@soulcode/bexio-oauth 0.2.0 → 0.3.1

package/README.md

@@ -11,12 +11,14 @@ It is **not** an auth framework: your app keeps its own login. For "Sign in with
 
 ```bash
 npm install @soulcode/bexio-oauth pg
-npx @soulcode/bexio-oauth sql > migrations/0001_bexio_grants.sql   # then apply it
+npx @soulcode/bexio-oauth sql > migrations/0001_bexio_oauth.sql    # then apply it
 npx @soulcode/bexio-oauth keygen                                    # encryption key
 ```
 
 Requires Node ≥ 24 and PostgreSQL.
 
+Use one Bexio OAuth client per app: Bexio keeps one refresh token chain per user, company and client, so apps sharing a client id invalidate each other's grants. Owners of your app that connect the same Bexio user and company share one connection, refreshed once for all of them ([guide §2](https://github.com/SoulcodeAgency/bexio-oauth/blob/main/docs/integration.md#why-owners-of-the-same-identity-share-a-connection)).
+
 ## Quickstart
 
 ```ts
@@ -37,14 +39,16 @@ export const bexio = createBexioOAuth({
 ```
 
 ```ts
-// GET /api/bexio/connect
+// app/api/bexio/connect/route.ts
 export const GET = async (req: Request) =>
   bexio.start({
     ownerId: await currentWorkspaceId(req),
     returnTo: "/settings",
   });
+```
 
-// GET /api/bexio/callback  (your redirectUri)
+```ts
+// app/api/bexio/callback/route.ts  (your redirectUri)
 export const GET = async (req: Request) =>
   bexio.callback(req, { ownerId: await currentWorkspaceId(req) });
 ```
@@ -60,7 +64,7 @@ await fetch("https://api.bexio.com/2.0/contact", {
 });
 ```
 
-Also: `listGrants`, `disconnect`, `refreshIdle` (keep idle grants alive), `saveGrant` (tokens from your auth framework). Every error is a `BexioOAuthError` with a stable `code`.
+Also: `listGrants`, `disconnect`, `refreshIdle` (keep idle connections alive), `saveGrant` (tokens from your auth framework). Every error is a `BexioOAuthError` with a stable `code`.
 
 ## License
 

package/dist/claims.d.ts

@@ -26,6 +26,6 @@ export interface BexioIdentity {
  * missing.
  */
 export declare function mapClaims(claims: ClaimBag): BexioIdentity;
-/** The value a grant's ciphertext is bound to (see `TokenCipher`). */
-export declare function grantBinding(ownerId: string, companyId: string, userId: string): string;
+/** The value a connection's ciphertext is bound to (see `TokenCipher`). */
+export declare function connectionBinding(companyId: string, userId: string): string;
 //# sourceMappingURL=claims.d.ts.map

package/dist/claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAEA,uDAAuD;AACvD,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAClE,uCAAuC;AACvC,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAC1D;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAMvC,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE/C,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAaD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,CAwBzD;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,MAAM,CAER"}
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAEA,uDAAuD;AACvD,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAClE,uCAAuC;AACvC,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAC1D;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAMvC,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE/C,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAaD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,CAwBzD;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/dist/claims.js

@@ -51,8 +51,8 @@ export function mapClaims(claims) {
         userEmail: text(claims.email),
     };
 }
-/** The value a grant's ciphertext is bound to (see `TokenCipher`). */
-export function grantBinding(ownerId, companyId, userId) {
-    return `${ownerId}\u0000${companyId}\u0000${userId}`;
+/** The value a connection's ciphertext is bound to (see `TokenCipher`). */
+export function connectionBinding(companyId, userId) {
+    return `${companyId}\u0000${userId}`;
 }
 //# sourceMappingURL=claims.js.map

package/dist/claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAClE,uCAAuC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1D,QAAQ;IACR,SAAS;IACT,OAAO;IACP,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAiBH,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAgB;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO;QACL,MAAM;QACN,SAAS;QACT,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACtC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QAC9C,QAAQ,EACN,KAAK,IAAI,MAAM;YACb,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,OAAO,GAAG,OAAO,SAAS,SAAS,SAAS,MAAM,EAAE,CAAC;AACvD,CAAC"}
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAClE,uCAAuC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAC1D;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1D,QAAQ;IACR,SAAS;IACT,OAAO;IACP,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAiBH,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAgB;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO;QACL,MAAM;QACN,SAAS;QACT,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACtC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QAC9C,QAAQ,EACN,KAAK,IAAI,MAAM;YACb,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,OAAO,GAAG,SAAS,SAAS,MAAM,EAAE,CAAC;AACvC,CAAC"}

package/dist/crypto.d.ts

@@ -12,8 +12,8 @@ export interface Keyring {
 export declare function generateKey(): string;
 /**
  * Encrypts tokens at rest as compact JWE (`dir` + `A256GCM`) and seals the
- * short-lived flow cookie. The `bxg` protected header binds a token to the
- * grant it belongs to, so ciphertext copied to another row fails to decrypt.
