@appweaver/core 1.5.0 → 1.6.0

package/prisma/client/models/OneTimeToken.d.ts

@@ -23,7 +23,6 @@ export type OneTimeTokenMinAggregateOutputType = {
     tokenHash: string | null;
     purpose: string | null;
     expiresAt: Date | null;
-    updatedAt: Date | null;
     createdAt: Date | null;
 };
 export type OneTimeTokenMaxAggregateOutputType = {
@@ -31,16 +30,14 @@ export type OneTimeTokenMaxAggregateOutputType = {
     tokenHash: string | null;
     purpose: string | null;
     expiresAt: Date | null;
-    updatedAt: Date | null;
     createdAt: Date | null;
 };
 export type OneTimeTokenCountAggregateOutputType = {
     id: number;
     tokenHash: number;
     purpose: number;
-    expiresAt: number;
     data: number;
-    updatedAt: number;
+    expiresAt: number;
     createdAt: number;
     _all: number;
 };
@@ -55,7 +52,6 @@ export type OneTimeTokenMinAggregateInputType = {
     tokenHash?: true;
     purpose?: true;
     expiresAt?: true;
-    updatedAt?: true;
     createdAt?: true;
 };
 export type OneTimeTokenMaxAggregateInputType = {
@@ -63,16 +59,14 @@ export type OneTimeTokenMaxAggregateInputType = {
     tokenHash?: true;
     purpose?: true;
     expiresAt?: true;
-    updatedAt?: true;
     createdAt?: true;
 };
 export type OneTimeTokenCountAggregateInputType = {
     id?: true;
     tokenHash?: true;
     purpose?: true;
-    expiresAt?: true;
     data?: true;
-    updatedAt?: true;
+    expiresAt?: true;
     createdAt?: true;
     _all?: true;
 };
@@ -156,9 +150,8 @@ export type OneTimeTokenGroupByOutputType = {
     id: number;
     tokenHash: string;
     purpose: string;
-    expiresAt: Date;
     data: runtime.JsonValue;
-    updatedAt: Date;
+    expiresAt: Date;
     createdAt: Date;
     _count: OneTimeTokenCountAggregateOutputType | null;
     _avg: OneTimeTokenAvgAggregateOutputType | null;
@@ -176,39 +169,35 @@ export type OneTimeTokenWhereInput = {
     id?: Prisma.IntFilter<"OneTimeToken"> | number;
     tokenHash?: Prisma.StringFilter<"OneTimeToken"> | string;
     purpose?: Prisma.StringFilter<"OneTimeToken"> | string;
-    expiresAt?: Prisma.DateTimeFilter<"OneTimeToken"> | Date | string;
     data?: Prisma.JsonFilter<"OneTimeToken">;
-    updatedAt?: Prisma.DateTimeFilter<"OneTimeToken"> | Date | string;
+    expiresAt?: Prisma.DateTimeFilter<"OneTimeToken"> | Date | string;
     createdAt?: Prisma.DateTimeFilter<"OneTimeToken"> | Date | string;
 };
 export type OneTimeTokenOrderByWithRelationInput = {
     id?: Prisma.SortOrder;
     tokenHash?: Prisma.SortOrder;
     purpose?: Prisma.SortOrder;
-    expiresAt?: Prisma.SortOrder;
     data?: Prisma.SortOrder;
-    updatedAt?: Prisma.SortOrder;
+    expiresAt?: Prisma.SortOrder;
     createdAt?: Prisma.SortOrder;
 };
 export type OneTimeTokenWhereUniqueInput = Prisma.AtLeast<{
     id?: number;
+    tokenHash?: string;
