@rebasepro/server-postgres 0.10.1-canary.18115ba → 0.10.1-canary.31c773c

package/dist/auth/services.d.ts

@@ -1,6 +1,6 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { RebasePgTable } from "../types";
-import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
+import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
 export type { Role };
 export interface AuthSchemaTables {
     users: RebasePgTable;
@@ -90,38 +90,9 @@ export declare class UserService implements UserRepository {
 export declare class RefreshTokenService {
     private db;
     private refreshTokensTable;
-    private usersTable;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
-    /**
-     * Whether the table actually carries a column, so a host application that
-     * supplied its own `refresh_tokens` table — one that predates session
-     * grouping — degrades instead of throwing on every sign-in.
-     */
-    private has;
-    private col;
-    /** The columns to read back, narrowed to the ones this table has. */
-    private selection;
-    createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
     findByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
-    /**
-     * Record that a token was rotated away, keeping the row.
-     *
-     * The row is what lets `/auth/refresh` distinguish "you already used this,
-     * here is a fresh one" from "no idea what this is". Deleting it — which is
-     * what this used to do — collapsed both into a 401 and signed the user out
-     * for the crime of losing a response.
-     */
-    markRotated(tokenHash: string): Promise<void>;
-    /** Final kill of one sign-in: logout, or revoking a device remotely. */
-    revokeSession(sessionId: string): Promise<void>;
-    /**
-     * Housekeeping: rotation would otherwise leave a row per refresh forever.
-     * Superseded rows are only needed for as long as a straggler might still
-     * present them, and expired ones are dead weight everywhere.
-     */
-    prune(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
-    getTokensValidAfter(uid: string): Promise<Date | null>;
-    setTokensValidAfter(uid: string, at: Date): Promise<void>;
     deleteByHash(tokenHash: string): Promise<void>;
     deleteAllForUser(uid: string): Promise<void>;
     listForUser(uid: string): Promise<RefreshTokenInfo[]>;
@@ -182,12 +153,7 @@ export declare class PostgresTokenRepository implements TokenRepository {
     private passwordResetTokenService;
     private magicLinkTokenService;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
-    markRefreshTokenRotated(tokenHash: string): Promise<void>;
-    revokeRefreshTokenSession(sessionId: string): Promise<void>;
-    pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
-    getTokensValidAfter(uid: string): Promise<Date | null>;
-    setTokensValidAfter(uid: string, at: Date): Promise<void>;
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
     findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
     deleteRefreshToken(tokenHash: string): Promise<void>;
     deleteAllRefreshTokensForUser(uid: string): Promise<void>;
@@ -239,12 +205,7 @@ export declare class PostgresAuthRepository implements AuthRepository {
     createRole(_data: CreateRoleData): Promise<RoleData>;
     updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
     deleteRole(_id: string): Promise<void>;
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
-    markRefreshTokenRotated(tokenHash: string): Promise<void>;
-    revokeRefreshTokenSession(sessionId: string): Promise<void>;
-    pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
-    getTokensValidAfter(uid: string): Promise<Date | null>;
-    setTokensValidAfter(uid: string, at: Date): Promise<void>;
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
     findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
     deleteRefreshToken(tokenHash: string): Promise<void>;
     deleteAllRefreshTokensForUser(uid: string): Promise<void>;

package/dist/index.es.js

@@ -5,7 +5,7 @@ import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, or, relations, sql } from "drizzle-orm";
-import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
+import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs, { promises } from "fs";
 import path from "path";
 import chokidar from "chokidar";
@@ -9349,59 +9349,21 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		isAnonymous: boolean("is_anonymous").default(false).notNull(),
 		roles: text("roles").array().default([]).notNull(),
 		metadata: jsonb("metadata").$type().default({}).notNull(),
-		/**
-		* Sessions that began before this instant are dead, whatever tokens
-		* they still hold. Password resets and admin revocations stamp it.
