hazo_auth 10.0.0 → 10.2.0

package/dist/lib/auth/nextauth_config.d.ts

@@ -12,6 +12,8 @@ export type NextAuthCallbackAccount = {
     access_token?: string;
     id_token?: string;
     expires_at?: number;
+    refresh_token?: string;
+    scope?: string;
 };
 export type NextAuthCallbackProfile = {
     sub?: string;

package/dist/lib/auth/nextauth_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextauth_config.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/nextauth_config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAW,MAAM,WAAW,CAAC;AAatD,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CAkOjD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAW7C"}
+{"version":3,"file":"nextauth_config.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/nextauth_config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAW,MAAM,WAAW,CAAC;AActD,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CAwQjD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAW7C"}

package/dist/lib/auth/nextauth_config.js

@@ -7,6 +7,7 @@ import { get_oauth_config } from "../oauth_config.server.js";
 import { handle_google_oauth_login } from "../services/oauth_service.js";
 import { get_hazo_connect_instance } from "../hazo_connect_instance.server.js";
 import { create_app_logger } from "../app_logger.js";
+import { store_google_oauth_token, GoogleTokenStorageUnconfigured } from "../services/google_token_service.js";
 // section: config
 /**
  * Gets NextAuth.js configuration with enabled OAuth providers
@@ -29,6 +30,7 @@ export function get_nextauth_config() {
                         prompt: "consent",
                         access_type: "offline",
                         response_type: "code",
+                        include_granted_scopes: "true",
                     },
                 },
             }));
@@ -79,7 +81,7 @@ export function get_nextauth_config() {
              * Sign-in callback - handle user creation/linking for Google OAuth
              */
             async signIn({ account, profile, user, }) {
-                var _a;
+                var _a, _b, _c;
                 const logger = create_app_logger();
                 if ((account === null || account === void 0 ? void 0 : account.provider) === "google" && profile) {
                     try {
@@ -113,6 +115,42 @@ export function get_nextauth_config() {
                         });
                         // Store user_id in account for the JWT callback to pick up
                         account.hazo_user_id = result.user_id;
+                        // Capture refresh token when extra scopes were granted
+                        const BASE_SCOPES = ["openid", "email", "profile"];
+                        const granted_scopes = ((_b = account.scope) !== null && _b !== void 0 ? _b : "").split(" ").filter(Boolean);
+                        const has_extra_scopes = granted_scopes.some(s => !BASE_SCOPES.includes(s));
+                        if (account.refresh_token && has_extra_scopes) {
+                            try {
+                                await store_google_oauth_token({
+                                    user_id: result.user_id,
+                                    refresh_token: account.refresh_token,
+                                    access_token: account.access_token,
+                                    scopes: (_c = account.scope) !== null && _c !== void 0 ? _c : "",
+                                    expires_at: account.expires_at
+                                        ? new Date(account.expires_at * 1000).toISOString()
+                                        : undefined,
+                                });
+                                logger.info("nextauth_google_token_stored", {
+                                    user_id: result.user_id,
+                                    scopes: account.scope,
+                                });
+                            }
+                            catch (tokenError) {
+                                if (tokenError instanceof GoogleTokenStorageUnconfigured) {
+                                    logger.error("nextauth_google_token_storage_unconfigured", {
+                                        user_id: result.user_id,
+                                        error: tokenError.message,
+                                    });
+                                    return "/api/auth/error?error=GoogleTokenStorageUnconfigured";
+                                }
+                                const errorMsg = tokenError instanceof Error ? tokenError.message : String(tokenError);
+                                logger.error("nextauth_google_token_store_failed", {
+                                    user_id: result.user_id,
+                                    error: errorMsg,
+                                });
+                                // Non-fatal: continue sign-in even if token storage fails
+                            }
+                        }
                         return true;
                     }
                     catch (error) {

package/dist/lib/auth/request_google_scopes.d.ts

@@ -0,0 +1,10 @@
+import { signIn } from "next-auth/react";
+/**
+ * Triggers an incremental Google OAuth consent flow to grant additional scopes.
+ * Call from a client component when the user needs to grant extra Google API access
+ * (e.g. analytics, sheets). On completion, hazo_auth stores the refresh token.
+ */
+export declare function requestGoogleScopes(scopes: string[], opts?: {
+    callbackUrl?: string;
+}): ReturnType<typeof signIn>;
+//# sourceMappingURL=request_google_scopes.d.ts.map

package/dist/lib/auth/request_google_scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request_google_scopes.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/request_google_scopes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,UAAU,CAAC,OAAO,MAAM,CAAC,CAS3B"}

