@soulcode/bexio-oauth 0.2.0 → 0.3.1

package/dist/store/postgres.js

@@ -1,20 +1,53 @@
 import { BexioOAuthError } from "../errors.js";
-// `id` is a uuid column: any other value matches no row, and would make
+// `id` columns are uuids: any other value matches no row, and would make
 // Postgres reject the cast instead of returning nothing.
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const COLUMNS = `id, owner_id, bexio_company_id, bexio_user_id, bexio_company_user_id,
+const CONNECTION_COLUMNS = `id, bexio_company_id, bexio_user_id, bexio_company_user_id,
   company_name, user_name, user_email, role, status, access_token, refresh_token,
   access_expires_at, refresh_expires_at, scope, refresh_locked_until,
-  last_refreshed_at, created_at, updated_at`;
+  authorized_at, last_refreshed_at, created_at, updated_at`;
+/** Connection columns qualified with `c.`, for joins. */
+const C_COLUMNS = CONNECTION_COLUMNS.split(",")
+    .map((column) => `c.${column.trim()}`)
+    .join(", ");
+/** A grant joined with its connection (`c`) and the grant (`g`). */
+const GRANT_COLUMNS = `g.id AS grant_id, g.owner_id, g.created_at AS grant_created_at, ${C_COLUMNS}`;
+/**
+ * The connection's columns an upsert sets, and the value each takes. They
+ * change only for an authorization at least as new as the stored one: Bexio
+ * has invalidated the older chain, so a slow connect that authorized earlier
+ * must not overwrite a later one. The grant is linked either way.
+ */
+const UPSERT_VALUES = [
+    ["bexio_company_user_id", "EXCLUDED.bexio_company_user_id"],
+    ["company_name", "EXCLUDED.company_name"],
+    ["user_name", "EXCLUDED.user_name"],
+    ["user_email", "EXCLUDED.user_email"],
+    ["role", "EXCLUDED.role"],
+    ["status", "'active'"],
+    ["access_token", "EXCLUDED.access_token"],
+    ["refresh_token", "EXCLUDED.refresh_token"],
+    ["access_expires_at", "EXCLUDED.access_expires_at"],
+    ["refresh_expires_at", "EXCLUDED.refresh_expires_at"],
+    ["scope", "EXCLUDED.scope"],
+    ["refresh_locked_until", "NULL"],
+    ["refresh_lock_token", "NULL"],
+    ["authorized_at", "EXCLUDED.authorized_at"],
+    ["last_refreshed_at", "EXCLUDED.last_refreshed_at"],
+    ["updated_at", "EXCLUDED.updated_at"],
+];
+const NEWER_AUTHORIZATION_WINS = UPSERT_VALUES.map(([column, value]) => `${column} = CASE WHEN EXCLUDED.authorized_at >= bexio_connections.authorized_at
+       THEN ${value} ELSE bexio_connections.${column} END`).join(",\n             ");
+/** SQLSTATE for a foreign key violation. */
+const FOREIGN_KEY_VIOLATION = "23503";
 function date(value) {
     if (value === null)
         return null;
     return value instanceof Date ? value : new Date(value);
 }
-function toRecord(row) {
+function toConnection(row) {
     return {
         id: row.id,
-        ownerId: row.owner_id,
         companyId: row.bexio_company_id,
         userId: row.bexio_user_id,
         companyUserId: row.bexio_company_user_id === null
@@ -31,49 +64,49 @@ function toRecord(row) {
         refreshExpiresAt: date(row.refresh_expires_at),
         scope: row.scope,
         refreshLockedUntil: date(row.refresh_locked_until),
+        authorizedAt: date(row.authorized_at),
         lastRefreshedAt: date(row.last_refreshed_at),
         createdAt: date(row.created_at),
         updatedAt: date(row.updated_at),
     };
 }
+function toGrant(row) {
+    return {
+        id: row.grant_id,
+        ownerId: row.owner_id,
+        createdAt: date(row.grant_created_at),
+        connection: toConnection(row),
+    };
+}
 /**
- * Grant store on the `bexio_grants` table (create it with
- * `npx @soulcode/bexio-oauth sql`). Every operation is a single statement,
- * so it works through transaction-mode poolers and HTTP drivers.
+ * Store on the `bexio_connections` and `bexio_grants` tables (create them
+ * with `npx @soulcode/bexio-oauth sql`). Every operation is a single
+ * statement, so it works through transaction-mode poolers and HTTP drivers.
