@byline/db-mysql 5.0.0 → 5.1.1

package/dist/database/schema/auth.d.ts

@@ -60,6 +60,23 @@ export declare const adminUsers: import("drizzle-orm/mysql-core").MySqlTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        session_version: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "session_version";
+            tableName: "byline_admin_users";
+            dataType: "number";
+            columnType: "MySqlInt";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         vid: import("drizzle-orm/mysql-core").MySqlColumn<{
             name: "vid";
             tableName: "byline_admin_users";
@@ -720,6 +737,98 @@ export declare const adminPermissions: import("drizzle-orm/mysql-core").MySqlTab
  * at the replacement row; presenting a rotated token is treated as replay
  * and revokes the whole chain.
  */
+export declare const adminLoginSessions: import("drizzle-orm/mysql-core").MySqlTableWithColumns<{
+    name: "byline_admin_login_sessions";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "id";
+            tableName: "byline_admin_login_sessions";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        admin_user_id: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "admin_user_id";
+            tableName: "byline_admin_login_sessions";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        session_version: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "session_version";
+            tableName: "byline_admin_login_sessions";
+            dataType: "number";
+            columnType: "MySqlInt";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expires_at: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "expires_at";
+            tableName: "byline_admin_login_sessions";
+            dataType: "date";
+            columnType: "MySqlDateTime";
+            data: Date;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revoked_at: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "revoked_at";
+            tableName: "byline_admin_login_sessions";
+            dataType: "date";
+            columnType: "MySqlDateTime";
+            data: Date;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'mysql';
+}>;
 export declare const adminRefreshTokens: import("drizzle-orm/mysql-core").MySqlTableWithColumns<{
     name: "byline_admin_refresh_tokens";
     schema: undefined;
@@ -792,6 +901,23 @@ export declare const adminRefreshTokens: import("drizzle-orm/mysql-core").MySqlT
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        sid: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "sid";
+            tableName: "byline_admin_refresh_tokens";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         token_hash: import("drizzle-orm/mysql-core").MySqlColumn<{
             name: "token_hash";
             tableName: "byline_admin_refresh_tokens";
@@ -809,6 +935,23 @@ export declare const adminRefreshTokens: import("drizzle-orm/mysql-core").MySqlT
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        session_version: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "session_version";
+            tableName: "byline_admin_refresh_tokens";
+            dataType: "number";
+            columnType: "MySqlInt";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         issued_at: import("drizzle-orm/mysql-core").MySqlColumn<{
             name: "issued_at";
             tableName: "byline_admin_refresh_tokens";
@@ -949,3 +1092,62 @@ export declare const adminPermissionsRelations: import("drizzle-orm").Relations<
 export declare const adminRefreshTokensRelations: import("drizzle-orm").Relations<"byline_admin_refresh_tokens", {
     user: import("drizzle-orm").One<"byline_admin_users", true>;
 }>;
+/** Shared, expiring fixed-window counters for password sign-in admission. */
+export declare const adminSignInRateLimits: import("drizzle-orm/mysql-core").MySqlTableWithColumns<{
+    name: "byline_admin_sign_in_rate_limits";
+    schema: undefined;
+    columns: {
+        key: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "key";
+            tableName: "byline_admin_sign_in_rate_limits";
+            dataType: "string";
+            columnType: "MySqlVarChar";
+            data: string;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        attempts: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "attempts";
+            tableName: "byline_admin_sign_in_rate_limits";
+            dataType: "number";
+            columnType: "MySqlInt";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expires_at: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "expires_at";
+            tableName: "byline_admin_sign_in_rate_limits";
+            dataType: "date";
+            columnType: "MySqlDateTime";
+            data: Date;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'mysql';
+}>;

