@rebasepro/server-postgres 0.10.0 → 0.10.1-canary.14e53ae

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.10.0",
+  "version": "0.10.1-canary.14e53ae",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,11 +47,11 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.10.0",
-    "@rebasepro/common": "0.10.0",
-    "@rebasepro/types": "0.10.0",
-    "@rebasepro/utils": "0.10.0",
-    "@rebasepro/server": "0.10.0"
+    "@rebasepro/codegen": "0.10.1-canary.14e53ae",
+    "@rebasepro/server": "0.10.1-canary.14e53ae",
+    "@rebasepro/types": "0.10.1-canary.14e53ae",
+    "@rebasepro/utils": "0.10.1-canary.14e53ae",
+    "@rebasepro/common": "0.10.1-canary.14e53ae"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.9",

package/src/PostgresBootstrapper.ts

@@ -37,6 +37,8 @@ import { buildCollectionsFromSchema, introspectSchema, readRlsStatus } from "./s
 import { buildDrizzleTablesFromSchema, buildDrizzleRelationsFromSchema } from "./schema/dynamic-tables";
 import { detectConnectionPosture, ensureAppRole, validatePolicyPgRoles, warnOnAnonymousGrants, REBASE_USER_ROLE, type RawSqlRunner } from "./security/rls-enforcement";
 import { provisionTriggerCdc, type CdcTableRef } from "./services/cdc/trigger-cdc";
+import { createChannelBus, resolveChannelBusSetting } from "./services/channel-bus";
+import { isChannelBusInstance } from "@rebasepro/types";
 
 export interface PostgresDriverConfig {
     connectionString?: string;
@@ -54,9 +56,13 @@ export interface PostgresDriverConfig {
      */
     introspectionSchema?: string;
     /**
-     * Realtime options. Currently only channel retention, which is opt-in:
-     * without rules here no channel keeps any history and broadcast stays
-     * fire-and-forget. See {@link ChannelRetentionRule}.
+     * Realtime options, both opt-in:
+     *
+     *  - `channels` — retention. Without rules no channel keeps any history and
+     *    broadcast stays fire-and-forget. See {@link ChannelRetentionRule}.
+     *  - `bus` — the cross-instance transport for channel broadcast and
+     *    presence. Defaults to in-process only, which is correct for a single
+     *    instance and wrong for two. See {@link ChannelBusConfig}.
      */
     realtime?: RealtimeChannelsConfig;
 }
@@ -337,6 +343,29 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
             // Prefer DATABASE_DIRECT_URL to bypass PgBouncer for LISTEN/NOTIFY.
             const directUrl = process.env.DATABASE_DIRECT_URL || pgConfig.connectionString;
 
+            // ── Cross-instance channel bus ───────────────────────────────────
+            // Entity changes already span instances (CDC / LISTEN below).
+            // Channel broadcast and presence did not — they lived in per-process
+            // maps, so behind two replicas the clients of one were invisible to
+            // the other. Opt-in, and a no-op when left at "memory".
+            try {
+                const busSetting = resolveChannelBusSetting(pgConfig.realtime?.bus);
+                // A supplied instance is always installed; a named built-in only
+                // when it is not the in-process default, so the common case
+                // touches none of this machinery.
+                const wantsBus = isChannelBusInstance(busSetting) || busSetting.type !== "memory";
+                if (wantsBus) {
+                    await realtimeService.configureChannelBus(
+                        createChannelBus(busSetting, {
+                            db: schemaAwareDb as unknown as NodePgDatabase<Record<string, unknown>>,
+                            directUrl
+                        })
+                    );
+                }
+            } catch (err) {
+                logger.warn("⚠️ [ChannelBus] Could not configure the channel bus — channel broadcast and presence stay per-instance", { error: err });
+            }
+
             // Database-level Change Data Capture. When active, realtime events are
             // emitted for EVERY committed write — including ones that bypass the
             // Rebase API (psql, another service's cron, raw SQL, the Studio SQL
@@ -615,6 +644,46 @@ authRepository };
             return internals.realtimeService;
         },
 
