@soulcode/bexio-oauth 0.1.0 → 0.3.0

package/dist/store/postgres.js

@@ -1,16 +1,53 @@
-const COLUMNS = `id, owner_id, bexio_company_id, bexio_user_id, bexio_company_user_id,
+import { BexioOAuthError } from "../errors.js";
+// `id` columns are uuids: any other value matches no row, and would make
+// Postgres reject the cast instead of returning nothing.
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const CONNECTION_COLUMNS = `id, bexio_company_id, bexio_user_id, bexio_company_user_id,
   company_name, user_name, user_email, role, status, access_token, refresh_token,
   access_expires_at, refresh_expires_at, scope, refresh_locked_until,
-  last_refreshed_at, created_at, updated_at`;
+  authorized_at, last_refreshed_at, created_at, updated_at`;
+/** Connection columns qualified with `c.`, for joins. */
+const C_COLUMNS = CONNECTION_COLUMNS.split(",")
+    .map((column) => `c.${column.trim()}`)
+    .join(", ");
+/** A grant joined with its connection (`c`) and the grant (`g`). */
+const GRANT_COLUMNS = `g.id AS grant_id, g.owner_id, g.created_at AS grant_created_at, ${C_COLUMNS}`;
+/**
+ * The connection's columns an upsert sets, and the value each takes. They
+ * change only for an authorization at least as new as the stored one: Bexio
+ * has invalidated the older chain, so a slow connect that authorized earlier
+ * must not overwrite a later one. The grant is linked either way.
+ */
+const UPSERT_VALUES = [
+    ["bexio_company_user_id", "EXCLUDED.bexio_company_user_id"],
+    ["company_name", "EXCLUDED.company_name"],
+    ["user_name", "EXCLUDED.user_name"],
+    ["user_email", "EXCLUDED.user_email"],
+    ["role", "EXCLUDED.role"],
+    ["status", "'active'"],
+    ["access_token", "EXCLUDED.access_token"],
+    ["refresh_token", "EXCLUDED.refresh_token"],
+    ["access_expires_at", "EXCLUDED.access_expires_at"],
+    ["refresh_expires_at", "EXCLUDED.refresh_expires_at"],
+    ["scope", "EXCLUDED.scope"],
+    ["refresh_locked_until", "NULL"],
+    ["refresh_lock_token", "NULL"],
+    ["authorized_at", "EXCLUDED.authorized_at"],
+    ["last_refreshed_at", "EXCLUDED.last_refreshed_at"],
+    ["updated_at", "EXCLUDED.updated_at"],
+];
+const NEWER_AUTHORIZATION_WINS = UPSERT_VALUES.map(([column, value]) => `${column} = CASE WHEN EXCLUDED.authorized_at >= bexio_connections.authorized_at
+       THEN ${value} ELSE bexio_connections.${column} END`).join(",\n             ");
+/** SQLSTATE for a foreign key violation. */
+const FOREIGN_KEY_VIOLATION = "23503";
 function date(value) {
     if (value === null)
         return null;
     return value instanceof Date ? value : new Date(value);
 }
-function toRecord(row) {
+function toConnection(row) {
     return {
         id: row.id,
-        ownerId: row.owner_id,
         companyId: row.bexio_company_id,
         userId: row.bexio_user_id,
         companyUserId: row.bexio_company_user_id === null
@@ -27,49 +64,49 @@ function toRecord(row) {
         refreshExpiresAt: date(row.refresh_expires_at),
         scope: row.scope,
         refreshLockedUntil: date(row.refresh_locked_until),
+        authorizedAt: date(row.authorized_at),
         lastRefreshedAt: date(row.last_refreshed_at),
         createdAt: date(row.created_at),
         updatedAt: date(row.updated_at),
     };
 }
+function toGrant(row) {
+    return {
+        id: row.grant_id,
+        ownerId: row.owner_id,
+        createdAt: date(row.grant_created_at),
+        connection: toConnection(row),
+    };
+}
 /**
- * Grant store on the `bexio_grants` table (create it with
- * `npx @soulcode/bexio-oauth sql`). Every operation is a single statement,
- * so it works through transaction-mode poolers and HTTP drivers.
+ * Store on the `bexio_connections` and `bexio_grants` tables (create them
+ * with `npx @soulcode/bexio-oauth sql`). Every operation is a single
+ * statement, so it works through transaction-mode poolers and HTTP drivers.