+ * short-lived flow cookie. The `bxc` protected header binds a token to the
+ * connection it belongs to, so ciphertext copied to another row fails to decrypt.
  */
 export declare class TokenCipher {
     #private;

package/dist/crypto.js

@@ -16,8 +16,8 @@ function hash(value) {
 }
 /**
  * Encrypts tokens at rest as compact JWE (`dir` + `A256GCM`) and seals the
- * short-lived flow cookie. The `bxg` protected header binds a token to the
- * grant it belongs to, so ciphertext copied to another row fails to decrypt.
+ * short-lived flow cookie. The `bxc` protected header binds a token to the
+ * connection it belongs to, so ciphertext copied to another row fails to decrypt.
  */
 export class TokenCipher {
     #current;
@@ -48,20 +48,20 @@ export class TokenCipher {
             alg: "dir",
             enc: "A256GCM",
             kid: this.#current,
-            bxg: hash(binding),
+            bxc: hash(binding),
         })
             .encrypt(this.#key(this.#current).key);
     }
     async decrypt(jwe, binding) {
         try {
             const { plaintext, protectedHeader } = await compactDecrypt(jwe, (header) => this.#key(header.kid).key, JWE_ALGORITHMS);
-            if (protectedHeader.bxg !== hash(binding)) {
+            if (protectedHeader.bxc !== hash(binding)) {
                 throw new Error("binding mismatch");
             }
             return new TextDecoder().decode(plaintext);
         }
         catch {
-            throw new BexioOAuthError("decryption_failed", "stored token could not be decrypted (unknown key id, or it belongs to another grant)");
+            throw new BexioOAuthError("decryption_failed", "stored token could not be decrypted (unknown key id, or it belongs to another connection)");
         }
     }
     async seal(payload, ttlSeconds, now) {

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAY9C,MAAM,cAAc,GAAG;IACrB,uBAAuB,EAAE,CAAC,KAAK,CAAC;IAChC,2BAA2B,EAAE,CAAC,SAAS,CAAC;CACzC,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,GAAG,qBAAqB,CAAC;AAEzC,2DAA2D;AAC3D,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACb,QAAQ,CAAS;IACjB,KAAK,CAA0B;IAC/B,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEnD,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,mEAAmE;YACnE,sEAAsE;YACtE,oCAAoC;YACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,QAAQ,GAAG,uEAAuE,CACnF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,iBAAiB,OAAO,CAAC,OAAO,kBAAkB,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QAC9C,OAAO,IAAI,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;aAC3D,kBAAkB,CAAC;YAClB,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC;SACnB,CAAC;aACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,OAAe;QACxC,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CACzD,GAAG,EACH,CAAC,MAAkC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EACjE,cAAc,CACf,CAAC;YACF,IAAI,eAAe,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,sFAAsF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAmB,EACnB,UAAkB,EAClB,GAAS;QAET,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACpD,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;aAC3B,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;aACtE,WAAW,CAAC,UAAU,CAAC;aACvB,iBAAiB,CAAC,UAAU,GAAG,UAAU,CAAC;aAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,GAAS;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAClC,KAAK,EACL,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EACrC;gBACE,GAAG,cAAc;gBACjB,WAAW,EAAE,GAAG;aACjB,CACF,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,GAAuB;QAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,SAA6B;QACpC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,UAAU,CACtB,QAAQ,CACN,QAAQ,EACR,IAAI,EACJ,IAAI,UAAU,CAAC,CAAC,CAAC,EACjB,yBAAyB,EACzB,EAAE,CACH,CACF,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAY9C,MAAM,cAAc,GAAG;IACrB,uBAAuB,EAAE,CAAC,KAAK,CAAC;IAChC,2BAA2B,EAAE,CAAC,SAAS,CAAC;CACzC,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,GAAG,qBAAqB,CAAC;AAEzC,2DAA2D;AAC3D,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACb,QAAQ,CAAS;IACjB,KAAK,CAA0B;IAC/B,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEnD,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,mEAAmE;YACnE,sEAAsE;YACtE,oCAAoC;YACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,QAAQ,GAAG,uEAAuE,CACnF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,iBAAiB,OAAO,CAAC,OAAO,kBAAkB,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QAC9C,OAAO,IAAI,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;aAC3D,kBAAkB,CAAC;YAClB,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC;SACnB,CAAC;aACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,OAAe;QACxC,