     AND?: Prisma.OneTimeTokenWhereInput | Prisma.OneTimeTokenWhereInput[];
     OR?: Prisma.OneTimeTokenWhereInput[];
     NOT?: Prisma.OneTimeTokenWhereInput | Prisma.OneTimeTokenWhereInput[];
-    tokenHash?: Prisma.StringFilter<"OneTimeToken"> | string;
     purpose?: Prisma.StringFilter<"OneTimeToken"> | string;
-    expiresAt?: Prisma.DateTimeFilter<"OneTimeToken"> | Date | string;
     data?: Prisma.JsonFilter<"OneTimeToken">;
-    updatedAt?: Prisma.DateTimeFilter<"OneTimeToken"> | Date | string;
+    expiresAt?: Prisma.DateTimeFilter<"OneTimeToken"> | Date | string;
     createdAt?: Prisma.DateTimeFilter<"OneTimeToken"> | Date | string;
-}, "id">;
+}, "id" | "tokenHash">;
 export type OneTimeTokenOrderByWithAggregationInput = {
     id?: Prisma.SortOrder;
     tokenHash?: Prisma.SortOrder;
     purpose?: Prisma.SortOrder;
-    expiresAt?: Prisma.SortOrder;
     data?: Prisma.SortOrder;
-    updatedAt?: Prisma.SortOrder;
+    expiresAt?: Prisma.SortOrder;
     createdAt?: Prisma.SortOrder;
     _count?: Prisma.OneTimeTokenCountOrderByAggregateInput;
     _avg?: Prisma.OneTimeTokenAvgOrderByAggregateInput;
@@ -223,78 +212,69 @@ export type OneTimeTokenScalarWhereWithAggregatesInput = {
     id?: Prisma.IntWithAggregatesFilter<"OneTimeToken"> | number;
     tokenHash?: Prisma.StringWithAggregatesFilter<"OneTimeToken"> | string;
     purpose?: Prisma.StringWithAggregatesFilter<"OneTimeToken"> | string;
-    expiresAt?: Prisma.DateTimeWithAggregatesFilter<"OneTimeToken"> | Date | string;
     data?: Prisma.JsonWithAggregatesFilter<"OneTimeToken">;
-    updatedAt?: Prisma.DateTimeWithAggregatesFilter<"OneTimeToken"> | Date | string;
+    expiresAt?: Prisma.DateTimeWithAggregatesFilter<"OneTimeToken"> | Date | string;
     createdAt?: Prisma.DateTimeWithAggregatesFilter<"OneTimeToken"> | Date | string;
 };
 export type OneTimeTokenCreateInput = {
     tokenHash: string;
     purpose: string;
-    expiresAt: Date | string;
     data: Prisma.JsonNullValueInput | runtime.InputJsonValue;
-    updatedAt?: Date | string;
+    expiresAt: Date | string;
     createdAt?: Date | string;
 };
 export type OneTimeTokenUncheckedCreateInput = {
     id?: number;
     tokenHash: string;
     purpose: string;
-    expiresAt: Date | string;
     data: Prisma.JsonNullValueInput | runtime.InputJsonValue;
-    updatedAt?: Date | string;
+    expiresAt: Date | string;
     createdAt?: Date | string;
 };
 export type OneTimeTokenUpdateInput = {
     tokenHash?: Prisma.StringFieldUpdateOperationsInput | string;
     purpose?: Prisma.StringFieldUpdateOperationsInput | string;
-    expiresAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     data?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
-    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    expiresAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
 };
 export type OneTimeTokenUncheckedUpdateInput = {
