@rebasepro/server-postgres 0.10.1-canary.18115ba → 0.10.1-canary.31c773c

package/src/auth/services.ts

@@ -14,7 +14,6 @@ import {
     RoleData,
     CreateRoleData,
     RefreshTokenInfo,
-    RefreshTokenSession,
     PasswordResetTokenInfo,
     MagicLinkTokenInfo,
     UserIdentityData,
@@ -530,7 +529,6 @@ export class UserService implements UserRepository {
 
 export class RefreshTokenService {
     private refreshTokensTable: RebasePgTable;
-    private usersTable: RebasePgTable | null;
 
     constructor(
         private db: NodePgDatabase,
@@ -538,159 +536,55 @@ export class RefreshTokenService {
     ) {
         if (tableOrTables && ((tableOrTables as Partial<AuthSchemaTables>).refreshTokens || (tableOrTables as Partial<AuthSchemaTables>).users)) {
             this.refreshTokensTable = ((tableOrTables as Partial<AuthSchemaTables>).refreshTokens || refreshTokens) as RebasePgTable;
-            this.usersTable = ((tableOrTables as Partial<AuthSchemaTables>).users || users) as RebasePgTable;
         } else {
             this.refreshTokensTable = (tableOrTables as RebasePgTable) || (refreshTokens as unknown as RebasePgTable);
-            this.usersTable = users as unknown as RebasePgTable;
         }
     }
 
-    /**
-     * Whether the table actually carries a column, so a host application that
-     * supplied its own `refresh_tokens` table — one that predates session
-     * grouping — degrades instead of throwing on every sign-in.
-     */
-    private has(column: string): boolean {
-        return Boolean((this.refreshTokensTable as unknown as Record<string, unknown>)[column]);
-    }
-
-    private col(column: string) {
-        return (this.refreshTokensTable as unknown as Record<string, never>)[column];
-    }
-
-    /** The columns to read back, narrowed to the ones this table has. */
-    private selection() {
-        const selection: Record<string, never> = {
-            id: this.refreshTokensTable.id,
-            uid: this.refreshTokensTable.uid,
-            tokenHash: this.refreshTokensTable.tokenHash,
-            expiresAt: this.refreshTokensTable.expiresAt,
-            createdAt: this.refreshTokensTable.createdAt,
-            userAgent: this.refreshTokensTable.userAgent,
-            ipAddress: this.refreshTokensTable.ipAddress
-        } as unknown as Record<string, never>;
-        for (const optional of ["sessionId", "rotatedAt", "revoked", "sessionStartedAt"]) {
-            if (this.has(optional)) selection[optional] = this.col(optional);
-        }
-        return selection;
-    }
-
-    async createToken(
-        uid: string,
-        tokenHash: string,
-        expiresAt: Date,
-        userAgent?: string,
-        ipAddress?: string,
-        session?: RefreshTokenSession
-    ): Promise<void> {
-        // Empty strings rather than NULLs: the device-session UNIQUE constraint
-        // that needed them is gone, but sessions-list UIs already render "" as
-        // "unknown device" and would start showing blanks otherwise.
+    async createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void> {
+        // Fallback to empty string because UNIQUE constraints treat NULLs as strictly distinct in standard Postgres.
+        // We want (uid, NULL, NULL) to collide and overwrite, so we map undefined/null to empty strings.
         const safeUserAgent = userAgent || "";
         const safeIpAddress = ipAddress || "";
 