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CACzD,GAAG,EACH,CAAC,MAAkC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EACjE,cAAc,CACf,CAAC;YACF,IAAI,eAAe,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,2FAA2F,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAmB,EACnB,UAAkB,EAClB,GAAS;QAET,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACpD,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;aAC3B,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;aACtE,WAAW,CAAC,UAAU,CAAC;aACvB,iBAAiB,CAAC,UAAU,GAAG,UAAU,CAAC;aAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,GAAS;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAClC,KAAK,EACL,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EACrC;gBACE,GAAG,cAAc;gBACjB,WAAW,EAAE,GAAG;aACjB,CACF,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,GAAuB;QAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,SAA6B;QACpC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,UAAU,CACtB,QAAQ,CACN,QAAQ,EACR,IAAI,EACJ,IAAI,UAAU,CAAC,CAAC,CAAC,EACjB,yBAAyB,EACzB,EAAE,CACH,CACF,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/errors.d.ts

@@ -20,7 +20,7 @@ export type BexioOAuthErrorCode =
  | "ambiguous_grant"
 /** The refresh token is dead; the user has to reconnect. */
  | "reauth_required"
-/** A stored token can't be decrypted (unknown key id, or it belongs to another grant). */
+/** A stored token can't be decrypted (unknown key id, or it belongs to another connection). */
  | "decryption_failed"
 /** The library was configured incorrectly. */
  | "invalid_config";

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,mBAAmB;AAC7B,+DAA+D;AAC7D,gBAAgB;AAClB,wEAAwE;GACtE,gBAAgB;AAClB,mCAAmC;GACjC,eAAe;AACjB,2EAA2E;GACzE,kBAAkB;AACpB,6DAA6D;GAC3D,WAAW;AACb,4DAA4D;GAC1D,eAAe;AACjB,mEAAmE;GACjE,iBAAiB;AACnB,4DAA4D;GAC1D,iBAAiB;AACnB,0FAA0F;GACxF,mBAAmB;AACrB,8CAA8C;GAC5C,gBAAgB,CAAC;AAErB,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBAGjC,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;CAM1E;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,IAAI,CAAC,EAAE,mBAAmB,GACzB,KAAK,IAAI,eAAe,CAK1B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,mBAAmB;AAC7B,+DAA+D;AAC7D,gBAAgB;AAClB,wEAAwE;GACtE,gBAAgB;AAClB,mCAAmC;GACjC,eAAe;AACjB,2EAA2E;GACzE,kBAAkB;AACpB,6DAA6D;GAC3D,WAAW;AACb,4DAA4D;GAC1D,eAAe;AACjB,mEAAmE;GACjE,iBAAiB;AACnB,4DAA4D;GAC1D,iBAAiB;AACnB,+FAA+F;GAC7F,mBAAmB;AACrB,8CAA8C;GAC5C,gBAAgB,CAAC;AAErB,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBAGjC,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;CAM1E;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,IAAI,CAAC,EAAE,mBAAmB,GACzB,KAAK,IAAI,eAAe,CAK1B"}

package/dist/grants.d.ts

@@ -1,25 +1,34 @@
 import { type ClaimBag } from "./claims.js";
 import type { ClientContext } from "./config.js";
 import type { TokenCipher } from "./crypto.js";
-import type { GrantRecord, GrantStore } from "./store/types.js";
+import type { ConnectionRecord, GrantRecord, GrantStore } from "./store/types.js";
 import type { AccessToken, Grant, GrantSelector } from "./types.js";
-/** The app-facing view of a stored grant: no token material. */
-export declare function toGrant(r: GrantRecord): Grant;
-/** The binding a grant's ciphertexts are encrypted under. */
-export declare function bindingOf(record: GrantRecord): string;
-export declare function decryptFor(cipher: TokenCipher, record: GrantRecord, value: string): Promise<string>;
-/** Decrypts the grant's access token for the caller. */
-export declare function issue(cipher: TokenCipher, record: GrantRecord): Promise<AccessToken>;
+/**
+ * The app-facing view of a stored grant, with `c` (default: the grant's own)
+ * as its connection: no token material.
+ */
+export declare function toGrant(grant: GrantRecord, c?: ConnectionRecord): Grant;
+/** The binding a connection's ciphertexts are encrypted under. */
+export declare function bindingOf(connection: ConnectionRecord): string;
+export declare function decryptFor(cipher: TokenCipher, connection: ConnectionRecord, value: string): Promise<string>;
+/** Decrypts the connection's access token for the owner of `grant`. */
+export declare function issue(cipher: TokenCipher, grant: GrantRecord, connection: ConnectionRecord): Promise<AccessToken>;
 /** Exactly one grant of the owner, or `not_connected` / `ambiguous_grant`. */
 export declare function resolveGrant(store: GrantStore, selector: GrantSelector): Promise<GrantRecord>;
 /** The token's claims if it is a JWT, else none (Bexio access tokens usually are). */
 export declare function decodeIfJwt(token: string): ClaimBag;
 /**
- * Adds userinfo claims, only when the tokens lack the company claims. Token
- * claims win over userinfo; a userinfo failure keeps the token claims.
