@vunexa/lixa 0.1.4 → 0.1.6-alpha.10

package/dist/index.cjs

@@ -31,11 +31,31 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   AccountLinkingStrategy: () => AccountLinkingStrategy,
+  AccountUnlinkError: () => AccountUnlinkError,
+  DEFAULT_SESSION_COOKIE_NAME: () => DEFAULT_SESSION_COOKIE_NAME,
+  DEFAULT_SESSION_MAX_AGE_SECONDS: () => DEFAULT_SESSION_MAX_AGE_SECONDS,
+  DEFAULT_STATE_COOKIE_NAME: () => DEFAULT_STATE_COOKIE_NAME,
+  DEFAULT_STATE_MAX_AGE_SECONDS: () => DEFAULT_STATE_MAX_AGE_SECONDS,
+  EmailNotVerifiedError: () => EmailNotVerifiedError,
+  InvalidOAuthCallbackError: () => InvalidOAuthCallbackError,
+  InvalidProviderConfigError: () => InvalidProviderConfigError,
+  InvalidStateError: () => InvalidStateError,
   Lixa: () => Lixa,
+  LixaError: () => LixaError,
+  ProviderNotConfiguredError: () => ProviderNotConfiguredError,
+  RefreshTokenError: () => RefreshTokenError,
+  SessionNotFoundError: () => SessionNotFoundError,
+  TokenExchangeError: () => TokenExchangeError,
+  clearSessionCookie: () => clearSessionCookie,
+  clearStateCookie: () => clearStateCookie,
+  createSessionCookie: () => createSessionCookie,
+  createStateCookie: () => createStateCookie,
   decodeIdToken: () => decodeIdToken,
   determineProviderFromIssuer: () => determineProviderFromIssuer,
   extractUserInfo: () => extractUserInfo,
-  fetchUserInfo: () => fetchUserInfo
+  fetchUserInfo: () => fetchUserInfo,
+  isProductionEnvironment: () => isProductionEnvironment,
+  serializeCookie: () => serializeCookie
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -69,7 +89,7 @@ var LocalStateHandler = class {
       }
     };
   }
-  // Default GenerateState implementation
+  // Default generateState implementation
   async generateState(provider) {
     const state = (0, import_crypto.randomBytes)(16).toString("hex");
     const codeVerifier = (0, import_crypto.randomBytes)(32).toString("hex");
@@ -82,6 +102,10 @@ var LocalStateHandler = class {
       }
     };
   }
+  // PascalCase alias for backward compatibility
+  async GenerateState(provider) {
+    return this.generateState(provider);
+  }
 };
 
 // src/lixa.ts
@@ -94,7 +118,20 @@ var LocalSessionHandler = class {
   emailToSessionMap = /* @__PURE__ */ new Map();
   sessionStorage;
   constructor(defaultTtlSeconds = 600) {
-    this.cache = new import_node_cache2.default({ stdTTL: defaultTtlSeconds });
+    this.cache = new import_node_cache2.default({ stdTTL: defaultTtlSeconds, checkperiod: 60 });
+    this.cache.on("expired", (_key, value) => {
+      if (value && typeof value === "object" && value.email) {
+        this.emailToSessionMap.delete(String(value.email).toLowerCase());
+      }
+    });
+    this.cache.on("del", (_key, value) => {
+      if (value && typeof value === "object" && value.email) {
+        this.emailToSessionMap.delete(String(value.email).toLowerCase());
+      }
+    });
+    this.cache.on("flush", () => {
+      this.emailToSessionMap.clear();
+    });
     this.sessionStorage = {
       saveSession: async (sessionId, session, expiresInSeconds) => {
         this.cache.set(sessionId, session, expiresInSeconds);
@@ -125,8 +162,8 @@ var LocalSessionHandler = class {
       }
     };
   }
-  // Default GenerateSession implementation
-  async GenerateSession(tokenData, providerMetadata) {
+  // Default generateSession implementation
+  async generateSession(tokenData, _providerMetadata) {
     if (!tokenData.access_token || typeof tokenData.access_token !== "string") {
       throw new Error("No valid access token found in OAuth response");
     }
@@ -136,6 +173,10 @@ var LocalSessionHandler = class {
     };
     return session;
   }
+  // PascalCase alias for backward compatibility
+  async GenerateSession(tokenData, providerMetadata) {
+    return this.generateSession(tokenData, providerMetadata);
+  }
 };
 
 // src/utils/user-info.ts
@@ -207,16 +248,95 @@ async function extractUserInfo(tokenData, providerMetadata) {
   return { userInfo };
 }
 
+// src/errors.ts
+var LixaError = class extends Error {
+  /**
+   * Standard error code string.
+   */
+  code;
+  /**
+   * Additional error context data.