     id?: Prisma.IntFieldUpdateOperationsInput | number;
     tokenHash?: Prisma.StringFieldUpdateOperationsInput | string;
     purpose?: Prisma.StringFieldUpdateOperationsInput | string;
-    expiresAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     data?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
-    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    expiresAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
 };
 export type OneTimeTokenCreateManyInput = {
     id?: number;
     tokenHash: string;
     purpose: string;
-    expiresAt: Date | string;
     data: Prisma.JsonNullValueInput | runtime.InputJsonValue;
-    updatedAt?: Date | string;
+    expiresAt: Date | string;
     createdAt?: Date | string;
 };
 export type OneTimeTokenUpdateManyMutationInput = {
     tokenHash?: Prisma.StringFieldUpdateOperationsInput | string;
     purpose?: Prisma.StringFieldUpdateOperationsInput | string;
-    expiresAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     data?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
-    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    expiresAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
 };
 export type OneTimeTokenUncheckedUpdateManyInput = {
     id?: Prisma.IntFieldUpdateOperationsInput | number;
     tokenHash?: Prisma.StringFieldUpdateOperationsInput | string;
     purpose?: Prisma.StringFieldUpdateOperationsInput | string;
-    expiresAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     data?: Prisma.JsonNullValueInput | runtime.InputJsonValue;
-    updatedAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
+    expiresAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
     createdAt?: Prisma.DateTimeFieldUpdateOperationsInput | Date | string;
 };
 export type OneTimeTokenCountOrderByAggregateInput = {
     id?: Prisma.SortOrder;
     tokenHash?: Prisma.SortOrder;
     purpose?: Prisma.SortOrder;
-    expiresAt?: Prisma.SortOrder;
     data?: Prisma.SortOrder;
-    updatedAt?: Prisma.SortOrder;
+    expiresAt?: Prisma.SortOrder;
     createdAt?: Prisma.SortOrder;
 };
 export type OneTimeTokenAvgOrderByAggregateInput = {
@@ -305,7 +285,6 @@ export type OneTimeTokenMaxOrderByAggregateInput = {
     tokenHash?: Prisma.SortOrder;
     purpose?: Prisma.SortOrder;
     expiresAt?: Prisma.SortOrder;
-    updatedAt?: Prisma.SortOrder;
     createdAt?: Prisma.SortOrder;
 };
 export type OneTimeTokenMinOrderByAggregateInput = {
@@ -313,7 +292,6 @@ export type OneTimeTokenMinOrderByAggregateInput = {
     tokenHash?: Prisma.SortOrder;
     purpose?: Prisma.SortOrder;
     expiresAt?: Prisma.SortOrder;
-    updatedAt?: Prisma.SortOrder;
     createdAt?: Prisma.SortOrder;
 };
 export type OneTimeTokenSumOrderByAggregateInput = {
@@ -323,39 +301,35 @@ export type OneTimeTokenSelect<ExtArgs extends runtime.Types.Extensions.Internal
