tokenzen 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f4dde7ef56bd6c8ed1d4b23b43f4256b17dfce96f9a0b8a0272e294db5fbf30
-  data.tar.gz: c8fbddcc5c83663e8635063fc67dd0d48b085166ce1c8b8f13f3f5c01266bbe5
+  metadata.gz: 82f6a97feb3cf2582a57f606802d2978ecb8b7e59a761f5ca11b243235ec2665
+  data.tar.gz: d4bce0dc31a14c18d299b1bbfa02841d0be1271174dff28c994e0e72e3385e5a
 SHA512:
-  metadata.gz: 13f223728ffc56a0609a1834b09c1e1bb4b5dc0d6d4a7a426a221d9d42bd316a52cea0135ef11d9430943057ae43ec67c2b5e8c98a624a624e3209e9b389100e
-  data.tar.gz: 4b38a201f3a87dd92e0c8c68d4eed112ff497f960c10cab5ebea806843e430b21d1c93f85247974649956bd8915701d1971c96ad442e9d461af19b928a367adb
+  metadata.gz: 45e06ea452280b363a8552d6498331f7281a754307eddf72231f67b3d0983a462593ba7ca8fcbf5a884a66eea092e938c620bf02e91b5c4d1341b63cf8ee6fa5
+  data.tar.gz: 47f09407cbea9d9ed77f82a9e2aedc39ecf959fc9ef956ee442476b3266a66d8eaa6c6951550fe7d70d4f0e71c4f5617f8be38b053a88da75c2953e591650181

data/README.md

@@ -1,57 +1,52 @@
 Tokenzen
 =======
 
-Tokenzen is a lightweight, model-agnostic token authentication toolkit for Rails.
+Tokenzen is a lightweight, session-based token authentication toolkit for Rails.
 
-It provides secure, polymorphic access token management for any ActiveRecord model — not just User.
+It provides secure, encrypted access + refresh token management for any ActiveRecord model — not just User.
 
 Tokenzen is designed to be:
     - Model agnostic
     - Multi-model compatible
+    - Multi-device aware
+    - Session-limited
+    - Secure refresh-rotation enabled
     - Cache-backed and scalable
-    - Configurable
     - Lightweight
     - Easy to integrate
 
 ========================================
 FEATURES
 =========
-
     - Works with any model (Admin, Customer, Account, etc.)
-    - Access and refresh token generation
-    - Token revocation (logout)
-    - Multi-device support
-    - Automatic token rotation on refresh token change
-    - Token validation
-    - Refresh access token using refresh token
+    - Access + Refresh token generation
+    - Secure refresh token rotation (replay-safe)
+    - Multi-device login support
+    - Configurable max session limit
+    - Automatic session revocation on password change
+    - Logout from all devices
+    - Token validation via class-level API
     - Configurable expiration
-    - AES-256 encryption of tokens
+    - AES-256-GCM encryption of tokens
     - Rails auto-loading via Railtie
 
 ========================================
 INSTALLATION
 ============
-
 Add this to your application's Gemfile:
-
     gem "tokenzen"
 
 Then run:
-
     bundle install
 
 Or install manually:
-
     gem install tokenzen
 
 ========================================
 BASIC USAGE
 ===========
-
 Include Tokenzen in any ActiveRecord model.
 
-Example:
-
     class Admin < ApplicationRecord
         include Tokenzen::Authenticatable
         tokenzen
@@ -67,42 +62,39 @@ You can use Tokenzen in multiple models at the same time:
 ========================================
 GENERATE ACCESS + REFRESH TOKEN
 ===============================
-
     admin = Admin.first
     tokens = admin.generate_tokens
-    # tokens => { access_token: "...", refresh_token: "..." }
+        # tokens => { access_token: "...", refresh_token: "..." }
 
-This generates secure encrypted tokens and stores them in cache with separate expiries.
+This:
+    - Creates a new session
+    - Enforces max session limit
+    - Stores tokens in cache
+    - Encrypts them using AES-256
+    - Returns encrypted tokens
 
 ========================================
-LOGIN / VALIDATE TOKENS
+AUTHENTICATE ACCESS TOKEN
 =======================
-
-Use the class-level `login` method to validate a token pair:
-
-    record = Admin.login(tokens[:access_token], tokens[:refresh_token])
-    # returns Admin instance if valid, nil if invalid
-
 You can also validate token pair from an instance:
 