+   */
+  details;
+  constructor(message, code = "LIXA_ERROR", details) {
+    super(message);
+    this.name = this.constructor.name;
+    this.code = code;
+    this.details = details;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var InvalidStateError = class extends LixaError {
+  constructor(message = "Invalid or expired state", details) {
+    super(message, "INVALID_STATE", details);
+  }
+};
+var ProviderNotConfiguredError = class extends LixaError {
+  constructor(provider, details) {
+    const message = details?.message && typeof details.message === "string" ? details.message : `Provider '${provider}' is not available. Either import it from '@vunexa/lixa-providers' and include it in the configuration, or provide a custom implementation using the 'provider' field: { provider: new CustomProvider(), clientId: '...', ... }`;
+    super(message, "PROVIDER_NOT_CONFIGURED", {
+      provider,
+      ...details
+    });
+  }
+};
+var InvalidProviderConfigError = class extends LixaError {
+  constructor(message, details) {
+    super(message, "INVALID_PROVIDER_CONFIG", details);
+  }
+};
+var InvalidOAuthCallbackError = class extends LixaError {
+  constructor(message, details) {
+    super(message, "INVALID_OAUTH_CALLBACK", details);
+  }
+};
+var TokenExchangeError = class extends LixaError {
+  status;
+  constructor(message, status, details) {
+    super(message, "TOKEN_EXCHANGE_FAILED", { status, ...details });
+    this.status = status;
+  }
+};
+var SessionNotFoundError = class extends LixaError {
+  constructor(message = "Active session not found or has expired", details) {
+    super(message, "SESSION_NOT_FOUND", details);
+  }
+};
+var EmailNotVerifiedError = class extends LixaError {
+  constructor(email, details) {
+    super(
+      `Cannot link account: email '${email || "unknown"}' is not verified by the identity provider`,
+      "EMAIL_NOT_VERIFIED",
+      { email, ...details }
+    );
+  }
+};
+var AccountUnlinkError = class extends LixaError {
+  constructor(message, details) {
+    super(message, "ACCOUNT_UNLINK_ERROR", details);
+  }
+};
+var RefreshTokenError = class extends LixaError {
+  constructor(message, details) {
+    super(message, "REFRESH_TOKEN_ERROR", details);
+  }
+};
+
 // src/lixa.ts
 var Lixa = class _Lixa {
   static DEFAULT_PROVIDERS = /* @__PURE__ */ new Map();
   static CONFIGURED_PROVIDERS = /* @__PURE__ */ new Map();
   // Legacy registry for backward compatibility
-  static LOCAL_STATE_HANDLER = new LocalStateHandler();
-  static LOCAL_SESSION_HANDLER = new LocalSessionHandler();
+  // Instance-scoped fallback handlers to ensure no cross-instance state pollution
+  localStateHandler;
+  localSessionHandler;
+  localResourceHandler;
+  userResourceStore = /* @__PURE__ */ new Map();
+  refreshMutexes = /* @__PURE__ */ new Map();
   config;
   stateHandler;
   sessionHandler;
+  resourceHandler;
   debug;
   /**
    * Creates a new Lixa instance with the provided configuration.
@@ -233,9 +353,44 @@ var Lixa = class _Lixa {
    */
   constructor(config) {
     this.config = config;
-    this.stateHandler = config.stateHandler || _Lixa.LOCAL_STATE_HANDLER;
-    this.sessionHandler = config.sessionHandler || _Lixa.LOCAL_SESSION_HANDLER;
     this.debug = config.debug || false;
+    this.localStateHandler = new LocalStateHandler();
+    this.localSessionHandler = new LocalSessionHandler();
+    this.localResourceHandler = {
+      resourceStorage: {
+        saveResource: async (userId, provider, resource) => {
+          let userMap = this.userResourceStore.get(userId);
+          if (!userMap) {
+            userMap = /* @__PURE__ */ new Map();
+            this.userResourceStore.set(userId, userMap);
+          }
+          userMap.set(provider.toLowerCase(), resource);
+        },
+        getResource: async (userId, provider) => {
+          const userMap = this.userResourceStore.get(userId);
+          return userMap?.get(provider.toLowerCase()) || null;
+        },
+        getUserResources: async (userId) => {
+          const userMap = this.userResourceStore.get(userId);
+          const result = {};
+          if (userMap) {
+            for (const [p, r] of userMap.entries()) {
+              result[p] = r;
+            }
+          }
+          return result;
+        },
+        deleteResource: async (userId, provider) => {
+          const userMap = this.userResourceStore.get(userId);
+          if (userMap) {
+            userMap.delete(provider.toLowerCase());
+          }
+        }
+      }
+    };
+    this.stateHandler = config.stateHandler || this.localStateHandler;
+    this.sessionHandler = config.sessionHandler || this.localSessionHandler;
+    this.resourceHandler = config.resourceHandler || this.localResourceHandler;
     this.log("INFO", "Init", "Initializing Lixa instance", {
       providers: Object.keys(config.providers),
       debug: this.debug
@@ -250,8 +405,9 @@ var Lixa = class _Lixa {
       } else {
         if (!_Lixa.DEFAULT_PROVIDERS.has(name) && !_Lixa.CONFIGURED_PROVIDERS.has(name)) {
           this.log("ERROR", "Init", `Provider '${providerName}' not available`);
-          throw new Error(
-            `Provider '${providerName}' is not available. Either import it from '@vunexa/lixa-providers' and include it in the configuration, or provide a custom implementation using the 'provider' field: { provider: new CustomProvider(), clientId: '...', ... }`
+          throw new ProviderNotConfiguredError(
+            providerName,
+            { hint: `Ensure the provider is registered via '@vunexa/lixa-providers' or provided inline.` }
           );
         }
         this.log("INFO", "Init", `Using registered provider: ${providerName}`);
@@ -264,7 +420,7 @@ var Lixa = class _Lixa {
    * 
    * @param name - The provider name
    * @param config - The provider configuration
-   * @throws Error when required fields are missing or invalid
+   * @throws InvalidProviderConfigError when required fields are missing or invalid
    */
   validateProviderConfig(name, config) {
     const requiredFields = ["clientId", "clientSecret", "redirectUri", "scopes"];
@@ -273,18 +429,21 @@ var Lixa = class _Lixa {
       return value === void 0 || value === null || typeof value === "string" && value.trim() === "";
     });
     if (missingFields.length > 0) {
-      throw new Error(