+        /**
+         * Create any collection tables, columns and enum types the database is
+         * missing — additively, never destructively.
+         *
+         * This is what lets the managed runtime boot a project against a fresh
+         * database and actually serve it. Before this, only auth tables were
+         * ensured, so a managed tenant came up with working sign-in and a 500 on
+         * every data route.
+         *
+         * Runs through the drizzle handle's underlying session so it uses the
+         * same connection (and therefore the same privileges) the driver already
+         * proved it can bootstrap with.
+         */
+        async ensureCollectionSchema(
+            collections: unknown[],
+            driverResult: InitializedDriver,
+            log?: (message: string) => void
+        ): Promise<{ applied: number }> {
+            const internals = driverResult.internals as PostgresDriverInternals;
+            const { ensureCollectionTables } = await import("./schema/ensure-collection-tables");
+            // Runs through the drizzle handle the driver already bootstrapped
+            // with, so it uses exactly the connection and privileges that were
+            // proven to work. Every statement is DDL or a catalogue read with no
+            // bindable values (schema names are identifiers), and the module
+            // validates them before they reach a string.
+            const queryable = {
+                async query<T>(text: string): Promise<{ rows: T[] }> {
+                    const result = await internals.db.execute(sql.raw(text));
+                    const rows = (result as unknown as { rows?: T[] }).rows;
+                    return { rows: rows ?? (Array.isArray(result) ? (result as T[]) : []) };
+                }
+            };
+            const plan = await ensureCollectionTables(
+                queryable,
+                collections as Parameters<typeof ensureCollectionTables>[1],
+                log
+            );
+            return { applied: plan.actions.length };
+        },
+
         getAdmin(driverResult: InitializedDriver): DatabaseAdmin | undefined {
             const internals = driverResult.internals as PostgresDriverInternals;
             return internals.driver.admin;

package/src/auth/ensure-tables.ts

@@ -107,6 +107,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
                 email_verification_sent_at TIMESTAMP WITH TIME ZONE,
                 is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
                 metadata JSONB DEFAULT '{}' NOT NULL,
+                tokens_valid_after TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
             )
@@ -209,17 +210,23 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         `);
 
 
-        // Create refresh tokens table (includes user_agent, ip_address, and unique constraint)
+        // Create refresh tokens table. One row per TOKEN, grouped into a
+        // sign-in by session_id — deliberately without a uniqueness rule on
+        // (uid, user_agent, ip_address); see the schema module for why that
+        // constraint had to go.
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
                 uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                session_id TEXT NOT NULL DEFAULT gen_random_uuid()::text,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+                revoked BOOLEAN DEFAULT FALSE NOT NULL,
+                rotated_at TIMESTAMP WITH TIME ZONE,
+                session_started_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
         `);
 
@@ -348,6 +355,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             "email_verification_sent_at TIMESTAMP WITH TIME ZONE",
             "is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
             "metadata JSONB DEFAULT '{}' NOT NULL",
+            "tokens_valid_after TIMESTAMP WITH TIME ZONE",
             "created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
             "updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
         ];
@@ -358,6 +366,86 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             `);
         }
 
+        // ── Migration: refresh_tokens become session-scoped, rotation-safe ──
+        // Two shapes are reconciled here, on EVERY table named refresh_tokens
+        // in whatever schema it lives (a database provisioned by an older era
+        // can carry the table in a different schema than the one this run
+        // derives, and auth would then read a table nobody migrated):
+        //
+        //   1. The new columns. A token is now a member of a session
+        //      (`session_id`) and is retained after rotation (`revoked`,
+        //      `rotated_at`) so a replayed token can be recognised instead of
+        //      looking like a forgery. `session_started_at` is carried across
+        //      rotations so `users.tokens_valid_after` cannot be outrun.
+        //   2. The removal of `unique_device_session`. It made (uid,
+        //      user_agent, ip_address) the identity of a session, which evicted
+        //      a second browser profile behind one NAT and churned rows as
+        //      phones changed networks. UA and IP are metadata now.
+        //
+        // Every existing row is adopted rather than dropped: it keeps its
+        // token_hash, gets a session of its own, and stays unrevoked — so the
+        // sessions live in browsers right now survive the upgrade rather than
+        // everyone being signed out by the fix for being signed out.
+        try {
+            const rtTables = await db.execute(sql`
+                SELECT table_schema, table_name
+                FROM information_schema.tables
+                WHERE table_name = 'refresh_tokens'
+            `);
+            const found = (rtTables.rows as { table_schema: string; table_name: string }[]);
+            logger.info(`🔍 refresh_tokens reconcile: found ${found.length} table(s): ${found.map(r => `"${r.table_schema}"."${r.table_name}"`).join(", ") || "(none)"}`);
+            for (const { table_schema } of found) {
+                const qualified = `"${table_schema}"."refresh_tokens"`;
+                try {
+                    // Added nullable, then back-filled, then constrained: adding
+                    // `session_id NOT NULL DEFAULT gen_random_uuid()` in one step
+                    // would stamp every existing row with the SAME uuid on some
+                    // Postgres versions, silently merging every live session into
+                    // one that a single logout would then wipe.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_id TEXT`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
+
+                    // One session per pre-existing row: under the old model a row
+                    // WAS a device session, and there is no record of which rows
+                    // descended from the same sign-in.
+                    await db.execute(sql`
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_id = gen_random_uuid()::text
+                        WHERE session_id IS NULL
+                    `);
+                    await db.execute(sql`
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_started_at = COALESCE(created_at, NOW())
+                        WHERE session_started_at IS NULL
+                    `);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET DEFAULT gen_random_uuid()::text`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET DEFAULT NOW()`);
+                    // SET NOT NULL only once the back-fill above has definitely
+                    // run; on a table that somehow still holds a NULL this throws
+                    // and is caught below rather than failing the boot.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET NOT NULL`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET NOT NULL`);
+
+                    await db.execute(sql`
+                        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_session
+                        ON ${sql.raw(qualified)}(session_id)
+                    `);
+
+                    // The device-session constraint is now actively harmful: two
+                    // live tokens of one session (a rotation in flight) share a
+                    // uid, and usually a user agent and IP too.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
+                    logger.info(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
+                } catch (perTableError: unknown) {
+                    logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
+                }
+            }
+        } catch (migrationError: unknown) {
+            logger.warn(`⚠️  refresh_tokens session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
+        }
+
         // ── Migration: Copy roles from legacy junction table to inline column ──
         // If the old rebase.user_roles and rebase.roles tables exist, migrate
         // the data into the new TEXT[] column then drop the legacy tables.