+ * Adds userinfo claims when the tokens lack the profile claims. Bexio's access
+ * token carries `company_id` but no company name, email or person name; the
+ * ID token has them, so the extra call only happens without one (`saveGrant`
+ * with an access token alone). Token claims win over userinfo; a userinfo
+ * failure keeps the token claims.
  */
 export declare function withUserInfo(ctx: ClientContext, claims: ClaimBag, accessToken: string): Promise<ClaimBag>;
-/** Encrypts the tokens, reads the role and upserts the grant for the identity in `claims`. */
+/**
+ * Encrypts the tokens, reads the role, and upserts the connection for the
+ * identity in `claims` and the owner's grant on it.
+ */
 export declare function saveTokens(ctx: ClientContext, input: {
     ownerId: string;
     claims: ClaimBag;

package/dist/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEpE,gEAAgE;AAChE,wBAAgB,OAAO,CAAC,CAAC,EAAE,WAAW,GAAG,KAAK,CAkB7C;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAErD;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wDAAwD;AACxD,wBAAsB,KAAK,CACzB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,WAAW,CAAC,CAMtB;AAED,8EAA8E;AAC9E,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,WAAW,CAAC,CAatB;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAMnD;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAYnB;AAED,8FAA8F;AAC9F,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACA,OAAO,CAAC,WAAW,CAAC,CAuBtB;AAED,wBAAsB,UAAU,CAC9B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACzB,OAAO,CAAC,KAAK,EAAE,CAAC,CAIlB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CAef"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgC,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EACV,gBAAgB,EAChB,WAAW,EACX,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,OAAO,CACrB,KAAK,EAAE,WAAW,EAClB,CAAC,GAAE,gBAAmC,GACrC,KAAK,CAmBP;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,CAE9D;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,gBAAgB,EAC5B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,uEAAuE;AACvE,wBAAsB,KAAK,CACzB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAAC,WAAW,CAAC,CAMtB;AAED,8EAA8E;AAC9E,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,WAAW,CAAC,CAatB;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAMnD;AAKD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAanB;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACA,OAAO,CAAC,WAAW,CAAC,CAsBtB;AAED,wBAAsB,UAAU,CAC9B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACzB,OAAO,CAAC,KAAK,EAAE,CAAC,CAMlB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/grants.js

@@ -1,41 +1,45 @@
 import * as oidc from "openid-client";
 import { decodeJwt } from "jose";
-import { grantBinding, mapClaims } from "./claims.js";
+import { connectionBinding, mapClaims } from "./claims.js";
 import { BexioOAuthError } from "./errors.js";
 import { fetchRole } from "./permissions.js";
-/** The app-facing view of a stored grant: no token material. */
-export function toGrant(r) {
+/**
+ * The app-facing view of a stored grant, with `c` (default: the grant's own)
+ * as its connection: no token material.
+ */
+export function toGrant(grant, c = grant.connection) {
     return {
-        id: r.id,
-        ownerId: r.ownerId,
-        companyId: r.companyId,
-        companyName: r.companyName,
-        userId: r.userId,
-        userName: r.userName,
-        userEmail: r.userEmail,
-        companyUserId: r.companyUserId,
-        role: r.role,
-        status: r.status,
-        scope: r.scope,
-        accessExpiresAt: r.accessExpiresAt,
-        lastRefreshedAt: r.lastRefreshedAt,
-        createdAt: r.createdAt,
-        updatedAt: r.updatedAt,
+        id: grant.id,
+        ownerId: grant.ownerId,
+        connectionId: c.id,
+        companyId: c.companyId,
+        companyName: c.companyName,
+        userId: c.userId,
+        userName: c.userName,
+        userEmail: c.userEmail,
+        companyUserId: c.companyUserId,
+        role: c.role,
+        status: c.status,
+        scope: c.scope,
+        accessExpiresAt: c.accessExpiresAt,
+        lastRefreshedAt: c.lastRefreshedAt,
+        createdAt: grant.createdAt,
+        updatedAt: c.updatedAt,
     };
 }
-/** The binding a grant's ciphertexts are encrypted under. */
-export function bindingOf(record) {
-    return grantBinding(record.ownerId, record.companyId, record.userId);
+/** The binding a connection's ciphertexts are encrypted under. */
+export function bindingOf(connection) {
+    return connectionBinding(connection.companyId, connection.userId);
 }
-export function decryptFor(cipher, record, value) {
-    return cipher.decrypt(value, bindingOf(record));
+export function decryptFor(cipher, connection, value) {
+    return cipher.decrypt(value, bindingOf(connection));
 }
-/** Decrypts the grant's access token for the caller. */
-export async function issue(cipher, record) {
+/** Decrypts the connection's access token for the owner of `grant`. */
+export async function issue(cipher, grant, connection) {
     return {
-        accessToken: await decryptFor(cipher, record, record.accessToken),
-        expiresAt: record.accessExpiresAt,
-        grant: toGrant(record),
+        accessToken: await decryptFor(cipher, connection, connection.accessToken),
+        expiresAt: connection.accessExpiresAt,
+        grant: toGrant(grant, connection),
     };
 }
 /** Exactly one grant of the owner, or `not_connected` / `ambiguous_grant`. */
@@ -59,12 +63,17 @@ export function decodeIfJwt(token) {
         return {};
     }
 }
+/** Claims a connection needs beyond the ids (see `mapClaims`). */
+const PROFILE_CLAIMS = ["company_id", "company_name", "email"];
 /**
- * Adds userinfo claims, only when the tokens lack the company claims. Token
- * claims win over userinfo; a userinfo failure keeps the token claims.