  */
 export function postgresStore(sql) {
-    const one = async (text, params) => {
-        const { rows } = await sql.query(text, params);
-        return rows[0] ? toRecord(rows[0]) : null;
-    };
-    const many = async (text, params) => {
+    const connection = async (text, params) => {
         const { rows } = await sql.query(text, params);
-        return rows.map(toRecord);
+        return rows[0] ? toConnection(rows[0]) : null;
     };
     return {
         async upsertGrant(g) {
-            const row = await one(`INSERT INTO bexio_grants (owner_id, bexio_company_id, bexio_user_id,
-           bexio_company_user_id, company_name, user_name, user_email, role, status,
-           access_token, refresh_token, access_expires_at, refresh_expires_at, scope,
-           refresh_locked_until, last_refreshed_at, created_at, updated_at)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'active', $9, $10, $11, $12, $13, NULL, $14, $14, $14)
-         ON CONFLICT (owner_id, bexio_company_id, bexio_user_id) DO UPDATE SET
-           bexio_company_user_id = EXCLUDED.bexio_company_user_id,
-           company_name = EXCLUDED.company_name,
-           user_name = EXCLUDED.user_name,
-           user_email = EXCLUDED.user_email,
-           role = EXCLUDED.role,
-           status = 'active',
-           access_token = EXCLUDED.access_token,
-           refresh_token = EXCLUDED.refresh_token,
-           access_expires_at = EXCLUDED.access_expires_at,
-           refresh_expires_at = EXCLUDED.refresh_expires_at,
-           scope = EXCLUDED.scope,
-           refresh_locked_until = NULL,
-           refresh_lock_token = NULL,
-           last_refreshed_at = EXCLUDED.last_refreshed_at,
-           updated_at = EXCLUDED.updated_at
-         RETURNING ${COLUMNS}`, [
+            const { rows } = await sql.query(`WITH connection AS (
+           INSERT INTO bexio_connections (bexio_company_id, bexio_user_id,
+             bexio_company_user_id, company_name, user_name, user_email, role, status,
+             access_token, refresh_token, access_expires_at, refresh_expires_at, scope,
+             refresh_locked_until, refresh_lock_token, authorized_at, last_refreshed_at,
+             created_at, updated_at)
+           VALUES ($2, $3, $4, $5, $6, $7, $8, 'active', $9, $10, $11, $12, $13, NULL, NULL, $15, $14, $14, $14)
+           ON CONFLICT (bexio_company_id, bexio_user_id) DO UPDATE SET
+             ${NEWER_AUTHORIZATION_WINS}
+           RETURNING ${CONNECTION_COLUMNS}
+         ), g AS (
+           INSERT INTO bexio_grants (owner_id, connection_id, created_at)
+           SELECT $1, id, $14 FROM connection
+           ON CONFLICT (owner_id, connection_id) DO UPDATE SET owner_id = EXCLUDED.owner_id
+           RETURNING id, owner_id, created_at
+         )
+         SELECT ${GRANT_COLUMNS} FROM g, connection c`, [
                 g.ownerId,
                 g.companyId,
                 g.userId,
@@ -88,28 +121,64 @@ export function postgresStore(sql) {
                 g.refreshExpiresAt,
                 g.scope,
                 g.now,
+                g.authorizedAt,
             ]);
-            if (!row) {
+            if (!rows[0]) {
                 throw new BexioOAuthError("invalid_config", "SqlClient returned no row for INSERT … RETURNING; check the driver wrapper");
             }
-            return row;
+            return toGrant(rows[0]);
         },
         async findGrants({ ownerId, companyId, grantId }) {
             if (grantId !== undefined && !UUID.test(grantId))
                 return [];
-            return many(`SELECT ${COLUMNS} FROM bexio_grants
-         WHERE owner_id = $1
-           AND ($2::text IS NULL OR bexio_company_id = $2)
-           AND ($3::uuid IS NULL OR id = $3::uuid)
-         ORDER BY created_at, id`, [ownerId, companyId ?? null, grantId ?? null]);
+            const { rows } = await sql.query(`SELECT ${GRANT_COLUMNS}
+         FROM bexio_grants g JOIN bexio_connections c ON c.id = g.connection_id
+         WHERE g.owner_id = $1
+           AND ($2::text IS NULL OR c.bexio_company_id = $2)
+           AND ($3::uuid IS NULL OR g.id = $3::uuid)
+         ORDER BY g.created_at, g.id`, [ownerId, companyId ?? null, grantId ?? null]);
+            return rows.map(toGrant);
         },
-        async getGrant(id) {
+        async deleteGrant(id) {
+            if (!UUID.test(id))
+                return;
+            await sql.query(`DELETE FROM bexio_grants WHERE id = $1`, [id]);
+        },
+        async getConnection(id) {
+            if (!UUID.test(id))
+                return null;
+            return connection(`SELECT ${CONNECTION_COLUMNS} FROM bexio_connections WHERE id = $1`, [id]);
+        },
+        // NOT EXISTS reads the statement's snapshot, so it can miss a grant that
+        // a concurrent upsertGrant commits meanwhile. The foreign key catches
+        // that case: it checks against committed data and fails the delete.