package/src/auth/services.ts

@@ -14,6 +14,7 @@ import {
     RoleData,
     CreateRoleData,
     RefreshTokenInfo,
+    RefreshTokenSession,
     PasswordResetTokenInfo,
     MagicLinkTokenInfo,
     UserIdentityData,
@@ -529,6 +530,7 @@ export class UserService implements UserRepository {
 
 export class RefreshTokenService {
     private refreshTokensTable: RebasePgTable;
+    private usersTable: RebasePgTable | null;
 
     constructor(
         private db: NodePgDatabase,
@@ -536,55 +538,159 @@ export class RefreshTokenService {
     ) {
         if (tableOrTables && ((tableOrTables as Partial<AuthSchemaTables>).refreshTokens || (tableOrTables as Partial<AuthSchemaTables>).users)) {
             this.refreshTokensTable = ((tableOrTables as Partial<AuthSchemaTables>).refreshTokens || refreshTokens) as RebasePgTable;
+            this.usersTable = ((tableOrTables as Partial<AuthSchemaTables>).users || users) as RebasePgTable;
         } else {
             this.refreshTokensTable = (tableOrTables as RebasePgTable) || (refreshTokens as unknown as RebasePgTable);
+            this.usersTable = users as unknown as RebasePgTable;
         }
     }
 
-    async createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void> {
-        // Fallback to empty string because UNIQUE constraints treat NULLs as strictly distinct in standard Postgres.
-        // We want (uid, NULL, NULL) to collide and overwrite, so we map undefined/null to empty strings.
+    /**
+     * Whether the table actually carries a column, so a host application that
+     * supplied its own `refresh_tokens` table — one that predates session
+     * grouping — degrades instead of throwing on every sign-in.
+     */
+    private has(column: string): boolean {
+        return Boolean((this.refreshTokensTable as unknown as Record<string, unknown>)[column]);
+    }
+
+    private col(column: string) {
+        return (this.refreshTokensTable as unknown as Record<string, never>)[column];
+    }
+
+    /** The columns to read back, narrowed to the ones this table has. */
+    private selection() {
+        const selection: Record<string, never> = {
+            id: this.refreshTokensTable.id,
+            uid: this.refreshTokensTable.uid,
+            tokenHash: this.refreshTokensTable.tokenHash,
+            expiresAt: this.refreshTokensTable.expiresAt,
+            createdAt: this.refreshTokensTable.createdAt,
+            userAgent: this.refreshTokensTable.userAgent,
+            ipAddress: this.refreshTokensTable.ipAddress
+        } as unknown as Record<string, never>;
+        for (const optional of ["sessionId", "rotatedAt", "revoked", "sessionStartedAt"]) {
+            if (this.has(optional)) selection[optional] = this.col(optional);
+        }
+        return selection;
+    }
+
+    async createToken(
+        uid: string,
+        tokenHash: string,
+        expiresAt: Date,
+        userAgent?: string,
+        ipAddress?: string,
+        session?: RefreshTokenSession
+    ): Promise<void> {
+        // Empty strings rather than NULLs: the device-session UNIQUE constraint
+        // that needed them is gone, but sessions-list UIs already render "" as
+        // "unknown device" and would start showing blanks otherwise.
         const safeUserAgent = userAgent || "";
         const safeIpAddress = ipAddress || "";
 