-        `Provider '${name}' configuration is missing required fields: ${missingFields.join(", ")}`
+      throw new InvalidProviderConfigError(
+        `Provider '${name}' configuration is missing required fields: ${missingFields.join(", ")}`,
+        { provider: name, missingFields }
       );
     }
     if (!Array.isArray(config.scopes)) {
-      throw new Error(
-        `Provider '${name}' configuration error: 'scopes' must be an array of strings`
+      throw new InvalidProviderConfigError(
+        `Provider '${name}' configuration error: 'scopes' must be an array of strings`,
+        { provider: name }
       );
     }
     if (config.scopes.length === 0) {
-      throw new Error(
-        `Provider '${name}' configuration error: 'scopes' array cannot be empty`
+      throw new InvalidProviderConfigError(
+        `Provider '${name}' configuration error: 'scopes' array cannot be empty`,
+        { provider: name }
       );
     }
   }
@@ -293,7 +452,7 @@ var Lixa = class _Lixa {
    * 
    * @param name - The provider name
    * @param provider - The provider implementation
-   * @throws Error when required properties are missing
+   * @throws InvalidProviderConfigError when required properties are missing
    */
   validateProviderImplementation(name, provider) {
     const requiredProps = ["authorizationEndpoint", "tokenEndpoint", "userInfoEndpoint"];
@@ -302,24 +461,27 @@ var Lixa = class _Lixa {
       return !value || typeof value !== "string" || value.trim() === "";
     });
     if (missingProps.length > 0) {
-      throw new Error(
-        `Provider '${name}' implementation is missing required properties: ${missingProps.join(", ")}. All IProvider implementations must define: authorizationEndpoint, tokenEndpoint, and userInfoEndpoint.`
+      throw new InvalidProviderConfigError(
+        `Provider '${name}' implementation is missing required properties: ${missingProps.join(", ")}. All IProvider implementations must define: authorizationEndpoint, tokenEndpoint, and userInfoEndpoint.`,
+        { provider: name, missingProps }
       );
     }
   }
   /**
-   * Structured debug logging with standardized format.
+   * Structured logging with standardized format and custom logger support.
    * 
-   * @param level - Log level (INFO, WARN, ERROR)
-   * @param context - Context of the log (Init, Auth, Token, Session, State)
+   * @param level - Log level (INFO, WARN, ERROR, DEBUG)
+   * @param context - Context of the log (Init, Auth, Token, Session, State, AccountLinking, Resource)
    * @param message - Log message
    * @param data - Optional data to log
-   * 
-   * @remarks
-   * Format: [Lixa] [timestamp] [level] [context] message
-   * Only logs when debug mode is enabled.
    */
   log(level, context, message, data) {
+    if (this.config.logger) {
+      try {
+        this.config.logger.log(level, context, message, data);
+      } catch {
+      }
+    }
     if (!this.debug) return;
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     const prefix = `[Lixa] [${timestamp}] [${level}] [${context}]`;
@@ -370,8 +532,9 @@ var Lixa = class _Lixa {
     if (legacyProvider) {
       return legacyProvider;
     }
-    throw new Error(
-      `Provider '${name}' not found. Ensure the provider is included in the configuration with a 'provider' field, or registered using Lixa.registerProvider().`
+    throw new ProviderNotConfiguredError(
+      name,
+      { hint: `Ensure the provider is included in the configuration with a 'provider' field, or registered using Lixa.registerProvider().` }
     );
   }
   /**
@@ -561,23 +724,26 @@ var Lixa = class _Lixa {
     const providerConfig = this.findProviderByType(providerType);
     if (!providerConfig) {
       this.log("ERROR", "Auth", `Provider '${String(provider)}' is not configured`);
-      throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);
+      throw new ProviderNotConfiguredError(String(provider), {
+        message: `Provider '${String(provider)}' is not configured in this Lixa instance`
+      });
     }
     const providerImpl = this.getProvider(providerType, providerConfig);
     let stateValue;
     let codeVerifier;
-    if (this.stateHandler.generateState) {
-      this.log("INFO", "State", "Calling custom GenerateState");
-      const generated = await this.stateHandler.generateState(providerType);
+    const generateStateFn = this.stateHandler.generateState || this.stateHandler.GenerateState;
+    if (generateStateFn) {
+      this.log("INFO", "State", "Calling custom generateState");
+      const generated = await generateStateFn(providerType);
       stateValue = state || generated.state;
       codeVerifier = generated.data.codeVerifier;
-      const storage = this.stateHandler.stateStorage || _Lixa.LOCAL_STATE_HANDLER.stateStorage;
+      const storage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage;
       await storage.saveState(stateValue, generated.data, 300);
     } else {
       this.log("INFO", "State", "Using default state generation");
       stateValue = state || (0, import_crypto2.randomBytes)(16).toString("hex");
       codeVerifier = (0, import_crypto2.randomBytes)(32).toString("hex");
-      const storage = this.stateHandler.stateStorage || _Lixa.LOCAL_STATE_HANDLER.stateStorage;
+      const storage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage;
       await storage.saveState(
         stateValue,
         {
@@ -586,12 +752,17 @@ var Lixa = class _Lixa {
           codeVerifier
         },
         300
-        // 5 minutes in seconds
+        // 5 minutes in seconds (synchronized with cookie TTL)
       );
     }
     const codeChallenge = _Lixa.buildCodeChallenge(codeVerifier);
     this.log("INFO", "State", `Saved state for provider: ${providerType}`, { state: stateValue });
-    const authNScopes = this.resolveAuthNScopes(providerType, providerConfig.scopes, providerImpl);
+    const authNScopes = this.resolveAuthNScopes(
+      providerType,
+      providerConfig.scopes,
+      providerImpl,
+      providerConfig.allowNonAuthScopes
+    );
     const params = new URLSearchParams({
       client_id: providerConfig.clientId,
       redirect_uri: providerConfig.redirectUri,
@@ -610,9 +781,12 @@ var Lixa = class _Lixa {
     return authUrl;
   }
   /**
-   * Restricts primary authentication scopes strictly to AuthN identity scopes.
