), refreshToken);
+    }
+    catch (error) {
+        if (error instanceof oidc.ResponseBodyError &&
+            error.error === "invalid_grant") {
+            // A reconnect during the refresh restarts the chain at Bexio, which
+            // rejects this (older) refresh token. If the reconnect's write already
+            // landed, it cleared our lock: nothing is marked and the caller reads
+            // the new tokens. If it lands later, it revives the connection then.
+            if (!(await store.markReauthRequired(connection.id, lockToken, clock())))
+                return null;
+            throw new BexioOAuthError("reauth_required", "Bexio rejected the refresh token; reconnect required", { cause: describe(error) });
+        }
+        await store.releaseRefreshLock(connection.id, lockToken);
+        if (isBexioOAuthError(error))
+            throw error;
+        throw new BexioOAuthError("idp_error", "token refresh failed", {
+            cause: describe(error),
+        });
+    }
+    const now = clock();
+    const binding = bindingOf(connection);
+    // null: lock lost while refreshing (someone reconnected, or our lock
+    // expired and another caller took over). Their write wins.
+    return store.saveRefreshed(connection.id, lockToken, {
+        accessToken: await cipher.encrypt(tokens.access_token, binding),
+        refreshToken: tokens.refresh_token
+            ? await cipher.encrypt(tokens.refresh_token, binding)
+            : null,
+        ...tokenExpiry(tokens, now),
+        scope: tokens.scope ?? null,
+        role: await fetchRole(ctx.fetchImpl, ctx.apiBaseUrl, tokens.access_token),
+        now,
+    });
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** `BexioOAuth.getAccessToken`. */
+export async function getAccessToken(ctx, selector) {
+    const { store, clock } = ctx;
+    const grant = await resolveGrant(store, selector);
+    let connection = grant.connection;
+    const deadline = clock().getTime() + ctx.lockTtlMs + WAIT_GRACE_MS;
+    let wait = 50;
+    const reread = async () => {
+        const current = await store.getConnection(connection.id);
+        if (!current)
+            throw new BexioOAuthError("not_connected", "grant was disconnected");
+        return current;
+    };
+    for (;;) {
+        if (connection.status === "reauth_required") {
+            throw new BexioOAuthError("reauth_required", "grant needs to be reconnected");
+        }
+        const now = clock();
+        if (isFresh(connection, now))
+            return issue(ctx.cipher, grant, connection);
+        // Every iteration that would do more work is bounded, whether the last
+        // one waited for another refresher or lost its own lock.
+        if (now.getTime() > deadline) {
+            throw new BexioOAuthError("idp_error", "timed out waiting for a concurrent token refresh");
+        }
+        // Discovery outside the lock, so a cold start doesn't eat into it.
+        await ctx.oidc.config();
+        const window = lockWindow(ctx, clock());
+        const locked = await store.acquireRefreshLock({
+            id: connection.id,
+            ...window,
+            accessExpiresBefore: new Date(now.getTime() + EXPIRY_SKEW_MS),
+        });
+        if (locked) {
+            const refreshed = await refreshLocked(ctx, locked, window.lockToken);
+            if (refreshed)
+                return issue(ctx.cipher, grant, refreshed);
+            // Lost the lock to a reconnect or another refresher: look at their
+            // result before anything else (it may be fresh, or reauth_required).
+            connection = await reread();
+            continue;
+        }
+        // Someone else (possibly for another owner of this connection) is
+        // refreshing, or just did: wait for their result.
+        await sleep(wait);
+        wait = Math.min(wait * 2, 1_000);
+        connection = await reread();
+    }
+}
+//# sourceMappingURL=refresh.js.map