     id?: boolean;
     tokenHash?: boolean;
     purpose?: boolean;
-    expiresAt?: boolean;
     data?: boolean;
-    updatedAt?: boolean;
+    expiresAt?: boolean;
     createdAt?: boolean;
 }, ExtArgs["result"]["oneTimeToken"]>;
 export type OneTimeTokenSelectCreateManyAndReturn<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = runtime.Types.Extensions.GetSelect<{
     id?: boolean;
     tokenHash?: boolean;
     purpose?: boolean;
-    expiresAt?: boolean;
     data?: boolean;
-    updatedAt?: boolean;
+    expiresAt?: boolean;
     createdAt?: boolean;
 }, ExtArgs["result"]["oneTimeToken"]>;
 export type OneTimeTokenSelectUpdateManyAndReturn<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = runtime.Types.Extensions.GetSelect<{
     id?: boolean;
     tokenHash?: boolean;
     purpose?: boolean;
-    expiresAt?: boolean;
     data?: boolean;
-    updatedAt?: boolean;
+    expiresAt?: boolean;
     createdAt?: boolean;
 }, ExtArgs["result"]["oneTimeToken"]>;
 export type OneTimeTokenSelectScalar = {
     id?: boolean;
     tokenHash?: boolean;
     purpose?: boolean;
-    expiresAt?: boolean;
     data?: boolean;
-    updatedAt?: boolean;
+    expiresAt?: boolean;
     createdAt?: boolean;
 };
-export type OneTimeTokenOmit<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = runtime.Types.Extensions.GetOmit<"id" | "tokenHash" | "purpose" | "expiresAt" | "data" | "updatedAt" | "createdAt", ExtArgs["result"]["oneTimeToken"]>;
+export type OneTimeTokenOmit<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = runtime.Types.Extensions.GetOmit<"id" | "tokenHash" | "purpose" | "data" | "expiresAt" | "createdAt", ExtArgs["result"]["oneTimeToken"]>;
 export type $OneTimeTokenPayload<ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = {
     name: "OneTimeToken";
     objects: {};
@@ -363,12 +337,11 @@ export type $OneTimeTokenPayload<ExtArgs extends runtime.Types.Extensions.Intern
         id: number;
         tokenHash: string;
         purpose: string;
-        expiresAt: Date;
         data: runtime.JsonValue;
+        expiresAt: Date;
         /**
          * Audit columns
          */
-        updatedAt: Date;
         createdAt: Date;
     }, ExtArgs["result"]["oneTimeToken"]>;
     composites: {};
@@ -727,9 +700,8 @@ export interface OneTimeTokenFieldRefs {
     readonly id: Prisma.FieldRef<"OneTimeToken", 'Int'>;
     readonly tokenHash: Prisma.FieldRef<"OneTimeToken", 'String'>;
     readonly purpose: Prisma.FieldRef<"OneTimeToken", 'String'>;
-    readonly expiresAt: Prisma.FieldRef<"OneTimeToken", 'DateTime'>;
     readonly data: Prisma.FieldRef<"OneTimeToken", 'Json'>;
-    readonly updatedAt: Prisma.FieldRef<"OneTimeToken", 'DateTime'>;
+    readonly expiresAt: Prisma.FieldRef<"OneTimeToken", 'DateTime'>;
     readonly createdAt: Prisma.FieldRef<"OneTimeToken", 'DateTime'>;
 }
 /**

