@rebasepro/server-postgres 0.10.0 → 0.10.1-canary.18115ba

package/dist/schema/auth-schema.d.ts

@@ -232,6 +232,23 @@ export declare function createAuthSchema(usersSchemaName?: string): {
             }, {}, {
                 $type: Record<string, unknown>;
             }>;
+            tokensValidAfter: import("drizzle-orm/pg-core").PgColumn<{
+                name: "tokens_valid_after";
+                tableName: "users";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             createdAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "created_at";
                 tableName: "users";
@@ -307,6 +324,23 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            sessionId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "session_id";
+                tableName: "refresh_tokens";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             tokenHash: import("drizzle-orm/pg-core").PgColumn<{
                 name: "token_hash";
                 tableName: "refresh_tokens";
@@ -343,6 +377,57 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            revoked: import("drizzle-orm/pg-core").PgColumn<{
+                name: "revoked";
+                tableName: "refresh_tokens";
+                dataType: "boolean";
+                columnType: "PgBoolean";
+                data: boolean;
+                driverParam: boolean;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            rotatedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "rotated_at";
+                tableName: "refresh_tokens";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            sessionStartedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "session_started_at";
+                tableName: "refresh_tokens";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             userAgent: import("drizzle-orm/pg-core").PgColumn<{
                 name: "user_agent";
                 tableName: "refresh_tokens";
@@ -1398,6 +1483,23 @@ export declare const users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {
             $type: Record<string, unknown>;
         }>;
+        tokensValidAfter: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tokens_valid_after";
+            tableName: "users";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "users";
@@ -1473,6 +1575,23 @@ export declare const refreshTokens: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "session_id";
+            tableName: "refresh_tokens";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         tokenHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "token_hash";
             tableName: "refresh_tokens";
@@ -1509,6 +1628,57 @@ export declare const refreshTokens: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        revoked: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked";
+            tableName: "refresh_tokens";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        rotatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "rotated_at";
+            tableName: "refresh_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sessionStartedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "session_started_at";
+            tableName: "refresh_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         userAgent: import("drizzle-orm/pg-core").PgColumn<{
             name: "user_agent";
             tableName: "refresh_tokens";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.10.0",
+  "version": "0.10.1-canary.18115ba",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,11 +47,11 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.10.0",
-    "@rebasepro/common": "0.10.0",
-    "@rebasepro/types": "0.10.0",
-    "@rebasepro/utils": "0.10.0",
-    "@rebasepro/server": "0.10.0"
+    "@rebasepro/codegen": "0.10.1-canary.18115ba",
+    "@rebasepro/common": "0.10.1-canary.18115ba",
+    "@rebasepro/utils": "0.10.1-canary.18115ba",
+    "@rebasepro/server": "0.10.1-canary.18115ba",
+    "@rebasepro/types": "0.10.1-canary.18115ba"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.9",

package/src/auth/ensure-tables.ts

@@ -107,6 +107,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
                 email_verification_sent_at TIMESTAMP WITH TIME ZONE,
                 is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
                 metadata JSONB DEFAULT '{}' NOT NULL,
+                tokens_valid_after TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
             )
@@ -209,17 +210,23 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         `);
 
 
-        // Create refresh tokens table (includes user_agent, ip_address, and unique constraint)
+        // Create refresh tokens table. One row per TOKEN, grouped into a
+        // sign-in by session_id — deliberately without a uniqueness rule on
+        // (uid, user_agent, ip_address); see the schema module for why that
+        // constraint had to go.
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
                 uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                session_id TEXT NOT NULL DEFAULT gen_random_uuid()::text,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+                revoked BOOLEAN DEFAULT FALSE NOT NULL,
+                rotated_at TIMESTAMP WITH TIME ZONE,
+                session_started_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
         `);
 
@@ -348,6 +355,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             "email_verification_sent_at TIMESTAMP WITH TIME ZONE",
             "is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
             "metadata JSONB DEFAULT '{}' NOT NULL",
+            "tokens_valid_after TIMESTAMP WITH TIME ZONE",
             "created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
             "updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
         ];
@@ -358,6 +366,86 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             `);
         }
 