+        async deleteUnusedConnection(id) {
             if (!UUID.test(id))
                 return null;
-            return one(`SELECT ${COLUMNS} FROM bexio_grants WHERE id = $1`, [id]);
+            try {
+                const { rows } = await sql.query(`DELETE FROM bexio_connections c
+           WHERE c.id = $1
+             AND NOT EXISTS (SELECT 1 FROM bexio_grants g WHERE g.connection_id = c.id)
+           RETURNING ${C_COLUMNS}, EXISTS (
+             SELECT 1 FROM bexio_connections o
+             WHERE o.bexio_user_id = c.bexio_user_id AND o.id <> c.id
+           ) AS user_has_other_connections`, [id]);
+                const row = rows[0];
+                return row
+                    ? {
+                        connection: toConnection(row),
+                        userHasOtherConnections: row.user_has_other_connections,
+                    }
+                    : null;
+            }
+            catch (error) {
+                if (error.code === FOREIGN_KEY_VIOLATION)
+                    return null;
+                throw error;
+            }
         },
         async acquireRefreshLock({ id, now, lockUntil, lockToken, accessExpiresBefore, refreshedBefore, }) {
-            return one(`UPDATE bexio_grants SET refresh_locked_until = $3, refresh_lock_token = $6
+            return connection(`UPDATE bexio_connections SET refresh_locked_until = $3, refresh_lock_token = $6
          WHERE id = $1
            AND status = 'active'
            AND (refresh_locked_until IS NULL OR refresh_locked_until <= $2)
@@ -117,7 +186,7 @@ export function postgresStore(sql) {
              ($4::timestamptz IS NOT NULL AND (access_expires_at IS NULL OR access_expires_at <= $4))
              OR ($5::timestamptz IS NOT NULL AND last_refreshed_at < $5)
            )
-         RETURNING ${COLUMNS}`, [
+         RETURNING ${CONNECTION_COLUMNS}`, [
                 id,
                 now,
                 lockUntil,
@@ -129,7 +198,7 @@ export function postgresStore(sql) {
         // Holder writes are fenced by refresh_lock_token: a holder whose lock
         // expired or was cleared by a reconnect matches no row and changes nothing.
         async saveRefreshed(id, lockToken, r) {
-            return one(`UPDATE bexio_grants SET
+            return connection(`UPDATE bexio_connections SET
            access_token = $2,
            refresh_token = COALESCE($3, refresh_token),
            access_expires_at = $4,
@@ -142,7 +211,7 @@ export function postgresStore(sql) {
            last_refreshed_at = $8,
            updated_at = $8
          WHERE id = $1 AND refresh_lock_token = $9
-         RETURNING ${COLUMNS}`, [
+         RETURNING ${CONNECTION_COLUMNS}`, [
                 id,
                 r.accessToken,
                 r.refreshToken,
@@ -155,22 +224,22 @@ export function postgresStore(sql) {
             ]);
         },
         async markReauthRequired(id, lockToken, now) {
-            await sql.query(`UPDATE bexio_grants SET status = 'reauth_required',
+            return connection(`UPDATE bexio_connections SET status = 'reauth_required',
            refresh_locked_until = NULL, refresh_lock_token = NULL, updated_at = $2
-         WHERE id = $1 AND refresh_lock_token = $3`, [id, now, lockToken]);
+         WHERE id = $1 AND refresh_lock_token = $3
+         RETURNING ${CONNECTION_COLUMNS}`, [id, now, lockToken]);
         },
         async releaseRefreshLock(id, lockToken) {
-            await sql.query(`UPDATE bexio_grants SET refresh_locked_until = NULL, refresh_lock_token = NULL
+            await sql.query(`UPDATE bexio_connections SET refresh_locked_until = NULL, refresh_lock_token = NULL
          WHERE id = $1 AND refresh_lock_token = $2`, [id, lockToken]);
         },
-        async deleteGrant(id) {
-            await sql.query(`DELETE FROM bexio_grants WHERE id = $1`, [id]);
-        },
-        async listIdleGrants({ refreshedBefore, limit }) {
-            return many(`SELECT ${COLUMNS} FROM bexio_grants
-         WHERE status = 'active' AND last_refreshed_at < $1
-         ORDER BY last_refreshed_at
+        async listIdleConnections({ refreshedBefore, limit }) {
+            const { rows } = await sql.query(`SELECT ${CONNECTION_COLUMNS} FROM bexio_connections c