-        // A plain INSERT. Rotation ADDS a token; it does not replace a device's
-        // row. Two refreshes racing on the same session therefore both succeed
-        // and both end holding a usable token, where the previous upsert had
-        // them overwrite each other and logged one of the two tabs out.
-        const values: Record<string, unknown> = {
-            uid,
-            tokenHash,
-            expiresAt,
-            userAgent: safeUserAgent,
-            ipAddress: safeIpAddress
-        };
-        if (session && this.has("sessionId")) values.sessionId = session.id;
-        if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
-
-        await this.db.insert(this.refreshTokensTable).values(values);
+        // Atomic upsert keyed on the device session (uid, user_agent, ip_address).
+        // A DELETE-then-INSERT races under concurrent refreshes — cookie-mode boot can
+        // fire two /refresh calls at once (both carrying the same refresh cookie): both
+        // DELETE, then the second INSERT violates `unique_device_session` and 500s.
+        // A single INSERT ... ON CONFLICT DO UPDATE rotates the token atomically.
+        await this.db.insert(this.refreshTokensTable)
+            .values({
+                uid,
+                tokenHash,
+                expiresAt,
+                userAgent: safeUserAgent,
+                ipAddress: safeIpAddress
+            })
+            .onConflictDoUpdate({
+                target: [
+                    this.refreshTokensTable.uid,
+                    this.refreshTokensTable.userAgent,
+                    this.refreshTokensTable.ipAddress
+                ],
+                set: { tokenHash, expiresAt }
+            });
     }
 
     async findByHash(tokenHash: string): Promise<RefreshTokenInfo | null> {
         const [token] = await this.db
-            .select(this.selection())
+            .select({
+                id: this.refreshTokensTable.id,
+                uid: this.refreshTokensTable.uid,
+                tokenHash: this.refreshTokensTable.tokenHash,
+                expiresAt: this.refreshTokensTable.expiresAt,
+                createdAt: this.refreshTokensTable.createdAt,
+                userAgent: this.refreshTokensTable.userAgent,
+                ipAddress: this.refreshTokensTable.ipAddress
+            })
             .from(this.refreshTokensTable)
             .where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 
-        return (token as unknown as RefreshTokenInfo) || null;
-    }
-
-    /**
-     * Record that a token was rotated away, keeping the row.
-     *
-     * The row is what lets `/auth/refresh` distinguish "you already used this,
-     * here is a fresh one" from "no idea what this is". Deleting it — which is
-     * what this used to do — collapsed both into a 401 and signed the user out
-     * for the crime of losing a response.
-     */
-    async markRotated(tokenHash: string): Promise<void> {
-        if (!this.has("rotatedAt")) {
-            await this.deleteByHash(tokenHash);
-            return;
-        }
-        await this.db
-            .update(this.refreshTokensTable)
-            .set({ rotatedAt: new Date() })
-            .where(eq(this.refreshTokensTable.tokenHash, tokenHash));
-    }
-
-    /** Final kill of one sign-in: logout, or revoking a device remotely. */
-    async revokeSession(sessionId: string): Promise<void> {
-        if (!this.has("sessionId")) return;
-        if (this.has("revoked")) {
-            await this.db
-                .update(this.refreshTokensTable)
-                .set({ revoked: true, ...(this.has("rotatedAt") ? { rotatedAt: new Date() } : {}) })
-                .where(eq(this.col("sessionId"), sessionId));
-            return;
-        }
-        await this.db.delete(this.refreshTokensTable).where(eq(this.col("sessionId"), sessionId));
-    }
-
-    /**
-     * Housekeeping: rotation would otherwise leave a row per refresh forever.
-     * Superseded rows are only needed for as long as a straggler might still
-     * present them, and expired ones are dead weight everywhere.
-     */
-    async prune(uid: string, sessionId: string, supersededBefore: Date): Promise<void> {
-        const uidCol = this.refreshTokensTable.uid;
-        const expiresCol = this.refreshTokensTable.expiresAt;
-        if (!this.has("rotatedAt") || !this.has("sessionId")) {
-            await this.db.delete(this.refreshTokensTable)
-                .where(sql`${uidCol} = ${uid} AND ${expiresCol} < NOW()`);
-            return;
-        }
-        const rotatedCol = this.col("rotatedAt");
-        const sessionCol = this.col("sessionId");
-        await this.db.delete(this.refreshTokensTable).where(sql`
-            ${uidCol} = ${uid}
-            AND (
-                ${expiresCol} < NOW()
-                OR (
-                    ${sessionCol} = ${sessionId}
-                    AND ${rotatedCol} IS NOT NULL
-                    AND ${rotatedCol} < ${supersededBefore}
-                )
-            )
-        `);
-    }
-
-    async getTokensValidAfter(uid: string): Promise<Date | null> {
-        if (!this.usersTable || !(this.usersTable as unknown as Record<string, unknown>).tokensValidAfter) return null;
-        const [row] = await this.db
-            .select({ tokensValidAfter: (this.usersTable as unknown as Record<string, never>).tokensValidAfter })
-            .from(this.usersTable)
-            .where(eq(this.usersTable.id, uid));
-        const value = (row as { tokensValidAfter?: Date | string | null } | undefined)?.tokensValidAfter;
-        return value ? new Date(value) : null;
-    }
-
-    async setTokensValidAfter(uid: string, at: Date): Promise<void> {
-        if (!this.usersTable || !(this.usersTable as unknown as Record<string, unknown>).tokensValidAfter) return;
-        await this.db
-            .update(this.usersTable)
-            .set({ tokensValidAfter: at })
-            .where(eq(this.usersTable.id, uid));
+        return (token as RefreshTokenInfo) || null;
     }
 