+   * Restricts primary authentication scopes strictly to AuthN identity scopes unless allowNonAuthScopes is true.
    */
-  resolveAuthNScopes(providerType, configuredScopes, providerImpl) {
+  resolveAuthNScopes(providerType, configuredScopes, providerImpl, allowNonAuthScopes) {
+    if (allowNonAuthScopes) {
+      return configuredScopes && configuredScopes.length > 0 ? configuredScopes : providerImpl.authScopes || ["openid", "email", "profile"];
+    }
     const defaultAuthScopes = {
       google: ["openid", "email", "profile"],
       github: ["read:user", "user:email"],
@@ -641,7 +815,7 @@ var Lixa = class _Lixa {
         "Auth",
         `Primary authentication is strictly limited to AuthN scopes. Excluded non-AuthN resource scopes: [${nonAuthNScopes.join(
           ", "
-        )}]. Use lixa.getResourceAuthUrl() post-login to connect resource providers.`
+        )}]. Set 'allowNonAuthScopes: true' on provider config to include them, or use lixa.getResourceAuthUrl() post-login to connect resource providers.`
       );
     }
     if (validAuthNScopes.length > 0) {
@@ -677,18 +851,18 @@ var Lixa = class _Lixa {
     this.log("INFO", "Auth", `Handling OAuth callback for provider: ${providerType}`);
     if (!code || code.trim() === "") {
       this.log("ERROR", "Auth", "Invalid or missing authorization code in callback");
-      throw new Error("Invalid or missing code in callback");
+      throw new InvalidOAuthCallbackError("Invalid or missing code in callback");
     }
     if (!state || state.trim() === "") {
       this.log("ERROR", "Auth", "Invalid or missing state in callback");
-      throw new Error("Invalid or missing state in callback");
+      throw new InvalidOAuthCallbackError("Invalid or missing state in callback");
     }
     this.log("INFO", "State", "Validating state parameter", { state });
-    const stateStorage = this.stateHandler.stateStorage || _Lixa.LOCAL_STATE_HANDLER.stateStorage;
+    const stateStorage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage;
     const cachedState = await stateStorage.getState(state);
     if (!cachedState) {
       this.log("ERROR", "State", "State validation failed: state not found or expired", { state });
-      throw new Error("Invalid or expired state");
+      throw new InvalidStateError("Invalid or expired state", { state });
     }
     this.log("INFO", "State", "State validated successfully, removing from cache");
     await stateStorage.deleteState(state);
@@ -696,7 +870,9 @@ var Lixa = class _Lixa {
     const providerConfig = this.findProviderByType(providerType);
     if (!providerConfig) {
       this.log("ERROR", "Auth", `Provider '${String(provider)}' is not configured`);
-      throw new Error(`Provider '${String(provider)}' is not configured in this Lixa instance`);
+      throw new ProviderNotConfiguredError(String(provider), {
+        message: `Provider '${String(provider)}' is not configured in this Lixa instance`
+      });
     }
     const providerImpl = this.getProvider(providerType, providerConfig);
     this.log("INFO", "Token", `Exchanging authorization code for tokens`, { provider: providerType });
@@ -722,9 +898,12 @@ var Lixa = class _Lixa {
       extractedUserInfo = userInfo;
     } catch {
     }
-    const generateSession = this.sessionHandler.generateSession || _Lixa.LOCAL_SESSION_HANDLER.GenerateSession.bind(_Lixa.LOCAL_SESSION_HANDLER);
-    if (this.sessionHandler.generateSession) {
-      this.log("INFO", "Session", "Calling custom GenerateSession");
+    const generateSession = this.sessionHandler.generateSession || this.sessionHandler.GenerateSession || (this.localSessionHandler.generateSession ? this.localSessionHandler.generateSession.bind(this.localSessionHandler) : void 0);
+    if (!generateSession) {
+      throw new Error("No session generation handler available");
+    }
+    if (this.sessionHandler.generateSession || this.sessionHandler.GenerateSession) {
+      this.log("INFO", "Session", "Calling custom generateSession");
     } else {
       this.log("INFO", "Session", "Using default session generation");
     }
@@ -733,7 +912,7 @@ var Lixa = class _Lixa {
     if (extractedUserInfo?.email && !session.email) {
       session.email = extractedUserInfo.email;
     }
-    const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
+    const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage;
     const linkingConfig = this.config.accountLinking;
     const mode = String(linkingConfig?.mode || "");
     const isLinkByEmail = mode === "AUTO_LINK_BY_VERIFIED_EMAIL" /* AUTO_LINK_BY_VERIFIED_EMAIL */ || mode === "AUTO_LINK_BY_VERIFIED_EMAIL" || mode === "linkByEmail";
@@ -786,27 +965,31 @@ var Lixa = class _Lixa {
    */
   async linkAccount(params) {
     const { sessionId, provider, code, state } = params;
-    const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
+    const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage;
     const existingSession = await sessionStorage.getSession(sessionId);
