@byline/admin 5.0.0 → 5.1.1

package/dist/fields/field-services-context.d.ts

@@ -6,7 +6,7 @@
  * Copyright (c) Infonomic Company Limited
  */
 import { type ReactNode } from 'react';
-import type { BylineFieldServices } from './field-services-types';
+import type { BylineFieldServices } from './field-services-types.js';
 interface BylineFieldServicesProviderProps {
     services: BylineFieldServices;
     children: ReactNode;

package/dist/forms/available-locales-widget.d.ts

@@ -1,4 +1,4 @@
-export { type ReconciledLocaleState, reconcileLocaleState } from './available-locales-reconcile';
+export { type ReconciledLocaleState, reconcileLocaleState } from './available-locales-reconcile.js';
 /** A content locale to render a checkbox for. */
 export interface AvailableLocalesWidgetLocale {
     code: string;

package/dist/forms/document-actions.d.ts

@@ -1,4 +1,4 @@
-import type { PublishedVersionInfo } from './form-renderer';
+import type { PublishedVersionInfo } from './form-renderer.js';
 import type { ScheduledPublicationState } from './scheduled-publication-state.js';
 /**
  * Shape of a content-locale option as consumed by the Copy-to-Locale

package/dist/forms/form-renderer.d.ts

@@ -8,9 +8,9 @@
 import { type ReactNode } from 'react';
 import type { Field, FormAdminConfig, WorkflowStatus } from '@byline/core';
 import type { DocumentPatch } from '@byline/core/patches';
-import { type DocumentActionsLocaleOption } from './document-actions';
-import { type ScheduledPublicationInfo, type SchedulePublicationInput } from './scheduled-publication-control';
-import type { UseNavigationGuard } from './navigation-guard';
+import { type DocumentActionsLocaleOption } from './document-actions.js';
+import { type ScheduledPublicationInfo, type SchedulePublicationInput } from './scheduled-publication-control.js';
+import type { UseNavigationGuard } from './navigation-guard.js';
 /** Metadata about a previously published version that is still live. */
 export interface PublishedVersionInfo {
     id: string;

package/dist/forms/form-status-display.d.ts

@@ -6,7 +6,7 @@
  * Copyright (c) Infonomic Company Limited
  */
 import type { WorkflowStatus } from '@byline/core';
-import type { PublishedVersionInfo } from './form-renderer';
+import type { PublishedVersionInfo } from './form-renderer.js';
 /**
  * The status / metadata strip at the top of a document form — current
  * workflow status (suppressed for single-status workflows), last-modified and

package/dist/forms/upload-executor.d.ts

@@ -13,8 +13,8 @@
  * but only uploaded when the user clicks Save.
  */
 import type { Field, StoredFileValue } from '@byline/core';
-import type { UploadFieldFn } from '../fields/field-services-types';
-import type { PendingUpload } from './form-context';
+import type { UploadFieldFn } from '../fields/field-services-types.js';
+import type { PendingUpload } from './form-context.js';
 export interface UploadResult {
     fieldPath: string;
     success: boolean;

package/dist/modules/admin-account/components/change-password.js

@@ -84,6 +84,24 @@ function ChangeAccountPassword({ account, onClose, onSuccess }) {
             }
         }
     });
+    if (successMessage) return /*#__PURE__*/ jsxs("div", {
+        className: clsx('byline-account-change-password-wrap', change_password_module.wrap),
+        children: [
+            /*#__PURE__*/ jsx("div", {
+                role: "status",
+                children: /*#__PURE__*/ jsx(Alert, {
+                    intent: "success",
+                    children: successMessage
+                })
+            }),
+            /*#__PURE__*/ jsx(Button, {
+                type: "button",
+                intent: "primary",
+                onClick: ()=>window.location.reload(),
+                children: t('auth.signIn.title')
+            })
+        ]
+    });
     return /*#__PURE__*/ jsx("div", {
         className: clsx('byline-account-change-password-wrap', change_password_module.wrap),
         children: /*#__PURE__*/ jsxs("form", {