-    valid = admin.validate_tokens(tokens[:access_token])
-    # => ActiveRecord or nil
+    admin = Admin.validate_token(access_token)
+        # => Admin record or nil
 
 ========================================
-REFRESH ACCESS TOKEN
+REFRESH / ROTATE TOKENS
 ====================
-
 Use the refresh token to generate a new access token:
 
-    new_tokens = Admin.refresh_access(tokens[:refresh_token])
-    # returns { access_token: "...", refresh_token: "..." }
+    new_tokens = Admin.rotate_tokens(refresh_token)
+        # returns { access_token: "...", refresh_token: "..." }
 
 ========================================
 LOGOUT / CLEAR ALL TOKENS
 =========================
-
-    admin.logout
-    # clears all access and refresh tokens for this record
+    admin.logout(access_token)-> delete current session
+    admin.logout_all
+     # clears all access and refresh tokens for this record
 
 ========================================
 CONFIGURATION
@@ -115,6 +107,7 @@ Create an initializer:
     Tokenzen.configure do |config|
         config.access_token_expiry  = 2.days
         config.refresh_token_expiry = 2.months
+        config.max_sessions         = 3
         config.secret_key           = ENV["TOKENZEN_SECRET_KEY"] || Rails.application.secret_key_base
     end
 
@@ -123,44 +116,42 @@ The gem automatically encrypts all tokens using AES-256 with this secret key.
 ========================================
 HOW IT WORKS
 =============
-
-When a token is issued:
-
-    - A secure random key is generated for access and refresh tokens.
-    - Tokens are stored in cache along with model name and record ID.
-    - Tokens are encrypted using AES-256.
-    - Tokens are tracked per record for easy revocation.
+When a user logs in:
+    - A new session_id is created.
+    - Secure random keys are generated for access + refresh tokens.
+    - Tokens are stored in cache (Redis recommended).
+    - Tokens are encrypted using AES-256-GCM.
+    - Sessions are tracked per model record.
+    - Oldest session is removed if max_sessions limit is reached.
 
 Stored payload example:
 
     {
         "model" => "Admin",
         "id"    => 1,
-        "type"  => "access"   # or "refresh"
+        "type"  => "access"   # or "refresh",
+        "session_id" => "uuid"
     }
 
 This allows Tokenzen to work with any ActiveRecord model automatically.
 
 ========================================
-TOKEN ROTATION
+SESSION MANAGEMENT
 ===============
+Tokenzen supports:
+    - Multiple devices per user
+    - Configurable max session limit
+    - Automatic removal of oldest session when limit exceeded
+    - Full session revocation
 
-If your model includes:
-
-    - refresh_token
-    - password_digest
-
-Tokenzen will automatically:
-
-    - Rotate the refresh token when password changes
-    - Clear all access tokens when refresh token changes
+Example:
+If max_sessions = 3
 
-This behavior is optional and safely guarded.
+Logging in from 4th device will revoke the oldest session.
 
 ========================================
 PRODUCTION RECOMMENDATION
 ==========================
-
 Use Redis as your cache store for production environments:
 
     config.cache_store = :redis_cache_store, { url: ENV["REDIS_URL"] }
@@ -178,27 +169,28 @@ REQUIREMENTS
 ========================================
 SECURITY NOTES
 ================
-
-    - Tokens are encrypted using AES-256
-    - Tokens are stored in cache (Redis recommended)
-    - Tokens are namespaced per model
-    - Clearing tokens invalidates all sessions instantly
+    - Tokens encrypted using AES-256-GCM
+    - Refresh tokens rotate on use
+    - Old refresh tokens invalidated immediately
+    - Sessions revocable instantly
+    - No tokens stored in database
+    - No fingerprint/device binding required
+    - Replay attack resistant refresh flow
 
 ========================================
 ROADMAP
 ========
-
-    - Controller helpers (current_resource)
+    - Per-device logout
+    - Session listing API
+    - Sliding expiration
+    - Controller helpers
     - Rack middleware
-    - Stateless JWT mode
-    - Device/session tracking
-    - Revokable single-session tokens
-    - OAuth support
+    - Optional JWT mode
+    - OAuth compatibility layer
 