     if (!existingSession) {
-      throw new Error("Invalid session ID. User must be authenticated to link an account.");
+      throw new SessionNotFoundError("Invalid session ID. User must be authenticated to link an account.", { sessionId });
+    }
+    if (!code || code.trim() === "") {
+      throw new InvalidOAuthCallbackError("Invalid or missing code in linkAccount");
     }
     const providerType = String(provider).toLowerCase();
     const providerConfig = this.findProviderByType(providerType);
     if (!providerConfig) {
-      throw new Error(`Provider '${String(provider)}' is not configured`);
+      throw new ProviderNotConfiguredError(String(provider));
     }
     const providerImpl = this.getProvider(providerType, providerConfig);
-    let codeVerifier = (0, import_crypto2.randomBytes)(32).toString("hex");
+    let codeVerifier;
     if (state) {
-      const stateStorage = this.stateHandler.stateStorage || _Lixa.LOCAL_STATE_HANDLER.stateStorage;
+      const stateStorage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage;
       const cachedState = await stateStorage.getState(state);
-      if (cachedState) {
-        codeVerifier = cachedState.codeVerifier;
-        await stateStorage.deleteState(state);
+      if (!cachedState) {
+        throw new InvalidStateError("Invalid or expired state during account linking", { state });
       }
+      codeVerifier = cachedState.codeVerifier;
+      await stateStorage.deleteState(state);
     }
-    const tokens = await this.exchangeCodeForToken(providerType, providerConfig, providerImpl, codeVerifier);
+    const tokens = await this.exchangeCodeForToken(code, providerConfig, providerImpl, codeVerifier || "");
     const providerMetadata = {
       name: providerType,
       endpoints: {
@@ -844,14 +1027,17 @@ var Lixa = class _Lixa {
    * @returns Promise resolving to true on successful unlink
    */
   async unlinkAccount(sessionId, providerToUnlink) {
-    const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
+    const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage;
     const session = await sessionStorage.getSession(sessionId);
     if (!session || !session.accounts) {
-      throw new Error("Session not found or has no linked accounts.");
+      throw new AccountUnlinkError("Session not found or has no linked accounts.", { sessionId });
     }
     const linkedProviders = Object.keys(session.accounts);
     if (linkedProviders.length <= 1) {
-      throw new Error("Cannot unlink the only authentication provider for this account.");
+      throw new AccountUnlinkError("Cannot unlink the only authentication provider for this account.", {
+        sessionId,
+        provider: providerToUnlink
+      });
     }
     delete session.accounts[providerToUnlink.toLowerCase()];
     await sessionStorage.saveSession(sessionId, session, 86400);
@@ -870,20 +1056,20 @@ var Lixa = class _Lixa {
    */
   async getResourceAuthUrl(params) {
     const { sessionId, provider, scopes, state, prompt, extraConfig } = params;
-    const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
+    const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage;
     const activeSession = await sessionStorage.getSession(sessionId);
     if (!activeSession) {
-      throw new Error("Authentication required. Active session must exist to connect resource providers.");
+      throw new SessionNotFoundError("Authentication required. Active session must exist to connect resource providers.", { sessionId });
     }
     const providerType = String(provider).toLowerCase();
     const providerConfig = this.findProviderByType(providerType);
     if (!providerConfig) {
-      throw new Error(`Provider '${String(provider)}' is not configured`);
+      throw new ProviderNotConfiguredError(String(provider));
     }
     const providerImpl = this.getProvider(providerType, providerConfig);
     const stateValue = state || (0, import_crypto2.randomBytes)(16).toString("hex");
     const codeVerifier = (0, import_crypto2.randomBytes)(32).toString("hex");
-    const storage = this.stateHandler.stateStorage || _Lixa.LOCAL_STATE_HANDLER.stateStorage;
+    const storage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage;
     await storage.saveState(
       stateValue,
       {
@@ -908,77 +1094,245 @@ var Lixa = class _Lixa {
     });
     return `${providerImpl.authorizationEndpoint}?${searchParams.toString()}`;
   }
+  getUserKeyFromSession(session) {
+    return session.userId || session.email || session.id || "anonymous";
+  }
   /**
-   * Handles the OAuth callback for a connected resource provider and stores resource tokens on the session.
-   * 
-   * @param params - Object containing sessionId, provider, code, state, and requested scopes
-   * @returns Updated Session containing stored resource tokens under session.resources[provider]
+   * Handles the OAuth callback for a connected resource provider and stores resource tokens bound to user account.
