@vunexa/lixa 0.1.6-alpha.3 → 0.1.6-alpha.6

package/README.md

@@ -187,15 +187,16 @@ app.get("/connect/github/callback", async (req, res) => {
   res.redirect("/dashboard");
 });
 
-// 3. Query Connected Resource Access Token
+// 3. Query Connected Resource Access Token (Auto-Refreshes Expired Tokens)
 app.get("/api/github/repos", async (req, res) => {
+  // Queries by active session OR user ID, auto-refreshing expired access tokens
   const resource = await lixa.getConnectedResource(req.cookies.session_id, "github");
 
   if (!resource) {
     return res.status(403).json({ error: "GitHub resource not connected" });
   }
 
-  // Call GitHub API with resource access token
+  // Call GitHub API with active resource access token
   const response = await fetch("https://api.github.com/user/repos", {
     headers: { Authorization: `Bearer ${resource.accessToken}` },
   });
@@ -204,7 +205,10 @@ app.get("/api/github/repos", async (req, res) => {
   res.json(repos);
 });
 
-// 4. Disconnect Resource Provider
+// 4. Query Resource Directly by User ID (e.g. inside background cron jobs or webhooks)
+const githubResource = await lixa.getUserResource(userId, "github");
+
+// 5. Disconnect Resource Provider
 app.delete("/connect/github", async (req, res) => {
   await lixa.disconnectResource(req.cookies.session_id, "github");
   res.json({ success: true });
@@ -359,14 +363,6 @@ export const lixa = new Lixa({
       "accessToken": "gho_8f7b2a9e1c3...",
       "linkedAt": 1771657250000
     }
-  },
-  "resources": {
-    "github": {
-      "provider": "github",
-      "accessToken": "gho_resource_repo_9a8b7c...",
-      "scopes": ["repo", "read:org"],
-      "connectedAt": 1771657300000
-    }
   }
 }
 ```
@@ -494,16 +490,279 @@ export const lixa = new Lixa({
         "accessToken": "gho_8f7b2a9e1c3...",
         "linkedAt": 1771657250000
       }
-    },
-    "resources": {
-      "github": {
-        "provider": "github",
-        "accessToken": "gho_resource_repo_9a8b7c...",
-        "scopes": ["repo", "read:org"],
-        "connectedAt": 1771657300000
+    }
+  }
+}
+```
+
+---
+
+## Custom Resource Storage Implementation (`ResourceStorage`)
+
+While `SessionStorage` manages short-lived user authentication sessions (indexed by `sessionId`), **`ResourceStorage`** manages long-lived third-party API tokens (**AuthZ**) bound directly to a **User ID** (or Email). This ensures that third-party credentials (such as GitHub Repositories or Google Drive) persist across session expirations and logouts.
+
+### `ResourceStorage` Interface
+
+```typescript
+export interface ResourceStorage {
+  saveResource(userId: string, provider: string, resource: ConnectedResource): Promise<void>;
+  getResource(userId: string, provider: string): Promise<ConnectedResource | null>;
+  getUserResources(userId: string): Promise<Record<string, ConnectedResource>>;
+  deleteResource(userId: string, provider: string): Promise<void>;
+}
+```
+
+### 1. SQLite Resource Storage (`better-sqlite3`)
+
+#### Table Schema (SQL DDL)
+
+```sql
+CREATE TABLE IF NOT EXISTS user_resources (
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  data TEXT NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (user_id, provider)
+);
+```
+
+#### TypeScript Implementation
+
+```typescript
+import Database from "better-sqlite3";
+import { Lixa, type ResourceStorage, type ConnectedResource } from "@vunexa/lixa";
+
+export class SqliteResourceStorage implements ResourceStorage {