package/dist/lib/auth/request_google_scopes.js

@@ -0,0 +1,13 @@
+// file_description: client helper to trigger incremental Google OAuth scope consent
+"use client";
+import { signIn } from "next-auth/react";
+/**
+ * Triggers an incremental Google OAuth consent flow to grant additional scopes.
+ * Call from a client component when the user needs to grant extra Google API access
+ * (e.g. analytics, sheets). On completion, hazo_auth stores the refresh token.
+ */
+export function requestGoogleScopes(scopes, opts) {
+    var _a;
+    const scope = Array.from(new Set(["openid", "email", "profile", ...scopes])).join(" ");
+    return signIn("google", { callbackUrl: (_a = opts === null || opts === void 0 ? void 0 : opts.callbackUrl) !== null && _a !== void 0 ? _a : "/" }, { scope, access_type: "offline", include_granted_scopes: "true", prompt: "consent" });
+}

package/dist/lib/hazo_connect_instance.server.d.ts

@@ -15,4 +15,8 @@ import type { HazoConnectAdapter } from "hazo_connect";
  * @returns The singleton HazoConnectAdapter instance
  */
 export declare function get_hazo_connect_instance(): HazoConnectAdapter;
+/** Inject a connect adapter for tests (mirrors set_hazo_connect_instance pattern). */
+export declare function set_hazo_connect_instance(adapter: HazoConnectAdapter): void;
+/** Reset the injected adapter (call in afterAll). */
+export declare function reset_hazo_connect_instance(): void;
 //# sourceMappingURL=hazo_connect_instance.server.d.ts.map

package/dist/lib/hazo_connect_instance.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hazo_connect_instance.server.d.ts","sourceRoot":"","sources":["../../src/lib/hazo_connect_instance.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAMrB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAWvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,IAAI,kBAAkB,CAqE9D"}
+{"version":3,"file":"hazo_connect_instance.server.d.ts","sourceRoot":"","sources":["../../src/lib/hazo_connect_instance.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAMrB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAYvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,IAAI,kBAAkB,CAuE9D;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAG3E;AAED,qDAAqD;AACrD,wBAAgB,2BAA2B,IAAI,IAAI,CAIlD"}

package/dist/lib/hazo_connect_instance.server.js

@@ -2,6 +2,7 @@
 // section: server-only-guard
 import "server-only";
 import { getHazoConnectSingleton } from "hazo_connect/nextjs/setup";
+import { setHazoConnectSingleton, resetHazoConnectSingleton } from "hazo_connect/testing";
 import { create_sqlite_hazo_connect_server, get_hazo_connect_config_options } from "./hazo_connect_setup.server.js";
 import { initializeAdminService, getSqliteAdminService } from "hazo_connect/server";
 import { create_app_logger } from "./app_logger.js";
@@ -24,6 +25,9 @@ let isInitialized = false;
  * @returns The singleton HazoConnectAdapter instance
  */
 export function get_hazo_connect_instance() {
+    // Honor test injection or cached fallback first
+    if (hazoConnectInstance)
+        return hazoConnectInstance;
     // Use the new singleton API from hazo_connect
     // This automatically handles:
     // - Instance reuse
@@ -89,3 +93,14 @@ export function get_hazo_connect_instance() {
         return hazoConnectInstance;
     }
 }
+/** Inject a connect adapter for tests (mirrors set_hazo_connect_instance pattern). */
+export function set_hazo_connect_instance(adapter) {
+    hazoConnectInstance = adapter;
+    setHazoConnectSingleton(adapter);
+}
+/** Reset the injected adapter (call in afterAll). */
+export function reset_hazo_connect_instance() {
+    hazoConnectInstance = null;
+    isInitialized = false;
+    resetHazoConnectSingleton();
+}