package/dist/modules/admin-account/service.d.ts

@@ -25,12 +25,8 @@ import type { AccountResponse, ChangeAccountPasswordRequest, UpdateAccountReques
  *     in the new hash. A hijacked session cannot use this flow to lock
  *     out the legitimate owner.
  *
- * Note on session revocation: changing a password here does **not**
- * currently revoke other refresh tokens — existing access tokens stay
- * valid until their 15-minute expiry, and other refresh tokens remain
- * useable. A "sign out everywhere on password change" follow-up should
- * call `RefreshTokensRepository.revokeAllExcept(adminUserId, currentJti)`
- * once that lands.
+ * Native adapter password writes atomically advance the session generation and
+ * revoke every refresh session. External providers own their own revocation.
  */
 export declare class AdminAccountService {
     #private;

package/dist/modules/admin-account/service.js

@@ -1,5 +1,5 @@
 import { toAdminUser } from "../admin-users/dto.js";
-import { ERR_ADMIN_USER_EMAIL_IN_USE } from "../admin-users/errors.js";
+import { ERR_ADMIN_USER_EMAIL_IN_USE, ERR_ADMIN_USER_VERSION_CONFLICT } from "../admin-users/errors.js";
 import { hashPassword, verifyPassword } from "../auth/password.js";
 import { ERR_ADMIN_ACCOUNT_INVALID_CURRENT_PASSWORD, ERR_ADMIN_ACCOUNT_NOT_FOUND } from "./errors.js";
 function _check_private_redeclaration(obj, privateCollection) {
@@ -63,6 +63,7 @@ class AdminAccountService {
         if (!withHash) throw ERR_ADMIN_ACCOUNT_NOT_FOUND();
         const ok = await verifyPassword(request.currentPassword, withHash.password_hash);
         if (!ok) throw ERR_ADMIN_ACCOUNT_INVALID_CURRENT_PASSWORD();
+        if (withHash.vid !== request.vid) throw ERR_ADMIN_USER_VERSION_CONFLICT();
         const newHash = await hashPassword(request.newPassword);
         const row = await _class_private_field_get(this, _repo).setPasswordHash(actorId, request.vid, newHash);
         return toAdminUser(row);

package/dist/modules/admin-users/repository.d.ts

@@ -65,6 +65,8 @@ export interface AdminUserRow {
  */
 export interface AdminUserWithPasswordRow extends AdminUserRow {
     password_hash: string;
+    /** Native session generation, independent of edit revisions. */
+    session_version: number;
 }
 export interface CreateAdminUserInput {
     email: string;
@@ -143,16 +145,23 @@ export interface AdminUsersRepository {
      * Content update with optimistic concurrency. Throws
      * `AdminUsersError(VERSION_CONFLICT)` if the stored `vid` differs from
      * `expectedVid`. Bumps `vid` on success and returns the fresh row.
+     * A false `is_enabled` patch must atomically advance the native session
+     * generation and revoke refresh sessions, under the account row lock.
      */
     update(id: string, expectedVid: number, patch: UpdateAdminUserInput): Promise<AdminUserRow>;
     /**
      * Replace the stored password hash with optimistic concurrency.
      * Version-gated on `expectedVid`. Caller supplies a pre-hashed PHC string.
+     * Atomically advance the native session generation and revoke every refresh
+     * session in the same transaction. Lock the account before refresh rows.
      * Returns the updated row so callers holding the edit form can refresh
      * their cached `vid` without a second round-trip.
      */
     setPasswordHash(id: string, expectedVid: number, passwordHash: string): Promise<AdminUserRow>;
-    /** Toggle enabled state. Vid-less — admin intent is independent of other edits. */
+    /**
+     * Toggle enabled state. Disable must atomically advance the native session
+     * generation and revoke refresh sessions. Enable never resets the generation.
+     */
     setEnabled(id: string, enabled: boolean): Promise<void>;
     /**
      * Set the admin interface locale preference. Vid-less — user preference