+  private db = new Database("lixa_resources.db");
+
+  constructor() {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS user_resources (
+        user_id TEXT NOT NULL,
+        provider TEXT NOT NULL,
+        data TEXT NOT NULL,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (user_id, provider)
+      );
+    `);
+  }
+
+  async saveResource(userId: string, provider: string, resource: ConnectedResource): Promise<void> {
+    const stmt = this.db.prepare(`
+      INSERT INTO user_resources (user_id, provider, data, updated_at)
+      VALUES (?, ?, ?, ?)
+      ON CONFLICT(user_id, provider) DO UPDATE SET
+        data = excluded.data,
+        updated_at = excluded.updated_at
+    `);
+    stmt.run(userId, provider.toLowerCase(), JSON.stringify(resource), Date.now());
+  }
+
+  async getResource(userId: string, provider: string): Promise<ConnectedResource | null> {
+    const stmt = this.db.prepare(`SELECT data FROM user_resources WHERE user_id = ? AND provider = ?`);
+    const row = stmt.get(userId, provider.toLowerCase()) as { data: string } | undefined;
+    return row ? (JSON.parse(row.data) as ConnectedResource) : null;
+  }
+
+  async getUserResources(userId: string): Promise<Record<string, ConnectedResource>> {
+    const stmt = this.db.prepare(`SELECT provider, data FROM user_resources WHERE user_id = ?`);
+    const rows = stmt.all(userId) as Array<{ provider: string; data: string }>;
+    const result: Record<string, ConnectedResource> = {};
+    for (const r of rows) {
+      result[r.provider] = JSON.parse(r.data);
+    }
+    return result;
+  }
+
+  async deleteResource(userId: string, provider: string): Promise<void> {
+    const stmt = this.db.prepare(`DELETE FROM user_resources WHERE user_id = ? AND provider = ?`);
+    stmt.run(userId, provider.toLowerCase());
+  }
+}
+
+// Pass to Lixa instance via resourceHandler
+export const lixa = new Lixa({
+  resourceHandler: {
+    resourceStorage: new SqliteResourceStorage(),
+  },
+  providers: { /* ... */ },
+});
+```
+
+#### Saved JSON Records Example in SQLite (`user_resources` Table)
+
+**Row 1 (GitHub Repositories)**:
+```json
+{
+  "user_id": "1049281048",
+  "provider": "github",
+  "data": {
+    "accessToken": "gho_resource_repo_9a8b7c...",
+    "refreshToken": "ghr_refresh_token_123...",
+    "scopes": ["repo", "read:org"],
+    "expiresAt": 1771743600000,
+    "connectedAt": 1771657300000
+  }
+}
+```
+
+**Row 2 (Google Drive)**:
+```json
+{
+  "user_id": "1049281048",
+  "provider": "google",
+  "data": {
+    "accessToken": "ya29.drive_resource_token_456...",
+    "refreshToken": "1//09abc_google_refresh_token...",
+    "scopes": ["https://www.googleapis.com/auth/drive.readonly"],
+    "expiresAt": 1771660800000,
+    "connectedAt": 1771657400000
+  }
+}
+```
+
+---
+
+### 2. AWS DynamoDB Resource Storage (`@aws-sdk/lib-dynamodb`)
+
+For serverless AWS deployments storing user API credentials in DynamoDB:
+
+#### Table Configuration
+
+- **Table Name**: `LixaUserResources`
+- **Partition Key (PK)**: `userId` (String)
+- **Sort Key (SK)**: `provider` (String)
+
+#### TypeScript Implementation
+
+```typescript
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, PutCommand, GetCommand, DeleteCommand, QueryCommand } from "@aws-sdk/lib-dynamodb";
+import { Lixa, type ResourceStorage, type ConnectedResource } from "@vunexa/lixa";
+
+export class DynamoDbResourceStorage implements ResourceStorage {
+  private docClient: DynamoDBDocumentClient;
