@xemahq/oidc-session-nest 0.1.0

package/dist/session/session-service.js

@@ -0,0 +1,224 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionService = void 0;
+exports.storeKeyFor = storeKeyFor;
+const node_crypto_1 = require("node:crypto");
+const errors_1 = require("../errors");
+const actor_1 = require("./actor");
+const oidc_client_1 = require("../oidc/oidc-client");
+const pkce_1 = require("../oidc/pkce");
+const PENDING_AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
+const REFRESH_LEASE_TTL_MS = 15 * 1000;
+const REFRESH_POLL_INTERVAL_MS = 50;
+class SessionService {
+    options;
+    store;
+    client;
+    now;
+    sleep;
+    inFlightRefresh = new Map();
+    constructor(deps) {
+        this.options = deps.options;
+        this.store = deps.store;
+        this.client = deps.client;
+        this.now = deps.now ?? (() => Date.now());
+        this.sleep =
+            deps.sleep ??
+                ((ms) => new Promise((resolve) => {
+                    setTimeout(resolve, ms);
+                }));
+    }
+    async beginAuthorization(input) {
+        const state = (0, pkce_1.randomUrlSafeToken)();
+        const nonce = (0, pkce_1.randomUrlSafeToken)();
+        const pending = {
+            codeVerifier: input.pkceVerifier,
+            nonce,
+            returnTo: input.returnTo,
+            createdAt: this.now(),
+        };
+        await this.store.putPendingAuthorization(state, pending, PENDING_AUTHORIZATION_TTL_MS);
+        const authorizationUrl = await this.client.buildAuthorizationUrl({
+            state,
+            nonce,
+            codeChallenge: input.codeChallenge,
+        });
+        return { authorizationUrl, state };
+    }
+    takePendingAuthorization(state) {
+        return this.store.takePendingAuthorization(state);
+    }
+    async establishSession(tokenSet, returnTo) {
+        const subjectId = tokenSet.accessClaims.sub;
+        if (typeof subjectId !== 'string' || subjectId === '') {
+            throw new Error('[oidc-session-nest] The access token carries no "sub" claim, so the ' +
+                'session would have no subject. Refusing to establish it.');
+        }
+        const startedAt = this.now();
+        const record = {
+            version: 1,
+            subjectId,
+            activeOrgId: (0, actor_1.resolveInitialActiveOrgId)(tokenSet.accessClaims),
+            orgRoles: (0, actor_1.resolveSessionOrgRoles)(tokenSet.accessClaims),
+            accessToken: tokenSet.accessToken,
+            ...(tokenSet.refreshToken === undefined
+                ? {}
+                : { refreshToken: tokenSet.refreshToken }),
+            ...(tokenSet.idToken === undefined ? {} : { idToken: tokenSet.idToken }),
+            accessTokenExpiresAt: tokenSet.accessTokenExpiresAt,
+            absoluteExpiresAt: startedAt + this.options.ttl.absoluteTtlSeconds * 1000,
+            claims: tokenSet.accessClaims,
+            createdAt: startedAt,
+        };
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const cookieValue = (0, pkce_1.randomUrlSafeToken)();
+            const written = await this.store.createSession(storeKeyFor(cookieValue), record, this.idleTtlMs(record));
+            if (written) {
+                return { cookieValue, actor: (0, actor_1.toSessionActor)(record), returnTo };
+            }
+        }
+        throw new Error('[oidc-session-nest] Could not mint an unused session key in two attempts. ' +
+            'That is not a collision — check that the store is not returning a stale ' +
+            'answer for every key.');
+    }
+    async resolveSession(cookieValue) {
+        const key = storeKeyFor(cookieValue);
+        const record = await this.store.readSession(key, {
+            idleTtlMs: this.options.ttl.idleTtlSeconds * 1000,
+            now: this.now(),
+        });
+        if (record === null) {
+            return { session: null, expired: true };
+        }
+        const fresh = await this.ensureFreshAccessToken(key, record);
+        if (fresh === null) {
+            return { session: null, expired: true };
+        }
+        return {
+            session: { key, record: fresh, actor: (0, actor_1.toSessionActor)(fresh) },
+            expired: false,
+        };
+    }
+    async setActiveOrg(session, orgId) {
+        const role = session.record.orgRoles[orgId];
+        if (role === undefined) {
+            throw new Error(`[oidc-session-nest] This session has no membership in org "${orgId}". ` +
+                'Refusing to act in an org the token does not grant.');