package/dist/modules/auth/index.d.ts

@@ -19,7 +19,9 @@
  * Clerk, institutional SSO) should be shipped as separate packages
  * against `@byline/auth` rather than added here.
  */
-export { JwtSessionProvider, type JwtSessionProviderConfig } from './jwt-session-provider.js';
+export { JwtSessionProvider, type JwtSessionProviderConfig, type NativeSessionEvent, } from './jwt-session-provider.js';
 export { hashPassword, verifyPassword } from './password.js';
 export { resolveActor } from './resolve-actor.js';
+export { createPasswordSignInLimiter, type SignInLimiterOptions, type SignInRateLimitPolicy, type SignInRateLimitStore, type SignInSecurityEvent, } from './sign-in-rate-limiter.js';
+export type { LoginSessionRow, LoginSessionsRepository } from './login-sessions-repository.js';
 export type { IssueRefreshTokenInput, RefreshTokenRow, RefreshTokensRepository, } from './refresh-tokens-repository.js';

package/dist/modules/auth/index.js

@@ -1,3 +1,4 @@
 export { JwtSessionProvider } from "./jwt-session-provider.js";
 export { hashPassword, verifyPassword } from "./password.js";
 export { resolveActor } from "./resolve-actor.js";
+export { createPasswordSignInLimiter } from "./sign-in-rate-limiter.js";

package/dist/modules/auth/jwt-session-provider.d.ts

@@ -5,9 +5,14 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import { type AdminAuth, type RefreshSessionArgs, type SessionProvider, type SessionProviderCapabilities, type SessionTokens, type SignInResult, type SignInWithPasswordArgs } from '@byline/auth';
+import { type AdminAuth, type RefreshSessionArgs, type RevokeSessionArgs, type SessionProvider, type SessionProviderCapabilities, type SessionTokens, type SignInResult, type SignInWithPasswordArgs } from '@byline/auth';
 import type { AdminStore } from '../../store.js';
+export interface NativeSessionEvent {
+    type: 'refresh_attempted' | 'refresh_completed' | 'refresh_contested';
+}
 export interface JwtSessionProviderConfig {
+    /** Best-effort, token-free renewal telemetry. Errors never change authentication outcomes. */
+    onEvent?: (event: NativeSessionEvent) => void;
     /**
      * Adapter-backed admin repositories. Construct via the DB adapter's
      * admin-store factory (e.g. `createAdminStore(db)` from
@@ -39,8 +44,9 @@ export declare class JwtSessionProvider implements SessionProvider {
     signInWithPassword(args: SignInWithPasswordArgs): Promise<SignInResult>;
     verifyAccessToken(token: string): Promise<{
         actor: AdminAuth;
+        sessionId: string;
     }>;
     refreshSession(args: RefreshSessionArgs): Promise<SessionTokens>;
-    revokeSession(refreshToken: string): Promise<void>;
+    revokeSession(args: RevokeSessionArgs): Promise<void>;
     resolveActor(adminUserId: string): Promise<AdminAuth | null>;
 }