+  private tableName = "LixaUserResources";
+
+  constructor() {
+    const client = new DynamoDBClient({ region: process.env.AWS_REGION || "us-east-1" });
+    this.docClient = DynamoDBDocumentClient.from(client);
+  }
+
+  async saveResource(userId: string, provider: string, resource: ConnectedResource): Promise<void> {
+    await this.docClient.send(
+      new PutCommand({
+        TableName: this.tableName,
+        Item: {
+          userId,
+          provider: provider.toLowerCase(),
+          resourceData: resource,
+          updatedAt: Date.now(),
+        },
+      })
+    );
+  }
+
+  async getResource(userId: string, provider: string): Promise<ConnectedResource | null> {
+    const res = await this.docClient.send(
+      new GetCommand({
+        TableName: this.tableName,
+        Key: {
+          userId,
+          provider: provider.toLowerCase(),
+        },
+      })
+    );
+
+    return res.Item ? (res.Item.resourceData as ConnectedResource) : null;
+  }
+
+  async getUserResources(userId: string): Promise<Record<string, ConnectedResource>> {
+    const res = await this.docClient.send(
+      new QueryCommand({
+        TableName: this.tableName,
+        KeyConditionExpression: "userId = :userId",
+        ExpressionAttributeValues: { ":userId": userId },
+      })
+    );
+
+    const result: Record<string, ConnectedResource> = {};
+    if (res.Items) {
+      for (const item of res.Items) {
+        result[item.provider] = item.resourceData as ConnectedResource;
       }
     }
+    return result;
+  }
+
+  async deleteResource(userId: string, provider: string): Promise<void> {
+    await this.docClient.send(
+      new DeleteCommand({
+        TableName: this.tableName,
+        Key: {
+          userId,
+          provider: provider.toLowerCase(),
+        },
+      })
+    );
+  }
+}
+
+// Pass to Lixa instance via resourceHandler
+export const lixa = new Lixa({
+  resourceHandler: {
+    resourceStorage: new DynamoDbResourceStorage(),
+  },
+  providers: { /* ... */ },
+});
+```
+
+#### Saved DynamoDB Resource Items Example (`LixaUserResources` Table)
+
+```json
+[
+  {
+    "userId": "1049281048",
+    "provider": "github",
+    "updatedAt": 1771657300000,
+    "resourceData": {
+      "accessToken": "gho_resource_repo_9a8b7c...",
+      "refreshToken": "ghr_refresh_token_123...",
+      "scopes": ["repo", "read:org"],
+      "expiresAt": 1771743600000,
+      "connectedAt": 1771657300000
+    }
+  },
+  {
+    "userId": "1049281048",
+    "provider": "google",
+    "updatedAt": 1771657400000,
+    "resourceData": {
+      "accessToken": "ya29.drive_resource_token_456...",
+      "refreshToken": "1//09abc_google_refresh_token...",
+      "scopes": ["https://www.googleapis.com/auth/drive.readonly"],
+      "expiresAt": 1771660800000,
+      "connectedAt": 1771657400000
+    }
   }
+]
+```
+
+---
+
+### 3. Querying Connected Resources Directly by User ID
+
+`ResourceStorage` enables background workers, cron jobs, and webhooks to access third-party API credentials by `userId` without an active HTTP session:
+
+```typescript
+// Background worker querying user's GitHub Repos token
+const githubResource = await lixa.getUserResource(user.id, "github");
+
+if (githubResource) {
+  // Lixa auto-refreshes expired access tokens transparently!
+  const response = await fetch("https://api.github.com/user/repos", {
+    headers: { Authorization: `Bearer ${githubResource.accessToken}` },
+  });
 }
 ```
 