-		*
-		* Deleting the user's refresh-token rows (which we also do) is not
-		* sufficient on its own: a request already in flight can insert a
-		* freshly rotated row microseconds after the delete and survive it.
-		* This timestamp cannot be outrun that way — it is checked against
-		* `refresh_tokens.session_started_at`, which rotation carries forward.
-		*/
-		tokensValidAfter: timestamp("tokens_valid_after"),
 		createdAt: timestamp("created_at").defaultNow().notNull(),
 		updatedAt: timestamp("updated_at").defaultNow().notNull()
 	});
 	/**
-	* Refresh tokens for long-lived sessions.
-	*
-	* A row is one token, not one device. Every token minted from the same
-	* sign-in shares a `sessionId`, and rotation ADDS a row rather than
-	* replacing one: the superseded token stays on file, flagged `revoked`
-	* with a `rotatedAt` stamp. That record is what lets the refresh endpoint
-	* tell a client replaying a token it never got an answer for (a response
-	* lost to a redeploy, a second tab racing on boot) apart from a stranger
-	* presenting a token that was never issued. Deleting the old row on sight
-	* — the previous behaviour — made those two cases indistinguishable, and
-	* the legitimate one is overwhelmingly the common one.
-	*
-	* There is deliberately NO unique constraint on (uid, user_agent,
-	* ip_address). Keying a session on the IP meant one row per "device",
-	* so a second browser profile behind the same NAT silently evicted the
-	* first, and a phone changing networks orphaned a row on every hop.
-	* User agent and IP are descriptive metadata for the sessions list;
-	* `sessionId` is the identity.
+	* Refresh tokens for long-lived sessions
 	*/
 	const refreshTokens = tableCreator("refresh_tokens", {
 		id: uuid("id").defaultRandom().primaryKey(),
 		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-		sessionId: uuid("session_id").defaultRandom().notNull(),
 		tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
 		expiresAt: timestamp("expires_at").notNull(),
-		revoked: boolean("revoked").default(false).notNull(),
-		rotatedAt: timestamp("rotated_at"),
-		/**
-		* When the sign-in this token descends from happened — carried across
-		* every rotation, unlike `createdAt`. `users.tokensValidAfter` is
-		* compared against this, so a revocation cannot be outrun by a token
-		* that rotates immediately after it.
-		*/
-		sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
 		userAgent: varchar("user_agent", { length: 500 }),
 		ipAddress: varchar("ip_address", { length: 45 }),
 		createdAt: timestamp("created_at").defaultNow().notNull()
-	}, (table) => ({ sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId) }));
+	}, (table) => ({ uniqueDeviceSession: unique("unique_device_session").on(table.uid, table.userAgent, table.ipAddress) }));
 	/**
 	* Password reset tokens for forgot password flow
 	*/
@@ -21191,7 +21153,6 @@ async function ensureAuthTablesExist(db, collection) {
                 email_verification_sent_at TIMESTAMP WITH TIME ZONE,
                 is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
                 metadata JSONB DEFAULT '{}' NOT NULL,
-                tokens_valid_after TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
             )
@@ -21272,15 +21233,12 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
                 uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
-                session_id TEXT NOT NULL DEFAULT gen_random_uuid()::text,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
-                revoked BOOLEAN DEFAULT FALSE NOT NULL,
-                rotated_at TIMESTAMP WITH TIME ZONE,
-                session_started_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
             )
         `);
 		await db.execute(sql`
@@ -21370,7 +21328,6 @@ async function ensureAuthTablesExist(db, collection) {
 			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
 			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
 			"metadata JSONB DEFAULT '{}' NOT NULL",
-			"tokens_valid_after TIMESTAMP WITH TIME ZONE",
 			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
 			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
 		]) await db.execute(sql`
@@ -21387,36 +21344,42 @@ async function ensureAuthTablesExist(db, collection) {
 			for (const { table_schema } of found) {