package/dist/modules/auth/jwt-session-provider.js

@@ -1,9 +1,10 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { ERR_ACCOUNT_DISABLED, ERR_INVALID_CREDENTIALS, ERR_INVALID_TOKEN, ERR_REVOKED_TOKEN } from "@byline/auth";
-import { SignJWT, jwtVerify } from "jose";
+import { ERR_ACCESS_EXPIRED, ERR_ACCOUNT_DISABLED, ERR_INVALID_CREDENTIALS, ERR_INVALID_TOKEN, ERR_REVOKED_TOKEN, ERR_SESSION_CHANGED } from "@byline/auth";
+import { passwordSignInSchema } from "@byline/core/validation";
+import { SignJWT, compactVerify, jwtVerify } from "jose";
 import { v7 } from "uuid";
 import { verifyPassword } from "./password.js";
-import { resolveActor } from "./resolve-actor.js";
+import { resolveActor, resolveActorFromUser } from "./resolve-actor.js";
 function _check_private_redeclaration(obj, privateCollection) {
     if (privateCollection.has(obj)) throw new TypeError("Cannot initialize the same private elements twice on an object");
 }
@@ -51,18 +52,19 @@ const CAPABILITIES = {
     magicLink: false,
     sso: false
 };
-var _store = /*#__PURE__*/ new WeakMap(), _signingKey = /*#__PURE__*/ new WeakMap(), _issuer = /*#__PURE__*/ new WeakMap(), _accessTtl = /*#__PURE__*/ new WeakMap(), _refreshTtl = /*#__PURE__*/ new WeakMap(), _now = /*#__PURE__*/ new WeakMap(), _issueTokens = /*#__PURE__*/ new WeakSet(), _signAccessToken = /*#__PURE__*/ new WeakSet();
+var _onEvent = /*#__PURE__*/ new WeakMap(), _store = /*#__PURE__*/ new WeakMap(), _signingKey = /*#__PURE__*/ new WeakMap(), _issuer = /*#__PURE__*/ new WeakMap(), _accessTtl = /*#__PURE__*/ new WeakMap(), _refreshTtl = /*#__PURE__*/ new WeakMap(), _now = /*#__PURE__*/ new WeakMap(), _emit = /*#__PURE__*/ new WeakSet(), _observedLogins = /*#__PURE__*/ new WeakSet(), _issueTokens = /*#__PURE__*/ new WeakSet(), _signAccessToken = /*#__PURE__*/ new WeakSet();
 class JwtSessionProvider {
     async signInWithPassword(args) {
+        const credentials = passwordSignInSchema.parse(args);
         const users = _class_private_field_get(this, _store).adminUsers;
-        const row = await users.getByEmailForSignIn(args.email);
+        const row = await users.getByEmailForSignIn(credentials.email);
         if (!row) {
-            await verifyPassword(args.password, DUMMY_HASH_FOR_TIMING);
+            await verifyPassword(credentials.password, DUMMY_HASH_FOR_TIMING);
             throw ERR_INVALID_CREDENTIALS({
                 message: 'invalid credentials'
             });
         }
-        const ok = await verifyPassword(args.password, row.password_hash);
+        const ok = await verifyPassword(credentials.password, row.password_hash);
         if (!ok) {
             await users.recordLoginFailure(row.id);
             throw ERR_INVALID_CREDENTIALS({
@@ -72,101 +74,196 @@ class JwtSessionProvider {
         if (!row.is_enabled) throw ERR_ACCOUNT_DISABLED({
             message: 'account disabled'
         });
-        await users.recordLoginSuccess(row.id, args.ip ?? null);
-        const actor = await resolveActor(_class_private_field_get(this, _store), row.id);
-        if (!actor) throw ERR_ACCOUNT_DISABLED({
-            message: 'account disabled'
-        });
-        const tokens = await _class_private_method_get(this, _issueTokens, issueTokens).call(this, {
-            adminUserId: row.id,
-            ip: args.ip ?? null,
-            userAgent: args.userAgent ?? null
+        const previous = await _class_private_method_get(this, _observedLogins, observedLogins).call(this, args);
+        const withLocks = (work)=>previous.length ? _class_private_field_get(this, _store).withSessionLocks([
+                row.id,
+                ...previous.map((login)=>login.admin_user_id)
+            ], work) : _class_private_field_get(this, _store).withSessionLock(row.id, (store)=>work(store));
+        return withLocks(async (store)=>{
+            const current = await store.adminUsers.getByIdForSignIn(row.id);
+            if (!current?.is_enabled) throw ERR_ACCOUNT_DISABLED({
+                message: 'account disabled'
+            });
+            if (current.password_hash !== row.password_hash || current.session_version !== row.session_version) throw ERR_INVALID_CREDENTIALS({
+                message: 'credentials changed during sign-in'
+            });
+            for (const observed of previous){