  */
 export function postgresStore(sql) {
-    const one = async (text, params) => {
+    const connection = async (text, params) => {
         const { rows } = await sql.query(text, params);
-        return rows[0] ? toRecord(rows[0]) : null;
-    };
-    const many = async (text, params) => {
-        const { rows } = await sql.query(text, params);
-        return rows.map(toRecord);
+        return rows[0] ? toConnection(rows[0]) : null;
     };
     return {
         async upsertGrant(g) {
-            const row = await one(`INSERT INTO bexio_grants (owner_id, bexio_company_id, bexio_user_id,
-           bexio_company_user_id, company_name, user_name, user_email, role, status,
-           access_token, refresh_token, access_expires_at, refresh_expires_at, scope,
-           refresh_locked_until, last_refreshed_at, created_at, updated_at)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'active', $9, $10, $11, $12, $13, NULL, $14, $14, $14)
-         ON CONFLICT (owner_id, bexio_company_id, bexio_user_id) DO UPDATE SET
-           bexio_company_user_id = EXCLUDED.bexio_company_user_id,
-           company_name = EXCLUDED.company_name,
-           user_name = EXCLUDED.user_name,
-           user_email = EXCLUDED.user_email,
-           role = EXCLUDED.role,
-           status = 'active',
-           access_token = EXCLUDED.access_token,
-           refresh_token = EXCLUDED.refresh_token,
-           access_expires_at = EXCLUDED.access_expires_at,
-           refresh_expires_at = EXCLUDED.refresh_expires_at,
-           scope = EXCLUDED.scope,
-           refresh_locked_until = NULL,
-           refresh_lock_token = NULL,
-           last_refreshed_at = EXCLUDED.last_refreshed_at,
-           updated_at = EXCLUDED.updated_at
-         RETURNING ${COLUMNS}`, [
+            const { rows } = await sql.query(`WITH connection AS (
+           INSERT INTO bexio_connections (bexio_company_id, bexio_user_id,
+             bexio_company_user_id, company_name, user_name, user_email, role, status,
+             access_token, refresh_token, access_expires_at, refresh_expires_at, scope,
+             refresh_locked_until, refresh_lock_token, authorized_at, last_refreshed_at,
+             created_at, updated_at)
+           VALUES ($2, $3, $4, $5, $6, $7, $8, 'active', $9, $10, $11, $12, $13, NULL, NULL, $15, $14, $14, $14)
+           ON CONFLICT (bexio_company_id, bexio_user_id) DO UPDATE SET
+             ${NEWER_AUTHORIZATION_WINS}
+           RETURNING ${CONNECTION_COLUMNS}
+         ), g AS (
+           INSERT INTO bexio_grants (owner_id, connection_id, created_at)
+           SELECT $1, id, $14 FROM connection
+           ON CONFLICT (owner_id, connection_id) DO UPDATE SET owner_id = EXCLUDED.owner_id
+           RETURNING id, owner_id, created_at
+         )
+         SELECT ${GRANT_COLUMNS} FROM g, connection c`, [
                 g.ownerId,
                 g.companyId,
                 g.userId,
@@ -84,23 +121,64 @@ export function postgresStore(sql) {
                 g.refreshExpiresAt,
                 g.scope,
                 g.now,
+                g.authorizedAt,
             ]);
-            if (!row)
-                throw new Error("upsert returned no row");
-            return row;
+            if (!rows[0]) {
+                throw new BexioOAuthError("invalid_config", "SqlClient returned no row for INSERT … RETURNING; check the driver wrapper");
+            }
+            return toGrant(rows[0]);
         },
         async findGrants({ ownerId, companyId, grantId }) {
-            return many(`SELECT ${COLUMNS} FROM bexio_grants
-         WHERE owner_id = $1
-           AND ($2::text IS NULL OR bexio_company_id = $2)
-           AND ($3::uuid IS NULL OR id = $3::uuid)
-         ORDER BY created_at, id`, [ownerId, companyId ?? null, grantId ?? null]);
+            if (grantId !== undefined && !UUID.test(grantId))
+                return [];
+            const { rows } = await sql.query(`SELECT ${GRANT_COLUMNS}
+         FROM bexio_grants g JOIN bexio_connections c ON c.id = g.connection_id
+         WHERE g.owner_id = $1
+           AND ($2::text IS NULL OR c.bexio_company_id = $2)
+           AND ($3::uuid IS NULL OR g.id = $3::uuid)
+         ORDER BY g.created_at, g.id`, [ownerId, companyId ?? null, grantId ?? null]);
+            return rows.map(toGrant);
+        },
+        async deleteGrant(id) {
+            if (!UUID.test(id))
+                return;
+            await sql.query(`DELETE FROM bexio_grants WHERE id = $1`, [id]);
         },
-        async getGrant(id) {
-            return one(`SELECT ${COLUMNS} FROM bexio_grants WHERE id = $1`, [id]);
+        async getConnection(id) {
+            if (!UUID.test(id))
+                return null;
+            return connection(`SELECT ${CONNECTION_COLUMNS} FROM bexio_connections WHERE id = $1`, [id]);
+        },
+        // NOT EXISTS reads the statement's snapshot, so it can miss a grant that
+        // a concurrent upsertGrant commits meanwhile. The foreign key catches
+        // that case: it checks against committed data and fails the delete.