package/dist/lib/schema/sqlite_schema.d.ts

@@ -1,2 +1,2 @@
-export declare const SQLITE_SCHEMA = "\n-- hazo_auth canonical SQLite schema\n-- This schema creates all tables required by hazo_auth\n\n-- Users table (from migration 011)\nCREATE TABLE IF NOT EXISTS hazo_users (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL UNIQUE,\n  password_hash TEXT,\n  name TEXT,\n  email_verified BOOLEAN DEFAULT false,\n  login_attempts INTEGER DEFAULT 0,\n  last_logon TEXT,\n  profile_picture_url TEXT,\n  profile_source TEXT CHECK(profile_source IN ('gravatar', 'custom', 'predefined')),\n  mfa_secret TEXT,\n  url_on_logon TEXT,\n  google_id TEXT UNIQUE,\n  auth_providers TEXT DEFAULT 'email',\n  user_type TEXT,\n  app_user_data TEXT,\n  status TEXT DEFAULT 'ACTIVE' CHECK(status IN ('PENDING', 'ACTIVE', 'BLOCKED')),\n  managed_by_user_id TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  pin_hash TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_email ON hazo_users(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_google_id ON hazo_users(google_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_status ON hazo_users(status);\n\n-- Refresh tokens table\n-- Note: runtime (token_service.ts) writes token_hash (argon2-hashed value) on\n-- insert and verifies via argon2.verify(token_hash, plaintext_token) on read.\n-- The plaintext \"token\" column is retained nullable for legacy compatibility\n-- but new writes only set token_hash.\nCREATE TABLE IF NOT EXISTS hazo_refresh_tokens (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  token TEXT UNIQUE,\n  token_hash TEXT,\n  token_type TEXT DEFAULT 'refresh',\n  expires_at TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_user ON hazo_refresh_tokens(user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token ON hazo_refresh_tokens(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token_hash ON hazo_refresh_tokens(token_hash);\n\n-- Roles table\nCREATE TABLE IF NOT EXISTS hazo_roles (\n  id TEXT PRIMARY KEY,\n  role_name TEXT NOT NULL UNIQUE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Permissions table\nCREATE TABLE IF NOT EXISTS hazo_permissions (\n  id TEXT PRIMARY KEY,\n  permission_name TEXT NOT NULL UNIQUE,\n  description TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Role-permission assignments (composite PK, no id column)\nCREATE TABLE IF NOT EXISTS hazo_role_permissions (\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  permission_id TEXT NOT NULL REFERENCES hazo_permissions(id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (role_id, permission_id)\n);\n\n-- Unified scopes table (hierarchical multi-tenancy)\nCREATE TABLE IF NOT EXISTS hazo_scopes (\n  id TEXT PRIMARY KEY,\n  parent_id TEXT REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  name TEXT NOT NULL,\n  level TEXT NOT NULL,\n  logo_url TEXT,\n  primary_color TEXT,\n  secondary_color TEXT,\n  tagline TEXT,\n  slug TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_parent ON hazo_scopes(parent_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_level ON hazo_scopes(level);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_slug ON hazo_scopes(slug);\n\n-- Default system scope (for non-multi-tenancy mode)\nINSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)\nVALUES ('00000000-0000-0000-0000-000000000001', NULL, 'System', 'default', datetime('now'), datetime('now'));\n\n-- User-scope assignments (membership model with scope-specific roles)\nCREATE TABLE IF NOT EXISTS hazo_user_scopes (\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  status TEXT DEFAULT 'ACTIVE' CHECK (status IN ('INVITED', 'ACTIVE', 'SUSPENDED', 'DEPARTED')),\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (user_id, scope_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_scope ON hazo_user_scopes(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_root ON hazo_user_scopes(root_scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_role ON hazo_user_scopes(role_id);\n\n-- Invitations table\nCREATE TABLE IF NOT EXISTS hazo_invitations (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL,\n  token TEXT NOT NULL UNIQUE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  invited_by TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  status TEXT NOT NULL DEFAULT 'PENDING' CHECK(status IN ('PENDING', 'ACCEPTED', 'EXPIRED', 'REVOKED')),\n  expires_at TEXT NOT NULL,\n  accepted_at TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_email ON hazo_invitations(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_token ON hazo_invitations(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_scope ON hazo_invitations(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_status ON hazo_invitations(status);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_expires ON hazo_invitations(expires_at);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_managed_by ON hazo_users(managed_by_user_id);\n\n-- Relationships table\nCREATE TABLE IF NOT EXISTS hazo_user_relationships (\n  id TEXT PRIMARY KEY,\n  parent_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  child_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  relationship_type TEXT NOT NULL DEFAULT 'parent',\n  can_view_progress BOOLEAN DEFAULT true,\n  can_edit_profile BOOLEAN DEFAULT true,\n  can_delete BOOLEAN DEFAULT false,\n  is_self BOOLEAN DEFAULT false,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  UNIQUE(parent_user_id, child_user_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_parent ON hazo_user_relationships(parent_user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_child ON hazo_user_relationships(child_user_id);\n\n-- Firm admin role (for firm creators)\nINSERT OR IGNORE INTO hazo_roles (id, role_name, created_at, changed_at)\nVALUES (lower(hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-4' || substr(hex(randomblob(2)),2) || '-' || substr('89ab',abs(random()) % 4 + 1, 1) || substr(hex(randomblob(2)),2) || '-' || hex(randomblob(6))), 'firm_admin', datetime('now'), datetime('now'));\n";