+         WHERE c.status = 'active' AND c.last_refreshed_at < $1
+           AND EXISTS (SELECT 1 FROM bexio_grants g WHERE g.connection_id = c.id)
+         ORDER BY c.last_refreshed_at
          LIMIT $2`, [refreshedBefore, limit]);
+            return rows.map(toConnection);
         },
     };
 }

package/dist/store/postgres.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../src/store/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAW/C,wEAAwE;AACxE,yDAAyD;AACzD,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,MAAM,OAAO,GAAG;;;4CAG4B,CAAC;AA2B7C,SAAS,IAAI,CAAC,KAA2B;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAQ;IACxB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,SAAS,EAAE,GAAG,CAAC,gBAAgB;QAC/B,MAAM,EAAE,GAAG,CAAC,aAAa;QACzB,aAAa,EACX,GAAG,CAAC,qBAAqB,KAAK,IAAI;YAChC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACvC,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC9C,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClD,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAQ,IAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,CAAC;YACjB,MAAM,GAAG,GAAG,MAAM,GAAG,CACnB;;;;;;;;;;;;;;;;;;;;;qBAqBa,OAAO,EAAE,EACtB;gBACE,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG;aACN,CACF,CAAC;YACF,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;YAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC5D,OAAO,IAAI,CACT,UAAU,OAAO;;;;iCAIQ,EACzB,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,CAC9C,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,GAAG,CAAC,UAAU,OAAO,kCAAkC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,EAAE,EACF,GAAG,EACH,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,eAAe,GAChB;YACC,OAAO,GAAG,CACR;;;;;;;;qBAQa,OAAO,EAAE,EACtB;gBACE,EAAE;gBACF,GAAG;gBACH,SAAS;gBACT,mBAAmB,IAAI,IAAI;gBAC3B,eAAe,IAAI,IAAI;gBACvB,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,4EAA4E;QAC5E,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;YAClC,OAAO,GAAG,CACR;;;;;;;;;;;;;qBAaa,OAAO,EAAE,EACtB;gBACE,EAAE;gBACF,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,GAAG;gBACL,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG;YACzC,MAAM,GAAG,CAAC,KAAK,CACb;;mDAE2C,EAC3C,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CACrB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS;YACpC,MAAM,GAAG,CAAC,KAAK,CACb;mDAC2C,EAC3C,CAAC,EAAE,EAAE,SAAS,CAAC,CAChB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,MAAM,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;YAC7C,OAAO,IAAI,CACT,UAAU,OAAO;;;kBAGP,EACV,CAAC,eAAe,EAAE,KAAK,CAAC,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../src/store/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAW/C,yEAAyE;AACzE,yDAAyD;AACzD,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,MAAM,kBAAkB,GAAG;;;2DAGgC,CAAC;AAE5D,yDAAyD;AACzD,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC;KAC5C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;KACrC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEd,oEAAoE;AACpE,MAAM,aAAa,GAAG,mEAAmE,SAAS,EAAE,CAAC;AAErG;;;;;GAKG;AACH,MAAM,aAAa,GAAsC;IACvD,CAAC,uBAAuB,EAAE,gCAAgC,CAAC;IAC3D,CAAC,cAAc,EAAE,uBAAuB,CAAC;IACzC,CAAC,WAAW,EAAE,oBAAoB,CAAC;IACnC,CAAC,YAAY,EAAE,qBAAqB,CAAC;IACrC,CAAC,MAAM,EAAE,eAAe,CAAC;IACzB,CAAC,QAAQ,EAAE,UAAU,CAAC;IACtB,CAAC,cAAc,EAAE,uBAAuB,CAAC;IACzC,CAAC,eAAe,EAAE,wBAAwB,CAAC;IAC3C,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;IACnD,CAAC,oBAAoB,EAAE,6BAA6B,CAAC;IACrD,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAC3B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAC9B,CAAC,eAAe,EAAE,wBAAwB,CAAC;IAC3C,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;IACnD,CAAC,YAAY,EAAE,qBAAqB,CAAC;CACtC,CAAC;AACF,MAAM,wBAAwB,GAAG,aAAa,CAAC,GAAG,CAChD,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAClB,GAAG,MAAM;cACC,KAAK,2BAA2B,MAAM,MAAM,CACzD,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAE3B,4CAA4C;AAC5C,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAiCtC,SAAS,IAAI,CAAC,KAA2B;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB;IACtC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,gBAAgB;QAC/B,MAAM,EAAE,GAAG,CAAC,aAAa;QACzB,aAAa,EACX,GAAG,CAAC,qBAAqB,KAAK,IAAI;YAChC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACvC,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC9C,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