+        // ── Migration: refresh_tokens become session-scoped, rotation-safe ──
+        // Two shapes are reconciled here, on EVERY table named refresh_tokens
+        // in whatever schema it lives (a database provisioned by an older era
+        // can carry the table in a different schema than the one this run
+        // derives, and auth would then read a table nobody migrated):
+        //
+        //   1. The new columns. A token is now a member of a session
+        //      (`session_id`) and is retained after rotation (`revoked`,
+        //      `rotated_at`) so a replayed token can be recognised instead of
+        //      looking like a forgery. `session_started_at` is carried across
+        //      rotations so `users.tokens_valid_after` cannot be outrun.
+        //   2. The removal of `unique_device_session`. It made (uid,
+        //      user_agent, ip_address) the identity of a session, which evicted
+        //      a second browser profile behind one NAT and churned rows as
+        //      phones changed networks. UA and IP are metadata now.
+        //
+        // Every existing row is adopted rather than dropped: it keeps its
+        // token_hash, gets a session of its own, and stays unrevoked — so the
+        // sessions live in browsers right now survive the upgrade rather than
+        // everyone being signed out by the fix for being signed out.
+        try {
+            const rtTables = await db.execute(sql`
+                SELECT table_schema, table_name
+                FROM information_schema.tables
+                WHERE table_name = 'refresh_tokens'
+            `);
+            const found = (rtTables.rows as { table_schema: string; table_name: string }[]);
+            logger.info(`🔍 refresh_tokens reconcile: found ${found.length} table(s): ${found.map(r => `"${r.table_schema}"."${r.table_name}"`).join(", ") || "(none)"}`);
+            for (const { table_schema } of found) {
+                const qualified = `"${table_schema}"."refresh_tokens"`;
+                try {
+                    // Added nullable, then back-filled, then constrained: adding
+                    // `session_id NOT NULL DEFAULT gen_random_uuid()` in one step
+                    // would stamp every existing row with the SAME uuid on some
+                    // Postgres versions, silently merging every live session into
+                    // one that a single logout would then wipe.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_id TEXT`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
+
+                    // One session per pre-existing row: under the old model a row
+                    // WAS a device session, and there is no record of which rows
+                    // descended from the same sign-in.
+                    await db.execute(sql`
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_id = gen_random_uuid()::text
+                        WHERE session_id IS NULL
+                    `);
+                    await db.execute(sql`
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_started_at = COALESCE(created_at, NOW())
+                        WHERE session_started_at IS NULL
+                    `);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET DEFAULT gen_random_uuid()::text`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET DEFAULT NOW()`);
+                    // SET NOT NULL only once the back-fill above has definitely
+                    // run; on a table that somehow still holds a NULL this throws
+                    // and is caught below rather than failing the boot.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET NOT NULL`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET NOT NULL`);
+
+                    await db.execute(sql`
+                        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_session
+                        ON ${sql.raw(qualified)}(session_id)
+                    `);
+
+                    // The device-session constraint is now actively harmful: two
+                    // live tokens of one session (a rotation in flight) share a
+                    // uid, and usually a user agent and IP too.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
+                    logger.info(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
+                } catch (perTableError: unknown) {
+                    logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
+                }
+            }
+        } catch (migrationError: unknown) {
+            logger.warn(`⚠️  refresh_tokens session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
+        }
+
         // ── Migration: Copy roles from legacy junction table to inline column ──
         // If the old rebase.user_roles and rebase.roles tables exist, migrate
         // the data into the new TEXT[] column then drop the legacy tables.