+        async deleteUnusedConnection(id) {
+            if (!UUID.test(id))
+                return null;
+            try {
+                const { rows } = await sql.query(`DELETE FROM bexio_connections c
+           WHERE c.id = $1
+             AND NOT EXISTS (SELECT 1 FROM bexio_grants g WHERE g.connection_id = c.id)
+           RETURNING ${C_COLUMNS}, EXISTS (
+             SELECT 1 FROM bexio_connections o
+             WHERE o.bexio_user_id = c.bexio_user_id AND o.id <> c.id
+           ) AS user_has_other_connections`, [id]);
+                const row = rows[0];
+                return row
+                    ? {
+                        connection: toConnection(row),
+                        userHasOtherConnections: row.user_has_other_connections,
+                    }
+                    : null;
+            }
+            catch (error) {
+                if (error.code === FOREIGN_KEY_VIOLATION)
+                    return null;
+                throw error;
+            }
         },
         async acquireRefreshLock({ id, now, lockUntil, lockToken, accessExpiresBefore, refreshedBefore, }) {
-            return one(`UPDATE bexio_grants SET refresh_locked_until = $3, refresh_lock_token = $6
+            return connection(`UPDATE bexio_connections SET refresh_locked_until = $3, refresh_lock_token = $6
          WHERE id = $1
            AND status = 'active'
            AND (refresh_locked_until IS NULL OR refresh_locked_until <= $2)
@@ -108,7 +186,7 @@ export function postgresStore(sql) {
              ($4::timestamptz IS NOT NULL AND (access_expires_at IS NULL OR access_expires_at <= $4))
              OR ($5::timestamptz IS NOT NULL AND last_refreshed_at < $5)
            )
-         RETURNING ${COLUMNS}`, [
+         RETURNING ${CONNECTION_COLUMNS}`, [
                 id,
                 now,
                 lockUntil,
@@ -120,7 +198,7 @@ export function postgresStore(sql) {
         // Holder writes are fenced by refresh_lock_token: a holder whose lock
         // expired or was cleared by a reconnect matches no row and changes nothing.
         async saveRefreshed(id, lockToken, r) {
-            return one(`UPDATE bexio_grants SET
+            return connection(`UPDATE bexio_connections SET
            access_token = $2,
            refresh_token = COALESCE($3, refresh_token),
            access_expires_at = $4,
@@ -133,7 +211,7 @@ export function postgresStore(sql) {
            last_refreshed_at = $8,
            updated_at = $8
          WHERE id = $1 AND refresh_lock_token = $9
-         RETURNING ${COLUMNS}`, [
+         RETURNING ${CONNECTION_COLUMNS}`, [
                 id,
                 r.accessToken,
                 r.refreshToken,
@@ -146,22 +224,22 @@ export function postgresStore(sql) {
             ]);
         },
         async markReauthRequired(id, lockToken, now) {
-            await sql.query(`UPDATE bexio_grants SET status = 'reauth_required',
+            return connection(`UPDATE bexio_connections SET status = 'reauth_required',
            refresh_locked_until = NULL, refresh_lock_token = NULL, updated_at = $2
-         WHERE id = $1 AND refresh_lock_token = $3`, [id, now, lockToken]);
+         WHERE id = $1 AND refresh_lock_token = $3
+         RETURNING ${CONNECTION_COLUMNS}`, [id, now, lockToken]);
         },
         async releaseRefreshLock(id, lockToken) {
-            await sql.query(`UPDATE bexio_grants SET refresh_locked_until = NULL, refresh_lock_token = NULL
+            await sql.query(`UPDATE bexio_connections SET refresh_locked_until = NULL, refresh_lock_token = NULL
          WHERE id = $1 AND refresh_lock_token = $2`, [id, lockToken]);
         },
-        async deleteGrant(id) {
-            await sql.query(`DELETE FROM bexio_grants WHERE id = $1`, [id]);
-        },
-        async listIdleGrants({ refreshedBefore, limit }) {
-            return many(`SELECT ${COLUMNS} FROM bexio_grants
-         WHERE status = 'active' AND last_refreshed_at < $1
-         ORDER BY last_refreshed_at
+        async listIdleConnections({ refreshedBefore, limit }) {
+            const { rows } = await sql.query(`SELECT ${CONNECTION_COLUMNS} FROM bexio_connections c
+         WHERE c.status = 'active' AND c.last_refreshed_at < $1