;QACrC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAAa;IAC5B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,QAAQ;QAChB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACrC,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;QAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,CAAC;YACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAC9B;;;;;;;;eAQO,wBAAwB;uBAChB,kBAAkB;;;;;;;kBAOvB,aAAa,uBAAuB,EAC9C;gBACE,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,YAAY;aACf,CACF,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACb,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAa,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;YAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAC9B,UAAU,aAAa;;;;;qCAKM,EAC7B,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,CAC9C,CAAC;YACF,OAAQ,IAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO;YAC3B,MAAM,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE;YACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,UAAU,CACf,UAAU,kBAAkB,uCAAuC,EACnE,CAAC,EAAE,CAAC,CACL,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,oEAAoE;QACpE,KAAK,CAAC,sBAAsB,CAAC,EAAE;YAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAC9B;;;uBAGa,SAAS;;;2CAGW,EACjC,CAAC,EAAE,CAAC,CACL,CAAC;gBACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CACqD,CAAC;gBACxE,OAAO,GAAG;oBACR,CAAC,CAAC;wBACE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC;wBAC7B,uBAAuB,EAAE,GAAG,CAAC,0BAA0B;qBACxD;oBACH,CAAC,CAAC,IAAI,CAAC;YACX,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA4B,CAAC,IAAI,KAAK,qBAAqB;oBAC9D,OAAO,IAAI,CAAC;gBACd,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,EAAE,EACF,GAAG,EACH,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,eAAe,GAChB;YACC,OAAO,UAAU,CACf;;;;;;;;qBAQa,kBAAkB,EAAE,EACjC;gBACE,EAAE;gBACF,GAAG;gBACH,SAAS;gBACT,mBAAmB,IAAI,IAAI;gBAC3B,eAAe,IAAI,IAAI;gBACvB,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,4EAA4E;QAC5E,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;YAClC,OAAO,UAAU,CACf;;;;;;;;;;;;;qBAaa,kBAAkB,EAAE,EACjC;gBACE,EAAE;gBACF,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,GAAG;gBACL,SAAS;aACV,CACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG;YACzC,OAAO,UAAU,CACf;;;qBAGa,kBAAkB,EAAE,EACjC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CACrB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS;YACpC,MAAM,GAAG,CAAC,KAAK,CACb;mDAC2C,EAC3C,CAAC,EAAE,EAAE,SAAS,CAAC,CAChB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;YAClD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAC9B,UAAU,kBAAkB;;;;kBAIlB,EACV,CAAC,eAAe,EAAE,KAAK,CAAC,CACzB,CAAC;YACF,OAAQ,IAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/store/types.d.ts

@@ -1,9 +1,12 @@
 import type { Role } from "../permissions.js";
 export type GrantStatus = "active" | "reauth_required";
-/** A stored grant. Token fields hold JWE ciphertext, never plaintext. */
-export interface GrantRecord {
+/**
+ * A stored connection: one Bexio identity (company, user) and the tokens of
+ * its refresh token chain, shared by every owner that connected it. Token
+ * fields hold JWE ciphertext, never plaintext.
+ */
+export interface ConnectionRecord {
     id: string;
-    ownerId: string;
     companyId: string;
     userId: string;
     companyUserId: number | null;
@@ -18,11 +21,26 @@ export interface GrantRecord {
     refreshExpiresAt: Date | null;
     scope: string | null;
     refreshLockedUntil: Date | null;
+    /** When Bexio issued the authorization the tokens belong to. */
+    authorizedAt: Date;
     lastRefreshedAt: Date;
     createdAt: Date;
     updatedAt: Date;
 }
-/** Insert, or overwrite the tokens of, the grant for (owner, company, user). */
+/** A stored grant: one owner's access to a connection. */
+export interface GrantRecord {
+    id: string;
+    ownerId: string;
+    createdAt: Date;
+    connection: ConnectionRecord;
+}
+/**
+ * Upsert of the connection for (company, user) and of the grant for (owner,
+ * that connection). The grant is always linked. The connection takes the new
+ * tokens (status `active`, lock cleared) unless it already holds a newer
+ * authorization: Bexio invalidates older chains, so a slow connect that
+ * authorized earlier must not overwrite a later one.