 ========================================
 CONTRIBUTING
 ==============
-
 Bug reports and pull requests are welcome at:
 
     https://github.com/stndrk/tokenzen

data/lib/tokenzen/authenticatable.rb

@@ -2,92 +2,133 @@
 
 module Tokenzen
   module Authenticatable
-    def self.included(base)
-      base.extend(ClassMethods)
+    extend ActiveSupport::Concern
+
+    # ============================================================
+    # CALLBACKS
+    # ============================================================
+    included do
+      after_commit :_tokenzen_revoke_on_password_change, on: :update
+      after_commit :_tokenzen_revoke_all_on_destroy, on: :destroy
     end
 
-    module ClassMethods
-      def tokenzen(options = {})
-        include Tokenzen::Authenticatable::InstanceMethods
+    # ============================================================
+    # CLASS METHODS
+    # ============================================================
+    class_methods do
 
-        class_attribute :tokenzen_options
-        self.tokenzen_options = options
-
-        before_save :_tokenzen_rotate_refresh_token
-        around_save :_tokenzen_handle_refresh_rotation
-        after_destroy :_tokenzen_clear_tokens
+      # Enable token features in model
+      def tokenzen
+        include InstanceMethods unless included_modules.include?(InstanceMethods)
       end
-    end
 
-    module InstanceMethods
-      attr_reader :current_access_token, :current_refresh_token
+      # -------------------------------
+      # VALIDATE ACCESS TOKEN
+      # -------------------------------
+      def validate_token(access_token)
+        return if access_token.blank?
 
-      # Generate access + refresh token
-      def generate_tokens(access_expiry: nil, refresh_expiry: nil)
-        tokens = TokenStore.issue_tokens(self, access_expiry: access_expiry, refresh_expiry: refresh_expiry)
-        @current_access_token = tokens[:access_token]
-        @current_refresh_token = tokens[:refresh_token]
-        tokens
+        TokenStore.authenticate(access_token)
+      rescue
+        nil
       end
 
-      # Logout: clear all tokens
-      def logout
-        clear_all_access_tokens
-      end
+      # -------------------------------
+      # ROTATE REFRESH TOKEN
+      # -------------------------------
+      def rotate_tokens(refresh_token)
+        return if refresh_token.blank?
 
-      # Clear all tokens
-      def clear_all_access_tokens
-        TokenStore.clear_tokens(self)
-        @current_access_token = nil
-        @current_refresh_token = nil
+        TokenStore.renew_tokens(refresh_token)
+      rescue
+        nil
       end
 
-      # Validate tokens for this record
-      def validate_tokens(access_token)
-        TokenStore.fetch_record_from_access(access_token)
+      # -------------------------------
+      # LOGOUT CURRENT SESSION
+      # -------------------------------
+      def logout(access_token)
+        return if access_token.blank?
+
+        TokenStore.revoke_current_session(access_token)
+      rescue
+        nil
       end
+    end
 
-      # =============================
-      # Class-level login using token pair
-      # =============================
-      #
-      # Returns the record if tokens valid, else nil
-      #
-      def self.login(access_token, refresh_token = nil)
-        record = TokenStore.fetch_record_from_access(access_token)
-        return nil unless record
-
-        if refresh_token
-          refresh_record = TokenStore.fetch_record_from_refresh(refresh_token)
-          return nil unless refresh_record == record
-        end
+    # ============================================================
+    # INSTANCE METHODS
+    # ============================================================
+    module InstanceMethods
 
-        record
+      attr_reader :current_access_token, :current_refresh_token
+
+      # -------------------------------
+      # LOGIN / ISSUE TOKENS
+      # -------------------------------
+      def generate_tokens
+        raise "Record must be persisted" unless persisted?
+
+        tokens = TokenStore.issue_tokens(self)
+
+        assign_tokens(tokens) if tokens.present?
+
+        tokens
+      rescue
+        nil
       end
 