package/dist/database/schema/auth.js

@@ -36,6 +36,7 @@ import { createdAt, timestamps, uuidChar } from './common.js';
 // ---------------------------------------------------------------------------
 export const adminUsers = mysqlTable('byline_admin_users', {
     id: uuidChar('id').primaryKey(),
+    session_version: int('session_version').notNull().default(0),
     vid: int('vid').notNull().default(1),
     given_name: varchar('given_name', { length: 100 }),
     family_name: varchar('family_name', { length: 100 }),
@@ -162,11 +163,27 @@ export const adminPermissions = mysqlTable('byline_admin_permissions', {
  * at the replacement row; presenting a rotated token is treated as replay
  * and revokes the whole chain.
  */
+export const adminLoginSessions = mysqlTable('byline_admin_login_sessions', {
+    id: uuidChar('id').primaryKey(),
+    admin_user_id: uuidChar('admin_user_id').notNull(),
+    session_version: int('session_version').notNull(),
+    expires_at: datetime('expires_at', { fsp: 6 }).notNull(),
+    revoked_at: datetime('revoked_at', { fsp: 6 }),
+}, (table) => [
+    foreignKey({
+        name: 'fk_admin_login_sessions_user',
+        columns: [table.admin_user_id],
+        foreignColumns: [adminUsers.id],
+    }).onDelete('cascade'),
+    index('idx_admin_login_sessions_user').on(table.admin_user_id),
+]);
 export const adminRefreshTokens = mysqlTable('byline_admin_refresh_tokens', {
     id: uuidChar('id').primaryKey(),
     admin_user_id: uuidChar('admin_user_id').notNull(),
     /** SHA-256 hex digest of the raw refresh-token string. 64 chars. */
+    sid: uuidChar('sid'),
     token_hash: varchar('token_hash', { length: 64 }).notNull().unique(),
+    session_version: int('session_version').notNull().default(-1),
     // fsp 6 throughout this table, matching pg — see `common.ts`'s
     // `auditTimestamp` docblock for why every temporal column in this
     // schema moved from fsp 3 to fsp 6.
@@ -183,11 +200,17 @@ export const adminRefreshTokens = mysqlTable('byline_admin_refresh_tokens', {
     ip: varchar('ip', { length: 45 }),
     ...timestamps,
 }, (table) => [
+    foreignKey({
+        name: 'fk_admin_refresh_tokens_sid',
+        columns: [table.sid],
+        foreignColumns: [adminLoginSessions.id],
+    }).onDelete('cascade'),
     foreignKey({
         name: 'fk_admin_refresh_tokens_admin_user_id',
         columns: [table.admin_user_id],
         foreignColumns: [adminUsers.id],
     }).onDelete('cascade'),
+    index('idx_admin_refresh_tokens_sid').on(table.sid),
     index('idx_byline_admin_refresh_tokens_user').on(table.admin_user_id),
     index('idx_byline_admin_refresh_tokens_token_hash').on(table.token_hash),
 ]);
@@ -224,3 +247,9 @@ export const adminRefreshTokensRelations = relations(adminRefreshTokens, ({ one
         references: [adminUsers.id],
     }),
 }));
+/** Shared, expiring fixed-window counters for password sign-in admission. */
+export const adminSignInRateLimits = mysqlTable('byline_admin_sign_in_rate_limits', {
+    key: varchar('key', { length: 64 }).primaryKey(),
+    attempts: int('attempts').notNull(),
+    expires_at: datetime('expires_at', { fsp: 3 }).notNull(),
+}, (table) => [index('idx_admin_sign_in_rate_limits_expiry').on(table.expires_at)]);

package/dist/database/schema/index.d.ts

@@ -4102,4 +4102,4 @@ export declare const recurringTasks: import("drizzle-orm/mysql-core").MySqlTable
     };
     dialect: 'mysql';
 }>;
-export { adminPermissions, adminPermissionsRelations, adminRefreshTokens, adminRefreshTokensRelations, adminRoleAdminUser, adminRoleAdminUserRelations, adminRoles, adminRolesRelations, adminUserPreferences, adminUsers, adminUsersRelations, } from './auth.js';
+export { adminLoginSessions, adminPermissions, adminPermissionsRelations, adminRefreshTokens, adminRefreshTokensRelations, adminRoleAdminUser, adminRoleAdminUserRelations, adminRoles, adminRolesRelations, adminSignInRateLimits, adminUserPreferences, adminUsers, adminUsersRelations, } from './auth.js';