package/dist/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../src/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,sFAAsF;AACtF,MAAM,aAAa,GAAG,KAAK,CAAC;AAK5B,qFAAqF;AACrF,MAAM,UAAU,WAAW,CACzB,MAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC3D,OAAO;QACL,eAAe,EACb,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QAChD,gBAAgB,EACd,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC;YACvD,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;YACnD,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,OAAO,CAAC,UAA4B,EAAE,GAAS;IAC7D,OAAO,CACL,UAAU,CAAC,eAAe,KAAK,IAAI;QACnC,UAAU,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,GAAG,CAAC,OAAO,EAAE,CACtE,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,UAAU,CAAC,GAAkB,EAAE,GAAS;IACtD,OAAO;QACL,GAAG;QACH,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;QAClD,SAAS,EAAE,UAAU,EAAE;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAkB,EAClB,UAA4B,EAC5B,SAAiB;IAEjB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,UAAU,CAC7B,MAAM,EACN,UAAU,EACV,UAAU,CAAC,YAAY,CACxB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,6CAA6C;QAC7C,MAAM,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACnC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EACvB,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,IAAI,CAAC,iBAAiB;YACvC,KAAK,CAAC,KAAK,KAAK,eAAe,EAC/B,CAAC;YACD,oEAAoE;YACpE,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,sDAAsD,EACtD,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACzD,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,sBAAsB,EAAE;YAC7D,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,qEAAqE;IACrE,2DAA2D;IAC3D,OAAO,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE;QACnD,WAAW,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC;QAC/D,YAAY,EAAE,MAAM,CAAC,aAAa;YAChC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC;YACrD,CAAC,CAAC,IAAI;QACR,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,IAAI,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC;QACzE,GAAG;KACJ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhF,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAkB,EAClB,QAAuB;IAEvB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,GAAG,aAAa,CAAC;IACnE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC5C,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC1E,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,kDAAkD,CACnD,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC5C,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,GAAG,MAAM;YACT,mBAAmB,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrE,IAAI,SAAS;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAC1D,mEAAmE;YACnE,qEAAqE;YACrE,UAAU,GAAG,MAAM,MAAM,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QAED,kEAAkE;QAClE,kDAAkD;QAClD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACjC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/dist/return-to.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Only same-origin relative paths: blocks open redirects via `returnTo`.
+ * Parsed with the URL parser (the same one the redirect will go through), so
+ * tricks like `/\t/evil.example` are caught, and normalized to path+query+hash.
+ * Returns `fallback` for an empty value; throws `invalid_config` otherwise.
+ */
+export declare function safeReturnTo(value: string | undefined, fallback: string): string;
+//# sourceMappingURL=return-to.d.ts.map

package/dist/return-to.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-to.d.ts","sourceRoot":"","sources":["../src/return-to.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,MAAM,GACf,MAAM,CAqBR"}

package/dist/return-to.js

@@ -0,0 +1,31 @@
+import { BexioOAuthError } from "./errors.js";
+const RETURN_TO_BASE = "https://return-to.invalid";
+/**
+ * Only same-origin relative paths: blocks open redirects via `returnTo`.
+ * Parsed with the URL parser (the same one the redirect will go through), so
+ * tricks like `/\t/evil.example` are caught, and normalized to path+query+hash.
+ * Returns `fallback` for an empty value; throws `invalid_config` otherwise.
+ */
+export function safeReturnTo(value, fallback) {
+    if (!value)
+        return fallback;
+    const invalid = () => new BexioOAuthError("invalid_config", "returnTo must be a relative path like /settings");
+    // eslint-disable-next-line no-control-regex
+    if (!value.startsWith("/") || /[\u0000-\u001f\\]/.test(value))
+        throw invalid();
+    let url;
+    try {
+        url = new URL(value, RETURN_TO_BASE);
+    }
+    catch {
+        throw invalid();
+    }
+    if (url.origin !== RETURN_TO_BASE)
+        throw invalid();
+    // Dot segments can collapse to "//host" (e.g. "/.//evil.example"), which a
+    // browser reads as protocol-relative: check the normalized result too.
+    if (url.pathname.startsWith("//"))
+        throw invalid();
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+//# sourceMappingURL=return-to.js.map

package/dist/return-to.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"return-to.js","sourceRoot":"","sources":["../src/return-to.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAyB,EACzB,QAAgB;IAEhB,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,eAAe,CACjB,gBAAgB,EAChB,iDAAiD,CAClD,CAAC;IACJ,4CAA4C;IAC5C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3D,MAAM,OAAO,EAAE,CAAC;IAClB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc;QAAE,MAAM,OAAO,EAAE,CAAC;IACnD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACnD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC"}

package/dist/sql.d.ts

@@ -4,6 +4,11 @@ export interface Migration {
     name: string;
     sql: string;
 }
-/** The schema migrations shipped with this version, in order. */
+/**
+ * The schema migrations shipped with this version, in order.
+ *
+ * The SQL is embedded in the build (generated from `sql/*.sql`), not read from
+ * disk, so this works unchanged when a bundler inlines the library.
+ */
 export declare function migrations(): Promise<Migration[]>;
 //# sourceMappingURL=sql.d.ts.map