     async deleteByHash(tokenHash: string): Promise<void> {
@@ -703,12 +597,20 @@ export class RefreshTokenService {
 
     async listForUser(uid: string): Promise<RefreshTokenInfo[]> {
         const tokens = await this.db
-            .select(this.selection())
+            .select({
+                id: this.refreshTokensTable.id,
+                uid: this.refreshTokensTable.uid,
+                tokenHash: this.refreshTokensTable.tokenHash,
+                expiresAt: this.refreshTokensTable.expiresAt,
+                createdAt: this.refreshTokensTable.createdAt,
+                userAgent: this.refreshTokensTable.userAgent,
+                ipAddress: this.refreshTokensTable.ipAddress
+            })
             .from(this.refreshTokensTable)
             .where(eq(this.refreshTokensTable.uid, uid))
             .orderBy(this.refreshTokensTable.createdAt);
 
-        return tokens as unknown as RefreshTokenInfo[];
+        return tokens as RefreshTokenInfo[];
     }
 
     async deleteById(id: string, uid: string): Promise<void> {
@@ -902,28 +804,8 @@ export class PostgresTokenRepository implements TokenRepository {
 
     // Refresh token operations
 
-    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void> {
-        await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
-    }
-
-    async markRefreshTokenRotated(tokenHash: string): Promise<void> {
-        await this.refreshTokenService.markRotated(tokenHash);
-    }
-
-    async revokeRefreshTokenSession(sessionId: string): Promise<void> {
-        await this.refreshTokenService.revokeSession(sessionId);
-    }
-
-    async pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void> {
-        await this.refreshTokenService.prune(uid, sessionId, supersededBefore);
-    }
-
-    async getTokensValidAfter(uid: string): Promise<Date | null> {
-        return this.refreshTokenService.getTokensValidAfter(uid);
-    }
-
-    async setTokensValidAfter(uid: string, at: Date): Promise<void> {
-        await this.refreshTokenService.setTokensValidAfter(uid, at);
+    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void> {
+        await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
     }
 
     async findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null> {
@@ -1136,28 +1018,8 @@ collectionPermissions: null }
 
     // Token operations (delegate to PostgresTokenRepository)
 