 				const qualified = `"${table_schema}"."refresh_tokens"`;
 				try {
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_id TEXT`);
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
-					await db.execute(sql`
-                        UPDATE ${sql.raw(qualified)}
-                        SET session_id = gen_random_uuid()::text
-                        WHERE session_id IS NULL
-                    `);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS user_agent TEXT`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS ip_address TEXT`);
+					await db.execute(sql`UPDATE ${sql.raw(qualified)} SET user_agent = '' WHERE user_agent IS NULL`);
+					await db.execute(sql`UPDATE ${sql.raw(qualified)} SET ip_address = '' WHERE ip_address IS NULL`);
 					await db.execute(sql`
-                        UPDATE ${sql.raw(qualified)}
-                        SET session_started_at = COALESCE(created_at, NOW())
-                        WHERE session_started_at IS NULL
+                        DELETE FROM ${sql.raw(qualified)} a
+                        USING ${sql.raw(qualified)} b
+                        WHERE a.ctid < b.ctid
+                          AND a.uid = b.uid
+                          AND a.user_agent = b.user_agent
+                          AND a.ip_address = b.ip_address
                     `);
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET DEFAULT gen_random_uuid()::text`);
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET DEFAULT NOW()`);
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET NOT NULL`);
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET NOT NULL`);
-					await db.execute(sql`
-                        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_session
-                        ON ${sql.raw(qualified)}(session_id)
+					const uniques = await db.execute(sql`
+                        SELECT conname, pg_get_constraintdef(oid) AS def
+                        FROM pg_constraint
+                        WHERE conrelid = ${sql.raw(`'${qualified}'`)}::regclass AND contype = 'u'
                     `);
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
-					logger.info(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
+					for (const u of uniques.rows) logger.info(`   ${qualified} unique: ${u.conname} → ${u.def}`);
+					if (uniques.rows.some((u) => {
+						const cols = (u.def.match(/\(([^)]*)\)/)?.[1] || "").split(",").map((c) => c.trim().replace(/"/g, ""));
+						return cols.length === 3 && cols.includes("uid") && cols.includes("user_agent") && cols.includes("ip_address");
+					})) logger.info(`✓ correct device-session unique already present on ${qualified}`);
+					else {
+						await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
+						await db.execute(sql`
+                            ALTER TABLE ${sql.raw(qualified)}
+                                ADD CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
+                        `);
+						logger.info(`✅ Added correct unique_device_session constraint to ${qualified}`);
+					}
 				} catch (perTableError) {
 					logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
 				}
 			}
 		} catch (migrationError) {
-			logger.warn(`⚠️  refresh_tokens session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
+			logger.warn(`⚠️  refresh_tokens device-session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
 		}
 		try {
 			if ((await db.execute(sql`
@@ -21908,31 +21871,34 @@ var UserService = class {
 var RefreshTokenService = class {
 	db;
 	refreshTokensTable;
-	usersTable;
 	constructor(db, tableOrTables) {
 		this.db = db;
-		if (tableOrTables && (tableOrTables.refreshTokens || tableOrTables.users)) {
-			this.refreshTokensTable = tableOrTables.refreshTokens || refreshTokens;
-			this.usersTable = tableOrTables.users || users;
-		} else {
-			this.refreshTokensTable = tableOrTables || refreshTokens;
-			this.usersTable = users;
-		}
+		if (tableOrTables && (tableOrTables.refreshTokens || tableOrTables.users)) this.refreshTokensTable = tableOrTables.refreshTokens || refreshTokens;
+		else this.refreshTokensTable = tableOrTables || refreshTokens;
 	}
-	/**
-	* Whether the table actually carries a column, so a host application that
-	* supplied its own `refresh_tokens` table — one that predates session
-	* grouping — degrades instead of throwing on every sign-in.