package/queue/bull-queue.js

@@ -7,8 +7,11 @@ const context_1 = require("../context");
 class BullQueue extends common_1.Queue {
     /** @internal */
     _queues = new Map();
+    /** @internal */
+    _healthCheckQueue;
     async onDestroy() {
         await this.closeAll();
+        await this._healthCheckQueue?.close();
     }
     get(name) {
         let processor = this._queues.get(name);
@@ -33,9 +36,10 @@ class BullQueue extends common_1.Queue {
         }
     }
     async checkHealth() {
+        // Reused, so an outage is logged once and not on every check
+        this._healthCheckQueue ??= new BullQueueProcessor('health-check');
         try {
-            const queue = new BullQueueProcessor('health-check');
-            await queue.close();
+            await this._healthCheckQueue.ensureConnected();
             return { success: true };
         }
         catch (e) {
@@ -47,9 +51,7 @@ exports.BullQueue = BullQueue;
 class BullQueueProcessor extends common_1.QueueProcessor {
     name;
     /** @internal */
-    _connection = (0, context_1.inject)(common_1.Redis).createClient({
-        maxRetriesPerRequest: null
-    });
+    _connection;
     /** @internal */
     _queue;
     /** @internal */
@@ -59,6 +61,10 @@ class BullQueueProcessor extends common_1.QueueProcessor {
     constructor(name) {
         super();
         this.name = name;
+        this._connection = (0, context_1.inject)(common_1.Redis).createClient({
+            connectionName: `queue:${name}`,
+            maxRetriesPerRequest: null
+        });
         this._queue = new bullmq_1.Queue(name, {
             connection: this._connection, // Needed because of different ioredis types
             skipVersionCheck: true,
@@ -78,11 +84,18 @@ class BullQueueProcessor extends common_1.QueueProcessor {
                 }
             }
         });
+        // Without a listener BullMQ prints every reconnection error, the outage
+        // itself is logged once by the Redis connection monitor
+        this._queue.on('error', (error) => {
+            common_1.logger.debug(error, `Queue '${name}' error`);
+        });
     }
     async sendJob(data, name, options = {}) {
+        await this.ensureConnected();
         return await this._queue.add(name ?? 'defaultJob', data, options);
     }
     async sendBulkJobs(jobs) {
+        await this.ensureConnected();
         return await this._queue.addBulk(jobs.map(({ data, name, options }) => ({
             data,
             name: name ?? 'defaultJob',
@@ -182,9 +195,43 @@ class BullQueueProcessor extends common_1.QueueProcessor {
         return true;
     }
     async close() {
+        const connected = this._connection.status === 'ready';
         await this._queue.close();
+        this.ignoreLateErrors(this._queue);
         for (const worker of this._workers) {
-            await worker.close();
+            // Running jobs cannot finish while Redis is down
+            await worker.close(!connected);
+            this.ignoreLateErrors(worker);
+        }
+        // BullMQ does not close a connection it was given
+        if (connected) {
+            await this._connection.quit();
+        }
+        else {
+            this._connection.disconnect();
+        }
+    }
+    /**
+     * Fails fast while Redis is down, the queue would otherwise wait for the
+     * reconnection. Waits only for a connection that is still being established.
+     *
+     * @internal
+     */
+    async ensureConnected() {
+        const connection = this._connection;
+        if (['wait', 'connecting', 'connect'].includes(connection.status)) {
+            await new Promise((resolve) => {
+                const done = () => {
+                    connection.off('ready', done);
+                    connection.off('error', done);
+                    resolve();
+                };
+                connection.once('ready', done);
+                connection.once('error', done);
+            });
+        }
+        if (connection.status !== 'ready') {
+            throw new Error(`Queue '${this.name}' is unavailable, Redis connection is not ready`);
         }
     }
     /** @internal */
@@ -204,4 +251,17 @@ class BullQueueProcessor extends common_1.QueueProcessor {
         }
         await Promise.allSettled(handlerActions);
     }
+    /**
+     * BullMQ removes the listeners of its connections on close, but one still
+     * connecting fails afterward and emits an unhandled error that crashes the
+     * process.
+     *
+     * @internal
+     */
+    ignoreLateErrors(target) {
+        const internal = target;
+        for (const key of ['connection', 'blockingConnection']) {
+            internal[key]?.on('error', () => undefined);
+        }
+    }
 }