+                const login = await store.loginSessions.findById(observed.id);
+                if (login && login.admin_user_id === observed.admin_user_id) await store.loginSessions.revoke(login.id, _class_private_field_get(this, _now).call(this));
+            }
+            await store.adminUsers.recordLoginSuccess(row.id, args.ip ?? null);
+            const actor = await resolveActorFromUser(store, current);
+            if (!actor) throw ERR_ACCOUNT_DISABLED({
+                message: 'account disabled'
+            });
+            const tokens = await _class_private_method_get(this, _issueTokens, issueTokens).call(this, store, {
+                adminUserId: row.id,
+                sessionVersion: current.session_version,
+                ip: args.ip ?? null,
+                userAgent: args.userAgent ?? null
+            });
+            return {
+                ...tokens,
+                actor
+            };
         });
-        return {
-            ...tokens,
-            actor
-        };
     }
     async verifyAccessToken(token) {
         let payload;
         try {
             const result = await jwtVerify(token, _class_private_field_get(this, _signingKey), {
-                issuer: _class_private_field_get(this, _issuer)
+                issuer: _class_private_field_get(this, _issuer),
+                algorithms: [
+                    'HS256'
+                ],
+                currentDate: _class_private_field_get(this, _now).call(this),
+                requiredClaims: [
+                    'sub',
+                    'iat',
+                    'exp',
+                    'jti',
+                    'sv',
+                    'sid'
+                ]
             });
             payload = result.payload;
         } catch (err) {
+            if (err instanceof Error && 'code' in err && 'ERR_JWT_EXPIRED' === err.code) throw ERR_ACCESS_EXPIRED({
+                message: 'access token expired'
+            });
             throw ERR_INVALID_TOKEN({
                 message: 'access token verification failed',
                 cause: err
             });
         }
-        if ('access' !== payload.typ) throw ERR_INVALID_TOKEN({
+        if ('access' !== payload.typ || 'string' != typeof payload.sub || !validSid(payload.sid) || !Number.isSafeInteger(payload.sv) || payload.sv < 0) throw ERR_INVALID_TOKEN({
             message: 'unexpected token type'
         });
-        const actor = await resolveActor(_class_private_field_get(this, _store), payload.sub);
+        const current = await _class_private_field_get(this, _store).adminUsers.getByIdForSignIn(payload.sub);
+        if (!current?.is_enabled) throw ERR_ACCOUNT_DISABLED({
+            message: 'account disabled or deleted'
+        });
+        if (current.session_version !== payload.sv) throw ERR_REVOKED_TOKEN({
+            message: 'account session generation changed'
+        });
+        const login = await _class_private_field_get(this, _store).loginSessions.findById(payload.sid);
+        if (!login || login.admin_user_id !== payload.sub || login.session_version !== payload.sv || null != login.revoked_at || login.expires_at.getTime() <= _class_private_field_get(this, _now).call(this).getTime()) throw ERR_REVOKED_TOKEN({
+            message: 'login revoked or expired'
+        });
+        const actor = await resolveActorFromUser(_class_private_field_get(this, _store), current);
         if (!actor) throw ERR_ACCOUNT_DISABLED({
             message: 'account disabled or deleted'
         });
         return {
-            actor
+            actor,
+            sessionId: payload.sid
         };
     }
     async refreshSession(args) {
-        const refreshTokens = _class_private_field_get(this, _store).refreshTokens;
+        _class_private_method_get(this, _emit, emit).call(this, 'refresh_attempted');
         const hash = hashToken(args.refreshToken);
-        const row = await refreshTokens.findByHash(hash);
-        if (!row) throw ERR_INVALID_TOKEN({
+        const observed = await _class_private_field_get(this, _store).refreshTokens.findByHash(hash);
+        if (!observed) throw ERR_INVALID_TOKEN({
             message: 'refresh token not recognised'
         });
-        const now = _class_private_field_get(this, _now).call(this);
-        if (null != row.revoked_at) {