package/dist/sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAKD,iEAAiE;AACjE,wBAAsB,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAWvD"}
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAEvD"}

package/dist/sql.js

@@ -1,15 +1,11 @@
-import { readdir, readFile } from "node:fs/promises";
-// `sql/` sits next to `src/` and `dist/` in the package.
-const SQL_DIR = new URL("../sql/", import.meta.url);
-/** The schema migrations shipped with this version, in order. */
+import { MIGRATIONS } from "./migrations.generated.js";
+/**
+ * The schema migrations shipped with this version, in order.
+ *
+ * The SQL is embedded in the build (generated from `sql/*.sql`), not read from
+ * disk, so this works unchanged when a bundler inlines the library.
+ */
 export async function migrations() {
-    const files = (await readdir(SQL_DIR))
-        .filter((f) => /^\d{4}_.+\.sql$/.test(f))
-        .sort();
-    return Promise.all(files.map(async (name) => ({
-        number: Number.parseInt(name.slice(0, 4), 10),
-        name,
-        sql: await readFile(new URL(name, SQL_DIR), "utf8"),
-    })));
+    return MIGRATIONS.map((m) => ({ ...m }));
 }
 //# sourceMappingURL=sql.js.map

package/dist/sql.js.map

@@ -1 +1 @@
-{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AASrD,yDAAyD;AACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEpD,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACxC,IAAI,EAAE,CAAC;IACV,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI;QACJ,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;KACpD,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AASvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/store/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/store/memory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAGV,UAAU,EAGX,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,wBAAgB,WAAW,IAAI,UAAU,CAgHxC"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/store/memory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAIV,UAAU,EAGX,MAAM,YAAY,CAAC;AASpB;;;GAGG;AACH,wBAAgB,WAAW,IAAI,UAAU,CA0JxC"}

