@better-auth/redis-storage 1.6.25 → 1.6.26

package/dist/index.d.mts

@@ -38,7 +38,36 @@ declare function redisStorage(config: RedisStorageConfig): {
   increment(key: string, ttl: number): Promise<number>;
   set(key: string, value: string, ttl?: number | undefined): Promise<void>;
   delete(key: string): Promise<void>;
+  /**
+   * Lists the keys under the configured prefix, with the prefix stripped.
+   *
+   * Keys are enumerated with `SCAN`, a best-effort walk: it may report the
+   * same key on more than one page, so the result is de-duplicated, and
+   * keys added or removed while the scan runs may or may not appear. Order
+   * is not guaranteed.
+   */
   listKeys(): Promise<string[]>;
+  /**
+   * Deletes keys under the configured prefix.
+   *
+   * **Not atomic.** Keys are enumerated with `SCAN` and deleted page by
+   * page, so if Redis errors or the connection drops mid-iteration the
+   * returned promise rejects *after* earlier pages have already been
+   * deleted, leaving the store partially cleared. A rejection therefore
+   * means "an unknown subset of keys may already be gone", not "nothing
+   * changed", unlike a single blocking `DEL`, which either removes
+   * everything or nothing.
+   *
+   * **Best-effort while the keyspace changes.** `SCAN` is a best-effort
+   * enumeration: keys added or removed while the scan runs may or may not
+   * be returned, and a key may be returned more than once. A resolved call
+   * is therefore not proof the store is empty when other clients are
+   * writing concurrently.
+   *
+   * `clear()` is safe to call again: it is idempotent, so callers that need
+   * a fully empty store (e.g. revoking every session or rate-limit counter)
+   * should retry until it resolves. An already-empty store is a no-op.
+   */
   clear(): Promise<void>;
 };
 //#endregion

package/dist/index.mjs

@@ -41,6 +41,16 @@ return value
 		return `${keyPrefix}${key}`;
 	};
 	const isUnknownCommandError = (error) => error instanceof Error && error.message.toLowerCase().includes("unknown command");
+	const SCAN_COUNT = 100;
+	const escapedPrefix = keyPrefix.replace(/[\\*?[\]]/g, "\\$&");
+	async function* scanBatches() {
+		let cursor = "0";
+		do {
+			const [nextCursor, batch] = await client.scan(cursor, "MATCH", `${escapedPrefix}*`, "COUNT", SCAN_COUNT);
+			cursor = nextCursor;
+			if (batch.length > 0) yield batch;
+		} while (cursor !== "0");
+	}
 	return {
 		async get(key) {
 			return client.get(prefixKey(key));
@@ -67,12 +77,42 @@ return value
 		async delete(key) {
 			await client.del(prefixKey(key));
 		},
+		/**
+		* Lists the keys under the configured prefix, with the prefix stripped.
+		*
+		* Keys are enumerated with `SCAN`, a best-effort walk: it may report the
+		* same key on more than one page, so the result is de-duplicated, and
+		* keys added or removed while the scan runs may or may not appear. Order
+		* is not guaranteed.
+		*/
 		async listKeys() {
-			return (await client.keys(`${keyPrefix}*`)).map((key) => key.replace(keyPrefix, ""));
+			const keys = /* @__PURE__ */ new Set();
+			for await (const batch of scanBatches()) for (const key of batch) keys.add(key.slice(keyPrefix.length));
+			return [...keys];
 		},
+		/**
+		* Deletes keys under the configured prefix.
+		*
+		* **Not atomic.** Keys are enumerated with `SCAN` and deleted page by
+		* page, so if Redis errors or the connection drops mid-iteration the
+		* returned promise rejects *after* earlier pages have already been
+		* deleted, leaving the store partially cleared. A rejection therefore
+		* means "an unknown subset of keys may already be gone", not "nothing
+		* changed", unlike a single blocking `DEL`, which either removes
+		* everything or nothing.
+		*
+		* **Best-effort while the keyspace changes.** `SCAN` is a best-effort
+		* enumeration: keys added or removed while the scan runs may or may not
+		* be returned, and a key may be returned more than once. A resolved call
+		* is therefore not proof the store is empty when other clients are
+		* writing concurrently.
+		*
+		* `clear()` is safe to call again: it is idempotent, so callers that need
+		* a fully empty store (e.g. revoking every session or rate-limit counter)
+		* should retry until it resolves. An already-empty store is a no-op.
+		*/
 		async clear() {
-			const keys = await client.keys(`${keyPrefix}*`);
-			await client.del(...keys);
+			for await (const batch of scanBatches()) await client.del(...batch);
 		}
 	};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/redis-storage",
-  "version": "1.6.25",
+  "version": "1.6.26",
   "description": "Redis storage for Better Auth secondary storage",
   "type": "module",
   "license": "MIT",
@@ -35,15 +35,15 @@
   },
   "peerDependencies": {
     "ioredis": "^5.0.0",
-    "@better-auth/core": "^1.6.25"
+    "@better-auth/core": "^1.6.26"
   },
   "devDependencies": {
     "@types/node": "^25.3.2",
     "ioredis": "^5.9.3",
     "tsdown": "0.22.7",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5",
-    "@better-auth/core": "1.6.25"
+    "vitest": "^4.1.10",
+    "@better-auth/core": "1.6.26"
   },
   "scripts": {
     "build": "tsdown",