-            if (null != row.rotated_to_id) {
-                await refreshTokens.revokeChain(row.id, now);
-                throw ERR_REVOKED_TOKEN({
-                    message: 'refresh token was already rotated — chain revoked'
-                });
+        const outcome = await _class_private_field_get(this, _store).withSessionLock(observed.admin_user_id, async (store, user)=>{
+            if (!user?.is_enabled) throw ERR_ACCOUNT_DISABLED({
+                message: 'account disabled or deleted'
+            });
+            const refreshTokens = store.refreshTokens;
+            const row = await refreshTokens.findByHash(hash);
+            if (!row) throw ERR_INVALID_TOKEN({
+                message: 'refresh token not recognised'
+            });
+            const now = _class_private_field_get(this, _now).call(this);
+            const login = row.sid ? await store.loginSessions.findById(row.sid) : null;
+            if (!login || login.admin_user_id !== user.id || login.session_version !== user.session_version || null != login.revoked_at) throw ERR_REVOKED_TOKEN({
+                message: 'login revoked'
+            });
+            if (args.expectedSessionId && args.expectedSessionId !== login.id) throw ERR_SESSION_CHANGED({
+                message: 'session changed before renewal'
+            });
+            if (null != row.revoked_at) {
+                if (null != row.rotated_to_id) {
+                    await store.loginSessions.revoke(login.id, now);
+                    await refreshTokens.revokeChain(row.id, now);
+                }
+                return {
+                    contested: null != row.rotated_to_id,
+                    error: ERR_REVOKED_TOKEN({
+                        message: 'refresh token has been revoked'
+                    })
+                };
             }
-            throw ERR_REVOKED_TOKEN({
-                message: 'refresh token has been revoked'
+            if (row.session_version !== user.session_version) throw ERR_REVOKED_TOKEN({
+                message: 'account session generation changed'
+            });
+            if (row.expires_at.getTime() <= now.getTime() || login.expires_at.getTime() <= now.getTime()) throw ERR_INVALID_TOKEN({
+                message: 'refresh token expired'
+            });
+            const newId = v7();
+            const newRefreshPlain = generateOpaqueToken();
+            const refreshExpiresAt = new Date(now.getTime() + 1000 * _class_private_field_get(this, _refreshTtl));
+            await refreshTokens.issue({
+                id: newId,
+                admin_user_id: row.admin_user_id,
+                token_hash: hashToken(newRefreshPlain),
+                session_version: user.session_version,
+                sid: login.id,
+                expires_at: refreshExpiresAt,
+                user_agent: args.userAgent ?? null,
+                ip: args.ip ?? null
             });
+            await store.loginSessions.extend(login.id, refreshExpiresAt);
+            await refreshTokens.markRotated(row.id, newId, now);
+            const accessToken = await _class_private_method_get(this, _signAccessToken, signAccessToken).call(this, row.admin_user_id, user.session_version, login.id, now);
+            return {
+                tokens: {
+                    sessionId: login.id,
+                    accessToken,
+                    refreshToken: newRefreshPlain,
+                    accessTokenExpiresAt: new Date(now.getTime() + 1000 * _class_private_field_get(this, _accessTtl)),
+                    refreshTokenExpiresAt: refreshExpiresAt
+                }
+            };
+        });
+        if ('error' in outcome) {
+            if (outcome.contested) _class_private_method_get(this, _emit, emit).call(this, 'refresh_contested');
+            throw outcome.error;
         }
-        if (row.expires_at.getTime() <= now.getTime()) throw ERR_INVALID_TOKEN({
-            message: 'refresh token expired'
-        });
-        const newId = v7();
-        const newRefreshPlain = generateOpaqueToken();
-        const newRefreshHash = hashToken(newRefreshPlain);
-        const refreshExpiresAt = new Date(now.getTime() + 1000 * _class_private_field_get(this, _refreshTtl));
-        await refreshTokens.issue({
-            id: newId,
-            admin_user_id: row.admin_user_id,