-      # Refresh access token using refresh token
-      def self.refresh_access(refresh_token)
-        TokenStore.refresh_access_token(refresh_token)
+      # -------------------------------
+      # LOGOUT ALL DEVICES
+      # -------------------------------
+      def logout_all
+        return unless persisted?
+
+        TokenStore.revoke_all(self)
+      rescue
+        nil
       end
 
       private
 
-      def _tokenzen_rotate_refresh_token
-        return unless respond_to?(:password_digest_changed?) && password_digest_changed?
-        self.refresh_token = JwtProcessor.encode(model: self.class.name, id: id) if respond_to?(:refresh_token=)
+      # ============================================================
+      # PASSWORD CHANGE DETECTION
+      # ============================================================
+      def _tokenzen_revoke_on_password_change
+        return unless _password_changed?
+
+        TokenStore.revoke_all(self)
+      rescue
+        nil
       end
 
-      def _tokenzen_handle_refresh_rotation
-        changed = respond_to?(:refresh_token_changed?) && refresh_token_changed?
-        yield
-        return unless changed
-        clear_all_access_tokens
-        generate_tokens
+      # Support both has_secure_password and custom columns
+      def _password_changed?
+        if respond_to?(:saved_change_to_password_digest?)
+          saved_change_to_password_digest?
+        elsif respond_to?(:saved_change_to_encrypted_password?)
+          saved_change_to_encrypted_password?
+        else
+          false
+        end
       end
 
-      def _tokenzen_clear_tokens
-        clear_all_access_tokens
+      # ============================================================
+      # DESTROY CALLBACK
+      # ============================================================
+      def _tokenzen_revoke_all_on_destroy
+        TokenStore.revoke_all(self)
+      rescue
+        nil
+      end
+
+      # ============================================================
+      # ASSIGN TOKENS TO INSTANCE
+      # ============================================================
+      def assign_tokens(tokens)
+        @current_access_token  = tokens[:access_token]
+        @current_refresh_token = tokens[:refresh_token]
       end
     end
   end
-end
+end

data/lib/tokenzen/configuration.rb

@@ -1,52 +1,80 @@
 # frozen_string_literal: true
 
-require "active_support"
-require "active_support/message_encryptor"
-require "active_support/key_generator"
+require "openssl"
+require "base64"
+require "digest"
 
 module Tokenzen
   class Configuration
-    attr_accessor :cache_store,
-                  :access_token_expiry,
-                  :refresh_token_expiry,
-                  :secret_key
+    class << self
+      attr_accessor :cache_store,
+                    :access_token_expiry,
+                    :refresh_token_expiry,
+                    :secret_key,
+                    :max_sessions
 
-    def initialize
-      @cache_store = Rails.cache
-      @access_token_expiry = 2.days
-      @refresh_token_expiry = 2.months
+      # ================================
+      # Default Setup
+      # ================================
+      def setup!
+        @cache_store ||= defined?(Rails) ? Rails.cache : {}
+        @access_token_expiry ||= 172800      # 2 days in seconds
+        @refresh_token_expiry ||= 5_184_000    # 60 days
+        @max_sessions = 3
+        @secret_key ||= default_secret_key
+      end
 
-      @secret_key = default_secret_key
-    end
+      # ================================
+      # AES-256-GCM Encryption
+      # ================================
+      def encrypt(value)
+        setup!
 
-    # Public encrypt method
-    def encrypt(value)
-      message_encryptor.encrypt_and_sign(value)
-    end
+        cipher = OpenSSL::Cipher.new("aes-256-gcm")
+        cipher.encrypt
+        cipher.key = derived_key
+        iv = cipher.random_iv
 
-    # Public decrypt method
-    def decrypt(value)
-      message_encryptor.decrypt_and_verify(value)
-    end
+        encrypted = cipher.update(value.to_s) + cipher.final
+        tag = cipher.auth_tag
+
+        Base64.strict_encode64(iv + tag + encrypted)
+      end
 
-    private
+      def decrypt(value)
+        setup!
 