+ * Adds userinfo claims when the tokens lack the profile claims. Bexio's access
+ * token carries `company_id` but no company name, email or person name; the
+ * ID token has them, so the extra call only happens without one (`saveGrant`
+ * with an access token alone). Token claims win over userinfo; a userinfo
+ * failure keeps the token claims.
  */
 export async function withUserInfo(ctx, claims, accessToken) {
-    if (claims.company_id !== undefined)
+    if (PROFILE_CLAIMS.every((claim) => claims[claim] !== undefined))
         return claims;
     try {
         const info = await oidc.fetchUserInfo(await ctx.oidc.config(), accessToken, typeof claims.sub === "string" ? claims.sub : oidc.skipSubjectCheck);
@@ -74,12 +83,16 @@ export async function withUserInfo(ctx, claims, accessToken) {
         return claims;
     }
 }
-/** Encrypts the tokens, reads the role and upserts the grant for the identity in `claims`. */
+/**
+ * Encrypts the tokens, reads the role, and upserts the connection for the
+ * identity in `claims` and the owner's grant on it.
+ */
 export async function saveTokens(ctx, input) {
     const identity = mapClaims(input.claims);
-    const binding = grantBinding(input.ownerId, identity.companyId, identity.userId);
+    const binding = connectionBinding(identity.companyId, identity.userId);
     const role = (await fetchRole(ctx.fetchImpl, ctx.apiBaseUrl, input.accessToken)) ??
         "member";
+    const issuedAt = decodeIfJwt(input.accessToken).iat;
     return ctx.store.upsertGrant({
         ownerId: input.ownerId,
         ...identity,
@@ -91,25 +104,40 @@ export async function saveTokens(ctx, input) {
         accessExpiresAt: input.accessExpiresAt,
         refreshExpiresAt: input.refreshExpiresAt,
         scope: input.scope,
+        authorizedAt: typeof issuedAt === "number" ? new Date(issuedAt * 1000) : ctx.clock(),
         now: ctx.clock(),
     });
 }
 export async function listGrants(store, query) {
     if (!query?.ownerId)
         throw new BexioOAuthError("invalid_config", "ownerId is required");
-    return (await store.findGrants({ ownerId: query.ownerId })).map(toGrant);
+    return (await store.findGrants({ ownerId: query.ownerId })).map((g) => toGrant(g));
 }
 export async function disconnect(ctx, selector) {
-    const record = await resolveGrant(ctx.store, selector);
+    const grant = await resolveGrant(ctx.store, selector);
+    // Delete first, revoke after: revoking ends the one refresh token chain
+    // all owners of this identity share, so it may only happen once the store
+    // has confirmed that no grant (not even a concurrent one) uses it.
+    await ctx.store.deleteGrant(grant.id);
+    const deleted = await ctx.store.deleteUnusedConnection(grant.connection.id);
+    if (!deleted)
+        return;
+    const { connection, userHasOtherConnections } = deleted;
+    // Revoking ends all of the user's chains at Bexio, whichever token it
+    // names: a stale (reauth_required) token would still end the chain the user
+    // authorized since, and any token the user's other company's connection.
+    if (!connection.refreshToken ||
+        connection.status !== "active" ||
+        userHasOtherConnections)
+        return;
     try {
         const c = await ctx.oidc.config();
-        if (record.refreshToken && c.serverMetadata().revocation_endpoint) {
-            await oidc.tokenRevocation(c, await decryptFor(ctx.cipher, record, record.refreshToken), { token_type_hint: "refresh_token" });
+        if (c.serverMetadata().revocation_endpoint) {
+            await oidc.tokenRevocation(c, await decryptFor(ctx.cipher, connection, connection.refreshToken), { token_type_hint: "refresh_token" });
         }
     }
     catch {
-        // Revocation is best effort; the grant is deleted either way.
+        // Revocation is best effort; the connection is deleted either way.