package/README.template.md

@@ -277,15 +277,16 @@ app.get("/connect/github/callback", async (req, res) => {
   res.redirect("/dashboard");
 });
 
-// 3. Query Connected Resource Access Token
+// 3. Query Connected Resource Access Token (Auto-Refreshes Expired Tokens)
 app.get("/api/github/repos", async (req, res) => {
+  // Queries by active session OR user ID, auto-refreshing expired access tokens
   const resource = await lixa.getConnectedResource(req.cookies.session_id, "github");
 
   if (!resource) {
     return res.status(403).json({ error: "GitHub resource not connected" });
   }
 
-  // Call GitHub API with resource access token
+  // Call GitHub API with active resource access token
   const response = await fetch("https://api.github.com/user/repos", {
     headers: { Authorization: `Bearer ${resource.accessToken}` },
   });
@@ -294,7 +295,10 @@ app.get("/api/github/repos", async (req, res) => {
   res.json(repos);
 });
 
-// 4. Disconnect Resource Provider
+// 4. Query Resource Directly by User ID (e.g. inside background cron jobs or webhooks)
+const githubResource = await lixa.getUserResource(userId, "github");
+
+// 5. Disconnect Resource Provider
 app.delete("/connect/github", async (req, res) => {
   await lixa.disconnectResource(req.cookies.session_id, "github");
   res.json({ success: true });
@@ -449,14 +453,6 @@ export const lixa = new Lixa({
       "accessToken": "gho_8f7b2a9e1c3...",
       "linkedAt": 1771657250000
     }
-  },
-  "resources": {
-    "github": {
-      "provider": "github",
-      "accessToken": "gho_resource_repo_9a8b7c...",
-      "scopes": ["repo", "read:org"],
-      "connectedAt": 1771657300000
-    }
   }
 }
 ```
@@ -584,16 +580,279 @@ export const lixa = new Lixa({
         "accessToken": "gho_8f7b2a9e1c3...",
         "linkedAt": 1771657250000
       }
-    },
-    "resources": {
-      "github": {
-        "provider": "github",
-        "accessToken": "gho_resource_repo_9a8b7c...",
-        "scopes": ["repo", "read:org"],
-        "connectedAt": 1771657300000
+    }
+  }
+}
+```
+
+---
+
+## Custom Resource Storage Implementation (`ResourceStorage`)
+
+While `SessionStorage` manages short-lived user authentication sessions (indexed by `sessionId`), **`ResourceStorage`** manages long-lived third-party API tokens (**AuthZ**) bound directly to a **User ID** (or Email). This ensures that third-party credentials (such as GitHub Repositories or Google Drive) persist across session expirations and logouts.
+
+### `ResourceStorage` Interface
+
+```typescript
+export interface ResourceStorage {
+  saveResource(userId: string, provider: string, resource: ConnectedResource): Promise<void>;
+  getResource(userId: string, provider: string): Promise<ConnectedResource | null>;
+  getUserResources(userId: string): Promise<Record<string, ConnectedResource>>;
+  deleteResource(userId: string, provider: string): Promise<void>;
+}
+```
+
+### 1. SQLite Resource Storage (`better-sqlite3`)
+
+#### Table Schema (SQL DDL)
+
+```sql
+CREATE TABLE IF NOT EXISTS user_resources (
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  data TEXT NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (user_id, provider)
+);
+```
+
+#### TypeScript Implementation
+
+```typescript
+import Database from "better-sqlite3";
+import { Lixa, type ResourceStorage, type ConnectedResource } from "@vunexa/lixa";
+
+export class SqliteResourceStorage implements ResourceStorage {
+  private db = new Database("lixa_resources.db");
+
+  constructor() {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS user_resources (
+        user_id TEXT NOT NULL,
+        provider TEXT NOT NULL,
+        data TEXT NOT NULL,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (user_id, provider)
+      );
+    `);
+  }
+
+  async saveResource(userId: string, provider: string, resource: ConnectedResource): Promise<void> {
+    const stmt = this.db.prepare(`
+      INSERT INTO user_resources (user_id, provider, data, updated_at)
+      VALUES (?, ?, ?, ?)
+      ON CONFLICT(user_id, provider) DO UPDATE SET
+        data = excluded.data,
+        updated_at = excluded.updated_at
+    `);
+    stmt.run(userId, provider.toLowerCase(), JSON.stringify(resource), Date.now());
+  }
+
+  async getResource(userId: string, provider: string): Promise<ConnectedResource | null> {
+    const stmt = this.db.prepare(`SELECT data FROM user_resources WHERE user_id = ? AND provider = ?`);
+    const row = stmt.get(userId, provider.toLowerCase()) as { data: string } | undefined;
+    return row ? (JSON.parse(row.data) as ConnectedResource) : null;
+  }
+
+  async getUserResources(userId: string): Promise<Record<string, ConnectedResource>> {
+    const stmt = this.db.prepare(`SELECT provider, data FROM user_resources WHERE user_id = ?`);
+    const rows = stmt.all(userId) as Array<{ provider: string; data: string }>;
+    const result: Record<string, ConnectedResource> = {};
+    for (const r of rows) {
+      result[r.provider] = JSON.parse(r.data);
+    }
+    return result;
+  }
+
+  async deleteResource(userId: string, provider: string): Promise<void> {
+    const stmt = this.db.prepare(`DELETE FROM user_resources WHERE user_id = ? AND provider = ?`);