package/dist/database/schema/index.js

@@ -996,4 +996,4 @@ export const recurringTasks = mysqlTable('byline_recurring_tasks', {
 // Auth schema — byline_admin_users, byline_admin_roles, etc.
 // See ./auth.ts for definitions and rationale.
 // ---------------------------------------------------------------------------
-export { adminPermissions, adminPermissionsRelations, adminRefreshTokens, adminRefreshTokensRelations, adminRoleAdminUser, adminRoleAdminUserRelations, adminRoles, adminRolesRelations, adminUserPreferences, adminUsers, adminUsersRelations, } from './auth.js';
+export { adminLoginSessions, adminPermissions, adminPermissionsRelations, adminRefreshTokens, adminRefreshTokensRelations, adminRoleAdminUser, adminRoleAdminUserRelations, adminRoles, adminRolesRelations, adminSignInRateLimits, adminUserPreferences, adminUsers, adminUsersRelations, } from './auth.js';

package/dist/database/schema/schema-pins.test.node.js

@@ -348,8 +348,10 @@ describe('schema pins — timestamp precision (spec §F.3)', () => {
     it('finds datetime columns to check (schema is not empty)', () => {
         expect(instantColumns.length).toBeGreaterThan(0);
     });
-    it.each(instantColumns.map((c) => [`${c.tableName}.${c.column.name}`, c.column]))('%s is datetime(6) — microsecond precision (pg parity)', (_label, column) => {
-        expect(column.getSQLType()).toBe('datetime(6)');
+    it.each(instantColumns.map((c) => [`${c.tableName}.${c.column.name}`, c.column]))('%s uses the PostgreSQL companion precision', (label, column) => {
+        // Admission windows intentionally share JavaScript millisecond precision on both adapters.
+        const precision = label === 'byline_admin_sign_in_rate_limits.expires_at' ? 3 : 6;
+        expect(column.getSQLType()).toBe(`datetime(${precision})`);
     });
     // `MySqlDate` (the `date()` builder, used by `datetimeStore.value_date`)
     // is the one temporal type genuinely outside this pin's scope — a

package/dist/modules/admin/admin-store.js

@@ -5,11 +5,15 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
+import { eq } from 'drizzle-orm';
+import { adminUsers } from '../../database/schema/auth.js';
 import { createAdminPermissionsRepository } from './admin-permissions-repository.js';
 import { createAdminPreferencesRepository } from './admin-preferences-repository.js';
 import { createAdminRolesRepository } from './admin-roles-repository.js';
 import { createAdminUsersRepository } from './admin-users-repository.js';
+import { createLoginSessionsRepository } from './login-sessions-repository.js';
 import { createRefreshTokensRepository } from './refresh-tokens-repository.js';
+import { createSignInRateLimitStore } from './sign-in-rate-limit-store.js';
 /**
  * Wire the five admin repositories against a Drizzle handle and return the
  * `AdminStore` bundle expected by `@byline/admin` — specifically by the
@@ -21,6 +25,32 @@ import { createRefreshTokensRepository } from './refresh-tokens-repository.js';
  */
 export function createAdminStore(db) {
     return {
+        async withSessionLock(adminUserId, work) {
+            return db.transaction(async (tx) => {
+                await tx
+                    .select({ id: adminUsers.id })
+                    .from(adminUsers)
+                    .where(eq(adminUsers.id, adminUserId))
+                    .for('update');
+                const scoped = createAdminStore(tx);
+                const user = await scoped.adminUsers.getByIdForSignIn(adminUserId);
+                return work(scoped, user);
+            });
+        },
+        async withSessionLocks(adminUserIds, work) {
+            return db.transaction(async (tx) => {
+                for (const id of [...new Set(adminUserIds)].sort()) {
+                    await tx
+                        .select({ id: adminUsers.id })
+                        .from(adminUsers)
+                        .where(eq(adminUsers.id, id))
+                        .for('update');
+                }
+                return work(createAdminStore(tx));
+            });
+        },
+        loginSessions: createLoginSessionsRepository(db),
+        signInRateLimits: createSignInRateLimitStore(db),
         adminUsers: createAdminUsersRepository(db),
         adminRoles: createAdminRolesRepository(db),
         adminPermissions: createAdminPermissionsRepository(db),