-            token_hash: newRefreshHash,
-            expires_at: refreshExpiresAt,
-            user_agent: args.userAgent ?? null,
-            ip: args.ip ?? null
-        });
-        await refreshTokens.markRotated(row.id, newId, now);
-        const accessToken = await _class_private_method_get(this, _signAccessToken, signAccessToken).call(this, row.admin_user_id, now);
-        const accessExpiresAt = new Date(now.getTime() + 1000 * _class_private_field_get(this, _accessTtl));
-        return {
-            accessToken,
-            refreshToken: newRefreshPlain,
-            accessTokenExpiresAt: accessExpiresAt,
-            refreshTokenExpiresAt: refreshExpiresAt
-        };
+        _class_private_method_get(this, _emit, emit).call(this, 'refresh_completed');
+        return outcome.tokens;
     }
-    async revokeSession(refreshToken) {
-        const refreshTokens = _class_private_field_get(this, _store).refreshTokens;
-        const row = await refreshTokens.findByHash(hashToken(refreshToken));
-        if (!row) return;
-        await refreshTokens.revoke(row.id, _class_private_field_get(this, _now).call(this));
+    async revokeSession(args) {
+        const logins = await _class_private_method_get(this, _observedLogins, observedLogins).call(this, {
+            previousAccessToken: args.accessToken,
+            previousRefreshToken: args.refreshToken
+        });
+        if (args.expectedSessionId && logins.some((login)=>login.id !== args.expectedSessionId)) throw ERR_SESSION_CHANGED({
+            message: 'session changed before logout'
+        });
+        for (const login of logins)await _class_private_field_get(this, _store).withSessionLock(login.admin_user_id, async (store)=>{
+            await store.loginSessions.revoke(login.id, _class_private_field_get(this, _now).call(this));
+        });
+        if (args.refreshToken) {
+            const row = await _class_private_field_get(this, _store).refreshTokens.findByHash(hashToken(args.refreshToken));
+            if (row) await _class_private_field_get(this, _store).withSessionLock(row.admin_user_id, async (store)=>{
+                await store.refreshTokens.revokeChain(row.id, _class_private_field_get(this, _now).call(this));
+            });
+        }
     }
     async resolveActor(adminUserId) {
         return resolveActor(_class_private_field_get(this, _store), adminUserId);
     }
     constructor(config){
+        _class_private_method_init(this, _emit);
+        _class_private_method_init(this, _observedLogins);
         _class_private_method_init(this, _issueTokens);
         _class_private_method_init(this, _signAccessToken);
+        _class_private_field_init(this, _onEvent, {
+            writable: true,
+            value: void 0
+        });
         _class_private_field_init(this, _store, {
             writable: true,
             value: void 0
@@ -192,6 +289,7 @@ class JwtSessionProvider {
             value: void 0
         });
         this.capabilities = CAPABILITIES;
+        _class_private_field_set(this, _onEvent, config.onEvent);
         _class_private_field_set(this, _store, config.store);
         _class_private_field_set(this, _signingKey, 'string' == typeof config.signingSecret ? new TextEncoder().encode(config.signingSecret) : config.signingSecret);
         if (_class_private_field_get(this, _signingKey).byteLength < 32) throw new Error('JwtSessionProvider: signingSecret must carry at least 32 bytes of entropy (256 bits)');
@@ -201,34 +299,85 @@ class JwtSessionProvider {
         _class_private_field_set(this, _now, config.now ?? (()=>new Date()));
     }
 }
-async function issueTokens(input) {
+function emit(type) {
+    var _this, _this1;
+    try {
+        null == (_this = _class_private_field_get(_this1 = this, _onEvent)) || _this.call(_this1, {
+            type
+        });
+    } catch  {}
+}
+async function observedLogins(args) {
+    const ids = new Set();
+    if (args.previousAccessToken) {
+        let claims;
+        try {
+            const verified = await compactVerify(args.previousAccessToken, _class_private_field_get(this, _signingKey), {
+                algorithms: [
+                    'HS256'
+                ]
+            });
+            claims = JSON.parse(new TextDecoder().decode(verified.payload));
+        } catch  {}