package/src/auth/services.ts

@@ -14,6 +14,7 @@ import {
     RoleData,
     CreateRoleData,
     RefreshTokenInfo,
+    RefreshTokenSession,
     PasswordResetTokenInfo,
     MagicLinkTokenInfo,
     UserIdentityData,
@@ -529,6 +530,7 @@ export class UserService implements UserRepository {
 
 export class RefreshTokenService {
     private refreshTokensTable: RebasePgTable;
+    private usersTable: RebasePgTable | null;
 
     constructor(
         private db: NodePgDatabase,
@@ -536,55 +538,159 @@ export class RefreshTokenService {
     ) {
         if (tableOrTables && ((tableOrTables as Partial<AuthSchemaTables>).refreshTokens || (tableOrTables as Partial<AuthSchemaTables>).users)) {
             this.refreshTokensTable = ((tableOrTables as Partial<AuthSchemaTables>).refreshTokens || refreshTokens) as RebasePgTable;
+            this.usersTable = ((tableOrTables as Partial<AuthSchemaTables>).users || users) as RebasePgTable;
         } else {
             this.refreshTokensTable = (tableOrTables as RebasePgTable) || (refreshTokens as unknown as RebasePgTable);
+            this.usersTable = users as unknown as RebasePgTable;
         }
     }
 
-    async createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void> {
-        // Fallback to empty string because UNIQUE constraints treat NULLs as strictly distinct in standard Postgres.
-        // We want (uid, NULL, NULL) to collide and overwrite, so we map undefined/null to empty strings.
+    /**
+     * Whether the table actually carries a column, so a host application that
+     * supplied its own `refresh_tokens` table — one that predates session
+     * grouping — degrades instead of throwing on every sign-in.
+     */
+    private has(column: string): boolean {
+        return Boolean((this.refreshTokensTable as unknown as Record<string, unknown>)[column]);
+    }
+
+    private col(column: string) {
+        return (this.refreshTokensTable as unknown as Record<string, never>)[column];
+    }
+
+    /** The columns to read back, narrowed to the ones this table has. */
+    private selection() {
+        const selection: Record<string, never> = {
+            id: this.refreshTokensTable.id,
+            uid: this.refreshTokensTable.uid,
+            tokenHash: this.refreshTokensTable.tokenHash,
+            expiresAt: this.refreshTokensTable.expiresAt,
+            createdAt: this.refreshTokensTable.createdAt,
+            userAgent: this.refreshTokensTable.userAgent,
+            ipAddress: this.refreshTokensTable.ipAddress
+        } as unknown as Record<string, never>;
+        for (const optional of ["sessionId", "rotatedAt", "revoked", "sessionStartedAt"]) {
+            if (this.has(optional)) selection[optional] = this.col(optional);
+        }
+        return selection;
+    }
+
+    async createToken(
+        uid: string,
+        tokenHash: string,
+        expiresAt: Date,
+        userAgent?: string,
+        ipAddress?: string,
+        session?: RefreshTokenSession
+    ): Promise<void> {
+        // Empty strings rather than NULLs: the device-session UNIQUE constraint
+        // that needed them is gone, but sessions-list UIs already render "" as
+        // "unknown device" and would start showing blanks otherwise.
         const safeUserAgent = userAgent || "";
         const safeIpAddress = ipAddress || "";
 
-        // Atomic upsert keyed on the device session (uid, user_agent, ip_address).
-        // A DELETE-then-INSERT races under concurrent refreshes — cookie-mode boot can
-        // fire two /refresh calls at once (both carrying the same refresh cookie): both
-        // DELETE, then the second INSERT violates `unique_device_session` and 500s.
-        // A single INSERT ... ON CONFLICT DO UPDATE rotates the token atomically.
-        await this.db.insert(this.refreshTokensTable)
-            .values({
-                uid,
-                tokenHash,
-                expiresAt,
-                userAgent: safeUserAgent,
-                ipAddress: safeIpAddress
-            })
-            .onConflictDoUpdate({
-                target: [
-                    this.refreshTokensTable.uid,
-                    this.refreshTokensTable.userAgent,
-                    this.refreshTokensTable.ipAddress
-                ],
-                set: { tokenHash, expiresAt }
-            });
+        // A plain INSERT. Rotation ADDS a token; it does not replace a device's
+        // row. Two refreshes racing on the same session therefore both succeed
+        // and both end holding a usable token, where the previous upsert had
+        // them overwrite each other and logged one of the two tabs out.
+        const values: Record<string, unknown> = {
+            uid,
+            tokenHash,
+            expiresAt,
+            userAgent: safeUserAgent,
+            ipAddress: safeIpAddress
+        };
+        if (session && this.has("sessionId")) values.sessionId = session.id;
+        if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
+
+        await this.db.insert(this.refreshTokensTable).values(values);
     }
 