+export declare const SQLITE_SCHEMA = "\n-- hazo_auth canonical SQLite schema\n-- This schema creates all tables required by hazo_auth\n\n-- Users table (from migration 011)\nCREATE TABLE IF NOT EXISTS hazo_users (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL UNIQUE,\n  password_hash TEXT,\n  name TEXT,\n  email_verified BOOLEAN DEFAULT false,\n  login_attempts INTEGER DEFAULT 0,\n  last_logon TEXT,\n  profile_picture_url TEXT,\n  profile_source TEXT CHECK(profile_source IN ('gravatar', 'custom', 'predefined')),\n  mfa_secret TEXT,\n  url_on_logon TEXT,\n  google_id TEXT UNIQUE,\n  auth_providers TEXT DEFAULT 'email',\n  user_type TEXT,\n  app_user_data TEXT,\n  status TEXT DEFAULT 'ACTIVE' CHECK(status IN ('PENDING', 'ACTIVE', 'BLOCKED')),\n  managed_by_user_id TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  pin_hash TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_email ON hazo_users(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_google_id ON hazo_users(google_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_status ON hazo_users(status);\n\n-- Refresh tokens table\n-- Note: runtime (token_service.ts) writes token_hash (argon2-hashed value) on\n-- insert and verifies via argon2.verify(token_hash, plaintext_token) on read.\n-- The plaintext \"token\" column is retained nullable for legacy compatibility\n-- but new writes only set token_hash.\nCREATE TABLE IF NOT EXISTS hazo_refresh_tokens (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  token TEXT UNIQUE,\n  token_hash TEXT,\n  token_type TEXT DEFAULT 'refresh',\n  expires_at TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_user ON hazo_refresh_tokens(user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token ON hazo_refresh_tokens(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token_hash ON hazo_refresh_tokens(token_hash);\n\n-- Roles table\nCREATE TABLE IF NOT EXISTS hazo_roles (\n  id TEXT PRIMARY KEY,\n  role_name TEXT NOT NULL UNIQUE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Permissions table\nCREATE TABLE IF NOT EXISTS hazo_permissions (\n  id TEXT PRIMARY KEY,\n  permission_name TEXT NOT NULL UNIQUE,\n  description TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Role-permission assignments (composite PK, no id column)\nCREATE TABLE IF NOT EXISTS hazo_role_permissions (\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  permission_id TEXT NOT NULL REFERENCES hazo_permissions(id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (role_id, permission_id)\n);\n\n-- Unified scopes table (hierarchical multi-tenancy)\nCREATE TABLE IF NOT EXISTS hazo_scopes (\n  id TEXT PRIMARY KEY,\n  parent_id TEXT REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  name TEXT NOT NULL,\n  level TEXT NOT NULL,\n  logo_url TEXT,\n  primary_color TEXT,\n  secondary_color TEXT,\n  tagline TEXT,\n  slug TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_parent ON hazo_scopes(parent_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_level ON hazo_scopes(level);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_slug ON hazo_scopes(slug);\n\n-- Default system scope (for non-multi-tenancy mode)\nINSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)\nVALUES ('00000000-0000-0000-0000-000000000001', NULL, 'System', 'default', datetime('now'), datetime('now'));\n\n-- User-scope assignments (membership model with scope-specific roles)\nCREATE TABLE IF NOT EXISTS hazo_user_scopes (\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  status TEXT DEFAULT 'ACTIVE' CHECK (status IN ('INVITED', 'ACTIVE', 'SUSPENDED', 'DEPARTED')),\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (user_id, scope_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_scope ON hazo_user_scopes(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_root ON hazo_user_scopes(root_scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_role ON hazo_user_scopes(role_id);\n\n-- Invitations table\nCREATE TABLE IF NOT EXISTS hazo_invitations (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL,\n  token TEXT NOT NULL UNIQUE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  invited_by TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  status TEXT NOT NULL DEFAULT 'PENDING' CHECK(status IN ('PENDING', 'ACCEPTED', 'EXPIRED', 'REVOKED')),\n  expires_at TEXT NOT NULL,\n  accepted_at TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_email ON hazo_invitations(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_token ON hazo_invitations(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_scope ON hazo_invitations(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_status ON hazo_invitations(status);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_expires ON hazo_invitations(expires_at);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_managed_by ON hazo_users(managed_by_user_id);\n\n-- Relationships table\nCREATE TABLE IF NOT EXISTS hazo_user_relationships (\n  id TEXT PRIMARY KEY,\n  parent_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  child_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  relationship_type TEXT NOT NULL DEFAULT 'parent',\n  can_view_progress BOOLEAN DEFAULT true,\n  can_edit_profile BOOLEAN DEFAULT true,\n  can_delete BOOLEAN DEFAULT false,\n  is_self BOOLEAN DEFAULT false,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  UNIQUE(parent_user_id, child_user_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_parent ON hazo_user_relationships(parent_user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_child ON hazo_user_relationships(child_user_id);\n\n-- Firm admin role (for firm creators)\nINSERT OR IGNORE INTO hazo_roles (id, role_name, created_at, changed_at)\nVALUES (lower(hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-4' || substr(hex(randomblob(2)),2) || '-' || substr('89ab',abs(random()) % 4 + 1, 1) || substr(hex(randomblob(2)),2) || '-' || hex(randomblob(6))), 'firm_admin', datetime('now'), datetime('now'));\n\n-- Google OAuth tokens (encrypted refresh/access tokens for extra-scope API access)\nCREATE TABLE IF NOT EXISTS hazo_google_oauth_tokens (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  provider TEXT NOT NULL DEFAULT 'google',\n  refresh_token_enc TEXT NOT NULL,\n  access_token_enc TEXT,\n  scopes TEXT NOT NULL DEFAULT '',\n  expires_at TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now')),\n  UNIQUE(user_id, provider)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_google_oauth_tokens_user ON hazo_google_oauth_tokens(user_id);\n";
 //# sourceMappingURL=sqlite_schema.d.ts.map

