@vunexa/lixa 0.1.6-alpha.3 → 0.1.6-alpha.6

package/dist/dao/types.d.ts

@@ -220,6 +220,53 @@ export interface SessionStorage {
         session: T;
     } | null>;
 }
+/**
+ * Resource storage operations interface.
+ *
+ * @remarks
+ * Manages long-lived third-party resource provider tokens (AuthZ) bound to a user account
+ * (User ID or Email), independent of short-lived user sessions.
+ *
+ * @public
+ */
+export interface ResourceStorage {
+    /**
+     * Saves a connected resource token for a user.
+     *
+     * @param userId - Unique user identifier or email
+     * @param provider - Resource provider name (e.g. 'github', 'google')
+     * @param resource - Connected resource details including access & refresh tokens
+     */
+    saveResource(userId: string, provider: string, resource: import("../models/session").ConnectedResource): Promise<void>;
+    /**
+     * Retrieves a connected resource token for a user.
+     *
+     * @param userId - Unique user identifier or email
+     * @param provider - Resource provider name
+     */
+    getResource(userId: string, provider: string): Promise<import("../models/session").ConnectedResource | null>;
+    /**
+     * Retrieves all connected resources for a user.
+     *
+     * @param userId - Unique user identifier or email
+     */
+    getUserResources(userId: string): Promise<Record<string, import("../models/session").ConnectedResource>>;
+    /**
+     * Deletes a connected resource token for a user.
+     *
+     * @param userId - Unique user identifier or email
+     * @param provider - Resource provider name
+     */
+    deleteResource(userId: string, provider: string): Promise<void>;
+}
+/**
+ * Resource handler configuration.
+ *
+ * @public
+ */
+export interface ResourceHandler {
+    resourceStorage?: ResourceStorage;
+}
 /**
  * Session handler for OAuth authentication.
  *

package/dist/dao/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/dao/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnF;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAEnD;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,aAAa,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IAE9E;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,CAAC,SAAS,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvG;;;;;OAKG;IACH,UAAU,CAAC,CAAC,SAAS,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpE;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACzG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,eAAe,CAAC,CAAC,CAAC,SAAS,OAAO,EAChC,SAAS,EAAE,OAAO,mBAAmB,EAAE,kBAAkB,EACzD,gBAAgB,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,GAC7D,OAAO,CAAC,CAAC,CAAC,CAAC;IAEd;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;;;;OAKG;IACH,eAAe,CAAC,CAAC,CAAC,SAAS,OAAO,EAChC,SAAS,EAAE,OAAO,mBAAmB,EAAE,kBAAkB,EACzD,gBAAgB,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,GAC7D,OAAO,CAAC,CAAC,CAAC,CAAC;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/dao/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnF;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAEnD;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,aAAa,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IAE9E;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,CAAC,SAAS,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvG;;;;;OAKG;IACH,UAAU,CAAC,CAAC,SAAS,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpE;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACzG;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,mBAAmB,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvH;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,mBAAmB,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAE7G;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAEzG;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,eAAe,CAAC,CAAC,CAAC,SAAS,OAAO,EAChC,SAAS,EAAE,OAAO,mBAAmB,EAAE,kBAAkB,EACzD,gBAAgB,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,GAC7D,OAAO,CAAC,CAAC,CAAC,CAAC;IAEd;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;;;;OAKG;IACH,eAAe,CAAC,CAAC,CAAC,SAAS,OAAO,EAChC,SAAS,EAAE,OAAO,mBAAmB,EAAE,kBAAkB,EACzD,gBAAgB,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,GAC7D,OAAO,CAAC,CAAC,CAAC,CAAC;CACf"}

package/dist/export-types/index.d.ts

@@ -141,6 +141,8 @@ export declare interface ConnectedResource {
     accessToken: string;
     /** Optional refresh token for offline resource access */
     refreshToken?: string | undefined;
+    /** Unix timestamp in milliseconds when the resource access token expires */
+    expiresAt?: number | undefined;
     /** Resource scopes granted by the user */
     scopes: string[];
     /** Full raw token response from provider */
@@ -437,6 +439,7 @@ export declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConf
     private config;
     private stateHandler;
     private sessionHandler;
+    private resourceHandler;
     private debug;
     /**
      * Creates a new Lixa instance with the provided configuration.