-    def message_encryptor
-      @message_encryptor ||= begin
-        key_len = ActiveSupport::MessageEncryptor.key_len
-        generator = ActiveSupport::KeyGenerator.new(@secret_key)
-        key = generator.generate_key("tokenzen", key_len)
+        decoded = Base64.strict_decode64(value)
 
-        ActiveSupport::MessageEncryptor.new(key)
+        iv        = decoded[0..11]
+        tag       = decoded[12..27]
+        encrypted = decoded[28..-1]
+
+        cipher = OpenSSL::Cipher.new("aes-256-gcm")
+        cipher.decrypt
+        cipher.key = derived_key
+        cipher.iv  = iv
+        cipher.auth_tag = tag
+
+        cipher.update(encrypted) + cipher.final
+      rescue OpenSSL::Cipher::CipherError, ArgumentError
+        nil
+      end
+
+      private
+
+      def derived_key
+        Digest::SHA256.digest(secret_key)
       end
-    end
 
-    def default_secret_key
-      if defined?(Rails) && Rails.application.respond_to?(:secret_key_base)
-        Rails.application.secret_key_base
-      else
-        ENV["TOKENZEN_SECRET_KEY"] || raise("TOKENZEN_SECRET_KEY not set in ENV and Rails.secret_key_base not found")
+      def default_secret_key
+        if defined?(Rails) && Rails.application.respond_to?(:secret_key_base)
+          Rails.application.secret_key_base
+        else
+          ENV["TOKENZEN_SECRET_KEY"] ||
+            raise("TOKENZEN_SECRET_KEY not set and Rails.secret_key_base not found")
+        end
       end
     end
   end
-end
+end

data/lib/tokenzen/token_store.rb

@@ -1,102 +1,282 @@
 # frozen_string_literal: true
 
+require "securerandom"
+
 module Tokenzen
   class TokenStore
     class << self
 
-      # Generate both tokens and store in cache
-      def issue_tokens(record, access_expiry: nil, refresh_expiry: nil)
-        access_expiry ||= Tokenzen.configuration.access_token_expiry
-        refresh_expiry ||= Tokenzen.configuration.refresh_token_expiry
+      # ============================================================
+      # ISSUE TOKENS (LOGIN / NEW DEVICE SESSION)
+      # ============================================================
+      def issue_tokens(record)
+        raise ArgumentError, "Record must be persisted" unless record&.id
 
-        access_key = SecureRandom.hex(32)
-        refresh_key = SecureRandom.hex(32)
+        enforce_session_limit(record)
 
-        access_payload = {
-          "model" => record.class.name,
-          "id" => record.id,
-          "type" => "access"
-        }
+        session_id = SecureRandom.uuid
 
-        refresh_payload = {
-          "model" => record.class.name,
-          "id" => record.id,
-          "type" => "refresh"
-        }
+        access_raw  = SecureRandom.hex(64)
+        refresh_raw = SecureRandom.hex(64)
+
+        access_payload  = build_payload(record, session_id, "access")
+        refresh_payload = build_payload(record, session_id, "refresh")
 
-        cache.write(access_key, access_payload, expires_in: access_expiry)
-        cache.write(refresh_key, refresh_payload, expires_in: refresh_expiry)
+        write_token(access_raw, access_payload, config.access_token_expiry)
+        write_token(refresh_raw, refresh_payload, config.refresh_token_expiry)
 
-        register_token(record, access_key)
-        register_token(record, refresh_key)
+        store_session_mapping(record, session_id, access_raw, refresh_raw)
+
+        register_session(record, session_id)
 
         {
-          access_token: encrypt(access_key),
-          refresh_token: encrypt(refresh_key)
+          access_token:  encrypt(access_raw),
+          refresh_token: encrypt(refresh_raw)
         }
       end
 
-      # Fetch record using access token
-      def fetch_record_from_access(token)
-        raw_key = decrypt(token)
-        payload = cache.read(raw_key)
-        return nil unless payload && payload["type"] == "access"
+      # ============================================================
+      # AUTHENTICATE ACCESS TOKEN
+      # ============================================================
+      def authenticate(encrypted_token)
+        raw = safe_decrypt(encrypted_token)
+        return unless raw
 
-        payload["model"].constantize.find_by(id: payload["id"])
+        payload = safe_read(raw)
+        return unless valid_payload?(payload, "access")
+
+        record = safe_find_record(payload)
+        return unless record
+
+        # ensure session still valid
+        return unless session_exists?(record, payload["session_id"])
+
+        record
       end
 