package/dist/lib/schema/sqlite_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite_schema.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/sqlite_schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,aAAa,ogOA+JzB,CAAC"}
+{"version":3,"file":"sqlite_schema.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/sqlite_schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,aAAa,uoPA+KzB,CAAC"}

package/dist/lib/schema/sqlite_schema.js

@@ -160,4 +160,20 @@ CREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_child ON hazo_user_relati
 -- Firm admin role (for firm creators)
 INSERT OR IGNORE INTO hazo_roles (id, role_name, created_at, changed_at)
 VALUES (lower(hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-4' || substr(hex(randomblob(2)),2) || '-' || substr('89ab',abs(random()) % 4 + 1, 1) || substr(hex(randomblob(2)),2) || '-' || hex(randomblob(6))), 'firm_admin', datetime('now'), datetime('now'));
+
+-- Google OAuth tokens (encrypted refresh/access tokens for extra-scope API access)
+CREATE TABLE IF NOT EXISTS hazo_google_oauth_tokens (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,
+  provider TEXT NOT NULL DEFAULT 'google',
+  refresh_token_enc TEXT NOT NULL,
+  access_token_enc TEXT,
+  scopes TEXT NOT NULL DEFAULT '',
+  expires_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  changed_at TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE(user_id, provider)
+);
+
+CREATE INDEX IF NOT EXISTS idx_hazo_google_oauth_tokens_user ON hazo_google_oauth_tokens(user_id);
 `;

package/dist/lib/services/google_token_service.d.ts

@@ -0,0 +1,48 @@
+export declare class GoogleTokenStorageUnconfigured extends Error {
+    constructor();
+}
+export type StoreGoogleOAuthTokenParams = {
+    user_id: string;
+    refresh_token: string;
+    access_token?: string;
+    scopes: string;
+    expires_at?: string;
+};
+export type GoogleTokenResult = {
+    ok: true;
+    access_token: string;
+    scopes: string;
+} | {
+    ok: false;
+    error: "not_connected" | "reconsent_required" | "refresh_failed" | "unconfigured";
+};
+export type GoogleTokenStatus = {
+    connected: boolean;
+    scopes: string;
+    expires_at: string | null;
+};
+/**
+ * Stores (inserts or updates) Google OAuth tokens for a user, encrypting sensitive fields.
+ * Throws GoogleTokenStorageUnconfigured if hazo_secure/crypto is unavailable or keys are missing.
+ */
+export declare function store_google_oauth_token(params: StoreGoogleOAuthTokenParams): Promise<void>;
+/**
+ * Returns a valid access token for the user, refreshing via Google if needed.
+ * Returns a typed error result instead of throwing for expected failure modes.
+ */
+export declare function getGoogleToken(userId: string, opts?: {
+    scopes?: string[];
+}): Promise<GoogleTokenResult>;
+/**
+ * Revokes the user's Google OAuth tokens — best-effort remote revocation, then deletes DB row.
+ */
+export declare function revoke_google_oauth_token(userId: string): Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+/**
+ * Returns connection status and scope information for a user's Google OAuth connection.
+ * Does not decrypt or refresh tokens.
+ */
+export declare function get_google_token_status(userId: string): Promise<GoogleTokenStatus>;
+//# sourceMappingURL=google_token_service.d.ts.map