     }
-    await ctx.store.deleteGrant(record.id);
 }
 //# sourceMappingURL=grants.js.map

package/dist/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAiB,MAAM,aAAa,CAAC;AAGrE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C,gEAAgE;AAChE,MAAM,UAAU,OAAO,CAAC,CAAc;IACpC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,MAAmB;IAC3C,OAAO,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAmB,EACnB,MAAmB,EACnB,KAAa;IAEb,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,MAAmB,EACnB,MAAmB;IAEnB,OAAO;QACL,WAAW,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC;QACjE,SAAS,EAAE,MAAM,CAAC,eAAe;QACjC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;KACvB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiB,EACjB,QAAuB;IAEvB,IAAI,CAAC,QAAQ,EAAE,OAAO;QACpB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QACnB,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;AAClB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,MAAgB,EAChB,WAAmB;IAEnB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CACnC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EACvB,WAAW,EACX,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CACpE,CAAC;QACF,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAkB,EAClB,KAQC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,YAAY,CAC1B,KAAK,CAAC,OAAO,EACb,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,MAAM,IAAI,GACR,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACnE,QAAQ,CAAC;IACX,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,QAAQ;QACX,IAAI;QACJ,WAAW,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;QACjE,YAAY,EAAE,KAAK,CAAC,YAAY;YAC9B,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,IAAI;QACR,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAiB,EACjB,KAA0B;IAE1B,IAAI,CAAC,KAAK,EAAE,OAAO;QACjB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAkB,EAClB,QAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,mBAAmB,EAAE,CAAC;YAClE,MAAM,IAAI,CAAC,eAAe,CACxB,CAAC,EACD,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,EACzD,EAAE,eAAe,EAAE,eAAe,EAAE,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IACD,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAiB,MAAM,aAAa,CAAC;AAG1E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAQ7C;;;GAGG;AACH,MAAM,UAAU,OAAO,CACrB,KAAkB,EAClB,IAAsB,KAAK,CAAC,UAAU;IAEtC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,CAAC,CAAC,EAAE;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,UAA4B;IACpD,OAAO,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAmB,EACnB,UAA4B,EAC5B,KAAa;IAEb,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,MAAmB,EACnB,KAAkB,EAClB,UAA4B;IAE5B,OAAO;QACL,WAAW,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,CAAC;QACzE,SAAS,EAAE,UAAU,CAAC,eAAe;QACrC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiB,EACjB,QAAuB;IAEvB,IAAI,CAAC,QAAQ,EAAE,OAAO;QACpB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QACnB,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;AAClB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,MAAgB,EAChB,WAAmB;IAEnB,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CACnC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EACvB,WAAW,EACX,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CACpE,CAAC;QACF,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAkB,EAClB,KAQC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,IAAI,GACR,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACnE,QAAQ,CAAC;IACX,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC;IACpD,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,QAAQ;QACX,IAAI;QACJ,WAAW,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;QACjE,YAAY,EAAE,KAAK,CAAC,YAAY;YAC9B,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,IAAI;QACR,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EACV,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE;QACxE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAiB,EACjB,KAA0B;IAE1B,IAAI,CAAC,KAAK,EAAE,OAAO;QACjB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpE,OAAO,CAAC,CAAC,CAAC,CACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAkB,EAClB,QAAuB;IAEvB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtD,wEAAwE;IACxE,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,EAAE,UAAU,EAAE,uBAAuB,EAAE,GAAG,OAAO,CAAC;IACxD,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,IACE,CAAC,UAAU,CAAC,YAAY;QACxB,UAAU,CAAC,MAAM,KAAK,QAAQ;QAC9B,uBAAuB;QAEvB,OAAO;IACT,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,mBAAmB,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,eAAe,CACxB,CAAC,EACD,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,EACjE,EAAE,eAAe,EAAE,eAAe,EAAE,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;AACH,CAAC"}

package/dist/idle-sweep.d.ts

@@ -2,7 +2,7 @@ import type { ClientContext } from "./config.js";
 import { type Duration } from "./duration.js";
 import type { RefreshIdleResult } from "./types.js";
 export declare const DEFAULT_IDLE_LIMIT = 100;
-/** `BexioOAuth.refreshIdle`: refreshes idle grants one after another. */
+/** `BexioOAuth.refreshIdle`: refreshes idle connections one after another. */
 export declare function refreshIdle(ctx: ClientContext, options: {
     idleFor: Duration;
     limit?: number;

package/dist/idle-sweep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idle-sweep.d.ts","sourceRoot":"","sources":["../src/idle-sweep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC,yEAAyE;AACzE,wBAAsB,WAAW,CAC/B,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,QAAQ,CAAA;CAAE,GACpE,OAAO,CAAC,iBAAiB,CAAC,CA2D5B"}
+{"version":3,"file":"idle-sweep.d.ts","sourceRoot":"","sources":["../src/idle-sweep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC,8EAA8E;AAC9E,wBAAsB,WAAW,CAC/B,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,QAAQ,CAAA;CAAE,GACpE,OAAO,CAAC,iBAAiB,CAAC,CA2D5B"}

package/dist/idle-sweep.js

@@ -2,7 +2,7 @@ import { toMs } from "./duration.js";
 import { isBexioOAuthError } from "./errors.js";
 import { lockWindow, refreshLocked } from "./refresh.js";
 export const DEFAULT_IDLE_LIMIT = 100;
-/** `BexioOAuth.refreshIdle`: refreshes idle grants one after another. */
+/** `BexioOAuth.refreshIdle`: refreshes idle connections one after another. */
 export async function refreshIdle(ctx, options) {
     const { store, clock } = ctx;
     const idleMs = toMs(options?.idleFor, "idleFor");
@@ -18,7 +18,7 @@ export async function refreshIdle(ctx, options) {
         remaining: 0,
     };
     const refreshedBefore = new Date(startedAt - idleMs);
-    const idle = await store.listIdleGrants({
+    const idle = await store.listIdleConnections({
         refreshedBefore,
         limit: options.limit ?? DEFAULT_IDLE_LIMIT,
     });
@@ -32,9 +32,9 @@ export async function refreshIdle(ctx, options) {
         result.failed = idle.length;
         return result;
     }
-    for (const [index, grant] of idle.entries()) {
+    for (const [index, connection] of idle.entries()) {
         // Stop before taking the next lock, so a function timeout can't cut a
-        // refresh in half. The oldest grants come first, so the next run
+        // refresh in half. The oldest connections come first, so the next run
         // continues where this one stopped.