package/dist/modules/admin/admin-users-repository.js

@@ -10,6 +10,8 @@ import { and, asc, desc, eq, inArray, like, or, sql } from 'drizzle-orm';
 import { v7 as uuidv7 } from 'uuid';
 import { adminUsers } from '../../database/schema/auth.js';
 import { affectedRowCount } from '../storage/storage-utils.js';
+import { createLoginSessionsRepository } from './login-sessions-repository.js';
+import { createRefreshTokensRepository } from './refresh-tokens-repository.js';
 /**
  * MySQL implementation of `AdminUsersRepository`. Ported from
  * `packages/db-postgres/src/modules/admin/admin-users-repository.ts`.
@@ -160,14 +162,22 @@ export function createAdminUsersRepository(db) {
         },
         async getByEmailForSignIn(email) {
             const [row] = await db
-                .select({ ...PUBLIC_COLUMNS, password_hash: adminUsers.password })
+                .select({
+                ...PUBLIC_COLUMNS,
+                password_hash: adminUsers.password,
+                session_version: adminUsers.session_version,
+            })
                 .from(adminUsers)
                 .where(eq(adminUsers.email, email.toLowerCase()));
             return row ?? null;
         },
         async getByIdForSignIn(id) {
             const [row] = await db
-                .select({ ...PUBLIC_COLUMNS, password_hash: adminUsers.password })
+                .select({
+                ...PUBLIC_COLUMNS,
+                password_hash: adminUsers.password,
+                session_version: adminUsers.session_version,
+            })
                 .from(adminUsers)
                 .where(eq(adminUsers.id, id));
             return row ?? null;
@@ -211,6 +221,9 @@ export function createAdminUsersRepository(db) {
                 updateSet.is_super_admin = patch.is_super_admin;
             if (patch.is_enabled !== undefined)
                 updateSet.is_enabled = patch.is_enabled;
+            if (patch.is_enabled === false) {
+                updateSet.session_version = sql `${adminUsers.session_version} + 1`;
+            }
             if (patch.is_email_verified !== undefined)
                 updateSet.is_email_verified = patch.is_email_verified;
             if (patch.remember_me !== undefined)
@@ -233,6 +246,10 @@ export function createAdminUsersRepository(db) {
                     .where(eq(adminUsers.id, id));
                 if (!fresh)
                     throw ERR_ADMIN_USER_VERSION_CONFLICT();
+                if (patch.is_enabled === false) {
+                    await createRefreshTokensRepository(tx).revokeAllForUser(id);
+                    await createLoginSessionsRepository(tx).revokeAllForUser(id);
+                }
                 return fresh;
             });
         },
@@ -245,6 +262,7 @@ export function createAdminUsersRepository(db) {
                     .update(adminUsers)
                     .set({
                     password: passwordHash,
+                    session_version: sql `${adminUsers.session_version} + 1`,
                     updated_at: now,
                     vid: sql `${adminUsers.vid} + 1`,
                 })
@@ -257,14 +275,27 @@ export function createAdminUsersRepository(db) {
                     .where(eq(adminUsers.id, id));
                 if (!fresh)
                     throw ERR_ADMIN_USER_VERSION_CONFLICT();
+                await createRefreshTokensRepository(tx).revokeAllForUser(id);
+                await createLoginSessionsRepository(tx).revokeAllForUser(id);
                 return fresh;
             });
         },
         async setEnabled(id, enabled) {
-            await db
-                .update(adminUsers)
-                .set({ is_enabled: enabled, updated_at: new Date(), vid: sql `${adminUsers.vid} + 1` })
-                .where(eq(adminUsers.id, id));
+            await db.transaction(async (tx) => {
+                await tx
+                    .update(adminUsers)
+                    .set({
+                    is_enabled: enabled,
+                    updated_at: new Date(),
+                    vid: sql `${adminUsers.vid} + 1`,
+                    ...(!enabled ? { session_version: sql `${adminUsers.session_version} + 1` } : {}),
+                })
+                    .where(eq(adminUsers.id, id));
+                if (!enabled) {
+                    await createRefreshTokensRepository(tx).revokeAllForUser(id);
+                    await createLoginSessionsRepository(tx).revokeAllForUser(id);
+                }
+            });
         },
         async setPreferredLocale(id, locale) {
             await db

package/dist/modules/admin/login-sessions-repository.d.ts

@@ -0,0 +1,11 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { LoginSessionsRepository } from '@byline/admin/auth';
+import type { MySql2Database } from 'drizzle-orm/mysql2';
+import type * as schema from '../../database/schema/index.js';
+export declare function createLoginSessionsRepository(db: MySql2Database<typeof schema>): LoginSessionsRepository;