    */
   async handleResourceCallback(params) {
     const { sessionId, provider, code, state, scopes } = params;
-    const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
+    const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage;
     const activeSession = await sessionStorage.getSession(sessionId);
     if (!activeSession) {
-      throw new Error("Authentication required. Active session not found for resource connection.");
+      throw new SessionNotFoundError("Authentication required. Active session not found for resource connection.", { sessionId });
     }
     const providerType = String(provider).toLowerCase();
     const providerConfig = this.findProviderByType(providerType);
     if (!providerConfig) {
-      throw new Error(`Provider '${String(provider)}' is not configured`);
+      throw new ProviderNotConfiguredError(String(provider));
     }
     const providerImpl = this.getProvider(providerType, providerConfig);
     let codeVerifier = (0, import_crypto2.randomBytes)(32).toString("hex");
     if (state) {
-      const stateStorage = this.stateHandler.stateStorage || _Lixa.LOCAL_STATE_HANDLER.stateStorage;
+      const stateStorage = this.stateHandler.stateStorage || this.localStateHandler.stateStorage;
       const cachedState = await stateStorage.getState(state);
-      if (cachedState) {
-        codeVerifier = cachedState.codeVerifier;
-        await stateStorage.deleteState(state);
+      if (!cachedState) {
+        throw new InvalidStateError("Invalid or expired state during resource connection callback", { state });
       }
+      codeVerifier = cachedState.codeVerifier;
+      await stateStorage.deleteState(state);
     }
     const tokens = await this.exchangeCodeForToken(code, providerConfig, providerImpl, codeVerifier);
-    activeSession.resources = activeSession.resources || {};
-    activeSession.resources[providerType] = {
+    const expiresAt = tokens.expires_in ? Date.now() + tokens.expires_in * 1e3 : void 0;
+    const connectedResource = {
       provider: providerType,
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token,
+      expiresAt,
       scopes: scopes || (tokens.scope ? tokens.scope.split(" ") : []),
       raw: tokens,
       connectedAt: Date.now()
     };
+    const userKey = this.getUserKeyFromSession(activeSession);
+    const resourceStorage = this.resourceHandler.resourceStorage || this.localResourceHandler.resourceStorage;
+    await resourceStorage.saveResource(userKey, providerType, connectedResource);
+    activeSession.resources = activeSession.resources || {};
+    activeSession.resources[providerType] = connectedResource;
     await sessionStorage.saveSession(sessionId, activeSession, 86400);
     return activeSession;
   }
   /**
-   * Retrieves a connected resource provider token for an active session.
+   * Retrieves a connected resource for a specific User ID / Email directly (independent of session IDs).
+   * Automatically refreshes expired access tokens if a refresh token is present.
+   * 
+   * @param userIdOrEmail - User identifier or email
+   * @param provider - Resource provider identifier (e.g. 'github', 'google')
+   */
+  async getUserResource(userIdOrEmail, provider) {
+    const resourceStorage = this.resourceHandler.resourceStorage || this.localResourceHandler.resourceStorage;
+    const providerType = provider.toLowerCase();
+    const resource = await resourceStorage.getResource(userIdOrEmail, providerType);
+    if (!resource) return null;
+    if (resource.refreshToken && resource.expiresAt && Date.now() >= resource.expiresAt - 6e4) {
+      this.log("INFO", "Token", `Resource access token for user '${userIdOrEmail}' on '${providerType}' is expired. Auto-refreshing...`);
+      try {
+        return await this.refreshUserResourceToken(userIdOrEmail, providerType);
+      } catch (error) {
+        this.log("ERROR", "Token", `Failed to auto-refresh resource token for user '${userIdOrEmail}' on '${providerType}'`, { error: String(error) });
+      }
+    }
+    return resource;
+  }
+  /**
+   * Retrieves all connected resources for a specific User ID / Email.
+   */
+  async getUserResources(userIdOrEmail) {
+    const resourceStorage = this.resourceHandler.resourceStorage || this.localResourceHandler.resourceStorage;
+    return await resourceStorage.getUserResources(userIdOrEmail);
+  }
+  /**
+   * Retrieves a connected resource provider token for an active session, auto-refreshing expired tokens if possible.
    * 
    * @param sessionId - Active session ID
-   * @param provider - Provider identifier (e.g. 'github')
+   * @param provider - Provider identifier (e.g. 'github', 'google')
    */
   async getConnectedResource(sessionId, provider) {
-    const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
+    const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage;
     const activeSession = await sessionStorage.getSession(sessionId);
-    if (!activeSession || !activeSession.resources) return null;
-    return activeSession.resources[provider.toLowerCase()] || null;
+    if (!activeSession) return null;
+    const providerType = provider.toLowerCase();
+    const userKey = this.getUserKeyFromSession(activeSession);
+    let resource = await this.getUserResource(userKey, providerType);
+    if (!resource && activeSession.resources) {
+      resource = activeSession.resources[providerType] || null;
+    }
+    if (resource) {
+      if (resource.refreshToken && resource.expiresAt && Date.now() >= resource.expiresAt - 6e4) {
+        this.log("INFO", "Token", `Resource access token for user '${userKey}' on '${providerType}' is expired. Auto-refreshing...`);
+        try {
+          resource = await this.refreshResourceToken(sessionId, providerType);
+        } catch (error) {
+          this.log("ERROR", "Token", `Failed to auto-refresh resource token for user '${userKey}' on '${providerType}'`, { error: String(error) });
+        }
+      }
+      activeSession.resources = activeSession.resources || {};
+      activeSession.resources[providerType] = resource;
+    }
+    return resource;
   }
   /**
-   * Disconnects a resource provider from an active session.
+   * Refreshes a user's resource access token using its refresh token.
+   * Deduplicates concurrent refresh requests via an in-flight promise mutex.
    * 
-   * @param sessionId - Active session ID
-   * @param provider - Provider identifier to disconnect
+   * @param userIdOrEmail - User identifier or email
+   * @param provider - Provider identifier (e.g. 'google', 'github')
    */
-  async disconnectResource(sessionId, provider) {
-    const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
+  async refreshUserResourceToken(userIdOrEmail, provider, existingResource) {
+    const mutexKey = `${userIdOrEmail.toLowerCase()}:${provider.toLowerCase()}`;
+    const existingPromise = this.refreshMutexes.get(mutexKey);
+    if (existingPromise) {
+      this.log("INFO", "Token", `Concurrent refresh request detected for '${mutexKey}'. Reusing in-flight promise.`);
+      return existingPromise;
+    }
+    const refreshPromise = this.executeRefreshUserResourceToken(userIdOrEmail, provider, existingResource).finally(() => {
+      this.refreshMutexes.delete(mutexKey);
+    });
+    this.refreshMutexes.set(mutexKey, refreshPromise);
+    return refreshPromise;
+  }
+  /**
+   * Internal execution of refresh token exchange.