@@ -749,6 +752,12 @@ export declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConf
      * @param params - Object containing sessionId, provider, code, state, and requested scopes
      * @returns Updated Session containing stored resource tokens under session.resources[provider]
      */
+    private static userResourceStore;
+    static LOCAL_RESOURCE_HANDLER: ResourceHandler;
+    private getUserKeyFromSession;
+    /**
+     * Handles the OAuth callback for a connected resource provider and stores resource tokens bound to user account.
+     */
     handleResourceCallback(params: {
         sessionId: string;
         provider: ConfiguredProviderKey<TConfig> | string;
@@ -757,17 +766,41 @@ export declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConf
         scopes?: string[];
     }): Promise<Session>;
     /**
-     * Retrieves a connected resource provider token for an active session.
+     * Retrieves a connected resource for a specific User ID / Email directly (independent of session IDs).
+     * Automatically refreshes expired access tokens if a refresh token is present.
+     *
+     * @param userIdOrEmail - User identifier or email
+     * @param provider - Resource provider identifier (e.g. 'github', 'google')
+     */
+    getUserResource(userIdOrEmail: string, provider: string): Promise<ConnectedResource | null>;
+    /**
+     * Retrieves all connected resources for a specific User ID / Email.
+     */
+    getUserResources(userIdOrEmail: string): Promise<Record<string, ConnectedResource>>;
+    /**
+     * Retrieves a connected resource provider token for an active session, auto-refreshing expired tokens if possible.
      *
      * @param sessionId - Active session ID
-     * @param provider - Provider identifier (e.g. 'github')
+     * @param provider - Provider identifier (e.g. 'github', 'google')
      */
     getConnectedResource(sessionId: string, provider: string): Promise<ConnectedResource | null>;
     /**
-     * Disconnects a resource provider from an active session.
+     * Refreshes a user's resource access token using its refresh token.
      *
-     * @param sessionId - Active session ID
-     * @param provider - Provider identifier to disconnect
+     * @param userIdOrEmail - User identifier or email
+     * @param provider - Provider identifier (e.g. 'google', 'github')
+     */
+    refreshUserResourceToken(userIdOrEmail: string, provider: string, existingResource?: ConnectedResource): Promise<ConnectedResource>;
+    /**
+     * Refreshes a connected resource access token for an active session.
+     */
+    refreshResourceToken(sessionId: string, provider: string): Promise<ConnectedResource>;
+    /**
+     * Disconnects a resource provider for a specific User ID / Email.
+     */
+    disconnectUserResource(userIdOrEmail: string, provider: string): Promise<boolean>;
+    /**
+     * Disconnects a resource provider from an active session and user account.
      */
     disconnectResource(sessionId: string, provider: string): Promise<boolean>;
     fetchSessionInfo(sessionId: string): Promise<Session | null>;
@@ -815,6 +848,14 @@ export declare interface LixaConfig<TProviders extends Record<string, ProviderCo
      * @see {@link SessionHandler}
      */
     sessionHandler?: SessionHandler;
+    /**
+     * Optional custom resource handler.
+     * Handles storage and management of long-lived third-party resource provider tokens (AuthZ)
+     * bound directly to user accounts (User ID or Email), independent of transient session IDs.
+     *
+     * @see {@link ResourceHandler}
+     */
+    resourceHandler?: ResourceHandler;
     /**
      * Enable debug logging.
      * When enabled, outputs structured logs for initialization, auth flow, and errors.
@@ -945,6 +986,55 @@ export declare interface ProviderMetadata {
     };
 }
 
+/**
+ * Resource handler configuration.
+ *
+ * @public
+ */
+export declare interface ResourceHandler {
+    resourceStorage?: ResourceStorage;
+}
+
+/**
+ * Resource storage operations interface.
+ *
+ * @remarks
+ * Manages long-lived third-party resource provider tokens (AuthZ) bound to a user account
+ * (User ID or Email), independent of short-lived user sessions.