-    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void> {
-        await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
-    }
-
-    async markRefreshTokenRotated(tokenHash: string): Promise<void> {
-        await this.tokenRepository.markRefreshTokenRotated(tokenHash);
-    }
-
-    async revokeRefreshTokenSession(sessionId: string): Promise<void> {
-        await this.tokenRepository.revokeRefreshTokenSession(sessionId);
-    }
-
-    async pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void> {
-        await this.tokenRepository.pruneRefreshTokens(uid, sessionId, supersededBefore);
-    }
-
-    async getTokensValidAfter(uid: string): Promise<Date | null> {
-        return this.tokenRepository.getTokensValidAfter(uid);
-    }
-
-    async setTokensValidAfter(uid: string, at: Date): Promise<void> {
-        await this.tokenRepository.setTokensValidAfter(uid, at);
+    async createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void> {
+        await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
     }
 
     async findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null> {

package/src/schema/auth-schema.ts

@@ -1,4 +1,4 @@
-import { pgSchema, pgTable, varchar, uuid, timestamp, boolean, jsonb, text, unique, index } from "drizzle-orm/pg-core";
+import { pgSchema, pgTable, varchar, uuid, timestamp, boolean, jsonb, text, unique } from "drizzle-orm/pg-core";
 import { relations } from "drizzle-orm";
 
 /**
@@ -25,62 +25,24 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         isAnonymous: boolean("is_anonymous").default(false).notNull(),
         roles: text("roles").array().default([]).notNull(),
         metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}).notNull(),
-        /**
-         * Sessions that began before this instant are dead, whatever tokens
-         * they still hold. Password resets and admin revocations stamp it.
-         *
-         * Deleting the user's refresh-token rows (which we also do) is not
-         * sufficient on its own: a request already in flight can insert a
-         * freshly rotated row microseconds after the delete and survive it.
-         * This timestamp cannot be outrun that way — it is checked against
-         * `refresh_tokens.session_started_at`, which rotation carries forward.
-         */
-        tokensValidAfter: timestamp("tokens_valid_after"),
         createdAt: timestamp("created_at").defaultNow().notNull(),
         updatedAt: timestamp("updated_at").defaultNow().notNull()
     });
 
 
     /**
-     * Refresh tokens for long-lived sessions.
-     *
-     * A row is one token, not one device. Every token minted from the same
-     * sign-in shares a `sessionId`, and rotation ADDS a row rather than
-     * replacing one: the superseded token stays on file, flagged `revoked`
-     * with a `rotatedAt` stamp. That record is what lets the refresh endpoint
-     * tell a client replaying a token it never got an answer for (a response
-     * lost to a redeploy, a second tab racing on boot) apart from a stranger
-     * presenting a token that was never issued. Deleting the old row on sight
-     * — the previous behaviour — made those two cases indistinguishable, and
-     * the legitimate one is overwhelmingly the common one.
-     *
-     * There is deliberately NO unique constraint on (uid, user_agent,
-     * ip_address). Keying a session on the IP meant one row per "device",
-     * so a second browser profile behind the same NAT silently evicted the
-     * first, and a phone changing networks orphaned a row on every hop.
-     * User agent and IP are descriptive metadata for the sessions list;
-     * `sessionId` is the identity.
+     * Refresh tokens for long-lived sessions
      */
     const refreshTokens = tableCreator("refresh_tokens", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        sessionId: uuid("session_id").defaultRandom().notNull(),
         tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
-        revoked: boolean("revoked").default(false).notNull(),
-        rotatedAt: timestamp("rotated_at"),
-        /**
-         * When the sign-in this token descends from happened — carried across
-         * every rotation, unlike `createdAt`. `users.tokensValidAfter` is
-         * compared against this, so a revocation cannot be outrun by a token
-         * that rotates immediately after it.
-         */
-        sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
         userAgent: varchar("user_agent", { length: 500 }),
         ipAddress: varchar("ip_address", { length: 45 }),
         createdAt: timestamp("created_at").defaultNow().notNull()
     }, (table) => ({
-        sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId)
+        uniqueDeviceSession: unique("unique_device_session").on(table.uid, table.userAgent, table.ipAddress)
     }));
 
     /**