+ */
 export interface GrantUpsert {
     ownerId: string;
     companyId: string;
@@ -37,9 +55,11 @@ export interface GrantUpsert {
     accessExpiresAt: Date | null;
     refreshExpiresAt: Date | null;
     scope: string | null;
+    /** When Bexio issued this authorization (the access token's `iat`). */
+    authorizedAt: Date;
     now: Date;
 }
-export interface GrantRefresh {
+export interface ConnectionRefresh {
     accessToken: string;
     /** `null` keeps the stored refresh token (the IdP didn't rotate it). */
     refreshToken: string | null;
@@ -53,6 +73,7 @@ export interface GrantRefresh {
     now: Date;
 }
 export interface LockRequest {
+    /** The connection to lock. */
     id: string;
     now: Date;
     lockUntil: Date;
@@ -64,42 +85,61 @@ export interface LockRequest {
     lockToken: string;
     /** Lock only if the access token expires before this instant (lazy refresh)… */
     accessExpiresBefore?: Date;
-    /** …or only if the grant was last refreshed before this instant (idle sweep). */
+    /** …or only if the connection was last refreshed before this instant (idle sweep). */
     refreshedBefore?: Date;
 }
 /**
- * Persistence for grants. Every method must be atomic on its own: the
- * library never needs multi-statement transactions.
+ * Persistence for connections and grants. Every method must be atomic on its
+ * own: the library never needs multi-statement transactions.
  */
 export interface GrantStore {
+    /** See `GrantUpsert`. Returns the grant with its connection. */
     upsertGrant(input: GrantUpsert): Promise<GrantRecord>;
+    /** The owner's grants with their connections, oldest first. */
     findGrants(query: {
         ownerId: string;
         companyId?: string;
         grantId?: string;
     }): Promise<GrantRecord[]>;
-    getGrant(id: string): Promise<GrantRecord | null>;
+    /** Deletes one grant; its connection stays. */
+    deleteGrant(id: string): Promise<void>;
+    getConnection(id: string): Promise<ConnectionRecord | null>;
     /**
-     * Takes the refresh lock if the grant is active, not locked (or the lock
-     * expired), and still matches the `accessExpiresBefore` / `refreshedBefore`
-     * condition. Returns the locked row, or `null` if someone else holds the
-     * lock or the grant no longer needs a refresh.
+     * Deletes the connection if no grant references it any more, and returns
+     * the deleted row, plus whether the same Bexio user still has a connection
+     * (for another company). Returns `null` (and changes nothing) while a grant
+     * still references it, including one added concurrently.
      */
-    acquireRefreshLock(request: LockRequest): Promise<GrantRecord | null>;
+    deleteUnusedConnection(id: string): Promise<{
+        connection: ConnectionRecord;
+        userHasOtherConnections: boolean;
+    } | null>;
+    /**
+     * Takes the refresh lock if the connection is active, not locked (or the
+     * lock expired), and still matches the `accessExpiresBefore` /
+     * `refreshedBefore` condition. Returns the locked row, or `null` if someone
+     * else holds the lock or the connection no longer needs a refresh.
+     */
+    acquireRefreshLock(request: LockRequest): Promise<ConnectionRecord | null>;
     /**
      * Stores refreshed tokens, sets `lastRefreshedAt`, and releases the lock.
      * Returns `null` (and changes nothing) unless `lockToken` still holds it.
      */
-    saveRefreshed(id: string, lockToken: string, refresh: GrantRefresh): Promise<GrantRecord | null>;
-    /** Sets `status = reauth_required` and releases the lock, if `lockToken` holds it. */
-    markReauthRequired(id: string, lockToken: string, now: Date): Promise<void>;
+    saveRefreshed(id: string, lockToken: string, refresh: ConnectionRefresh): Promise<ConnectionRecord | null>;
+    /**
+     * Sets `status = reauth_required` and releases the lock. Returns `null`
+     * (and changes nothing) unless `lockToken` still holds it.