         if (clock().getTime() - startedAt >= budgetMs) {
             result.remaining = idle.length - index;
@@ -42,7 +42,7 @@ export async function refreshIdle(ctx, options) {
         }
         const window = lockWindow(ctx, clock());
         const locked = await store.acquireRefreshLock({
-            id: grant.id,
+            id: connection.id,
             ...window,
             refreshedBefore,
         });

package/dist/idle-sweep.js.map

@@ -1 +1 @@
-{"version":3,"file":"idle-sweep.js","sourceRoot":"","sources":["../src/idle-sweep.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAiB,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAkB,EAClB,OAAqE;IAErE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,QAAQ,GACZ,OAAO,CAAC,UAAU,KAAK,SAAS;QAC9B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAsB;QAChC,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,CAAC;QACjB,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,CAAC;KACb,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC;QACtC,eAAe;QACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,kBAAkB;KAC3C,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,sEAAsE;QACtE,iEAAiE;QACjE,oCAAoC;QACpC,IAAI,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC9C,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACvC,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC5C,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,GAAG,MAAM;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;gBACpD,MAAM,CAAC,SAAS,EAAE,CAAC;;gBAChB,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"idle-sweep.js","sourceRoot":"","sources":["../src/idle-sweep.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAiB,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAkB,EAClB,OAAqE;IAErE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,QAAQ,GACZ,OAAO,CAAC,UAAU,KAAK,SAAS;QAC9B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAsB;QAChC,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,CAAC;QACjB,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,CAAC;KACb,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC;QAC3C,eAAe;QACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,kBAAkB;KAC3C,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,sEAAsE;QACtE,sEAAsE;QACtE,oCAAoC;QACpC,IAAI,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC9C,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACvC,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC5C,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,GAAG,MAAM;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;gBACpD,MAAM,CAAC,SAAS,EAAE,CAAC;;gBAChB,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -8,5 +8,5 @@ export { roleFromPermissions, type Role } from "./permissions.js";
 export { migrations, type Migration } from "./sql.js";
 export { memoryStore } from "./store/memory.js";
 export { postgresStore, type SqlClient } from "./store/postgres.js";
-export type { GrantRecord, GrantRefresh, GrantStatus, GrantStore, GrantUpsert, LockRequest, } from "./store/types.js";
+export type { ConnectionRecord, ConnectionRefresh, GrantRecord, GrantStatus, GrantStore, GrantUpsert, LockRequest, } from "./store/types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,cAAc,EACd,KAAK,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,cAAc,EACd,KAAK,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC"}

package/dist/migrations.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.generated.d.ts","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,eAAO,MAAM,UAAU,EAAE,SAAS,SAAS,EAsC1C,CAAC"}
+{"version":3,"file":"migrations.generated.d.ts","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,eAAO,MAAM,UAAU,EAAE,SAAS,SAAS,EAsD1C,CAAC"}

package/dist/migrations.generated.js

@@ -1,14 +1,15 @@
 export const MIGRATIONS = [
     {
         number: 1,
-        name: "0001_bexio_grants.sql",
-        sql: `-- @soulcode/bexio-oauth 0001: the grants table.
--- One row per (owner, Bexio company, Bexio user). Token columns hold JWE
--- ciphertext; only your server-side database role should be able to read them.
+        name: "0001_bexio_oauth.sql",
+        sql: `-- @soulcode/bexio-oauth 0001: connections and grants.
+-- Token columns hold JWE ciphertext; only your server-side database role
+-- should be able to read these tables.
 
-CREATE TABLE IF NOT EXISTS bexio_grants (
+-- One row per Bexio identity (company, user): the tokens of its one refresh
+-- token chain, shared by every owner that connected this identity.