     async findByHash(tokenHash: string): Promise<RefreshTokenInfo | null> {
         const [token] = await this.db
-            .select({
-                id: this.refreshTokensTable.id,
-                uid: this.refreshTokensTable.uid,
-                tokenHash: this.refreshTokensTable.tokenHash,
-                expiresAt: this.refreshTokensTable.expiresAt,
-                createdAt: this.refreshTokensTable.createdAt,
-                userAgent: this.refreshTokensTable.userAgent,
-                ipAddress: this.refreshTokensTable.ipAddress
-            })
+            .select(this.selection())
             .from(this.refreshTokensTable)
             .where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 
-        return (token as RefreshTokenInfo) || null;
+        return (token as unknown as RefreshTokenInfo) || null;
+    }
+
+    /**
+     * Record that a token was rotated away, keeping the row.
+     *
+     * The row is what lets `/auth/refresh` distinguish "you already used this,
+     * here is a fresh one" from "no idea what this is". Deleting it — which is
+     * what this used to do — collapsed both into a 401 and signed the user out
+     * for the crime of losing a response.
+     */
+    async markRotated(tokenHash: string): Promise<void> {
+        if (!this.has("rotatedAt")) {
+            await this.deleteByHash(tokenHash);
+            return;
+        }
+        await this.db
+            .update(this.refreshTokensTable)
+            .set({ rotatedAt: new Date() })
+            .where(eq(this.refreshTokensTable.tokenHash, tokenHash));
+    }
+
+    /** Final kill of one sign-in: logout, or revoking a device remotely. */
+    async revokeSession(sessionId: string): Promise<void> {
+        if (!this.has("sessionId")) return;
+        if (this.has("revoked")) {
+            await this.db
+                .update(this.refreshTokensTable)
+                .set({ revoked: true, ...(this.has("rotatedAt") ? { rotatedAt: new Date() } : {}) })
+                .where(eq(this.col("sessionId"), sessionId));
+            return;
+        }
+        await this.db.delete(this.refreshTokensTable).where(eq(this.col("sessionId"), sessionId));
+    }
+
+    /**
+     * Housekeeping: rotation would otherwise leave a row per refresh forever.
+     * Superseded rows are only needed for as long as a straggler might still
+     * present them, and expired ones are dead weight everywhere.
+     */
+    async prune(uid: string, sessionId: string, supersededBefore: Date): Promise<void> {
+        const uidCol = this.refreshTokensTable.uid;
+        const expiresCol = this.refreshTokensTable.expiresAt;
+        if (!this.has("rotatedAt") || !this.has("sessionId")) {
+            await this.db.delete(this.refreshTokensTable)
+                .where(sql`${uidCol} = ${uid} AND ${expiresCol} < NOW()`);
+            return;
+        }
+        const rotatedCol = this.col("rotatedAt");
+        const sessionCol = this.col("sessionId");
+        await this.db.delete(this.refreshTokensTable).where(sql`
+            ${uidCol} = ${uid}
+            AND (
+                ${expiresCol} < NOW()
+                OR (
+                    ${sessionCol} = ${sessionId}
+                    AND ${rotatedCol} IS NOT NULL
+                    AND ${rotatedCol} < ${supersededBefore}
+                )
+            )
+        `);
+    }
+
+    async getTokensValidAfter(uid: string): Promise<Date | null> {
+        if (!this.usersTable || !(this.usersTable as unknown as Record<string, unknown>).tokensValidAfter) return null;
+        const [row] = await this.db
+            .select({ tokensValidAfter: (this.usersTable as unknown as Record<string, never>).tokensValidAfter })
+            .from(this.usersTable)
+            .where(eq(this.usersTable.id, uid));
+        const value = (row as { tokensValidAfter?: Date | string | null } | undefined)?.tokensValidAfter;
+        return value ? new Date(value) : null;
+    }
+
+    async setTokensValidAfter(uid: string, at: Date): Promise<void> {
+        if (!this.usersTable || !(this.usersTable as unknown as Record<string, unknown>).tokensValidAfter) return;
+        await this.db
+            .update(this.usersTable)
+            .set({ tokensValidAfter: at })
+            .where(eq(this.usersTable.id, uid));
     }
 