+        }
+        const next = {
+            ...session.record,
+            version: session.record.version + 1,
+            activeOrgId: orgId,
+        };
+        const written = await this.store.replaceSession(session.key, session.record.version, next, this.idleTtlMs(next));
+        return written ? (0, actor_1.toSessionActor)(next) : null;
+    }
+    async endSession(session) {
+        if (session === null) {
+            return null;
+        }
+        await this.store.deleteSession(session.key);
+        return this.client.buildEndSessionUrl(session.record.idToken);
+    }
+    storeKeyFor(cookieValue) {
+        return storeKeyFor(cookieValue);
+    }
+    idleTtlMs(record) {
+        const idle = this.options.ttl.idleTtlSeconds * 1000;
+        const untilAbsolute = record.absoluteExpiresAt - this.now();
+        return Math.max(1, Math.min(idle, untilAbsolute));
+    }
+    async ensureFreshAccessToken(key, record) {
+        const now = this.now();
+        const leadMs = this.options.ttl.refreshLeadSeconds * 1000;
+        if (record.accessTokenExpiresAt - leadMs > now) {
+            return record;
+        }
+        if (record.refreshToken === undefined) {
+            return now >= record.accessTokenExpiresAt ? null : record;
+        }
+        const existing = this.inFlightRefresh.get(key);
+        if (existing !== undefined) {
+            return existing;
+        }
+        const pending = this.refreshUnderLease(key, record).finally(() => {
+            this.inFlightRefresh.delete(key);
+        });
+        this.inFlightRefresh.set(key, pending);
+        return pending;
+    }
+    async refreshUnderLease(key, record) {
+        const acquired = await this.store.acquireRefreshLease(key, REFRESH_LEASE_TTL_MS);
+        if (!acquired) {
+            return this.awaitAnotherRefresh(record, key);
+        }
+        try {
+            return await this.performRefresh(key, record);
+        }
+        finally {
+            await this.store.releaseRefreshLease(key);
+        }
+    }
+    async performRefresh(key, record) {
+        const refreshToken = record.refreshToken;
+        if (refreshToken === undefined) {
+            return record;
+        }
+        let tokenSet;
+        try {
+            tokenSet = await this.client.refresh(refreshToken);
+        }
+        catch (error) {
+            if (error instanceof oidc_client_1.OidcInvalidGrantError) {
+                await this.store.deleteSession(key);
+                return null;
+            }
+            throw error;
+        }
+        const next = {
+            ...record,
+            version: record.version + 1,
+            accessToken: tokenSet.accessToken,
+            ...(tokenSet.refreshToken === undefined
+                ? { refreshToken }
+                : { refreshToken: tokenSet.refreshToken }),
+            ...(tokenSet.idToken === undefined ? {} : { idToken: tokenSet.idToken }),
+            accessTokenExpiresAt: tokenSet.accessTokenExpiresAt,
+            orgRoles: (0, actor_1.resolveSessionOrgRoles)(tokenSet.accessClaims),
+            claims: tokenSet.accessClaims,
+        };
+        const written = await this.store.replaceSession(key, record.version, next, this.idleTtlMs(next));
+        if (!written) {
+            return this.store.readSession(key, {
+                idleTtlMs: this.options.ttl.idleTtlSeconds * 1000,
+                now: this.now(),
+            });
+        }
+        return next;
+    }
+    async awaitAnotherRefresh(record, key) {
+        if (this.now() < record.accessTokenExpiresAt) {
+            return record;
+        }
+        const attempts = Math.max(1, Math.ceil(this.options.ttl.refreshWaitMs / REFRESH_POLL_INTERVAL_MS));
+        for (let attempt = 0; attempt < attempts; attempt += 1) {
+            await this.sleep(REFRESH_POLL_INTERVAL_MS);
+            const latest = await this.store.readSession(key, {
+                idleTtlMs: this.options.ttl.idleTtlSeconds * 1000,
+                now: this.now(),
+            });
+            if (latest === null) {
+                return null;
+            }
+            if (latest.version > record.version) {
+                return latest;
+            }
+        }
+        throw new errors_1.SessionRefreshContendedError();
+    }
+}
+exports.SessionService = SessionService;
+function storeKeyFor(cookieValue) {
+    return (0, node_crypto_1.createHash)('sha256').update(cookieValue).digest('base64url');
+}
+//# sourceMappingURL=session-service.js.map