-	*/
-	has(column) {
-		return Boolean(this.refreshTokensTable[column]);
-	}
-	col(column) {
-		return this.refreshTokensTable[column];
+	async createToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
+		const safeUserAgent = userAgent || "";
+		const safeIpAddress = ipAddress || "";
+		await this.db.insert(this.refreshTokensTable).values({
+			uid,
+			tokenHash,
+			expiresAt,
+			userAgent: safeUserAgent,
+			ipAddress: safeIpAddress
+		}).onConflictDoUpdate({
+			target: [
+				this.refreshTokensTable.uid,
+				this.refreshTokensTable.userAgent,
+				this.refreshTokensTable.ipAddress
+			],
+			set: {
+				tokenHash,
+				expiresAt
+			}
+		});
 	}
-	/** The columns to read back, narrowed to the ones this table has. */
-	selection() {
-		const selection = {
+	async findByHash(tokenHash) {
+		const [token] = await this.db.select({
 			id: this.refreshTokensTable.id,
 			uid: this.refreshTokensTable.uid,
 			tokenHash: this.refreshTokensTable.tokenHash,
@@ -21940,94 +21906,9 @@ var RefreshTokenService = class {
 			createdAt: this.refreshTokensTable.createdAt,
 			userAgent: this.refreshTokensTable.userAgent,
 			ipAddress: this.refreshTokensTable.ipAddress
-		};
-		for (const optional of [
-			"sessionId",
-			"rotatedAt",
-			"revoked",
-			"sessionStartedAt"
-		]) if (this.has(optional)) selection[optional] = this.col(optional);
-		return selection;
-	}
-	async createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
-		const values = {
-			uid,
-			tokenHash,
-			expiresAt,
-			userAgent: userAgent || "",
-			ipAddress: ipAddress || ""
-		};
-		if (session && this.has("sessionId")) values.sessionId = session.id;
-		if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
-		await this.db.insert(this.refreshTokensTable).values(values);
-	}
-	async findByHash(tokenHash) {
-		const [token] = await this.db.select(this.selection()).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
+		}).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 		return token || null;
 	}
-	/**
-	* Record that a token was rotated away, keeping the row.
-	*
-	* The row is what lets `/auth/refresh` distinguish "you already used this,
-	* here is a fresh one" from "no idea what this is". Deleting it — which is
-	* what this used to do — collapsed both into a 401 and signed the user out
-	* for the crime of losing a response.
-	*/
-	async markRotated(tokenHash) {
-		if (!this.has("rotatedAt")) {
-			await this.deleteByHash(tokenHash);
-			return;
-		}
-		await this.db.update(this.refreshTokensTable).set({ rotatedAt: /* @__PURE__ */ new Date() }).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
-	}
-	/** Final kill of one sign-in: logout, or revoking a device remotely. */
-	async revokeSession(sessionId) {
-		if (!this.has("sessionId")) return;
-		if (this.has("revoked")) {
-			await this.db.update(this.refreshTokensTable).set({
-				revoked: true,
-				...this.has("rotatedAt") ? { rotatedAt: /* @__PURE__ */ new Date() } : {}
-			}).where(eq(this.col("sessionId"), sessionId));
-			return;
-		}
-		await this.db.delete(this.refreshTokensTable).where(eq(this.col("sessionId"), sessionId));
-	}
-	/**
-	* Housekeeping: rotation would otherwise leave a row per refresh forever.
-	* Superseded rows are only needed for as long as a straggler might still
-	* present them, and expired ones are dead weight everywhere.