-      # Fetch record using refresh token
-      def fetch_record_from_refresh(token)
-        raw_key = decrypt(token)
-        payload = cache.read(raw_key)
-        return nil unless payload && payload["type"] == "refresh"
+      # ============================================================
+      # REFRESH TOKEN (ROTATION)
+      # ============================================================
+      def renew_tokens(encrypted_refresh_token)
+        raw = safe_decrypt(encrypted_refresh_token)
+        return unless raw
 
-        payload["model"].constantize.find_by(id: payload["id"])
+        payload = safe_read(raw)
+        return unless valid_payload?(payload, "refresh")
+
+        record = safe_find_record(payload)
+        return unless record
+
+        session_id = payload["session_id"]
+
+        return unless session_exists?(record, session_id)
+
+        # delete old refresh token immediately (rotation)
+        cache.delete(raw)
+
+        revoke_session(record, session_id)
+
+        issue_tokens(record)
       end
 
-      # Refresh access token using refresh token
-      def refresh_access_token(refresh_token)
-        record = fetch_record_from_refresh(refresh_token)
+      # ============================================================
+      # LOGOUT CURRENT SESSION (THIS DEVICE ONLY)
+      # ============================================================
+      def revoke_current_session(encrypted_access_token)
+        raw = safe_decrypt(encrypted_access_token)
+        return unless raw
+
+        payload = safe_read(raw)
+        return unless valid_payload?(payload, "access")
+
+        record = safe_find_record(payload)
         return unless record
 
-        tokens = issue_tokens(record)
-        clear_tokens(record) # clear old tokens
-        tokens
+        revoke_session(record, payload["session_id"])
       end
 
-      # Clear all tokens for a record
-      def clear_tokens(record)
-        tokens_for(record).each { |key| cache.delete(key) }
-        cache.write(register_key(record), [], expires_in: Tokenzen.configuration.refresh_token_expiry)
+      # ============================================================
+      # LOGOUT ALL SESSIONS
+      # ============================================================
+      def revoke_all(record)
+        return unless record&.id
+
+        sessions(record).dup.each do |session_id|
+          revoke_session(record, session_id)
+        end
+
+        cache.delete(user_key(record))
       end
 
+      # ============================================================
+      # PRIVATE
+      # ============================================================
       private
 
-      def register_token(record, raw_key)
-        list = tokens_for(record)
-        list << raw_key
-        cache.write(register_key(record), list, expires_in: Tokenzen.configuration.refresh_token_expiry)
+      # -------------------------------
+      # TOKEN WRITE
+      # -------------------------------
+      def write_token(raw_key, payload, expiry)
+        cache.write(raw_key, payload, expires_in: expiry)
+      rescue => _e
+        nil
+      end
+
+      # -------------------------------
+      # BUILD PAYLOAD
+      # -------------------------------
+      def build_payload(record, session_id, type)
+        {
+          "model"      => record.class.name,
+          "id"         => record.id,
+          "type"       => type,
+          "session_id" => session_id
+        }
+      end
+
+      # -------------------------------
+      # SAFE CACHE READ
+      # -------------------------------
+      def safe_read(key)
+        cache.read(key)
+      rescue
+        nil
+      end
+
+      # -------------------------------
+      # SAFE DECRYPT
+      # -------------------------------
+      def safe_decrypt(token)
+        decrypt(token)
+      rescue
+        nil
+      end
+
+      # -------------------------------
+      # VALIDATE PAYLOAD
+      # -------------------------------
+      def valid_payload?(payload, expected_type)
+        payload &&
+          payload["type"] == expected_type &&
+          payload["model"].present? &&
+          payload["id"].present? &&
+          payload["session_id"].present?
+      end
+
+      # -------------------------------
+      # SAFE FIND RECORD
+      # -------------------------------
+      def safe_find_record(payload)
+        payload["model"].constantize.find_by(id: payload["id"])
+      rescue
+        nil
+      end
+
+      # -------------------------------
+      # SESSION LIMIT ENFORCEMENT
+      # -------------------------------
+      def enforce_session_limit(record)
+        list = sessions(record)
+
+        return if list.size < config.max_sessions
+
+        oldest = list.first
+        revoke_session(record, oldest)
+      end
+
+      # -------------------------------
+      # REGISTER SESSION
+      # -------------------------------
+      def register_session(record, session_id)
+        list = sessions(record)
+        list << session_id
+
+        cache.write(
+          user_key(record),
+          list,
+          expires_in: config.refresh_token_expiry
+        )
+      rescue
+        nil
+      end
+
+      # -------------------------------
+      # STORE SESSION TOKEN MAPPING
+      # -------------------------------
+      def store_session_mapping(record, session_id, access_raw, refresh_raw)
+        cache.write(
+          session_token_key(record, session_id),
+          { access: access_raw, refresh: refresh_raw },
+          expires_in: config.refresh_token_expiry
+        )
+      rescue
+        nil
+      end
+
+      # -------------------------------
+      # REVOKE ONE SESSION
+      # -------------------------------
+      def revoke_session(record, session_id)
+        session_data = cache.read(session_token_key(record, session_id))
+        return unless session_data
+
+        cache.delete(session_data[:access])
+        cache.delete(session_data[:refresh])
+        cache.delete(session_token_key(record, session_id))
+
+        list = sessions(record)
+        list.delete(session_id)
+
+        cache.write(user_key(record), list)
+      rescue
+        nil
+      end
+
+      # -------------------------------
+      # CHECK SESSION EXISTS
+      # -------------------------------
+      def session_exists?(record, session_id)
+        sessions(record).include?(session_id)
+      end
+
+      # -------------------------------
+      # FETCH SESSIONS
+      # -------------------------------
+      def sessions(record)
+        cache.read(user_key(record)) || []
+      rescue
+        []
+      end
+
+      # -------------------------------
+      # CACHE KEYS
+      # -------------------------------
+      def user_key(record)
+        "tokenzen:#{record.class.name}:#{record.id}:sessions"
       end
 