package/security/auth-service.d.ts

@@ -1,6 +1,7 @@
 import { AuthScope, AuthSource, AuthUser, ResourceId, RouteConfig } from '@appweaver/common';
 import { AuthTokens, JwtPayload, UserAdditionalData } from '../types';
 export declare class AuthService {
+    constructor();
     /**
      * Finds an authenticated user by their unique identifier.
      *

package/security/auth-service.js

@@ -19,6 +19,15 @@ class AuthService {
     /** Optional, since an application with no OAuth2 provider never registers it.
      * @internal */
     _oauth2Service = (0, context_1.inject)(oauth2_service_1.OAuth2Service, false);
+    /** @internal */
+    _events = (0, context_1.inject)(common_1.Events);
+    constructor() {
+        // Evicts the users changed outside of this service as well, e.g. through
+        // the resource routes, regardless of the cache invalidation strategy
+        const modelName = this._authUserService.modelName;
+        this._events.onResourceEvent(modelName, 'update', ({ previous, current }) => this.evictCachedUsers(previous, current));
+        this._events.onResourceEvent(modelName, 'delete', ({ current }) => this.evictCachedUsers(current));
+    }
     /**
      * Finds an authenticated user by their unique identifier.
      *
@@ -31,10 +40,7 @@ class AuthService {
             if (!common_1.config.CACHE_ENABLED || common_1.config.SECURITY_CACHE_TTL < 0) {
                 return this._authUserService.find(id);
             }
-            const cacheKey = this._cacheService.buildCacheKey({
-                baseKey: `${AUTH_KEY}:${id}`,
-                modelName: this._authUserService.modelName
-            });
+            const cacheKey = this.authCacheKey(id);
             const value = await this._cacheService.getCachedValue(cacheKey);
             if (value) {
                 return value;
@@ -59,10 +65,7 @@ class AuthService {
                 const result = await this._authUserService.query({ email: username });
                 return result.items[0] ?? null;
             }
-            const cacheKey = this._cacheService.buildCacheKey({
-                baseKey: `${AUTH_KEY}:${username}`,
-                modelName: this._authUserService.modelName
-            });
+            const cacheKey = this.authCacheKey(username);
             const value = await this._cacheService.getCachedValue(cacheKey);
             if (value) {
                 return value;
@@ -87,12 +90,17 @@ class AuthService {
      * @return {Promise<AuthUser>} A promise that resolves to the updated authenticated user object.
      */
     async updateAuthUser(id, data) {
+        let authUser;
         try {
-            return await this._authUserService.update(id, data);
+            authUser = await this._authUserService.update(id, data);
         }
         catch (e) {
             throw new errors_1.HttpError('Auth user update error', 500, e);
         }
+        // Awaited unlike the update event eviction, so the next request, e.g. with
+        // a token revoked by a logout, cannot read the previous state
+        await this.evictCachedUsers(authUser);
+        return authUser;
     }
     /**
      * Registers a new authenticated user based on the provided authentication source, email, and optional password and
@@ -217,9 +225,12 @@ class AuthService {
     authorize(authUser, url, routeConfig = {}, jwtPayload) {
         if (!authUser ||
             !authUser.enabled ||
+            // `iat` has a whole second precision, so a token issued within the same
+            // second as the logout is still accepted
             (authUser.logoutAt &&
                 jwtPayload &&
-                new Date(authUser.logoutAt).getTime() > jwtPayload?.iat)) {
+                Math.floor(new Date(authUser.logoutAt).getTime() / 1000) >
+                    jwtPayload.iat)) {
             throw new errors_1.HttpError('Unauthorized access', 401);
         }
         if (jwtPayload && !(0, helper_1.checkScopeAccess)(url, jwtPayload.scope)) {
@@ -317,11 +328,11 @@ class AuthService {
             scope,
             source,
             username: authUser.email,
-            sub: authUser.id,
-            iat: new Date().getTime()
+            sub: authUser.id
         };
         const expiresIn = common_1.config.SECURITY_JWT_EXPIRES_IN;
         const refreshExpiresIn = common_1.config.SECURITY_JWT_REFRESH_EXPIRES_IN;
+        // The signer sets the `iat` claim, in seconds like the expiration
         const accessToken = server.jwt.sign(jwtPayload, { expiresIn });
         const refreshToken = server.jwt.sign({ ...jwtPayload, scope: common_1.AuthScope.Refresh }, { expiresIn: refreshExpiresIn });
         common_1.logger.debug({ id: authUser.id }, 'Access tokens generated');
@@ -335,9 +346,28 @@ class AuthService {
      * successful.
      */
     async logout(id) {
-        await this._cacheService.removeCachedValue(`${AUTH_KEY}:${id}`);
         common_1.logger.debug({ id }, 'User logout');
         return !!(await this.updateAuthUser(id, { logoutAt: new Date() }));
     }
+    /** @internal */
+    async evictCachedUsers(...authUsers) {
+        const keys = new Set();
+        for (const authUser of authUsers) {
+            if (authUser) {
+                keys.add(this.authCacheKey(authUser.id));
+                keys.add(this.authCacheKey(authUser.email));
+            }
+        }
+        for (const key of keys) {
+            await this._cacheService.removeCachedValue(key);
+        }
+    }
+    /** @internal */
+    authCacheKey(idOrUsername) {
+        return this._cacheService.buildCacheKey({
+            baseKey: `${AUTH_KEY}:${idOrUsername}`,
+            modelName: this._authUserService.modelName
+        });
+    }
 }
 exports.AuthService = AuthService;