+ *
+ * @public
+ */
+export declare interface ResourceStorage {
+    /**
+     * Saves a connected resource token for a user.
+     *
+     * @param userId - Unique user identifier or email
+     * @param provider - Resource provider name (e.g. 'github', 'google')
+     * @param resource - Connected resource details including access & refresh tokens
+     */
+    saveResource(userId: string, provider: string, resource: ConnectedResource): Promise<void>;
+    /**
+     * Retrieves a connected resource token for a user.
+     *
+     * @param userId - Unique user identifier or email
+     * @param provider - Resource provider name
+     */
+    getResource(userId: string, provider: string): Promise<ConnectedResource | null>;
+    /**
+     * Retrieves all connected resources for a user.
+     *
+     * @param userId - Unique user identifier or email
+     */
+    getUserResources(userId: string): Promise<Record<string, ConnectedResource>>;
+    /**
+     * Deletes a connected resource token for a user.
+     *
+     * @param userId - Unique user identifier or email
+     * @param provider - Resource provider name
+     */
+    deleteResource(userId: string, provider: string): Promise<void>;
+}
+
 /**
  * Helper type to create a configuration with only registered providers.
  * Use this with Lixa.createConfig() for type safety.

package/dist/index.cjs

@@ -217,6 +217,7 @@ var Lixa = class _Lixa {
   config;
   stateHandler;
   sessionHandler;
+  resourceHandler;
   debug;
   /**
    * Creates a new Lixa instance with the provided configuration.
@@ -235,6 +236,7 @@ var Lixa = class _Lixa {
     this.config = config;
     this.stateHandler = config.stateHandler || _Lixa.LOCAL_STATE_HANDLER;
     this.sessionHandler = config.sessionHandler || _Lixa.LOCAL_SESSION_HANDLER;
+    this.resourceHandler = config.resourceHandler || _Lixa.LOCAL_RESOURCE_HANDLER;
     this.debug = config.debug || false;
     this.log("INFO", "Init", "Initializing Lixa instance", {
       providers: Object.keys(config.providers),
@@ -914,6 +916,45 @@ var Lixa = class _Lixa {
    * @param params - Object containing sessionId, provider, code, state, and requested scopes
    * @returns Updated Session containing stored resource tokens under session.resources[provider]
    */
+  static userResourceStore = /* @__PURE__ */ new Map();
+  static LOCAL_RESOURCE_HANDLER = {
+    resourceStorage: {
+      saveResource: async (userId, provider, resource) => {
+        let userMap = _Lixa.userResourceStore.get(userId);
+        if (!userMap) {
+          userMap = /* @__PURE__ */ new Map();
+          _Lixa.userResourceStore.set(userId, userMap);
+        }
+        userMap.set(provider.toLowerCase(), resource);
+      },
+      getResource: async (userId, provider) => {
+        const userMap = _Lixa.userResourceStore.get(userId);
+        return userMap?.get(provider.toLowerCase()) || null;
+      },
+      getUserResources: async (userId) => {
+        const userMap = _Lixa.userResourceStore.get(userId);
+        const result = {};
+        if (userMap) {
+          for (const [p, r] of userMap.entries()) {
+            result[p] = r;
+          }
+        }
+        return result;
+      },
+      deleteResource: async (userId, provider) => {
+        const userMap = _Lixa.userResourceStore.get(userId);
+        if (userMap) {
+          userMap.delete(provider.toLowerCase());
+        }
+      }
+    }
+  };
+  getUserKeyFromSession(session) {
+    return session.userId || session.email || session.id || "anonymous";
+  }
+  /**
+   * Handles the OAuth callback for a connected resource provider and stores resource tokens bound to user account.