+        if (claims?.iss === _class_private_field_get(this, _issuer) && 'access' === claims.typ && validSid(claims.sid) && 'string' == typeof claims.sub) {
+            const login = await _class_private_field_get(this, _store).loginSessions.findById(claims.sid);
+            if (login?.admin_user_id === claims.sub) ids.add(login.id);
+        }
+    }
+    if (args.previousRefreshToken) {
+        const token = await _class_private_field_get(this, _store).refreshTokens.findByHash(hashToken(args.previousRefreshToken));
+        if (token?.sid) {
+            const login = await _class_private_field_get(this, _store).loginSessions.findById(token.sid);
+            if (login?.admin_user_id === token.admin_user_id) ids.add(login.id);
+        }
+    }
+    const result = [];
+    for (const id of ids){
+        const login = await _class_private_field_get(this, _store).loginSessions.findById(id);
+        if (login) result.push(login);
+    }
+    return result;
+}
+async function issueTokens(store, input) {
     const now = _class_private_field_get(this, _now).call(this);
-    const refreshTokens = _class_private_field_get(this, _store).refreshTokens;
-    const accessToken = await _class_private_method_get(this, _signAccessToken, signAccessToken).call(this, input.adminUserId, now);
+    const refreshTokens = store.refreshTokens;
+    const sessionId = randomUUID();
+    const accessToken = await _class_private_method_get(this, _signAccessToken, signAccessToken).call(this, input.adminUserId, input.sessionVersion, sessionId, now);
     const accessExpiresAt = new Date(now.getTime() + 1000 * _class_private_field_get(this, _accessTtl));
     const refreshPlain = generateOpaqueToken();
     const refreshHash = hashToken(refreshPlain);
     const refreshExpiresAt = new Date(now.getTime() + 1000 * _class_private_field_get(this, _refreshTtl));
+    await store.loginSessions.create({
+        id: sessionId,
+        admin_user_id: input.adminUserId,
+        session_version: input.sessionVersion,
+        expires_at: refreshExpiresAt
+    });
     await refreshTokens.issue({
         id: v7(),
         admin_user_id: input.adminUserId,
         token_hash: refreshHash,
+        session_version: input.sessionVersion,
+        sid: sessionId,
         expires_at: refreshExpiresAt,
         user_agent: input.userAgent,
         ip: input.ip
     });
     return {
+        sessionId,
         accessToken,
         refreshToken: refreshPlain,
         accessTokenExpiresAt: accessExpiresAt,
         refreshTokenExpiresAt: refreshExpiresAt
     };
 }
-async function signAccessToken(adminUserId, now) {
+async function signAccessToken(adminUserId, sessionVersion, sessionId, now) {
     const iat = Math.floor(now.getTime() / 1000);
     const exp = iat + _class_private_field_get(this, _accessTtl);
     return new SignJWT({
-        typ: 'access'
+        typ: 'access',
+        sv: sessionVersion,
+        sid: sessionId
     }).setProtectedHeader({
         alg: 'HS256',
         typ: 'JWT'
@@ -241,4 +390,7 @@ function hashToken(token) {
     return createHash('sha256').update(token).digest('hex');
 }
 const DUMMY_HASH_FOR_TIMING = '$argon2id$v=19$m=19456,t=2,p=1$c2lkZS1jaGFubmVsLW1pdGlnYXRpb24$0Hqf2vQKZqSfZZ4nJRr7K5IOjn9ngjzaQjV+yTG6iNY';
+function validSid(value) {
+    return 'string' == typeof value && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
 export { JwtSessionProvider };

package/dist/modules/auth/login-sessions-repository.d.ts

@@ -0,0 +1,23 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Native JWT login membership. This is not a browser binding or a bearer credential store. */
+export interface LoginSessionRow {
+    id: string;
+    admin_user_id: string;
+    session_version: number;
+    expires_at: Date;
+    revoked_at: Date | null;
+}
+export interface LoginSessionsRepository {
+    /** All writes run under the owning account lock, through its scoped store. */
+    create(input: Omit<LoginSessionRow, 'revoked_at'>): Promise<void>;
+    findById(id: string): Promise<LoginSessionRow | null>;
+    extend(id: string, expiresAt: Date): Promise<void>;
+    revoke(id: string, at?: Date): Promise<void>;
+    revokeAllForUser(adminUserId: string, at?: Date): Promise<void>;
+}

package/dist/modules/auth/login-sessions-repository.js

@@ -0,0 +1 @@
+export { };