-	*/
-	async prune(uid, sessionId, supersededBefore) {
-		const uidCol = this.refreshTokensTable.uid;
-		const expiresCol = this.refreshTokensTable.expiresAt;
-		if (!this.has("rotatedAt") || !this.has("sessionId")) {
-			await this.db.delete(this.refreshTokensTable).where(sql`${uidCol} = ${uid} AND ${expiresCol} < NOW()`);
-			return;
-		}
-		const rotatedCol = this.col("rotatedAt");
-		const sessionCol = this.col("sessionId");
-		await this.db.delete(this.refreshTokensTable).where(sql`
-            ${uidCol} = ${uid}
-            AND (
-                ${expiresCol} < NOW()
-                OR (
-                    ${sessionCol} = ${sessionId}
-                    AND ${rotatedCol} IS NOT NULL
-                    AND ${rotatedCol} < ${supersededBefore}
-                )
-            )
-        `);
-	}
-	async getTokensValidAfter(uid) {
-		if (!this.usersTable || !this.usersTable.tokensValidAfter) return null;
-		const [row] = await this.db.select({ tokensValidAfter: this.usersTable.tokensValidAfter }).from(this.usersTable).where(eq(this.usersTable.id, uid));
-		const value = row?.tokensValidAfter;
-		return value ? new Date(value) : null;
-	}
-	async setTokensValidAfter(uid, at) {
-		if (!this.usersTable || !this.usersTable.tokensValidAfter) return;
-		await this.db.update(this.usersTable).set({ tokensValidAfter: at }).where(eq(this.usersTable.id, uid));
-	}
 	async deleteByHash(tokenHash) {
 		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 	}
@@ -22035,7 +21916,15 @@ var RefreshTokenService = class {
 		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid));
 	}
 	async listForUser(uid) {
-		return await this.db.select(this.selection()).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid)).orderBy(this.refreshTokensTable.createdAt);
+		return await this.db.select({
+			id: this.refreshTokensTable.id,
+			uid: this.refreshTokensTable.uid,
+			tokenHash: this.refreshTokensTable.tokenHash,
+			expiresAt: this.refreshTokensTable.expiresAt,
+			createdAt: this.refreshTokensTable.createdAt,
+			userAgent: this.refreshTokensTable.userAgent,
+			ipAddress: this.refreshTokensTable.ipAddress
+		}).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid)).orderBy(this.refreshTokensTable.createdAt);
 	}
 	async deleteById(id, uid) {
 		await this.db.delete(this.refreshTokensTable).where(sql`${this.refreshTokensTable.id} = ${id} AND ${this.refreshTokensTable.uid} = ${uid}`);
@@ -22180,23 +22069,8 @@ var PostgresTokenRepository = class {
 		this.passwordResetTokenService = new PasswordResetTokenService(db, tableOrTables);
 		this.magicLinkTokenService = new MagicLinkTokenService(db, tableOrTables);
 	}
-	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
-		await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
-	}
-	async markRefreshTokenRotated(tokenHash) {
-		await this.refreshTokenService.markRotated(tokenHash);
-	}
-	async revokeRefreshTokenSession(sessionId) {
-		await this.refreshTokenService.revokeSession(sessionId);
-	}
-	async pruneRefreshTokens(uid, sessionId, supersededBefore) {
-		await this.refreshTokenService.prune(uid, sessionId, supersededBefore);
-	}
-	async getTokensValidAfter(uid) {
-		return this.refreshTokenService.getTokensValidAfter(uid);
-	}
-	async setTokensValidAfter(uid, at) {
-		await this.refreshTokenService.setTokensValidAfter(uid, at);
+	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
+		await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
 	}
 	async findRefreshTokenByHash(tokenHash) {
 		return this.refreshTokenService.findByHash(tokenHash);
@@ -22362,23 +22236,8 @@ var PostgresAuthRepository = class {
 		};
 	}
 	async deleteRole(_id) {}
-	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
-		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
-	}
-	async markRefreshTokenRotated(tokenHash) {
-		await this.tokenRepository.markRefreshTokenRotated(tokenHash);
-	}
-	async revokeRefreshTokenSession(sessionId) {
-		await this.tokenRepository.revokeRefreshTokenSession(sessionId);
-	}
-	async pruneRefreshTokens(uid, sessionId, supersededBefore) {
-		await this.tokenRepository.pruneRefreshTokens(uid, sessionId, supersededBefore);
-	}
-	async getTokensValidAfter(uid) {
-		return this.tokenRepository.getTokensValidAfter(uid);
-	}
-	async setTokensValidAfter(uid, at) {
-		await this.tokenRepository.setTokensValidAfter(uid, at);
+	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
+		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
 	}
 	async findRefreshTokenByHash(tokenHash) {
 		return this.tokenRepository.findRefreshTokenByHash(tokenHash);