+   */
+  async executeRefreshUserResourceToken(userIdOrEmail, provider, existingResource) {
+    const resourceStorage = this.resourceHandler.resourceStorage || this.localResourceHandler.resourceStorage;
+    const providerType = provider.toLowerCase();
+    let resource = existingResource || await resourceStorage.getResource(userIdOrEmail, providerType);
+    if (!resource || !resource.refreshToken) {
+      throw new RefreshTokenError(
+        `No refresh token available for user '${userIdOrEmail}' on connected resource '${provider}'`,
+        { userId: userIdOrEmail, provider }
+      );
+    }
+    const providerConfig = this.findProviderByType(providerType);
+    if (!providerConfig) {
+      throw new ProviderNotConfiguredError(provider);
+    }
+    const providerImpl = this.getProvider(providerType, providerConfig);
+    const body = {
+      client_id: providerConfig.clientId,
+      client_secret: providerConfig.clientSecret,
+      grant_type: "refresh_token",
+      refresh_token: resource.refreshToken
+    };
+    const response = await fetch(providerImpl.tokenEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: new URLSearchParams(body).toString()
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new RefreshTokenError(
+        `Failed to refresh resource token for user '${userIdOrEmail}' on '${provider}': ${response.status} - ${errorText}`,
+        { userId: userIdOrEmail, provider, status: response.status }
+      );
+    }
+    const tokens = await response.json();
+    const expiresAt = tokens.expires_in ? Date.now() + tokens.expires_in * 1e3 : void 0;
+    resource.accessToken = tokens.access_token;
+    if (tokens.refresh_token) {
+      resource.refreshToken = tokens.refresh_token;
+    }
+    if (expiresAt) {
+      resource.expiresAt = expiresAt;
+    }
+    resource.raw = tokens;
+    resource.connectedAt = Date.now();
+    await resourceStorage.saveResource(userIdOrEmail, providerType, resource);
+    return resource;
+  }
+  /**
+   * Refreshes a connected resource access token for an active session.
+   */
+  async refreshResourceToken(sessionId, provider) {
+    const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage;
     const activeSession = await sessionStorage.getSession(sessionId);
-    if (!activeSession || !activeSession.resources) return false;
-    delete activeSession.resources[provider.toLowerCase()];
+    if (!activeSession) {
+      throw new SessionNotFoundError("Active session not found.", { sessionId });
+    }
+    const providerType = provider.toLowerCase();
+    const userKey = this.getUserKeyFromSession(activeSession);
+    const existingResource = activeSession.resources ? activeSession.resources[providerType] : void 0;
+    const refreshed = await this.refreshUserResourceToken(userKey, providerType, existingResource);
+    activeSession.resources = activeSession.resources || {};
+    activeSession.resources[providerType] = refreshed;
     await sessionStorage.saveSession(sessionId, activeSession, 86400);
+    return refreshed;
+  }
+  /**
+   * Disconnects a resource provider for a specific User ID / Email.
+   */
+  async disconnectUserResource(userIdOrEmail, provider) {
+    const resourceStorage = this.resourceHandler.resourceStorage || this.localResourceHandler.resourceStorage;
+    await resourceStorage.deleteResource(userIdOrEmail, provider.toLowerCase());
     return true;
   }
+  /**
+   * Disconnects a resource provider from an active session and user account.
+   */
+  async disconnectResource(sessionId, provider) {
+    const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage;
+    const activeSession = await sessionStorage.getSession(sessionId);
+    if (activeSession) {
+      const userKey = this.getUserKeyFromSession(activeSession);
+      await this.disconnectUserResource(userKey, provider);
+      if (activeSession.resources) {
+        delete activeSession.resources[provider.toLowerCase()];
+        await sessionStorage.saveSession(sessionId, activeSession, 86400);
+      }
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Retrieves active session details from session storage.
+   */
   async fetchSessionInfo(sessionId) {
-    const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
+    const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage;
     return await sessionStorage.getSession(sessionId);
   }
+  /**
+   * Deletes a session from session storage (e.g. on logout).