+     */
+    markReauthRequired(id: string, lockToken: string, now: Date): Promise<ConnectionRecord | null>;
     /** Releases the lock, if `lockToken` holds it. */
     releaseRefreshLock(id: string, lockToken: string): Promise<void>;
-    deleteGrant(id: string): Promise<void>;
-    /** Active grants last refreshed before `refreshedBefore`, oldest first. */
-    listIdleGrants(query: {
+    /**
+     * Active connections that at least one grant references, last refreshed
+     * before `refreshedBefore`, oldest first.
+     */
+    listIdleConnections(query: {
         refreshedBefore: Date;
         limit: number;
-    }): Promise<GrantRecord[]>;
+    }): Promise<ConnectionRecord[]>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/store/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAEvD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,qCAAqC;IACrC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,qCAAqC;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oCAAoC;IACpC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,IAAI,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,IAAI,CAAC;IAC3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,IAAI,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,UAAU,CAAC,KAAK,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAClD;;;;;OAKG;IACH,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,aAAa,CACX,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC/B,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,2EAA2E;IAC3E,cAAc,CAAC,KAAK,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,gEAAgE;IAChE,YAAY,EAAE,IAAI,CAAC;IACnB,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uEAAuE;IACvE,YAAY,EAAE,IAAI,CAAC;IACnB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,qCAAqC;IACrC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,qCAAqC;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oCAAoC;IACpC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,IAAI,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,IAAI,CAAC;IAC3B,sFAAsF;IACtF,eAAe,CAAC,EAAE,IAAI,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,+DAA+D;IAC/D,UAAU,CAAC,KAAK,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3B,+CAA+C;IAC/C,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAC1C,UAAU,EAAE,gBAAgB,CAAC;QAC7B,uBAAuB,EAAE,OAAO,CAAC;KAClC,GAAG,IAAI,CAAC,CAAC;IACV;;;;;OAKG;IACH,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3E;;;OAGG;IACH,aAAa,CACX,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpC;;;OAGG;IACH,kBAAkB,CAChB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpC,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,mBAAmB,CAAC,KAAK,EAAE;QACzB,eAAe,EAAE,IAAI,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACjC"}

package/dist/types.d.ts

@@ -17,7 +17,7 @@ export interface BexioOAuthConfig {
     issuer?: string;
     /** Defaults to `https://api.bexio.com`. Override only to point at a mock. */
     apiBaseUrl?: string;
-    /** How long one refresh may hold a grant's lock. Default `"30s"`. */
+    /** How long one refresh may hold a connection's lock. Default `"30s"`. */
     refreshLockTtl?: Duration;
     /** Where `callback` redirects when the flow cookie is gone. Default `"/"`. */
     defaultReturnTo?: string;
@@ -26,10 +26,16 @@ export interface BexioOAuthConfig {
     /** Clock override for tests. */
     clock?: () => Date;
 }
-/** A grant as the app sees it: no token material. */
+/**
+ * A grant as the app sees it: one owner's access to a connection, without
+ * token material. Grants of the same Bexio identity share one connection,
+ * so they share its tokens, role and status.
+ */
 export interface Grant {
     id: string;
     ownerId: string;
+    /** Shared by every grant of the same Bexio company and user. */
+    connectionId: string;
     companyId: string;
     companyName: string | null;
     userId: string;
@@ -41,7 +47,9 @@ export interface Grant {
     scope: string | null;
     accessExpiresAt: Date | null;
     lastRefreshedAt: Date;
+    /** When this owner connected. */
     createdAt: Date;
+    /** When the connection last changed. */
     updatedAt: Date;
 }
 /** Identifies one grant of an owner. */
@@ -64,15 +72,17 @@ export interface ExternalTokens {
     expiresAt?: Date | null;
     scope?: string | null;
 }
+/** Counts connections, not grants: owners of one Bexio identity share one. */
 export interface RefreshIdleResult {
     refreshed: number;
-    /** Idle grants another process was refreshing at the same time. */
+    /** Idle connections another process was refreshing at the same time. */
     skipped: number;
     reauthRequired: number;
     failed: number;
     /**
-     * Idle grants not attempted because `timeBudget` ran out (0 when every idle
-     * grant of this run was attempted). The next run picks them up first.
+     * Idle connections not attempted because `timeBudget` ran out (0 when every
+     * idle connection of this run was attempted). The next run picks them up
+     * first.