+           AND EXISTS (SELECT 1 FROM bexio_grants g WHERE g.connection_id = c.id)
+         ORDER BY c.last_refreshed_at
          LIMIT $2`, [refreshedBefore, limit]);
+            return rows.map(toConnection);
         },
     };
 }

package/dist/store/postgres.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../src/store/postgres.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,GAAG;;;4CAG4B,CAAC;AA2B7C,SAAS,IAAI,CAAC,KAA2B;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAQ;IACxB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,SAAS,EAAE,GAAG,CAAC,gBAAgB;QAC/B,MAAM,EAAE,GAAG,CAAC,aAAa;QACzB,aAAa,EACX,GAAG,CAAC,qBAAqB,KAAK,IAAI;YAChC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACvC,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC9C,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClD,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAQ,IAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,CAAC;YACjB,MAAM,GAAG,GAAG,MAAM,GAAG,CACnB;;;;;;;;;;;;;;;;;;;;;qBAqBa,OAAO,EAAE,EACtB;gBACE,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG;aACN,CACF,CAAC;YACF,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACpD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;YAC9C,OAAO,IAAI,CACT,UAAU,OAAO;;;;iCAIQ,EACzB,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,CAC9C,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,OAAO,GAAG,CAAC,UAAU,OAAO,kCAAkC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,EAAE,EACF,GAAG,EACH,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,eAAe,GAChB;YACC,OAAO,GAAG,CACR;;;;;;;;qBAQa,OAAO,EAAE,EACtB;gBACE,EAAE;gBACF,GAAG;gBACH,SAAS;gBACT,mBAAmB,IAAI,IAAI;gBAC3B,eAAe,IAAI,IAAI;gBACvB,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,4EAA4E;QAC5E,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;YAClC,OAAO,GAAG,CACR;;;;;;;;;;;;;qBAaa,OAAO,EAAE,EACtB;gBACE,EAAE;gBACF,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,GAAG;gBACL,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG;YACzC,MAAM,GAAG,CAAC,KAAK,CACb;;mDAE2C,EAC3C,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CACrB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS;YACpC,MAAM,GAAG,CAAC,KAAK,CACb;mDAC2C,EAC3C,CAAC,EAAE,EAAE,SAAS,CAAC,CAChB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,MAAM,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;YAC7C,OAAO,IAAI,CACT,UAAU,OAAO;;;kBAGP,EACV,CAAC,eAAe,EAAE,KAAK,CAAC,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../src/store/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAW/C,yEAAyE;AACzE,yDAAyD;AACzD,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,MAAM,kBAAkB,GAAG;;;2DAGgC,CAAC;AAE5D,yDAAyD;AACzD,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC;KAC5C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;KACrC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEd,oEAAoE;AACpE,MAAM,aAAa,GAAG,mEAAmE,SAAS,EAAE,CAAC;AAErG;;;;;GAKG;AACH,MAAM,aAAa,GAAsC;IACvD,CAAC,uBAAuB,EAAE,gCAAgC,CAAC;IAC3D,CAAC,cAAc,EAAE,uBAAuB,CAAC;IACzC,CAAC,WAAW,EAAE,oBAAoB,CAAC;IACnC,CAAC,YAAY,EAAE,qBAAqB,CAAC;IACrC,CAAC,MAAM,EAAE,eAAe,CAAC;IACzB,CAAC,QAAQ,EAAE,UAAU,CAAC;IACtB,CAAC,cAAc,EAAE,uBAAuB,CAAC;IACzC,CAAC,eAAe,EAAE,wBAAwB,CAAC;IAC3C,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;IACnD,CAAC,oBAAoB,EAAE,6BAA6B,CAAC;IACrD,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAC3B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAC9B,CAAC,eAAe,EAAE,wBAAwB,CAAC;IAC3C,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;IACnD,CAAC,YAAY,EAAE,qBAAqB,CAAC;CACtC,CAAC;AACF,MAAM,wBAAwB,GAAG,aAAa,CAAC,GAAG,CAChD,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAClB,GAAG,MAAM;cACC,KAAK,2BAA2B,MAAM,MAAM,CACzD,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAE3B,4CAA4C;AAC5C,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAiCtC,SAAS,IAAI,CAAC,KAA2B;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB;IACtC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,gBAAgB;QAC/B,MAAM,EAAE,GAAG,CAAC,aAAa;QACzB,aAAa,EACX,GAAG,CAAC,qBAAqB,KAAK,IAAI;YAChC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACvC,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC9C,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;QACrC