package/dist/store/memory.js

@@ -4,42 +4,86 @@ import { randomUUID } from "node:crypto";
  * lives in this process only.
  */
 export function memoryStore() {
-    const rows = new Map();
+    const connections = new Map();
+    const grants = new Map();
     const lockTokens = new Map();
     const copy = (row) => ({ ...row });
+    const joined = (grant) => ({
+        id: grant.id,
+        ownerId: grant.ownerId,
+        createdAt: grant.createdAt,
+        connection: copy(connections.get(grant.connectionId)),
+    });
+    const held = (id, lockToken) => {
+        const row = connections.get(id);
+        if (!row || lockTokens.get(id) !== lockToken)
+            return null;
+        lockTokens.delete(id);
+        row.refreshLockedUntil = null;
+        return row;
+    };
     return {
         async upsertGrant(input) {
-            const existing = [...rows.values()].find((r) => r.ownerId === input.ownerId &&
-                r.companyId === input.companyId &&
-                r.userId === input.userId);
-            const { now, ...fields } = input;
-            const row = {
-                id: existing?.id ?? randomUUID(),
-                ...fields,
-                status: "active",
-                refreshLockedUntil: null,
-                lastRefreshedAt: now,
-                createdAt: existing?.createdAt ?? now,
-                updatedAt: now,
-            };
-            rows.set(row.id, row);
-            lockTokens.delete(row.id);
-            return copy(row);
+            const { ownerId, now, ...fields } = input;
+            const existing = [...connections.values()].find((c) => c.companyId === input.companyId && c.userId === input.userId);
+            // An older authorization than the stored one only links the grant
+            // (see GrantUpsert).
+            const connection = existing && input.authorizedAt < existing.authorizedAt
+                ? existing
+                : {
+                    id: existing?.id ?? randomUUID(),
+                    ...fields,
+                    status: "active",
+                    refreshLockedUntil: null,
+                    lastRefreshedAt: now,
+                    createdAt: existing?.createdAt ?? now,
+                    updatedAt: now,
+                };
+            if (connection !== existing) {
+                connections.set(connection.id, connection);
+                lockTokens.delete(connection.id);
+            }
+            let grant = [...grants.values()].find((g) => g.ownerId === ownerId && g.connectionId === connection.id);
+            if (!grant) {
+                grant = {
+                    id: randomUUID(),
+                    ownerId,
+                    connectionId: connection.id,
+                    createdAt: now,
+                };
+                grants.set(grant.id, grant);
+            }
+            return joined(grant);
         },
         async findGrants({ ownerId, companyId, grantId }) {
-            return [...rows.values()]
-                .filter((r) => r.ownerId === ownerId &&
-                (companyId === undefined || r.companyId === companyId) &&
-                (grantId === undefined || r.id === grantId))
+            return [...grants.values()]
+                .filter((g) => g.ownerId === ownerId &&
+                (companyId === undefined ||
+                    connections.get(g.connectionId).companyId === companyId) &&
+                (grantId === undefined || g.id === grantId))
                 .sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime())
-                .map(copy);
+                .map(joined);
         },
-        async getGrant(id) {
-            const row = rows.get(id);
+        async deleteGrant(id) {
+            grants.delete(id);
+        },
+        async getConnection(id) {
+            const row = connections.get(id);
             return row ? copy(row) : null;
         },
+        async deleteUnusedConnection(id) {
+            const row = connections.get(id);
+            if (!row || [...grants.values()].some((g) => g.connectionId === id))
+                return null;
+            connections.delete(id);
+            lockTokens.delete(id);
+            return {
+                connection: copy(row),
+                userHasOtherConnections: [...connections.values()].some((c) => c.userId === row.userId),
+            };
+        },
         async acquireRefreshLock(req) {
-            const row = rows.get(req.id);
+            const row = connections.get(req.id);
             if (!row || row.status !== "active")
                 return null;
             if (row.refreshLockedUntil && row.refreshLockedUntil > req.now)
@@ -56,10 +100,9 @@ export function memoryStore() {
             return copy(row);
         },
         async saveRefreshed(id, lockToken, refresh) {
-            const row = rows.get(id);
-            if (!row || lockTokens.get(id) !== lockToken)
+            const row = held(id, lockToken);
+            if (!row)
                 return null;
-            lockTokens.delete(id);
             row.accessToken = refresh.accessToken;
             row.refreshToken = refresh.refreshToken ?? row.refreshToken;
             row.accessExpiresAt = refresh.accessExpiresAt;
@@ -67,34 +110,27 @@ export function memoryStore() {
             row.scope = refresh.scope ?? row.scope;
             row.role = refresh.role ?? row.role;
             row.status = "active";
-            row.refreshLockedUntil = null;
             row.lastRefreshedAt = refresh.now;
             row.updatedAt = refresh.now;
             return copy(row);
         },
         async markReauthRequired(id, lockToken, now) {
-            const row = rows.get(id);
-            if (!row || lockTokens.get(id) !== lockToken)
-                return;
-            lockTokens.delete(id);
+            const row = held(id, lockToken);
+            if (!row)
+                return null;
             row.status = "reauth_required";
-            row.refreshLockedUntil = null;
             row.updatedAt = now;
+            return copy(row);
         },
         async releaseRefreshLock(id, lockToken) {
-            const row = rows.get(id);
-            if (!row || lockTokens.get(id) !== lockToken)
-                return;
-            lockTokens.delete(id);
-            row.refreshLockedUntil = null;
-        },
-        async deleteGrant(id) {
-            rows.delete(id);
-            lockTokens.delete(id);
+            held(id, lockToken);
         },
-        async listIdleGrants({ refreshedBefore, limit }) {
-            return [...rows.values()]
-                .filter((r) => r.status === "active" && r.lastRefreshedAt < refreshedBefore)
+        async listIdleConnections({ refreshedBefore, limit }) {
+            const linked = new Set([...grants.values()].map((g) => g.connectionId));
+            return [...connections.values()]
+                .filter((c) => c.status === "active" &&
+                c.lastRefreshedAt < refreshedBefore &&
+                linked.has(c.id))
                 .sort((a, b) => a.lastRefreshedAt.getTime() - b.lastRefreshedAt.getTime())
                 .slice(0, limit)
                 .map(copy);