package/dist/lib/services/google_token_service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google_token_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/google_token_service.ts"],"names":[],"mappings":"AAUA,qBAAa,8BAA+B,SAAQ,KAAK;;CAOxD;AAID,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,cAAc,CAAA;CAAE,CAAC;AAErG,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AA6CF;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,IAAI,CAAC,CA0Ef;AAID;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA6I5B;AAID;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6D1C;AAID;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAexF"}

package/dist/lib/services/google_token_service.js

@@ -0,0 +1,319 @@
+// file_description: stores, retrieves, refreshes, and revokes Google OAuth tokens with encrypted persistence
+// section: imports
+import { createCrudService } from "hazo_connect/server";
+import { get_hazo_connect_instance } from "../hazo_connect_instance.server.js";
+import { create_app_logger } from "../app_logger.js";
+import { optional_import } from "hazo_core";
+import { randomUUID } from "crypto";
+// section: errors
+export class GoogleTokenStorageUnconfigured extends Error {
+    constructor() {
+        super("Google token storage is not configured. Set HAZO_AUTH_OAUTH_KEY_CURRENT and HAZO_AUTH_OAUTH_KEY_<ID> env vars.");
+        this.name = "GoogleTokenStorageUnconfigured";
+    }
+}
+// section: cache
+const access_token_cache = new Map();
+// section: helpers
+function makeKeyProvider(LookupKeyProvider) {
+    return new LookupKeyProvider((name) => {
+        if (name === "current")
+            return process.env.HAZO_AUTH_OAUTH_KEY_CURRENT;
+        if (name.startsWith("key_")) {
+            const keyId = name.slice(4).toUpperCase();
+            return process.env[`HAZO_AUTH_OAUTH_KEY_${keyId}`];
+        }
+        return undefined;
+    });
+}
+async function load_crypto_module() {
+    const cryptoModule = await optional_import("hazo_secure/crypto");
+    if (!cryptoModule)
+        throw new GoogleTokenStorageUnconfigured();
+    return cryptoModule;
+}
+// section: store
+/**
+ * Stores (inserts or updates) Google OAuth tokens for a user, encrypting sensitive fields.
+ * Throws GoogleTokenStorageUnconfigured if hazo_secure/crypto is unavailable or keys are missing.
+ */
+export async function store_google_oauth_token(params) {
+    var _a, _b;
+    const logger = create_app_logger();
+    const { encryptField, decryptField: _decryptField, aadFor, LookupKeyProvider } = await load_crypto_module();
+    const keys = makeKeyProvider(LookupKeyProvider);
+    // Force-fail early if no key is configured
+    try {
+        await keys.current();
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.error("google_token_service_key_provider_failed", {
+            filename: "google_token_service.ts",
+            error: msg,
+        });
+        throw new GoogleTokenStorageUnconfigured();
+    }
+    const refresh_enc = await encryptField(params.refresh_token, {
+        keys,
+        aad: aadFor("hazo_google_oauth_tokens", params.user_id, "refresh_token"),
+    });
+    const refresh_token_enc = JSON.stringify(refresh_enc);
+    let access_token_enc = null;
+    if (params.access_token) {
+        const access_enc = await encryptField(params.access_token, {
+            keys,
+            aad: aadFor("hazo_google_oauth_tokens", params.user_id, "access_token"),
+        });
+        access_token_enc = JSON.stringify(access_enc);
+    }
+    const adapter = get_hazo_connect_instance();
+    const service = createCrudService(adapter, "hazo_google_oauth_tokens");
+    const existing_rows = (await service.findBy({
+        user_id: params.user_id,
+        provider: "google",
+    }));
+    const now = new Date().toISOString();
+    if (existing_rows.length > 0) {
+        const existing = existing_rows[0];
+        await service.updateById(existing.id, {
+            refresh_token_enc,
+            access_token_enc,
+            scopes: params.scopes,
+            expires_at: (_a = params.expires_at) !== null && _a !== void 0 ? _a : null,
+            changed_at: now,
+        });
+        logger.info("google_token_service_token_updated", {
+            filename: "google_token_service.ts",
+            user_id: params.user_id,
+        });
+    }
+    else {
+        await service.insert({
+            id: randomUUID(),
+            user_id: params.user_id,
+            provider: "google",
+            refresh_token_enc,
+            access_token_enc,
+            scopes: params.scopes,
+            expires_at: (_b = params.expires_at) !== null && _b !== void 0 ? _b : null,
+            created_at: now,
+            changed_at: now,
+        });
+        logger.info("google_token_service_token_stored", {
+            filename: "google_token_service.ts",
+            user_id: params.user_id,
+        });
+    }
+}
+// section: get
+/**
+ * Returns a valid access token for the user, refreshing via Google if needed.
+ * Returns a typed error result instead of throwing for expected failure modes.
+ */
+export async function getGoogleToken(userId, opts) {
+    var _a, _b;
+    const logger = create_app_logger();
+    // Check in-memory cache first
+    const cached = access_token_cache.get(userId);
+    if (cached) {
+        const still_valid = new Date(cached.expires_at).getTime() - 60000 > Date.now();
+        if (still_valid) {
+            logger.info("google_token_service_cache_hit", {
+                filename: "google_token_service.ts",
+                user_id: userId,
+            });
+            // We need scopes from DB even on cache hit when scope check is requested
+            if (!((_a = opts === null || opts === void 0 ? void 0 : opts.scopes) === null || _a === void 0 ? void 0 : _a.length)) {
+                // No scope check needed — return cached token (scopes unknown from cache alone)
+                // Fall through to DB to get scopes for the result shape
+            }
+        }
+    }
+    const adapter = get_hazo_connect_instance();
+    const service = createCrudService(adapter, "hazo_google_oauth_tokens");
+    const rows = (await service.findBy({ user_id: userId, provider: "google" }));
+    if (rows.length === 0) {
+        return { ok: false, error: "not_connected" };
+    }
+    const row = rows[0];
+    // Scope check
+    if ((_b = opts === null || opts === void 0 ? void 0 : opts.scopes) === null || _b === void 0 ? void 0 : _b.length) {
+        const stored_scopes = row.scopes.split(" ").filter(Boolean);