package/dist/session/session-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-service.js","sourceRoot":"","sources":["../../src/session/session-service.ts"],"names":[],"mappings":";;;AAicA,kCAEC;AA5aD,6CAAyC;AAGzC,sCAAyD;AACzD,mCAKiB;AACjB,qDAI6B;AAC7B,uCAAkD;AAWlD,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAGpD,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAGvC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AA6CpC,MAAa,cAAc;IACR,OAAO,CAAqB;IAE5B,KAAK,CAAe;IAEpB,MAAM,CAAa;IAEnB,GAAG,CAAe;IAElB,KAAK,CAAgC;IAGrC,eAAe,GAAG,IAAI,GAAG,EAAyC,CAAC;IAEpF,YAAY,IAAwB;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YACR,IAAI,CAAC,KAAK;gBACV,CAAC,CAAC,EAAE,EAAE,EAAE,CACN,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;oBACtB,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1B,CAAC,CAAC,CAAC,CAAC;IACV,CAAC;IAMD,KAAK,CAAC,kBAAkB,CAAC,KAIxB;QACC,MAAM,KAAK,GAAG,IAAA,yBAAkB,GAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAA,yBAAkB,GAAE,CAAC;QACnC,MAAM,OAAO,GAAyB;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,KAAK;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,CACtC,KAAK,EACL,OAAO,EACP,4BAA4B,CAC7B,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;YAC/D,KAAK;YACL,KAAK;YACL,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAGD,wBAAwB,CAAC,KAAa;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IASD,KAAK,CAAC,gBAAgB,CACpB,QAAsB,EACtB,QAAuB;QAEvB,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC;QAC5C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,sEAAsE;gBACpE,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAkB;YAC5B,OAAO,EAAE,CAAC;YACV,SAAS;YACT,WAAW,EAAE,IAAA,iCAAyB,EAAC,QAAQ,CAAC,YAAY,CAAC;YAC7D,QAAQ,EAAE,IAAA,8BAAsB,EAAC,QAAQ,CAAC,YAAY,CAAC;YACvD,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC5C,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;YACxE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,iBAAiB,EAAE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,IAAI;YACzE,MAAM,EAAE,QAAQ,CAAC,YAAY;YAC7B,SAAS,EAAE,SAAS;SACrB,CAAC;QAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,WAAW,GAAG,IAAA,yBAAkB,GAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAC5C,WAAW,CAAC,WAAW,CAAC,EACxB,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CACvB,CAAC;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,IAAA,sBAAc,EAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;YAClE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,0EAA0E;YAC1E,uBAAuB,CAC1B,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,IAAI;YACjD,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAChB,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAGpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO;YACL,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAA,sBAAc,EAAC,KAAK,CAAC,EAAE;YAC7D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAaD,KAAK,CAAC,YAAY,CAChB,OAAoB,EACpB,KAAa;QAEb,MAAM,IAAI,GAAwB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,8DAA8D,KAAK,KAAK;gBACtE,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAkB;YAC1B,GAAG,OAAO,CAAC,MAAM;YACjB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC;YACnC,WAAW,EAAE,KAAK;SACnB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAC7C,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,MAAM,CAAC,OAAO,EACtB,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CACrB,CAAC;QACF,OAAO,OAAO,CAAC,CAAC,CAAC,IAAA,sBAAc,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAGD,KAAK,CAAC,UAAU,CAAC,OAA2B;QAC1C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAK5C,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IAGD,WAAW,CAAC,WAAmB;QAC7B,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAEO,SAAS,CAAC,MAAqB;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC;QACpD,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,GAAW,EACX,MAAqB;QAErB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC1D,IAAI,MAAM,CAAC,oBAAoB,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;YAC/C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAGtC,OAAO,GAAG,IAAI,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,GAAW,EACX,MAAqB;QAErB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CACnD,GAAG,EACH,oBAAoB,CACrB,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,GAAW,EACX,MAAqB;QAErB,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACzC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,QAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mCAAqB,EAAE,CAAC;gBAG3C,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YAID,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAkB;YAC1B,GAAG,MAAM;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC;YAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;YAIjC,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,YAAY,EAAE;gBAClB,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC5C,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;YACxE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,QAAQ,EAAE,IAAA,8BAAsB,EAAC,QAAQ,CAAC,YAAY,CAAC;YACvD,MAAM,EAAE,QAAQ,CAAC,YAAY;SAC9B,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAC7C,GAAG,EACH,MAAM,CAAC,OAAO,EACd,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CACrB,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YAIb,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;gBACjC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,IAAI;gBACjD,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAUO,KAAK,CAAC,mBAAmB,CAC/B,MAAqB,EACrB,GAAW;QAEX,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC;QAMD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,CAAC,EACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,wBAAwB,CAAC,CACrE,CAAC;QACF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;gBAC/C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,IAAI;gBACjD,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;YACH,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpC,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,qCAA4B,EAAE,CAAC;IAC3C,CAAC;CACF;AArVD,wCAqVC;AAQD,SAAgB,WAAW,CAAC,WAAmB;IAC7C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACtE,CAAC"}