-        // Atomic upsert keyed on the device session (uid, user_agent, ip_address).
-        // A DELETE-then-INSERT races under concurrent refreshes — cookie-mode boot can
-        // fire two /refresh calls at once (both carrying the same refresh cookie): both
-        // DELETE, then the second INSERT violates `unique_device_session` and 500s.
-        // A single INSERT ... ON CONFLICT DO UPDATE rotates the token atomically.
-        await this.db.insert(this.refreshTokensTable)
-            .values({
-                uid,
-                tokenHash,
-                expiresAt,
-                userAgent: safeUserAgent,
-                ipAddress: safeIpAddress
-            })
-            .onConflictDoUpdate({
-                target: [
-                    this.refreshTokensTable.uid,
-                    this.refreshTokensTable.userAgent,
-                    this.refreshTokensTable.ipAddress
-                ],
-                set: { tokenHash, expiresAt }
-            });
+        // A plain INSERT. Rotation ADDS a token; it does not replace a device's
+        // row. Two refreshes racing on the same session therefore both succeed
+        // and both end holding a usable token, where the previous upsert had
+        // them overwrite each other and logged one of the two tabs out.
+        const values: Record<string, unknown> = {
+            uid,
+            tokenHash,
+            expiresAt,
+            userAgent: safeUserAgent,
+            ipAddress: safeIpAddress
+        };
+        if (session && this.has("sessionId")) values.sessionId = session.id;
+        if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
+
+        await this.db.insert(this.refreshTokensTable).values(values);
     }
 
     async findByHash(tokenHash: string): Promise<RefreshTokenInfo | null> {
         const [token] = await this.db
-            .select({
-                id: this.refreshTokensTable.id,
-                uid: this.refreshTokensTable.uid,
-                tokenHash: this.refreshTokensTable.tokenHash,
-                expiresAt: this.refreshTokensTable.expiresAt,
-                createdAt: this.refreshTokensTable.createdAt,
-                userAgent: this.refreshTokensTable.userAgent,
-                ipAddress: this.refreshTokensTable.ipAddress
-            })
+            .select(this.selection())
             .from(this.refreshTokensTable)
             .where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 
-        return (token as RefreshTokenInfo) || null;
+        return (token as unknown as RefreshTokenInfo) || null;
+    }
+
+    /**
+     * Record that a token was rotated away, keeping the row.
+     *
+     * The row is what lets `/auth/refresh` distinguish "you already used this,
+     * here is a fresh one" from "no idea what this is". Deleting it — which is
+     * what this used to do — collapsed both into a 401 and signed the user out
+     * for the crime of losing a response.
+     */
+    async markRotated(tokenHash: string): Promise<void> {
+        if (!this.has("rotatedAt")) {
+            await this.deleteByHash(tokenHash);
+            return;
+        }
+        await this.db
+            .update(this.refreshTokensTable)
+            .set({ rotatedAt: new Date() })
+            .where(eq(this.refreshTokensTable.tokenHash, tokenHash));
+    }
+
+    /** Final kill of one sign-in: logout, or revoking a device remotely. */
+    async revokeSession(sessionId: string): Promise<void> {
+        if (!this.has("sessionId")) return;
+        if (this.has("revoked")) {
+            await this.db
+                .update(this.refreshTokensTable)
+                .set({ revoked: true, ...(this.has("rotatedAt") ? { rotatedAt: new Date() } : {}) })
+                .where(eq(this.col("sessionId"), sessionId));
+            return;
+        }
+        await this.db.delete(this.refreshTokensTable).where(eq(this.col("sessionId"), sessionId));
+    }
+
+    /**
+     * Housekeeping: rotation would otherwise leave a row per refresh forever.
+     * Superseded rows are only needed for as long as a straggler might still
+     * present them, and expired ones are dead weight everywhere.
+     */
+    async prune(uid: string, sessionId: string, supersededBefore: Date): Promise<void> {
+        const uidCol = this.refreshTokensTable.uid;
+        const expiresCol = this.refreshTokensTable.expiresAt;
+        if (!this.has("rotatedAt") || !this.has("sessionId")) {
+            await this.db.delete(this.refreshTokensTable)
+                .where(sql`${uidCol} = ${uid} AND ${expiresCol} < NOW()`);
+            return;
+        }
+        const rotatedCol = this.col("rotatedAt");
+        const sessionCol = this.col("sessionId");
+        await this.db.delete(this.refreshTokensTable).where(sql`
+            ${uidCol} = ${uid}
+            AND (
+                ${expiresCol} < NOW()
+                OR (
+                    ${sessionCol} = ${sessionId}
+                    AND ${rotatedCol} IS NOT NULL
+                    AND ${rotatedCol} < ${supersededBefore}
+                )
+            )
+        `);
+    }
+
+    async getTokensValidAfter(uid: string): Promise<Date | null> {
+        if (!this.usersTable || !(this.usersTable as unknown as Record<string, unknown>).tokensValidAfter) return null;
+        const [row] = await this.db
+            .select({ tokensValidAfter: (this.usersTable as unknown as Record<string, never>).tokensValidAfter })
+            .from(this.usersTable)
+            .where(eq(this.usersTable.id, uid));
+        const value = (row as { tokensValidAfter?: Date | string | null } | undefined)?.tokensValidAfter;
+        return value ? new Date(value) : null;
+    }
+
+    async setTokensValidAfter(uid: string, at: Date): Promise<void> {
+        if (!this.usersTable || !(this.usersTable as unknown as Record<string, unknown>).tokensValidAfter) return;
+        await this.db
+            .update(this.usersTable)
+            .set({ tokensValidAfter: at })
+            .where(eq(this.usersTable.id, uid));
     }
 