package/dist/store/memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/store/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAgB,EAAe,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IAE7D,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,KAAkB;YAClC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAC3B,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBAC/B,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAC5B,CAAC;YACF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC;YACjC,MAAM,GAAG,GAAgB;gBACvB,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,UAAU,EAAE;gBAChC,GAAG,MAAM;gBACT,MAAM,EAAE,QAAQ;gBAChB,kBAAkB,EAAE,IAAI;gBACxB,eAAe,EAAE,GAAG;gBACpB,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;gBACrC,SAAS,EAAE,GAAG;aACf,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACtB,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;YAC9C,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;iBACtB,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,OAAO;gBACrB,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;gBACtD,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAC9C;iBACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;iBAC7D,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,GAAgB;YACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,GAAG;gBAC5D,OAAO,IAAI,CAAC;YACd,MAAM,YAAY,GAChB,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,GAAG,CAAC,eAAe,KAAK,IAAI;oBAC3B,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBACpD,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS;oBAChC,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;YAC/C,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAC/B,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,SAAS,CAAC;YACvC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAqB;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC1D,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACtC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC;YAC5D,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;YAC9C,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,CAAC;YACxE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;YACvC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;YACpC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;YACtB,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC9B,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC;YAClC,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,OAAO;YACrD,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,GAAG,CAAC,MAAM,GAAG,iBAAiB,CAAC;YAC/B,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC9B,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,OAAO;YACrD,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;YAC7C,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;iBACtB,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,GAAG,eAAe,CACpE;iBACA,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,CACpE;iBACA,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/store/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiBzC;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAqB,EAAoB,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,KAAkB,EAAe,EAAE,CAAC,CAAC;QACnD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAE,CAAC;KACvD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,SAAiB,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1D,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,KAAkB;YAClC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC;YAC1C,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CACpE,CAAC;YACF,kEAAkE;YAClE,qBAAqB;YACrB,MAAM,UAAU,GACd,QAAQ,IAAI,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY;gBACpD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC;oBACE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,UAAU,EAAE;oBAChC,GAAG,MAAM;oBACT,MAAM,EAAE,QAAQ;oBAChB,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,GAAG;oBACpB,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;oBACrC,SAAS,EAAE,GAAG;iBACf,CAAC;YACR,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5B,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;gBAC3C,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,YAAY,KAAK,UAAU,CAAC,EAAE,CACjE,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG;oBACN,EAAE,EAAE,UAAU,EAAE;oBAChB,OAAO;oBACP,YAAY,EAAE,UAAU,CAAC,EAAE;oBAC3B,SAAS,EAAE,GAAG;iBACf,CAAC;gBACF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;YAC9C,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;iBACxB,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,OAAO;gBACrB,CAAC,SAAS,KAAK,SAAS;oBACtB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAE,CAAC,SAAS,KAAK,SAAS,CAAC;gBAC3D,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAC9C;iBACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;iBAC7D,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE;YACpB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,EAAE;YAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC;gBACrB,uBAAuB,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAC/B;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,GAAgB;YACvC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,GAAG;gBAC5D,OAAO,IAAI,CAAC;YACd,MAAM,YAAY,GAChB,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,GAAG,CAAC,eAAe,KAAK,IAAI;oBAC3B,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBACpD,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS;oBAChC,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;YAC/C,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAC/B,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,SAAS,CAAC;YACvC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAA0B;YAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACtC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC;YAC5D,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;YAC9C,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,CAAC;YACxE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;YACvC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;YACpC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;YACtB,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC;YAClC,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,GAAG,CAAC,MAAM,GAAG,iBAAiB,CAAC;YAC/B,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;YACpB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS;YACpC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;YAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;iBAC7B,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,QAAQ;gBACrB,CAAC,CAAC,eAAe,GAAG,eAAe;gBACnC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACnB;iBACA,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,CACpE;iBACA,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/store/postgres.d.ts

@@ -5,13 +5,13 @@ import type { GrantStore } from "./types.js";
  */
 export interface SqlClient {
     query(text: string, params?: unknown[]): Promise<{
-        rows: any[];
+        rows: unknown[];
     }>;
 }
 /**
- * Grant store on the `bexio_grants` table (create it with
- * `npx @soulcode/bexio-oauth sql`). Every operation is a single statement,
- * so it works through transaction-mode poolers and HTTP drivers.
+ * Store on the `bexio_connections` and `bexio_grants` tables (create them
+ * with `npx @soulcode/bexio-oauth sql`). Every operation is a single
+ * statement, so it works through transaction-mode poolers and HTTP drivers.
  */
 export declare function postgresStore(sql: SqlClient): GrantStore;
 //# sourceMappingURL=postgres.d.ts.map

package/dist/store/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/store/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,SAAS;IAExB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC,CAAC;CACnE;AAgED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAmKxD"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/store/postgres.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiC,UAAU,EAAE,MAAM,YAAY,CAAC;AAE5E;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CACvE;AA4HD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CA0MxD"}