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAAa;IAC5B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,QAAQ;QAChB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACrC,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;QAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,CAAC;YACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAC9B;;;;;;;;eAQO,wBAAwB;uBAChB,kBAAkB;;;;;;;kBAOvB,aAAa,uBAAuB,EAC9C;gBACE,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,YAAY;aACf,CACF,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACb,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAa,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;YAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAC9B,UAAU,aAAa;;;;;qCAKM,EAC7B,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,CAC9C,CAAC;YACF,OAAQ,IAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO;YAC3B,MAAM,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE;YACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,UAAU,CACf,UAAU,kBAAkB,uCAAuC,EACnE,CAAC,EAAE,CAAC,CACL,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,oEAAoE;QACpE,KAAK,CAAC,sBAAsB,CAAC,EAAE;YAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAC9B;;;uBAGa,SAAS;;;2CAGW,EACjC,CAAC,EAAE,CAAC,CACL,CAAC;gBACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CACqD,CAAC;gBACxE,OAAO,GAAG;oBACR,CAAC,CAAC;wBACE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC;wBAC7B,uBAAuB,EAAE,GAAG,CAAC,0BAA0B;qBACxD;oBACH,CAAC,CAAC,IAAI,CAAC;YACX,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA4B,CAAC,IAAI,KAAK,qBAAqB;oBAC9D,OAAO,IAAI,CAAC;gBACd,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,EAAE,EACF,GAAG,EACH,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,eAAe,GAChB;YACC,OAAO,UAAU,CACf;;;;;;;;qBAQa,kBAAkB,EAAE,EACjC;gBACE,EAAE;gBACF,GAAG;gBACH,SAAS;gBACT,mBAAmB,IAAI,IAAI;gBAC3B,eAAe,IAAI,IAAI;gBACvB,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,4EAA4E;QAC5E,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;YAClC,OAAO,UAAU,CACf;;;;;;;;;;;;;qBAaa,kBAAkB,EAAE,EACjC;gBACE,EAAE;gBACF,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,GAAG;gBACL,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG;YACzC,OAAO,UAAU,CACf;;;qBAGa,kBAAkB,EAAE,EACjC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CACrB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS;YACpC,MAAM,GAAG,CAAC,KAAK,CACb;mDAC2C,EAC3C,CAAC,EAAE,EAAE,SAAS,CAAC,CAChB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;YAClD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAC9B,UAAU,kBAAkB;;;;kBAIlB,EACV,CAAC,eAAe,EAAE,KAAK,CAAC,CACzB,CAAC;YACF,OAAQ,IAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/store/types.d.ts

@@ -1,9 +1,12 @@
 import type { Role } from "../permissions.js";
 export type GrantStatus = "active" | "reauth_required";
-/** A stored grant. Token fields hold JWE ciphertext, never plaintext. */
-export interface GrantRecord {
+/**
+ * A stored connection: one Bexio identity (company, user) and the tokens of
+ * its refresh token chain, shared by every owner that connected it. Token
+ * fields hold JWE ciphertext, never plaintext.
+ */
+export interface ConnectionRecord {
     id: string;
-    ownerId: string;
     companyId: string;
     userId: string;
     companyUserId: number | null;
@@ -18,11 +21,26 @@ export interface GrantRecord {
     refreshExpiresAt: Date | null;
     scope: string | null;
     refreshLockedUntil: Date | null;
+    /** When Bexio issued the authorization the tokens belong to. */
+    authorizedAt: Date;
     lastRefreshedAt: Date;
     createdAt: Date;
     updatedAt: Date;
 }
-/** Insert, or overwrite the tokens of, the grant for (owner, company, user). */
+/** A stored grant: one owner's access to a connection. */
+export interface GrantRecord {
+    id: string;
+    ownerId: string;
+    createdAt: Date;
+    connection: ConnectionRecord;
+}
+/**
+ * Upsert of the connection for (company, user) and of the grant for (owner,
+ * that connection). The grant is always linked. The connection takes the new
+ * tokens (status `active`, lock cleared) unless it already holds a newer
+ * authorization: Bexio invalidates older chains, so a slow connect that
+ * authorized earlier must not overwrite a later one.