package/dist/modules/admin/login-sessions-repository.js

@@ -0,0 +1,38 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { and, eq, isNull } from 'drizzle-orm';
+import { adminLoginSessions } from '../../database/schema/auth.js';
+export function createLoginSessionsRepository(db) {
+    return {
+        async create(input) {
+            await db.insert(adminLoginSessions).values(input);
+        },
+        async findById(id) {
+            const [row] = await db.select().from(adminLoginSessions).where(eq(adminLoginSessions.id, id));
+            return row ?? null;
+        },
+        async extend(id, expiresAt) {
+            await db
+                .update(adminLoginSessions)
+                .set({ expires_at: expiresAt })
+                .where(and(eq(adminLoginSessions.id, id), isNull(adminLoginSessions.revoked_at)));
+        },
+        async revoke(id, at = new Date()) {
+            await db
+                .update(adminLoginSessions)
+                .set({ revoked_at: at })
+                .where(and(eq(adminLoginSessions.id, id), isNull(adminLoginSessions.revoked_at)));
+        },
+        async revokeAllForUser(adminUserId, at = new Date()) {
+            await db
+                .update(adminLoginSessions)
+                .set({ revoked_at: at })
+                .where(and(eq(adminLoginSessions.admin_user_id, adminUserId), isNull(adminLoginSessions.revoked_at)));
+        },
+    };
+}

package/dist/modules/admin/refresh-tokens-repository.js

@@ -34,11 +34,16 @@ import { affectedRowCount } from '../storage/storage-utils.js';
 export function createRefreshTokensRepository(db) {
     return {
         async issue(input) {
+            if (!Number.isSafeInteger(input.session_version) || input.session_version < -1) {
+                throw new Error('issueRefreshToken: session_version must be an integer >= -1');
+            }
             const now = new Date();
             const row = {
                 id: input.id,
                 admin_user_id: input.admin_user_id,
                 token_hash: input.token_hash,
+                session_version: input.session_version,
+                sid: input.sid ?? null,
                 issued_at: now,
                 expires_at: input.expires_at,
                 revoked_at: null,
@@ -51,6 +56,8 @@ export function createRefreshTokensRepository(db) {
                 id: row.id,
                 admin_user_id: row.admin_user_id,
                 token_hash: row.token_hash,
+                session_version: row.session_version,
+                sid: row.sid,
                 issued_at: now,
                 expires_at: row.expires_at,
                 user_agent: row.user_agent,
@@ -90,30 +97,17 @@ export function createRefreshTokensRepository(db) {
                 .where(and(eq(adminRefreshTokens.id, id), isNull(adminRefreshTokens.revoked_at)));
         },
         async revokeChain(startId, at = new Date()) {
-            let cursor = startId;
-            let touched = 0;
-            // Bounded walk — chains in practice are short; 1000 is a safety ceiling.
-            for (let step = 0; cursor != null && step < 1000; step++) {
-                const [row] = await db
-                    .select({
-                    id: adminRefreshTokens.id,
-                    rotated_to_id: adminRefreshTokens.rotated_to_id,
-                    revoked_at: adminRefreshTokens.revoked_at,
-                })
-                    .from(adminRefreshTokens)
-                    .where(eq(adminRefreshTokens.id, cursor));
-                if (!row)
-                    break;
-                if (row.revoked_at == null) {
-                    await db
-                        .update(adminRefreshTokens)
-                        .set({ revoked_at: at, updated_at: new Date() })
-                        .where(eq(adminRefreshTokens.id, row.id));
-                    touched++;
-                }
-                cursor = row.rotated_to_id;
-            }
-            return touched;
+            const [member] = await db
+                .select()
+                .from(adminRefreshTokens)
+                .where(eq(adminRefreshTokens.id, startId));
+            if (!member?.sid)
+                return 0; // Legacy credentials fail closed in the provider.
+            const result = await db
+                .update(adminRefreshTokens)
+                .set({ revoked_at: at, updated_at: at })
+                .where(and(eq(adminRefreshTokens.sid, member.sid), isNull(adminRefreshTokens.revoked_at)));
+            return affectedRowCount(result);
         },
         async revokeAllForUser(adminUserId, at = new Date()) {
             const result = await db