+   */
   async handleResourceCallback(params) {
     const { sessionId, provider, code, state, scopes } = params;
     const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
@@ -937,44 +978,176 @@ var Lixa = class _Lixa {
       }
     }
     const tokens = await this.exchangeCodeForToken(code, providerConfig, providerImpl, codeVerifier);
-    activeSession.resources = activeSession.resources || {};
-    activeSession.resources[providerType] = {
+    const expiresAt = tokens.expires_in ? Date.now() + tokens.expires_in * 1e3 : void 0;
+    const connectedResource = {
       provider: providerType,
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token,
+      expiresAt,
       scopes: scopes || (tokens.scope ? tokens.scope.split(" ") : []),
       raw: tokens,
       connectedAt: Date.now()
     };
+    const userKey = this.getUserKeyFromSession(activeSession);
+    const resourceStorage = this.resourceHandler.resourceStorage || _Lixa.LOCAL_RESOURCE_HANDLER.resourceStorage;
+    await resourceStorage.saveResource(userKey, providerType, connectedResource);
+    activeSession.resources = activeSession.resources || {};
+    activeSession.resources[providerType] = connectedResource;
     await sessionStorage.saveSession(sessionId, activeSession, 86400);
     return activeSession;
   }
   /**
-   * Retrieves a connected resource provider token for an active session.
+   * Retrieves a connected resource for a specific User ID / Email directly (independent of session IDs).
+   * Automatically refreshes expired access tokens if a refresh token is present.
+   * 
+   * @param userIdOrEmail - User identifier or email
+   * @param provider - Resource provider identifier (e.g. 'github', 'google')
+   */
+  async getUserResource(userIdOrEmail, provider) {
+    const resourceStorage = this.resourceHandler.resourceStorage || _Lixa.LOCAL_RESOURCE_HANDLER.resourceStorage;
+    const providerType = provider.toLowerCase();
+    const resource = await resourceStorage.getResource(userIdOrEmail, providerType);
+    if (!resource) return null;
+    if (resource.refreshToken && resource.expiresAt && Date.now() >= resource.expiresAt - 6e4) {
+      this.log("INFO", "Token", `Resource access token for user '${userIdOrEmail}' on '${providerType}' is expired. Auto-refreshing...`);
+      try {
+        return await this.refreshUserResourceToken(userIdOrEmail, providerType);
+      } catch (error) {
+        this.log("ERROR", "Token", `Failed to auto-refresh resource token for user '${userIdOrEmail}' on '${providerType}'`, { error: String(error) });
+      }
+    }
+    return resource;
+  }
+  /**
+   * Retrieves all connected resources for a specific User ID / Email.
+   */
+  async getUserResources(userIdOrEmail) {
+    const resourceStorage = this.resourceHandler.resourceStorage || _Lixa.LOCAL_RESOURCE_HANDLER.resourceStorage;
+    return await resourceStorage.getUserResources(userIdOrEmail);
+  }
+  /**
+   * Retrieves a connected resource provider token for an active session, auto-refreshing expired tokens if possible.
    * 
    * @param sessionId - Active session ID
-   * @param provider - Provider identifier (e.g. 'github')
+   * @param provider - Provider identifier (e.g. 'github', 'google')
    */
   async getConnectedResource(sessionId, provider) {
     const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
     const activeSession = await sessionStorage.getSession(sessionId);
-    if (!activeSession || !activeSession.resources) return null;
-    return activeSession.resources[provider.toLowerCase()] || null;
+    if (!activeSession) return null;
+    const providerType = provider.toLowerCase();
+    const userKey = this.getUserKeyFromSession(activeSession);
+    let resource = await this.getUserResource(userKey, providerType);
+    if (!resource && activeSession.resources) {
+      resource = activeSession.resources[providerType] || null;
+    }
+    if (resource) {
+      if (resource.refreshToken && resource.expiresAt && Date.now() >= resource.expiresAt - 6e4) {
+        this.log("INFO", "Token", `Resource access token for user '${userKey}' on '${providerType}' is expired. Auto-refreshing...`);
+        try {
+          resource = await this.refreshResourceToken(sessionId, providerType);
+        } catch (error) {
+          this.log("ERROR", "Token", `Failed to auto-refresh resource token for user '${userKey}' on '${providerType}'`, { error: String(error) });
+        }
+      }
+      activeSession.resources = activeSession.resources || {};
+      activeSession.resources[providerType] = resource;
+    }
+    return resource;
   }
   /**
-   * Disconnects a resource provider from an active session.
+   * Refreshes a user's resource access token using its refresh token.