+    stmt.run(userId, provider.toLowerCase());
+  }
+}
+
+// Pass to Lixa instance via resourceHandler
+export const lixa = new Lixa({
+  resourceHandler: {
+    resourceStorage: new SqliteResourceStorage(),
+  },
+  providers: { /* ... */ },
+});
+```
+
+#### Saved JSON Records Example in SQLite (`user_resources` Table)
+
+**Row 1 (GitHub Repositories)**:
+```json
+{
+  "user_id": "1049281048",
+  "provider": "github",
+  "data": {
+    "accessToken": "gho_resource_repo_9a8b7c...",
+    "refreshToken": "ghr_refresh_token_123...",
+    "scopes": ["repo", "read:org"],
+    "expiresAt": 1771743600000,
+    "connectedAt": 1771657300000
+  }
+}
+```
+
+**Row 2 (Google Drive)**:
+```json
+{
+  "user_id": "1049281048",
+  "provider": "google",
+  "data": {
+    "accessToken": "ya29.drive_resource_token_456...",
+    "refreshToken": "1//09abc_google_refresh_token...",
+    "scopes": ["https://www.googleapis.com/auth/drive.readonly"],
+    "expiresAt": 1771660800000,
+    "connectedAt": 1771657400000
+  }
+}
+```
+
+---
+
+### 2. AWS DynamoDB Resource Storage (`@aws-sdk/lib-dynamodb`)
+
+For serverless AWS deployments storing user API credentials in DynamoDB:
+
+#### Table Configuration
+
+- **Table Name**: `LixaUserResources`
+- **Partition Key (PK)**: `userId` (String)
+- **Sort Key (SK)**: `provider` (String)
+
+#### TypeScript Implementation
+
+```typescript
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, PutCommand, GetCommand, DeleteCommand, QueryCommand } from "@aws-sdk/lib-dynamodb";
+import { Lixa, type ResourceStorage, type ConnectedResource } from "@vunexa/lixa";
+
+export class DynamoDbResourceStorage implements ResourceStorage {
+  private docClient: DynamoDBDocumentClient;
+  private tableName = "LixaUserResources";
+
+  constructor() {
+    const client = new DynamoDBClient({ region: process.env.AWS_REGION || "us-east-1" });
+    this.docClient = DynamoDBDocumentClient.from(client);
+  }
+
+  async saveResource(userId: string, provider: string, resource: ConnectedResource): Promise<void> {
+    await this.docClient.send(
+      new PutCommand({
+        TableName: this.tableName,
+        Item: {
+          userId,
+          provider: provider.toLowerCase(),
+          resourceData: resource,
+          updatedAt: Date.now(),
+        },
+      })
+    );
+  }
+
+  async getResource(userId: string, provider: string): Promise<ConnectedResource | null> {
+    const res = await this.docClient.send(
+      new GetCommand({
+        TableName: this.tableName,
+        Key: {
+          userId,
+          provider: provider.toLowerCase(),
+        },
+      })
+    );
+
+    return res.Item ? (res.Item.resourceData as ConnectedResource) : null;
+  }
+
+  async getUserResources(userId: string): Promise<Record<string, ConnectedResource>> {
+    const res = await this.docClient.send(
+      new QueryCommand({
+        TableName: this.tableName,
+        KeyConditionExpression: "userId = :userId",
+        ExpressionAttributeValues: { ":userId": userId },
+      })
+    );
+
+    const result: Record<string, ConnectedResource> = {};
+    if (res.Items) {
+      for (const item of res.Items) {
+        result[item.provider] = item.resourceData as ConnectedResource;
       }
     }
+    return result;
+  }
+
+  async deleteResource(userId: string, provider: string): Promise<void> {
+    await this.docClient.send(
+      new DeleteCommand({
+        TableName: this.tableName,
+        Key: {
+          userId,
+          provider: provider.toLowerCase(),
+        },
+      })
+    );
+  }
+}
+
+// Pass to Lixa instance via resourceHandler
+export const lixa = new Lixa({
+  resourceHandler: {
+    resourceStorage: new DynamoDbResourceStorage(),
+  },
+  providers: { /* ... */ },
+});
+```
+
+#### Saved DynamoDB Resource Items Example (`LixaUserResources` Table)
+
+```json
+[
+  {
+    "userId": "1049281048",
+    "provider": "github",
+    "updatedAt": 1771657300000,
+    "resourceData": {
+      "accessToken": "gho_resource_repo_9a8b7c...",
+      "refreshToken": "ghr_refresh_token_123...",
+      "scopes": ["repo", "read:org"],
+      "expiresAt": 1771743600000,
+      "connectedAt": 1771657300000
+    }
+  },
+  {
+    "userId": "1049281048",
+    "provider": "google",
+    "updatedAt": 1771657400000,
+    "resourceData": {
+      "accessToken": "ya29.drive_resource_token_456...",
+      "refreshToken": "1//09abc_google_refresh_token...",
+      "scopes": ["https://www.googleapis.com/auth/drive.readonly"],
+      "expiresAt": 1771660800000,
+      "connectedAt": 1771657400000
+    }
   }
+]
+```
+
+---
+
+### 3. Querying Connected Resources Directly by User ID
+
+`ResourceStorage` enables background workers, cron jobs, and webhooks to access third-party API credentials by `userId` without an active HTTP session:
+
+```typescript
+// Background worker querying user's GitHub Repos token
+const githubResource = await lixa.getUserResource(user.id, "github");
+
+if (githubResource) {
+  // Lixa auto-refreshes expired access tokens transparently!
+  const response = await fetch("https://api.github.com/user/repos", {
+    headers: { Authorization: `Bearer ${githubResource.accessToken}` },
+  });
 }
 ```