+        const missing = opts.scopes.some((s) => !stored_scopes.includes(s));
+        if (missing) {
+            return { ok: false, error: "reconsent_required" };
+        }
+    }
+    // Return cached token now that we have the row (scope check passed)
+    if (cached) {
+        const still_valid = new Date(cached.expires_at).getTime() - 60000 > Date.now();
+        if (still_valid) {
+            return { ok: true, access_token: cached.token, scopes: row.scopes };
+        }
+    }
+    // Need to refresh — load crypto
+    let cryptoModule;
+    try {
+        cryptoModule = await load_crypto_module();
+    }
+    catch (_c) {
+        return { ok: false, error: "unconfigured" };
+    }
+    const { decryptField, aadFor, LookupKeyProvider } = cryptoModule;
+    const keys = makeKeyProvider(LookupKeyProvider);
+    let decrypted_refresh;
+    try {
+        decrypted_refresh = await decryptField(JSON.parse(row.refresh_token_enc), {
+            keys,
+            aad: aadFor("hazo_google_oauth_tokens", userId, "refresh_token"),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.error("google_token_service_decrypt_failed", {
+            filename: "google_token_service.ts",
+            user_id: userId,
+            error: msg,
+        });
+        return { ok: false, error: "refresh_failed" };
+    }
+    // Call Google token refresh endpoint
+    let resp;
+    try {
+        resp = await fetch("https://oauth2.googleapis.com/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                refresh_token: decrypted_refresh,
+                client_id: process.env.HAZO_AUTH_GOOGLE_CLIENT_ID,
+                client_secret: process.env.HAZO_AUTH_GOOGLE_CLIENT_SECRET,
+            }),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.error("google_token_service_refresh_fetch_failed", {
+            filename: "google_token_service.ts",
+            user_id: userId,
+            error: msg,
+        });
+        return { ok: false, error: "refresh_failed" };
+    }
+    if (!resp.ok) {
+        logger.warn("google_token_service_refresh_rejected", {
+            filename: "google_token_service.ts",
+            user_id: userId,
+            status: resp.status,
+        });
+        return { ok: false, error: "refresh_failed" };
+    }
+    const data = await resp.json();
+    // Persist new access token (encrypted)
+    const new_expires_at = new Date(Date.now() + data.expires_in * 1000).toISOString();
+    try {
+        const { encryptField } = cryptoModule;
+        const access_enc = await encryptField(data.access_token, {
+            keys,
+            aad: aadFor("hazo_google_oauth_tokens", userId, "access_token"),
+        });
+        const access_token_enc = JSON.stringify(access_enc);
+        await service.updateById(row.id, {
+            access_token_enc,
+            expires_at: new_expires_at,
+            changed_at: new Date().toISOString(),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.warn("google_token_service_persist_access_token_failed", {
+            filename: "google_token_service.ts",
+            user_id: userId,
+            error: msg,
+            note: "Access token refreshed successfully but could not be persisted",
+        });
+    }
+    // Update in-memory cache
+    access_token_cache.set(userId, { token: data.access_token, expires_at: new_expires_at });
+    logger.info("google_token_service_token_refreshed", {
+        filename: "google_token_service.ts",
+        user_id: userId,
+    });
+    return { ok: true, access_token: data.access_token, scopes: row.scopes };
+}
+// section: revoke
+/**
+ * Revokes the user's Google OAuth tokens — best-effort remote revocation, then deletes DB row.
+ */
+export async function revoke_google_oauth_token(userId) {
+    const logger = create_app_logger();
+    const adapter = get_hazo_connect_instance();
+    const service = createCrudService(adapter, "hazo_google_oauth_tokens");
+    const rows = (await service.findBy({ user_id: userId, provider: "google" }));
+    if (rows.length === 0) {
+        return { ok: false, error: "not_connected" };
+    }
+    const row = rows[0];
+    // Attempt remote revocation — best effort
+    try {
+        const { decryptField, aadFor, LookupKeyProvider } = await load_crypto_module();
+        const keys = makeKeyProvider(LookupKeyProvider);
+        const decrypted_refresh = await decryptField(JSON.parse(row.refresh_token_enc), {
+            keys,
+            aad: aadFor("hazo_google_oauth_tokens", userId, "refresh_token"),
+        });
+        const revoke_resp = await fetch(`https://oauth2.googleapis.com/revoke?token=${encodeURIComponent(decrypted_refresh)}`, { method: "POST" });
+        if (!revoke_resp.ok) {
+            logger.warn("google_token_service_revoke_remote_failed", {
+                filename: "google_token_service.ts",
+                user_id: userId,
+                status: revoke_resp.status,
+                note: "Google revocation returned non-OK status; proceeding to delete local record",
+            });
+        }
+        else {
+            logger.info("google_token_service_revoke_remote_ok", {
+                filename: "google_token_service.ts",
+                user_id: userId,
+            });
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.warn("google_token_service_revoke_remote_error", {
+            filename: "google_token_service.ts",
+            user_id: userId,
+            error: msg,
+            note: "Remote revocation failed; proceeding to delete local record",
+        });
+    }
+    // Always delete the local row
+    await service.deleteById(row.id);
+    access_token_cache.delete(userId);
+    logger.info("google_token_service_revoked", {
+        filename: "google_token_service.ts",
+        user_id: userId,
+    });
+    return { ok: true };
+}
+// section: status
+/**
+ * Returns connection status and scope information for a user's Google OAuth connection.
+ * Does not decrypt or refresh tokens.
+ */
+export async function get_google_token_status(userId) {
+    var _a;
+    const adapter = get_hazo_connect_instance();
+    const service = createCrudService(adapter, "hazo_google_oauth_tokens");
+    const rows = (await service.findBy({ user_id: userId, provider: "google" }));
+    if (rows.length === 0) {
+        return { connected: false, scopes: "", expires_at: null };
+    }
+    const row = rows[0];
+    return {
+        connected: true,
+        scopes: row.scopes,
+        expires_at: (_a = row.expires_at) !== null && _a !== void 0 ? _a : null,
+    };
+}