+ */
 export interface GrantUpsert {
     ownerId: string;
     companyId: string;
@@ -37,9 +55,11 @@ export interface GrantUpsert {
     accessExpiresAt: Date | null;
     refreshExpiresAt: Date | null;
     scope: string | null;
+    /** When Bexio issued this authorization (the access token's `iat`). */
+    authorizedAt: Date;
     now: Date;
 }
-export interface GrantRefresh {
+export interface ConnectionRefresh {
     accessToken: string;
     /** `null` keeps the stored refresh token (the IdP didn't rotate it). */
     refreshToken: string | null;
@@ -53,6 +73,7 @@ export interface GrantRefresh {
     now: Date;
 }
 export interface LockRequest {
+    /** The connection to lock. */
     id: string;
     now: Date;
     lockUntil: Date;
@@ -64,42 +85,61 @@ export interface LockRequest {
     lockToken: string;
     /** Lock only if the access token expires before this instant (lazy refresh)… */
     accessExpiresBefore?: Date;
-    /** …or only if the grant was last refreshed before this instant (idle sweep). */
+    /** …or only if the connection was last refreshed before this instant (idle sweep). */
     refreshedBefore?: Date;
 }
 /**
- * Persistence for grants. Every method must be atomic on its own: the
- * library never needs multi-statement transactions.
+ * Persistence for connections and grants. Every method must be atomic on its
+ * own: the library never needs multi-statement transactions.
  */
 export interface GrantStore {
+    /** See `GrantUpsert`. Returns the grant with its connection. */
     upsertGrant(input: GrantUpsert): Promise<GrantRecord>;
+    /** The owner's grants with their connections, oldest first. */
     findGrants(query: {
         ownerId: string;
         companyId?: string;
         grantId?: string;
     }): Promise<GrantRecord[]>;
-    getGrant(id: string): Promise<GrantRecord | null>;
+    /** Deletes one grant; its connection stays. */
+    deleteGrant(id: string): Promise<void>;
+    getConnection(id: string): Promise<ConnectionRecord | null>;
     /**
-     * Takes the refresh lock if the grant is active, not locked (or the lock
-     * expired), and still matches the `accessExpiresBefore` / `refreshedBefore`
-     * condition. Returns the locked row, or `null` if someone else holds the
-     * lock or the grant no longer needs a refresh.
+     * Deletes the connection if no grant references it any more, and returns
+     * the deleted row, plus whether the same Bexio user still has a connection
+     * (for another company). Returns `null` (and changes nothing) while a grant
+     * still references it, including one added concurrently.
      */
-    acquireRefreshLock(request: LockRequest): Promise<GrantRecord | null>;
+    deleteUnusedConnection(id: string): Promise<{
+        connection: ConnectionRecord;
+        userHasOtherConnections: boolean;
+    } | null>;
+    /**
+     * Takes the refresh lock if the connection is active, not locked (or the
+     * lock expired), and still matches the `accessExpiresBefore` /
+     * `refreshedBefore` condition. Returns the locked row, or `null` if someone
+     * else holds the lock or the connection no longer needs a refresh.
+     */
+    acquireRefreshLock(request: LockRequest): Promise<ConnectionRecord | null>;
     /**
      * Stores refreshed tokens, sets `lastRefreshedAt`, and releases the lock.
      * Returns `null` (and changes nothing) unless `lockToken` still holds it.
      */
-    saveRefreshed(id: string, lockToken: string, refresh: GrantRefresh): Promise<GrantRecord | null>;
-    /** Sets `status = reauth_required` and releases the lock, if `lockToken` holds it. */
-    markReauthRequired(id: string, lockToken: string, now: Date): Promise<void>;
+    saveRefreshed(id: string, lockToken: string, refresh: ConnectionRefresh): Promise<ConnectionRecord | null>;
+    /**
+     * Sets `status = reauth_required` and releases the lock. Returns `null`
+     * (and changes nothing) unless `lockToken` still holds it.