package/dist/modules/admin/retry-deadlock.d.ts

@@ -0,0 +1,2 @@
+/** Retry only InnoDB deadlock victims: error 1213 guarantees transaction rollback. */
+export declare function retryDeadlock<T>(operation: () => Promise<T>): Promise<T>;

package/dist/modules/admin/retry-deadlock.js

@@ -0,0 +1,22 @@
+/** Retry only InnoDB deadlock victims: error 1213 guarantees transaction rollback. */
+export async function retryDeadlock(operation) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            let cause = error;
+            let deadlock = false;
+            for (let depth = 0; depth < 8 && cause && typeof cause === 'object'; depth++) {
+                if ('errno' in cause && cause.errno === 1213) {
+                    deadlock = true;
+                    break;
+                }
+                cause = 'cause' in cause ? cause.cause : undefined;
+            }
+            if (!deadlock || attempt >= 2)
+                throw error;
+            await new Promise((resolve) => setTimeout(resolve, 10 * 2 ** attempt + Math.random() * 10));
+        }
+    }
+}

package/dist/modules/admin/sign-in-rate-limit-store.d.ts

@@ -0,0 +1,11 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { SignInRateLimitStore } from '@byline/admin/auth';
+import type { MySql2Database } from 'drizzle-orm/mysql2';
+import type * as schema from '../../database/schema/index.js';
+export declare function createSignInRateLimitStore(db: MySql2Database<typeof schema>): SignInRateLimitStore;

package/dist/modules/admin/sign-in-rate-limit-store.js

@@ -0,0 +1,37 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { eq, sql } from 'drizzle-orm';
+import { adminSignInRateLimits as counters } from '../../database/schema/auth.js';
+import { retryDeadlock } from './retry-deadlock.js';
+export function createSignInRateLimitStore(db) {
+    return {
+        async consume(key, limit, expiresAt) {
+            // The upsert holds the row lock until our read commits, including concurrent first inserts.
+            return retryDeadlock(() => db.transaction(async (tx) => {
+                await tx
+                    .insert(counters)
+                    .values({ key, attempts: 1, expires_at: expiresAt })
+                    .onDuplicateKeyUpdate({
+                    set: { attempts: sql `least(${counters.attempts} + 1, ${limit + 1})` },
+                });
+                const [row] = await tx
+                    .select({ attempts: counters.attempts })
+                    .from(counters)
+                    .where(eq(counters.key, key))
+                    .for('update');
+                if (!row)
+                    throw new Error('Sign-in counter update returned no row');
+                return row.attempts <= limit;
+            }));
+        },
+        async purgeExpired(before) {
+            const [result] = await db.execute(sql `delete from ${counters} where ${counters.expires_at} < ${before.toISOString().slice(0, 23).replace('T', ' ')} limit 100`);
+            return result.affectedRows;
+        },
+    };
+}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/db-mysql",
   "private": false,
   "license": "MPL-2.0",
-  "version": "5.0.0",
+  "version": "5.1.1",
   "engines": {
     "node": ">=20.9.0"
   },
@@ -48,25 +48,25 @@
   ],
   "dependencies": {
     "drizzle-orm": "^0.45.2",
-    "mysql2": "^3.24.2",
+    "mysql2": "^3.24.4",
     "uuid": "^14.0.2",
-    "@byline/admin": "5.0.0",
-    "@byline/core": "5.0.0"
+    "@byline/admin": "5.1.1",
+    "@byline/core": "5.1.1"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.10",
-    "@types/node": "^26.4.0",
+    "@biomejs/biome": "2.5.12",
+    "@types/node": "^26.5.0",
     "chokidar": "^5.0.0",
     "chokidar-cli": "^3.0.0",
     "dotenv": "^17.4.2",
     "drizzle-kit": "^0.31.10",
     "npm-run-all": "^4.1.5",
-    "tsc-alias": "^1.9.2",
+    "tsc-alias": "^1.9.4",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.11",
-    "@byline/client": "5.0.0",
-    "@byline/auth": "5.0.0",
-    "@byline/db-conformance": "0.0.10"
+    "vitest": "^5.0.0",
+    "@byline/auth": "5.1.1",
+    "@byline/db-conformance": "0.0.10",
+    "@byline/client": "5.1.1"
   },
   "publishConfig": {
     "access": "public",