+CREATE TABLE IF NOT EXISTS bexio_connections (
   id                    uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
-  owner_id              text        NOT NULL,
   bexio_company_id      text        NOT NULL,
   bexio_user_id         text        NOT NULL,
   bexio_company_user_id integer,
@@ -24,16 +25,31 @@ CREATE TABLE IF NOT EXISTS bexio_grants (
   scope                 text,
   refresh_locked_until  timestamptz,
   refresh_lock_token    text,
+  authorized_at         timestamptz NOT NULL,
   last_refreshed_at     timestamptz NOT NULL DEFAULT now(),
   created_at            timestamptz NOT NULL DEFAULT now(),
   updated_at            timestamptz NOT NULL DEFAULT now(),
-  CONSTRAINT bexio_grants_owner_company_user_key UNIQUE (owner_id, bexio_company_id, bexio_user_id)
+  CONSTRAINT bexio_connections_company_user_key UNIQUE (bexio_company_id, bexio_user_id)
 );
 
--- refreshIdle(): active grants by last refresh.
-CREATE INDEX IF NOT EXISTS bexio_grants_idle_idx
-  ON bexio_grants (last_refreshed_at)
+-- refreshIdle(): active connections by last refresh.
+CREATE INDEX IF NOT EXISTS bexio_connections_idle_idx
+  ON bexio_connections (last_refreshed_at)
   WHERE status = 'active';
+
+-- One row per (owner, connection): an owner's access to a connection. A
+-- connection is deleted only once no grant references it (RESTRICT).
+CREATE TABLE IF NOT EXISTS bexio_grants (
+  id            uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+  owner_id      text        NOT NULL,
+  connection_id uuid        NOT NULL REFERENCES bexio_connections (id) ON DELETE RESTRICT,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT bexio_grants_owner_connection_key UNIQUE (owner_id, connection_id)
+);
+
+-- Disconnect checks whether a connection has grants left.
+CREATE INDEX IF NOT EXISTS bexio_grants_connection_idx
+  ON bexio_grants (connection_id);
 `,
     },
 ];

package/dist/migrations.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.generated.js","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,UAAU,GAAyB;IAC9C;QACE,MAAM,EAAE,CAAC;QACT,IAAI,EAAE,uBAAuB;QAC7B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCR;KACE;CACF,CAAC"}
+{"version":3,"file":"migrations.generated.js","sourceRoot":"","sources":["../src/migrations.generated.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,UAAU,GAAyB;IAC9C;QACE,MAAM,EAAE,CAAC;QACT,IAAI,EAAE,sBAAsB;QAC5B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDR;KACE;CACF,CAAC"}

package/dist/refresh.d.ts

@@ -1,6 +1,6 @@
 import * as oidc from "openid-client";
 import type { ClientContext } from "./config.js";
-import type { GrantRecord } from "./store/types.js";
+import type { ConnectionRecord } from "./store/types.js";
 import type { AccessToken, GrantSelector } from "./types.js";
 /** Refresh a little before the access token really expires. */
 export declare const EXPIRY_SKEW_MS = 30000;
@@ -11,7 +11,7 @@ export declare function tokenExpiry(tokens: TokenResponse, now: Date): {
     refreshExpiresAt: Date | null;
 };
 /** True while the access token is valid for longer than the skew. */
-export declare function isFresh(record: GrantRecord, now: Date): boolean;
+export declare function isFresh(connection: ConnectionRecord, now: Date): boolean;
 /** A new lock holder's token and lease, starting at `now`. */
 export declare function lockWindow(ctx: ClientContext, now: Date): {
     now: Date;
@@ -19,12 +19,12 @@ export declare function lockWindow(ctx: ClientContext, now: Date): {
     lockToken: `${string}-${string}-${string}-${string}-${string}`;
 };
 /**
- * Refreshes a grant whose lock the caller holds (`lockToken`). Every write
- * is fenced by the token: if the lock was lost (expired and taken over, or
- * the grant was reconnected meanwhile), the write changes nothing and this
- * returns `null`: the caller re-reads the grant.
+ * Refreshes a connection whose lock the caller holds (`lockToken`). Every
+ * write is fenced by the token: if the lock was lost (expired and taken over,
+ * or the connection was reconnected meanwhile), the write changes nothing and
+ * this returns `null`: the caller re-reads the connection.
  */
-export declare function refreshLocked(ctx: ClientContext, record: GrantRecord, lockToken: string): Promise<GrantRecord | null>;
+export declare function refreshLocked(ctx: ClientContext, connection: ConnectionRecord, lockToken: string): Promise<ConnectionRecord | null>;
 /** `BexioOAuth.getAccessToken`. */
 export declare function getAccessToken(ctx: ClientContext, selector: GrantSelector): Promise<AccessToken>;
 //# sourceMappingURL=refresh.d.ts.map