      */
     remaining: number;
 }
@@ -133,13 +143,17 @@ export interface BexioOAuth {
     listGrants(query: {
         ownerId: string;
     }): Promise<Grant[]>;
-    /** Revokes the refresh token at Bexio (best effort) and deletes the grant. */
+    /**
+     * Deletes the owner's grant. When it was the last grant of its connection,
+     * also deletes the connection and revokes its refresh token at Bexio (best
+     * effort). Other owners of the same Bexio identity keep working.
+     */
     disconnect(selector: GrantSelector): Promise<void>;
     /**
-     * Refreshes active grants not refreshed for `idleFor`, so Bexio doesn't end
-     * their offline sessions. Run it on a schedule. `limit` (default 100) caps
-     * the grants one run looks at; `timeBudget` stops the run before the next
-     * grant once that much time has passed.
+     * Refreshes active connections not refreshed for `idleFor`, so Bexio
+     * doesn't end their offline sessions. Run it on a schedule. `limit`
+     * (default 100) caps the connections one run looks at; `timeBudget` stops
+     * the run before the next connection once that much time has passed.
      */
     refreshIdle(options: {
         idleFor: Duration;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,cAAc,CAAC,EAAE,QAAQ,CAAC;IAC1B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB;AAED,qDAAqD;AACrD,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;CACd;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE1E;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExE;;;OAGG;IACH,cAAc,CACZ,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9E;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAE9D,kDAAkD;IAClD,UAAU,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAEzD,8EAA8E;IAC9E,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,OAAO,EAAE,QAAQ,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,QAAQ,CAAC;KACvB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,QAAQ,CAAC;IAC1B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,IAAI,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,wCAAwC;IACxC,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;CACd;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE1E;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExE;;;OAGG;IACH,cAAc,CACZ,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9E;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAE9D,kDAAkD;IAClD,UAAU,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAEzD;;;;OAIG;IACH,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,OAAO,EAAE,QAAQ,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,QAAQ,CAAC;KACvB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulcode/bexio-oauth",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Bexio OAuth token custody for Node apps: connect Bexio accounts, store tokens encrypted in Postgres, get a valid access token anywhere.",
   "keywords": [
     "bexio",
@@ -47,7 +47,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "jose": "^6.2.13",
+    "jose": "^6.2.14",
     "openid-client": "^6.8.8"
   },
   "devDependencies": {

package/sql/0001_bexio_oauth.sql

@@ -0,0 +1,48 @@
+-- @soulcode/bexio-oauth 0001: connections and grants.
+-- Token columns hold JWE ciphertext; only your server-side database role
+-- should be able to read these tables.
+
+-- One row per Bexio identity (company, user): the tokens of its one refresh
+-- token chain, shared by every owner that connected this identity.
+CREATE TABLE IF NOT EXISTS bexio_connections (
+  id                    uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+  bexio_company_id      text        NOT NULL,
+  bexio_user_id         text        NOT NULL,
+  bexio_company_user_id integer,
+  company_name          text,
+  user_name             text,
+  user_email            text,
+  role                  text        NOT NULL DEFAULT 'member' CHECK (role IN ('admin', 'member')),
+  status                text        NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'reauth_required')),
+  access_token          text        NOT NULL,
+  refresh_token         text,
+  access_expires_at     timestamptz,
+  refresh_expires_at    timestamptz,
+  scope                 text,
+  refresh_locked_until  timestamptz,
+  refresh_lock_token    text,
+  authorized_at         timestamptz NOT NULL,
+  last_refreshed_at     timestamptz NOT NULL DEFAULT now(),
+  created_at            timestamptz NOT NULL DEFAULT now(),
+  updated_at            timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT bexio_connections_company_user_key UNIQUE (bexio_company_id, bexio_user_id)
+);
+
+-- refreshIdle(): active connections by last refresh.
+CREATE INDEX IF NOT EXISTS bexio_connections_idle_idx
+  ON bexio_connections (last_refreshed_at)
+  WHERE status = 'active';
+
+-- One row per (owner, connection): an owner's access to a connection. A
+-- connection is deleted only once no grant references it (RESTRICT).
+CREATE TABLE IF NOT EXISTS bexio_grants (
+  id            uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+  owner_id      text        NOT NULL,
+  connection_id uuid        NOT NULL REFERENCES bexio_connections (id) ON DELETE RESTRICT,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT bexio_grants_owner_connection_key UNIQUE (owner_id, connection_id)
+);
+
+-- Disconnect checks whether a connection has grants left.
+CREATE INDEX IF NOT EXISTS bexio_grants_connection_idx
+  ON bexio_grants (connection_id);