package/security/resources/one-time-token/model.js

@@ -8,25 +8,29 @@ const shouldCreateModel = common_1.config.SECURITY_STORE_PROVIDER ===
 exports.default = shouldCreateModel
     ? (0, factory_1.createModel)({
         name: 'OneTimeToken',
+        // Tokens are only created and deleted, never updated
         audit: {
+            updatedAt: false,
             createdById: false
         },
         scalars: {
             tokenHash: {
                 type: 'string',
-                maxLength: 511
+                maxLength: 128,
+                unique: true
             },
             purpose: {
                 type: 'string',
-                maxLength: 255
-            },
-            expiresAt: {
-                type: 'dateTime'
+                maxLength: 64
             },
             data: {
                 type: 'json'
+            },
+            expiresAt: {
+                type: 'dateTime'
             }
         },
-        index: [['tokenHash', 'purpose']]
+        // Deleting the expired tokens filters by the expiration
+        index: [['expiresAt']]
     })
     : undefined;

package/security/store/database-security-store.js

@@ -9,44 +9,47 @@ class DatabaseSecurityStore extends common_1.SecurityStore {
     _db = (0, context_1.inject)(common_1.Database);
     async generateOneTimeToken(purpose, data, ttl) {
         const token = (0, common_1.generateToken)('bytes', 64);
-        await this._db.client().oneTimeToken.create({
+        const oneTimeTokens = this._db.client().oneTimeToken;
+        // Expired tokens are removed here, so they need no scheduled cleanup
+        await oneTimeTokens.deleteMany({
+            where: { expiresAt: { lt: new Date() } }
+        });
+        await oneTimeTokens.create({
             data: {
                 tokenHash: (0, common_1.makeHash)(token),
                 purpose,
-                expiresAt: new Date(Date.now() + ttl),
-                data: data
+                data: data,
+                expiresAt: new Date(Date.now() + ttl)
             }
         });
         return token;
     }
     async useOneTimeToken(token, purpose, validateContent) {
-        const oneTimeToken = await this._db.client().oneTimeToken.findFirst({
-            where: {
-                purpose,
-                tokenHash: (0, common_1.makeHash)(token)
-            }
+        const oneTimeTokens = this._db.client().oneTimeToken;
+        const oneTimeToken = await oneTimeTokens.findUnique({
+            where: { tokenHash: (0, common_1.makeHash)(token) }
         });
         if (oneTimeToken === null ||
+            oneTimeToken.purpose !== purpose ||
             oneTimeToken.expiresAt.getTime() < Date.now()) {
-            if (oneTimeToken) {
-                await this.removeOneTimeToken(oneTimeToken.id);
-            }
             throw new errors_1.HttpError('Invalid or expired token provided', 401);
         }
         const data = oneTimeToken.data;
+        // A token failing the validation is kept, so it can be used again
         if (validateContent) {
             const result = validateContent(data);
             if (!result.valid) {
                 throw new errors_1.HttpError(result.message, 401);
             }
         }
-        await this.removeOneTimeToken(oneTimeToken.id);
+        // Only the one of concurrent uses that removes the token gets its data
+        const { count } = await oneTimeTokens.deleteMany({
+            where: { id: oneTimeToken.id }
+        });
+        if (count === 0) {
+            throw new errors_1.HttpError('Invalid or expired token provided', 401);
+        }
         return data;
     }
-    /** @internal */
-    async removeOneTimeToken(id) {
-        // The generated client types the id after the configured primary key
-        await this._db.client().oneTimeToken.delete({ where: { id: id } });
-    }
 }
 exports.DatabaseSecurityStore = DatabaseSecurityStore;

package/security/store/redis-security-store.js

@@ -19,13 +19,18 @@ class RedisSecurityStore extends common_1.SecurityStore {
         if (value === null) {
             throw new errors_1.HttpError('Invalid or expired token provided', 401);
         }
+        // A token failing the validation is kept, so it can be used again
         if (validateContent) {
             const result = validateContent(value);
             if (!result.valid) {
                 throw new errors_1.HttpError(result.message, 401);
             }
         }
-        await this._redis.removeValue(tokenKey);
+        // Only the one of concurrent uses that removes the token gets its data
+        const removed = await this._redis.removeValue(tokenKey);
+        if (!removed) {
+            throw new errors_1.HttpError('Invalid or expired token provided', 401);
+        }
         return value;
     }
 }