    * 
-   * @param sessionId - Active session ID
-   * @param provider - Provider identifier to disconnect
+   * @param userIdOrEmail - User identifier or email
+   * @param provider - Provider identifier (e.g. 'google', 'github')
    */
-  async disconnectResource(sessionId, provider) {
+  async refreshUserResourceToken(userIdOrEmail, provider, existingResource) {
+    const resourceStorage = this.resourceHandler.resourceStorage || _Lixa.LOCAL_RESOURCE_HANDLER.resourceStorage;
+    const providerType = provider.toLowerCase();
+    let resource = existingResource || await resourceStorage.getResource(userIdOrEmail, providerType);
+    if (!resource || !resource.refreshToken) {
+      throw new Error(`No refresh token available for user '${userIdOrEmail}' on connected resource '${provider}'`);
+    }
+    const providerConfig = this.findProviderByType(providerType);
+    if (!providerConfig) {
+      throw new Error(`Provider '${provider}' is not configured`);
+    }
+    const providerImpl = this.getProvider(providerType, providerConfig);
+    const body = {
+      client_id: providerConfig.clientId,
+      client_secret: providerConfig.clientSecret,
+      grant_type: "refresh_token",
+      refresh_token: resource.refreshToken
+    };
+    const response = await fetch(providerImpl.tokenEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: new URLSearchParams(body).toString()
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Failed to refresh resource token for user '${userIdOrEmail}' on '${provider}': ${response.status} - ${errorText}`);
+    }
+    const tokens = await response.json();
+    const expiresAt = tokens.expires_in ? Date.now() + tokens.expires_in * 1e3 : void 0;
+    resource.accessToken = tokens.access_token;
+    if (tokens.refresh_token) {
+      resource.refreshToken = tokens.refresh_token;
+    }
+    if (expiresAt) {
+      resource.expiresAt = expiresAt;
+    }
+    resource.raw = tokens;
+    resource.connectedAt = Date.now();
+    await resourceStorage.saveResource(userIdOrEmail, providerType, resource);
+    return resource;
+  }
+  /**
+   * Refreshes a connected resource access token for an active session.
+   */
+  async refreshResourceToken(sessionId, provider) {
     const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
     const activeSession = await sessionStorage.getSession(sessionId);
-    if (!activeSession || !activeSession.resources) return false;
-    delete activeSession.resources[provider.toLowerCase()];
+    if (!activeSession) {
+      throw new Error("Active session not found.");
+    }
+    const providerType = provider.toLowerCase();
+    const userKey = this.getUserKeyFromSession(activeSession);
+    const existingResource = activeSession.resources ? activeSession.resources[providerType] : void 0;
+    const refreshed = await this.refreshUserResourceToken(userKey, providerType, existingResource);
+    activeSession.resources = activeSession.resources || {};
+    activeSession.resources[providerType] = refreshed;
     await sessionStorage.saveSession(sessionId, activeSession, 86400);
+    return refreshed;
+  }
+  /**
+   * Disconnects a resource provider for a specific User ID / Email.
+   */
+  async disconnectUserResource(userIdOrEmail, provider) {
+    const resourceStorage = this.resourceHandler.resourceStorage || _Lixa.LOCAL_RESOURCE_HANDLER.resourceStorage;
+    await resourceStorage.deleteResource(userIdOrEmail, provider.toLowerCase());
     return true;
   }
+  /**
+   * Disconnects a resource provider from an active session and user account.
+   */
+  async disconnectResource(sessionId, provider) {
+    const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
+    const activeSession = await sessionStorage.getSession(sessionId);
+    if (activeSession) {
+      const userKey = this.getUserKeyFromSession(activeSession);
+      await this.disconnectUserResource(userKey, provider);
+      if (activeSession.resources) {
+        delete activeSession.resources[provider.toLowerCase()];
+        await sessionStorage.saveSession(sessionId, activeSession, 86400);
+      }
+      return true;
+    }
+    return false;
+  }
   async fetchSessionInfo(sessionId) {
     const sessionStorage = this.sessionHandler.sessionStorage || _Lixa.LOCAL_SESSION_HANDLER.sessionStorage;
     return await sessionStorage.getSession(sessionId);