package/dist/lib/services/index.d.ts

@@ -18,4 +18,5 @@ export * from "./scope_service.js";
 export * from "./user_scope_service.js";
 export * from "./oauth_service.js";
 export * from "./branding_service.js";
+export * from "./google_token_service.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/services/index.ts"],"names":[],"mappings":"AAEA,cAAc,iBAAiB,CAAC;AAChC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/services/index.ts"],"names":[],"mappings":"AAEA,cAAc,iBAAiB,CAAC;AAChC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC"}

package/dist/lib/services/index.js

@@ -20,3 +20,4 @@ export * from "./scope_service.js";
 export * from "./user_scope_service.js";
 export * from "./oauth_service.js";
 export * from "./branding_service.js";
+export * from "./google_token_service.js";

package/dist/server/routes/google_token.d.ts

@@ -0,0 +1,13 @@
+import type { NextRequest } from "next/server";
+/**
+ * GET /api/hazo_auth/google/token
+ * Returns the current Google OAuth token status for the authenticated user.
+ */
+export declare function GET(request: NextRequest): Promise<Response>;
+/**
+ * DELETE /api/hazo_auth/google/token
+ * Revokes the stored Google OAuth token for the authenticated user.
+ * Does NOT sign the user out.
+ */
+export declare function DELETE(request: NextRequest): Promise<Response>;
+//# sourceMappingURL=google_token.d.ts.map

package/dist/server/routes/google_token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google_token.d.ts","sourceRoot":"","sources":["../../../src/server/routes/google_token.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS/C;;;GAGG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW,qBAuB7C;AAGD;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,WAAW,qBAuBhD"}