+     */
+    markReauthRequired(id: string, lockToken: string, now: Date): Promise<ConnectionRecord | null>;
     /** Releases the lock, if `lockToken` holds it. */
     releaseRefreshLock(id: string, lockToken: string): Promise<void>;
-    deleteGrant(id: string): Promise<void>;
-    /** Active grants last refreshed before `refreshedBefore`, oldest first. */
-    listIdleGrants(query: {
+    /**
+     * Active connections that at least one grant references, last refreshed
+     * before `refreshedBefore`, oldest first.
+     */
+    listIdleConnections(query: {
         refreshedBefore: Date;
         limit: number;
-    }): Promise<GrantRecord[]>;
+    }): Promise<ConnectionRecord[]>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/store/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAEvD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,qCAAqC;IACrC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,qCAAqC;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oCAAoC;IACpC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,IAAI,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,IAAI,CAAC;IAC3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,IAAI,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,UAAU,CAAC,KAAK,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAClD;;;;;OAKG;IACH,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,aAAa,CACX,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC/B,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,2EAA2E;IAC3E,cAAc,CAAC,KAAK,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,gEAAgE;IAChE,YAAY,EAAE,IAAI,CAAC;IACnB,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uEAAuE;IACvE,YAAY,EAAE,IAAI,CAAC;IACnB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,qCAAqC;IACrC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,qCAAqC;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oCAAoC;IACpC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,IAAI,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,IAAI,CAAC;IAC3B,sFAAsF;IACtF,eAAe,CAAC,EAAE,IAAI,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,+DAA+D;IAC/D,UAAU,CAAC,KAAK,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3B,+CAA+C;IAC/C,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAC1C,UAAU,EAAE,gBAAgB,CAAC;QAC7B,uBAAuB,EAAE,OAAO,CAAC;KAClC,GAAG,IAAI,CAAC,CAAC;IACV;;;;;OAKG;IACH,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3E;;;OAGG;IACH,aAAa,CACX,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpC;;;OAGG;IACH,kBAAkB,CAChB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpC,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,mBAAmB,CAAC,KAAK,EAAE;QACzB,eAAe,EAAE,IAAI,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACjC"}

package/dist/types.d.ts

@@ -0,0 +1,164 @@
+import type { Keyring } from "./crypto.js";
+import type { Duration } from "./duration.js";
+import type { Role } from "./permissions.js";
+import type { GrantStatus, GrantStore } from "./store/types.js";
+export interface BexioOAuthConfig {
+    /** From your Bexio OAuth app. */
+    clientId: string;
+    clientSecret: string;
+    /** Must exactly match a redirect URI registered at Bexio. */
+    redirectUri: string;
+    /** Bexio API scopes your app needs; `BASE_SCOPES` are always added. */
+    scopes?: string[];
+    /** Encryption keyring (see `generateKey`). */
+    keys: Keyring;
+    store: GrantStore;
+    /** Defaults to Bexio's production issuer. Override only to point at a mock. */
+    issuer?: string;
+    /** Defaults to `https://api.bexio.com`. Override only to point at a mock. */
+    apiBaseUrl?: string;
+    /** How long one refresh may hold a connection's lock. Default `"30s"`. */
+    refreshLockTtl?: Duration;
+    /** Where `callback` redirects when the flow cookie is gone. Default `"/"`. */
+    defaultReturnTo?: string;
+    /** Custom `fetch` for every outgoing request (tests, proxies). */
+    fetch?: typeof fetch;
+    /** Clock override for tests. */
+    clock?: () => Date;
+}
+/**
+ * A grant as the app sees it: one owner's access to a connection, without
+ * token material. Grants of the same Bexio identity share one connection,
+ * so they share its tokens, role and status.