     async deleteByHash(tokenHash: string): Promise<void> {
@@ -597,20 +703,12 @@ export class RefreshTokenService {
 
     async listForUser(uid: string): Promise<RefreshTokenInfo[]> {
         const tokens = await this.db
-            .select({
-                id: this.refreshTokensTable.id,
-                uid: this.refreshTokensTable.uid,
-                tokenHash: this.refreshTokensTable.tokenHash,
-                expiresAt: this.refreshTokensTable.expiresAt,
-                createdAt: this.refreshTokensTable.createdAt,
-                userAgent: this.refreshTokensTable.userAgent,
-                ipAddress: this.refreshTokensTable.ipAddress
-            })
+            .select(this.selection())
             .from(this.refreshTokensTable)
             .where(eq(this.refreshTokensTable.uid, uid))
             .orderBy(this.refreshTokensTable.createdAt);
 
-        return tokens as RefreshTokenInfo[];
+        return tokens as unknown as RefreshTokenInfo[];
     }
 
     async deleteById(id: string, uid: string): Promise<void> {
@@ -804,8 +902,28 @@ export class PostgresTokenRepository implements TokenRepository {
 
     // Refresh token operations
 
-    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void> {
-        await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
+    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void> {
+        await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+    }
+
+    async markRefreshTokenRotated(tokenHash: string): Promise<void> {
+        await this.refreshTokenService.markRotated(tokenHash);
+    }
+
+    async revokeRefreshTokenSession(sessionId: string): Promise<void> {
+        await this.refreshTokenService.revokeSession(sessionId);
+    }
+
+    async pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void> {
+        await this.refreshTokenService.prune(uid, sessionId, supersededBefore);
+    }
+
+    async getTokensValidAfter(uid: string): Promise<Date | null> {
+        return this.refreshTokenService.getTokensValidAfter(uid);
+    }
+
+    async setTokensValidAfter(uid: string, at: Date): Promise<void> {
+        await this.refreshTokenService.setTokensValidAfter(uid, at);
     }
 
     async findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null> {
@@ -1018,8 +1136,28 @@ collectionPermissions: null }
 
     // Token operations (delegate to PostgresTokenRepository)
 
-    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void> {
-        await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
+    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void> {
+        await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+    }
+
+    async markRefreshTokenRotated(tokenHash: string): Promise<void> {
+        await this.tokenRepository.markRefreshTokenRotated(tokenHash);
+    }
+
+    async revokeRefreshTokenSession(sessionId: string): Promise<void> {
+        await this.tokenRepository.revokeRefreshTokenSession(sessionId);
+    }
+
+    async pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void> {
+        await this.tokenRepository.pruneRefreshTokens(uid, sessionId, supersededBefore);
+    }
+
+    async getTokensValidAfter(uid: string): Promise<Date | null> {
+        return this.tokenRepository.getTokensValidAfter(uid);
+    }
+
+    async setTokensValidAfter(uid: string, at: Date): Promise<void> {
+        await this.tokenRepository.setTokensValidAfter(uid, at);
     }
 
     async findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null> {