@everystack/auth 0.4.7 → 0.4.8

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@everystack/auth` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.8] - 2026-09-26
+
+### Fixed
+
+- revoke sessions when users are blocked
+
+## [0.4.7] - 2026-09-26
+
+### Fixed
+
+- enforce bans on refresh and signin, check password before ban
+- make the access token lifetime configurable
+- signout revokes the presented refresh token
+- refuse banned users on OAuth sign-in; signout never fails on revoke
+
+### Documentation
+
+- document signout revocation, accessTokenTtlSec and ban enforcement
+
 ## [0.4.6] - 2026-09-22
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/auth",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "JWT authentication handlers, password hashing, and React auth context",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/models/functions.ts

@@ -39,8 +39,9 @@
  * hand-patch a body here.
  */
 
-import { defineFunction, arg, can, sql } from '@everystack/model';
+import { defineFunction, defineTrigger, arg, can, sql } from '@everystack/model';
 import { DEFAULT_ACCESS_TOKEN_TTL_SEC, resolveAccessTokenTtl } from '../sql';
+import { User } from './user';
 
 export const changePasswordFn = defineFunction('auth.change_password', {
   args: [arg('p_current_password', 'text'), arg('p_new_password', 'text')],
@@ -849,6 +850,36 @@ END;
 `,
 });
 
+/** Removes every session as soon as an account becomes unavailable. */
+export const revokeRefreshTokensOnUserBlockFn = defineFunction('auth.revoke_refresh_tokens_on_user_block', {
+  returns: 'trigger',
+  language: 'plpgsql',
+  security: 'definer',
+  searchPath: ['auth', 'public', 'pg_temp'],
+  body: sql`
+BEGIN
+  DELETE FROM auth.refresh_tokens WHERE user_id = NEW.id;
+  RETURN NEW;
+END;`,
+});
+
+/** The blocking transition is the durable revocation point; validation keeps its raise contract. */
+export const revokeRefreshTokensOnUserBlockTrigger = defineTrigger('users_revoke_refresh_tokens_on_block', {
+  on: User,
+  timing: 'after',
+  events: ['update'],
+  of: ['banned_until', 'deleted_at'],
+  forEach: 'row',
+  condition: sql`
+    (NEW.deleted_at IS NOT NULL AND OLD.deleted_at IS NULL)
+    OR (
+      NEW.banned_until > now()
+      AND (OLD.banned_until IS NULL OR OLD.banned_until <= now())
+    )
+  `,
+  execute: revokeRefreshTokensOnUserBlockFn,
+});
+
 export const verifyJwtFn = defineFunction('auth.verify_jwt', {
   args: [arg('p_token', 'text')],
   returns: 'jsonb',
@@ -979,6 +1010,7 @@ export const coreFunctions = [hashPasswordFn, verifyPasswordFn, signJwtFn, verif
 /** The refresh-token family (RFC 6819 rotation). Always on. */
 export const refreshTokenFunctions = [
   issueRefreshTokenFn, validateRefreshTokenFn, revokeRefreshTokensFn, signOutFn, cleanupRefreshTokensFn,
+  revokeRefreshTokensOnUserBlockFn,
 ];
 
 /** `auth.uid()` / `auth.role()` / `auth.jwt()` — called FROM RLS policies, so granted to the
@@ -1041,3 +1073,8 @@ export function authFunctions(opts: AuthFunctionOptions = {}) {
     ...(opts.jwtWrappers === true ? jwtWrapperFunctionsFor(opts.accessTokenTtlSec) : []),
   ];
 }
+
+/** The auth module's complete derived layer: functions plus lifecycle bindings. */
+export function authDerived(opts: AuthFunctionOptions = {}) {
+  return [...authFunctions(opts), revokeRefreshTokensOnUserBlockTrigger];
+}

package/src/models/index.ts

@@ -25,7 +25,7 @@ import { Device } from './device';
 import { MfaFactor } from './mfa-factor';
 import { MfaChallenge } from './mfa-challenge';
 import { OneTimeToken } from './one-time-token';
-import { authFunctions, type AuthFunctionOptions } from './functions';
+import { authDerived, type AuthFunctionOptions } from './functions';
 
 export * from './functions';
 
@@ -51,7 +51,7 @@ export function defineAuthModule(opts: AuthFunctionOptions = {}): Module {
   return defineModule({
     models: authModels,
     extensions: ['pgcrypto'],
-    derived: authFunctions(opts),
+    derived: authDerived(opts),
   });
 }
 

package/src/sql.ts

@@ -358,6 +358,33 @@ $$;
 
 REVOKE EXECUTE ON FUNCTION auth.validate_refresh_token FROM PUBLIC;`;
 
+const REVOKE_REFRESH_TOKENS_ON_USER_BLOCK = `\
+CREATE OR REPLACE FUNCTION auth.revoke_refresh_tokens_on_user_block()
+RETURNS TRIGGER
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+BEGIN
+  DELETE FROM auth.refresh_tokens WHERE user_id = NEW.id;
+  RETURN NEW;
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.revoke_refresh_tokens_on_user_block FROM PUBLIC;
+
+CREATE TRIGGER users_revoke_refresh_tokens_on_block
+AFTER UPDATE OF banned_until, deleted_at ON auth.users
+FOR EACH ROW
+WHEN (
+  (NEW.deleted_at IS NOT NULL AND OLD.deleted_at IS NULL)
+  OR (
+    NEW.banned_until > now()
+    AND (OLD.banned_until IS NULL OR OLD.banned_until <= now())
+  )
+)
+EXECUTE FUNCTION auth.revoke_refresh_tokens_on_user_block();`;
+
 const REVOKE_REFRESH_TOKENS = `\
 CREATE OR REPLACE FUNCTION auth.revoke_refresh_tokens(
   p_user_id UUID,
@@ -1091,7 +1118,10 @@ export function generateCoreSQL(): string {
 
 /** issue + validate + revoke + sign_out + cleanup refresh tokens (RFC 6819) */
 export function generateRefreshTokenSQL(): string {
-  return [ISSUE_REFRESH_TOKEN, '', VALIDATE_REFRESH_TOKEN, '', REVOKE_REFRESH_TOKENS, '', SIGN_OUT, '', CLEANUP_REFRESH_TOKENS]
+  return [
+    ISSUE_REFRESH_TOKEN, '', VALIDATE_REFRESH_TOKEN, '', REVOKE_REFRESH_TOKENS_ON_USER_BLOCK, '',
+    REVOKE_REFRESH_TOKENS, '', SIGN_OUT, '', CLEANUP_REFRESH_TOKENS,
+  ]
     .join('\n')
     .trimEnd() + '\n';
 }