-      def tokens_for(record)
-        cache.read(register_key(record)) || []
+      def session_token_key(record, session_id)
+        "tokenzen:#{record.class.name}:#{record.id}:#{session_id}"
       end
 
-      def register_key(record)
-        "tokenzen:#{record.class.name}:#{record.id}:tokens"
+      # -------------------------------
+      # HELPERS
+      # -------------------------------
+      def config
+        Tokenzen.configuration
       end
 
       def cache
-        Tokenzen.configuration.cache_store
+        config.cache_store
       end
 
       def encrypt(value)
-        Tokenzen.configuration.encrypt(value)
+        config.encrypt(value)
       end
 
       def decrypt(value)
-        Tokenzen.configuration.decrypt(value)
+        config.decrypt(value)
       end
     end
   end
-end
+end

data/lib/tokenzen/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tokenzen
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tokenzen
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Satendra
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-02-16 00:00:00.000000000 Z
+date: 2026-02-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -52,7 +52,6 @@ files:
 - lib/tokenzen.rb
 - lib/tokenzen/authenticatable.rb
 - lib/tokenzen/configuration.rb
-- lib/tokenzen/model.rb
 - lib/tokenzen/railtie.rb
 - lib/tokenzen/token_store.rb
 - lib/tokenzen/version.rb

data/lib/tokenzen/model.rb

@@ -1,46 +0,0 @@
-# frozen_string_literal: true
-
-module Tokenzen
-  module Model
-    extend ActiveSupport::Concern
-
-    included do
-      attr_reader :current_access_token
-
-      before_save :renew_refresh_token_on_password_change
-      around_save :handle_refresh_token_rotation
-      after_destroy :clear_all_access_tokens
-    end
-
-    # PUBLIC API
-    def generate_access_token
-      token = Tokenzen::TokenStore.write(id)
-      return unless token
-
-      Tokenzen::TokenStore.store_user_token(id, token)
-      @current_access_token = token
-    end
-
-    def clear_all_access_tokens
-      Tokenzen::TokenStore.clear_user_tokens(id)
-      @current_access_token = nil
-    end
-
-    private
-
-    def renew_refresh_token_on_password_change
-      return unless respond_to?(:password_digest_changed?) && password_digest_changed?
-
-      self.refresh_token = JwtProcessor.encode(id: id)
-    end
-
-    def handle_refresh_token_rotation
-      changed = respond_to?(:refresh_token_changed?) && refresh_token_changed?
-      yield
-      return unless changed
-
-      clear_all_access_tokens
-      generate_access_token
-    end
-  end
-end