+ */
+export interface Grant {
+    id: string;
+    ownerId: string;
+    /** Shared by every grant of the same Bexio company and user. */
+    connectionId: string;
+    companyId: string;
+    companyName: string | null;
+    userId: string;
+    userName: string | null;
+    userEmail: string | null;
+    companyUserId: number | null;
+    role: Role;
+    status: GrantStatus;
+    scope: string | null;
+    accessExpiresAt: Date | null;
+    lastRefreshedAt: Date;
+    /** When this owner connected. */
+    createdAt: Date;
+    /** When the connection last changed. */
+    updatedAt: Date;
+}
+/** Identifies one grant of an owner. */
+export interface GrantSelector {
+    ownerId: string;
+    companyId?: string;
+    grantId?: string;
+}
+export interface AccessToken {
+    accessToken: string;
+    expiresAt: Date | null;
+    grant: Grant;
+}
+/** Tokens obtained by your auth framework, for `saveGrant`. */
+export interface ExternalTokens {
+    accessToken: string;
+    refreshToken?: string | null;
+    idToken?: string | null;
+    /** Access-token expiry; defaults to the access token's `exp` claim. */
+    expiresAt?: Date | null;
+    scope?: string | null;
+}
+/** Counts connections, not grants: owners of one Bexio identity share one. */
+export interface RefreshIdleResult {
+    refreshed: number;
+    /** Idle connections another process was refreshing at the same time. */
+    skipped: number;
+    reauthRequired: number;
+    failed: number;
+    /**
+     * Idle connections not attempted because `timeBudget` ran out (0 when every
+     * idle connection of this run was attempted). The next run picks them up
+     * first.
+     */
+    remaining: number;
+}
+/**
+ * How the callback checks the owner. Either the `ownerId` your app derives
+ * from the signed-in session (must equal the one passed to `start`), or
+ * `authorizeOwner`, which receives the owner recorded at `start` and returns
+ * whether the signed-in user may connect Bexio for it. Use the latter when
+ * one callback URL serves many owners (e.g. workspaces).
+ */
+export type CallbackOptions = {
+    ownerId: string;
+} | {
+    authorizeOwner: (ownerId: string) => boolean | Promise<boolean>;
+};
+export interface CallbackResult {
+    grant: Grant;
+    returnTo: string;
+    /** Contains the `Set-Cookie` that deletes the flow cookie; copy it onto your response. */
+    headers: Headers;
+}
+/** The client returned by `createBexioOAuth`. */
+export interface BexioOAuth {
+    /**
+     * Starts the Connect flow: returns a redirect to Bexio that sets the
+     * encrypted flow cookie. Derive `ownerId` from your authenticated session.
+     * `returnTo` must be a relative path (default: `defaultReturnTo`).
+     */
+    start(options: {
+        ownerId: string;
+        returnTo?: string;
+    }): Promise<Response>;
+    /**
+     * Handles the redirect back from Bexio, saves the grant, and redirects to
+     * `returnTo` (or `returnTo?bexio_error=<code>` on failure). Only
+     * `invalid_config` and non-library errors are thrown.
+     */
+    callback(request: Request, options: CallbackOptions): Promise<Response>;
+    /**
+     * Handles the redirect back from Bexio and saves the grant. Throws a
+     * `BexioOAuthError` on failure; use `callback` for a ready-made redirect.
+     */
+    handleCallback(request: Request, options: CallbackOptions): Promise<CallbackResult>;
+    /**
+     * Saves tokens obtained by your auth framework ("Sign in with Bexio").
+     * Verifies the tokens' signatures against Bexio's keys first.
+     */
+    saveGrant(input: {
+        ownerId: string;
+        tokens: ExternalTokens;
+    }): Promise<Grant>;
+    /**
+     * A valid access token for the owner's grant, refreshed when needed.
+     * Safe to call from background jobs and from many instances at once.
+     */
+    getAccessToken(selector: GrantSelector): Promise<AccessToken>;
+    /** The owner's grants, without token material. */
+    listGrants(query: {
+        ownerId: string;
+    }): Promise<Grant[]>;
+    /**
+     * Deletes the owner's grant. When it was the last grant of its connection,
+     * also deletes the connection and revokes its refresh token at Bexio (best
+     * effort). Other owners of the same Bexio identity keep working.
+     */
+    disconnect(selector: GrantSelector): Promise<void>;
+    /**
+     * Refreshes active connections not refreshed for `idleFor`, so Bexio
+     * doesn't end their offline sessions. Run it on a schedule. `limit`
+     * (default 100) caps the connections one run looks at; `timeBudget` stops
+     * the run before the next connection once that much time has passed.
+     */
+    refreshIdle(options: {
+        idleFor: Duration;
+        limit?: number;
+        timeBudget?: Duration;
+    }): Promise<RefreshIdleResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,QAAQ,CAAC;IAC1B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,IAAI,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,wCAAwC;IACxC,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;CACd;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE1E;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExE;;;OAGG;IACH,cAAc,CACZ,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9E;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAE9D,kDAAkD;IAClD,UAAU,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAEzD;;;;OAIG;IACH,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,OAAO,EAAE,QAAQ,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,QAAQ,CAAC;KACvB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}