     async deleteByHash(tokenHash: string): Promise<void> {
@@ -597,20 +703,12 @@ export class RefreshTokenService {
 
     async listForUser(uid: string): Promise<RefreshTokenInfo[]> {
         const tokens = await this.db
-            .select({
-                id: this.refreshTokensTable.id,
-                uid: this.refreshTokensTable.uid,
-                tokenHash: this.refreshTokensTable.tokenHash,
-                expiresAt: this.refreshTokensTable.expiresAt,
-                createdAt: this.refreshTokensTable.createdAt,
-                userAgent: this.refreshTokensTable.userAgent,
-                ipAddress: this.refreshTokensTable.ipAddress
-            })
+            .select(this.selection())
             .from(this.refreshTokensTable)
             .where(eq(this.refreshTokensTable.uid, uid))
             .orderBy(this.refreshTokensTable.createdAt);
 
-        return tokens as RefreshTokenInfo[];
+        return tokens as unknown as RefreshTokenInfo[];
     }
 
     async deleteById(id: string, uid: string): Promise<void> {
@@ -804,8 +902,28 @@ export class PostgresTokenRepository implements TokenRepository {
 
     // Refresh token operations
 
-    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void> {
-        await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
+    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void> {
+        await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+    }
+
+    async markRefreshTokenRotated(tokenHash: string): Promise<void> {
+        await this.refreshTokenService.markRotated(tokenHash);
+    }
+
+    async revokeRefreshTokenSession(sessionId: string): Promise<void> {
+        await this.refreshTokenService.revokeSession(sessionId);
+    }
+
+    async pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void> {
+        await this.refreshTokenService.prune(uid, sessionId, supersededBefore);
+    }
+
+    async getTokensValidAfter(uid: string): Promise<Date | null> {
+        return this.refreshTokenService.getTokensValidAfter(uid);
+    }
+
+    async setTokensValidAfter(uid: string, at: Date): Promise<void> {
+        await this.refreshTokenService.setTokensValidAfter(uid, at);
     }
 
     async findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null> {
@@ -1018,8 +1136,28 @@ collectionPermissions: null }
 
     // Token operations (delegate to PostgresTokenRepository)
 
-    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void> {
-        await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
+    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void> {
+        await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+    }
+
+    async markRefreshTokenRotated(tokenHash: string): Promise<void> {
+        await this.tokenRepository.markRefreshTokenRotated(tokenHash);
+    }
+
+    async revokeRefreshTokenSession(sessionId: string): Promise<void> {
+        await this.tokenRepository.revokeRefreshTokenSession(sessionId);
+    }
+
+    async pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void> {
+        await this.tokenRepository.pruneRefreshTokens(uid, sessionId, supersededBefore);
+    }
+
+    async getTokensValidAfter(uid: string): Promise<Date | null> {
+        return this.tokenRepository.getTokensValidAfter(uid);
+    }
+
+    async setTokensValidAfter(uid: string, at: Date): Promise<void> {
+        await this.tokenRepository.setTokensValidAfter(uid, at);
     }
 
     async findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null> {