+   * 
+   * @param sessionId - Active session identifier
+   */
+  async deleteSession(sessionId) {
+    const sessionStorage = this.sessionHandler.sessionStorage || this.localSessionHandler.sessionStorage;
+    await sessionStorage.deleteSession(sessionId);
+  }
   async exchangeCodeForToken(code, providerConfig, providerImpl, codeVerifier) {
     const body = {
       client_id: providerConfig.clientId,
@@ -1009,8 +1363,10 @@ var Lixa = class _Lixa {
         statusText: response.statusText,
         error: errorBody
       });
-      throw new Error(
-        `Token exchange failed: ${response.status} ${response.statusText} - ${errorBody}`
+      throw new TokenExchangeError(
+        `Token exchange failed: ${response.status} ${response.statusText} - ${errorBody}`,
+        response.status,
+        { statusText: response.statusText, errorBody }
       );
     }
     this.log("INFO", "Token", "Token exchange response received successfully");
@@ -1025,13 +1381,152 @@ var Lixa = class _Lixa {
     return void 0;
   }
 };
+
+// src/utils/cookies.ts
+var DEFAULT_SESSION_COOKIE_NAME = "lixa_session";
+var DEFAULT_STATE_COOKIE_NAME = "lixa_oauth_state";
+var DEFAULT_SESSION_MAX_AGE_SECONDS = 24 * 60 * 60;
+var DEFAULT_STATE_MAX_AGE_SECONDS = 5 * 60;
+function isProductionEnvironment() {
+  return typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+}
+function serializeCookie(name, value, options) {
+  const isProd = isProductionEnvironment();
+  const path = options?.path ?? "/";
+  const httpOnly = options?.httpOnly ?? true;
+  const secure = options?.secure ?? isProd;
+  const sameSite = options?.sameSite ?? "lax";
+  const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
+  if (path) {
+    parts.push(`Path=${path}`);
+  }
+  if (typeof options?.maxAge === "number") {
+    parts.push(`Max-Age=${Math.floor(options.maxAge)}`);
+    const expires = new Date(Date.now() + options.maxAge * 1e3).toUTCString();
+    parts.push(`Expires=${expires}`);
+  }
+  if (options?.domain) {
+    parts.push(`Domain=${options.domain}`);
+  }
+  if (httpOnly) {
+    parts.push("HttpOnly");
+  }
+  if (secure) {
+    parts.push("Secure");
+  }
+  if (sameSite) {
+    const capitalized = sameSite.charAt(0).toUpperCase() + sameSite.slice(1).toLowerCase();
+    parts.push(`SameSite=${capitalized}`);
+  }
+  return parts.join("; ");
+}
+function createSessionCookie(sessionId, options) {
+  const isProd = isProductionEnvironment();
+  const resolvedOptions = {
+    name: options?.name || DEFAULT_SESSION_COOKIE_NAME,
+    path: options?.path ?? "/",
+    maxAge: options?.maxAge ?? DEFAULT_SESSION_MAX_AGE_SECONDS,
+    httpOnly: options?.httpOnly ?? true,
+    secure: options?.secure ?? isProd,
+    sameSite: options?.sameSite ?? "lax",
+    domain: options?.domain
+  };
+  const name = resolvedOptions.name;
+  const header = serializeCookie(name, sessionId, resolvedOptions);
+  return {
+    name,
+    value: sessionId,
+    options: resolvedOptions,
+    header
+  };
+}
+function clearSessionCookie(options) {
+  const isProd = isProductionEnvironment();
+  const resolvedOptions = {
+    name: options?.name || DEFAULT_SESSION_COOKIE_NAME,
+    path: options?.path ?? "/",
+    maxAge: 0,
+    httpOnly: options?.httpOnly ?? true,
+    secure: options?.secure ?? isProd,
+    sameSite: options?.sameSite ?? "lax",
+    domain: options?.domain
+  };
+  const name = resolvedOptions.name;
+  const header = serializeCookie(name, "", resolvedOptions);
+  return {
+    name,
+    value: "",
+    options: resolvedOptions,
+    header
+  };
+}
+function createStateCookie(state, options) {
+  const isProd = isProductionEnvironment();
+  const resolvedOptions = {
+    name: options?.name || DEFAULT_STATE_COOKIE_NAME,
+    path: options?.path ?? "/",
+    maxAge: options?.maxAge ?? DEFAULT_STATE_MAX_AGE_SECONDS,
+    httpOnly: options?.httpOnly ?? true,
+    secure: options?.secure ?? isProd,
+    sameSite: options?.sameSite ?? "lax",
+    domain: options?.domain
+  };
+  const name = resolvedOptions.name;
+  const header = serializeCookie(name, state, resolvedOptions);
+  return {
+    name,
+    value: state,
+    options: resolvedOptions,
+    header
+  };
+}
+function clearStateCookie(options) {
+  const isProd = isProductionEnvironment();
+  const resolvedOptions = {
+    name: options?.name || DEFAULT_STATE_COOKIE_NAME,
+    path: options?.path ?? "/",
+    maxAge: 0,
+    httpOnly: options?.httpOnly ?? true,
+    secure: options?.secure ?? isProd,
+    sameSite: options?.sameSite ?? "lax",
+    domain: options?.domain
+  };
+  const name = resolvedOptions.name;
+  const header = serializeCookie(name, "", resolvedOptions);
+  return {
+    name,
+    value: "",
+    options: resolvedOptions,
+    header
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AccountLinkingStrategy,
+  AccountUnlinkError,
+  DEFAULT_SESSION_COOKIE_NAME,
+  DEFAULT_SESSION_MAX_AGE_SECONDS,
+  DEFAULT_STATE_COOKIE_NAME,
+  DEFAULT_STATE_MAX_AGE_SECONDS,
+  EmailNotVerifiedError,
+  InvalidOAuthCallbackError,
+  InvalidProviderConfigError,
+  InvalidStateError,
   Lixa,
+  LixaError,
+  ProviderNotConfiguredError,
+  RefreshTokenError,
+  SessionNotFoundError,
+  TokenExchangeError,
+  clearSessionCookie,
+  clearStateCookie,
+  createSessionCookie,
+  createStateCookie,
   decodeIdToken,
   determineProviderFromIssuer,
   extractUserInfo,
-  fetchUserInfo
+  fetchUserInfo,
+  isProductionEnvironment,
+  serializeCookie
 });
 //# sourceMappingURL=index.cjs.map