package/dist/session/session-store.d.ts

@@ -0,0 +1,35 @@
+import type { OrgRole } from '@xemahq/platform-common';
+export interface SessionRecord {
+    readonly version: number;
+    readonly subjectId: string;
+    readonly activeOrgId: string | null;
+    readonly orgRoles: Readonly<Record<string, OrgRole>>;
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly idToken?: string;
+    readonly accessTokenExpiresAt: number;
+    readonly absoluteExpiresAt: number;
+    readonly claims: Readonly<Record<string, unknown>>;
+    readonly createdAt: number;
+}
+export interface PendingAuthorization {
+    readonly codeVerifier: string;
+    readonly nonce: string;
+    readonly returnTo: string | null;
+    readonly createdAt: number;
+}
+export interface ReadSessionOptions {
+    readonly idleTtlMs: number;
+    readonly now: number;
+}
+export interface SessionStore {
+    createSession(key: string, record: SessionRecord, ttlMs: number): Promise<boolean>;
+    readSession(key: string, options: ReadSessionOptions): Promise<SessionRecord | null>;
+    replaceSession(key: string, expectedVersion: number, record: SessionRecord, ttlMs: number): Promise<boolean>;
+    deleteSession(key: string): Promise<void>;
+    acquireRefreshLease(key: string, ttlMs: number): Promise<boolean>;
+    releaseRefreshLease(key: string): Promise<void>;
+    putPendingAuthorization(state: string, pending: PendingAuthorization, ttlMs: number): Promise<void>;
+    takePendingAuthorization(state: string): Promise<PendingAuthorization | null>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/session/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/session/session-store.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAGvD,MAAM,WAAW,aAAa;IAM5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAM3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAGD,MAAM,WAAW,kBAAkB;IAOjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAQD,MAAM,WAAW,YAAY;IAQ3B,aAAa,CACX,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAAC;IASpB,WAAW,CACT,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IASjC,cAAc,CACZ,GAAG,EAAE,MAAM,EACX,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAAC;IAGpB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAQ1C,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGlE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGhD,uBAAuB,CACrB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IASjB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CAC/E"}

package/dist/session/session-store.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=session-store.js.map

package/dist/session/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../../src/session/session-store.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@xemahq/oidc-session-nest",
+  "version": "0.1.0",
+  "description": "Server-side OIDC session for a NestJS backend-for-frontend: the browser holds one httpOnly cookie and never a Xema token. Performs the authorization-code exchange, keeps the token set in a session store the application owns, refreshes it under a lease so concurrent requests exchange once, and hands the generated Xema clients a bearer plus the org and Project headers through an ambient request scope.",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "peerDependencies": {
+    "@nestjs/common": "^10 || ^11",
+    "@nestjs/core": "^10 || ^11",
+    "@xemahq/contracts": "^0.1.0",
+    "@xemahq/oidc-guard": ">=0.6.0",
+    "@xemahq/platform-common": ">=0.28.2",
+    "@xemahq/xema-decorators": ">=0.15.0"
+  },
+  "devDependencies": {
+    "@nestjs/common": "11.1.18",
+    "@nestjs/core": "11.1.18",
+    "@nestjs/platform-express": "11.1.28",
+    "@nestjs/testing": "11.1.18",
+    "@types/jest": "^30.0.0",
+    "@types/node": "25.2.3",
+    "@xemahq/contracts": "^0.1.0",
+    "@xemahq/oidc-guard": "^0.6.0",
+    "@xemahq/platform-common": "^0.31.0",
+    "eslint": "^9.39.4",
+    "jest": "^30.3.0",
+    "reflect-metadata": "0.2.2",
+    "rxjs": "7.8.2",
+    "ts-jest": "^29.4.9",
+    "typescript": "5.9.3",
+    "@xemahq/eslint-config": "0.6.0",
+    "@xemahq/xema-decorators": "0.16.0"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "xema-source": "./src/index.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "license": "Apache-2.0",
+  "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
+  "homepage": "https://xema.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xema-dev/xema-kernel-sdk.git",
+    "directory": "packages/sdks/oidc-session-nest"
+  },
+  "scripts": {
+    "clean": "rm -rf dist",
+    "build": "tsc -p tsconfig.build.json",
+    "lint": "eslint .",
+    "test": "jest --config jest.config.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}