@rebasepro/server-postgres 0.10.1-canary.31c773c → 0.10.1-canary.811b3da

package/dist/auth/services.d.ts

@@ -1,6 +1,6 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { RebasePgTable } from "../types";
-import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
+import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
 export type { Role };
 export interface AuthSchemaTables {
     users: RebasePgTable;
@@ -90,9 +90,38 @@ export declare class UserService implements UserRepository {
 export declare class RefreshTokenService {
     private db;
     private refreshTokensTable;
+    private usersTable;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
-    createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    /**
+     * Whether the table actually carries a column, so a host application that
+     * supplied its own `refresh_tokens` table — one that predates session
+     * grouping — degrades instead of throwing on every sign-in.
+     */
+    private has;
+    private col;
+    /** The columns to read back, narrowed to the ones this table has. */
+    private selection;
+    createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
     findByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
+    /**
+     * Record that a token was rotated away, keeping the row.
+     *
+     * The row is what lets `/auth/refresh` distinguish "you already used this,
+     * here is a fresh one" from "no idea what this is". Deleting it — which is
+     * what this used to do — collapsed both into a 401 and signed the user out
+     * for the crime of losing a response.
+     */
+    markRotated(tokenHash: string): Promise<void>;
+    /** Final kill of one sign-in: logout, or revoking a device remotely. */
+    revokeSession(sessionId: string): Promise<void>;
+    /**
+     * Housekeeping: rotation would otherwise leave a row per refresh forever.
+     * Superseded rows are only needed for as long as a straggler might still
+     * present them, and expired ones are dead weight everywhere.
+     */
+    prune(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    getTokensValidAfter(uid: string): Promise<Date | null>;
+    setTokensValidAfter(uid: string, at: Date): Promise<void>;
     deleteByHash(tokenHash: string): Promise<void>;
     deleteAllForUser(uid: string): Promise<void>;
     listForUser(uid: string): Promise<RefreshTokenInfo[]>;
@@ -153,7 +182,12 @@ export declare class PostgresTokenRepository implements TokenRepository {
     private passwordResetTokenService;
     private magicLinkTokenService;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    markRefreshTokenRotated(tokenHash: string): Promise<void>;
+    revokeRefreshTokenSession(sessionId: string): Promise<void>;
+    pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    getTokensValidAfter(uid: string): Promise<Date | null>;
+    setTokensValidAfter(uid: string, at: Date): Promise<void>;
     findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
     deleteRefreshToken(tokenHash: string): Promise<void>;
     deleteAllRefreshTokensForUser(uid: string): Promise<void>;
@@ -205,7 +239,12 @@ export declare class PostgresAuthRepository implements AuthRepository {
     createRole(_data: CreateRoleData): Promise<RoleData>;
     updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
     deleteRole(_id: string): Promise<void>;
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    markRefreshTokenRotated(tokenHash: string): Promise<void>;
+    revokeRefreshTokenSession(sessionId: string): Promise<void>;
+    pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    getTokensValidAfter(uid: string): Promise<Date | null>;
+    setTokensValidAfter(uid: string, at: Date): Promise<void>;
     findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
     deleteRefreshToken(tokenHash: string): Promise<void>;
     deleteAllRefreshTokensForUser(uid: string): Promise<void>;

package/dist/index.es.js

@@ -5,7 +5,7 @@ import { Client, Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { ApiError, createEmailService, extractUserFromToken, loadCollectionsFromDirectory, logger, safeCompare } from "@rebasepro/server";
 import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, ilike, inArray, isTable, lt, or, relations, sql } from "drizzle-orm";
-import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
+import { PgArray, PgChar, PgTable, PgText, PgVarchar, bigint, boolean, char, cidr, customType, date, doublePrecision, geometry, getTableConfig, index, inet, integer, interval, json, jsonb, line, macaddr, macaddr8, numeric, pgSchema, pgTable, point, primaryKey, real, smallint, text, time, timestamp, unique, uuid, varchar, vector } from "drizzle-orm/pg-core";
 import fs, { promises } from "fs";
 import path from "path";
 import chokidar from "chokidar";
@@ -9349,21 +9349,59 @@ function createAuthSchema(usersSchemaName = "rebase") {
 		isAnonymous: boolean("is_anonymous").default(false).notNull(),
 		roles: text("roles").array().default([]).notNull(),
 		metadata: jsonb("metadata").$type().default({}).notNull(),
+		/**
+		* Sessions that began before this instant are dead, whatever tokens
+		* they still hold. Password resets and admin revocations stamp it.
+		*
+		* Deleting the user's refresh-token rows (which we also do) is not
+		* sufficient on its own: a request already in flight can insert a
+		* freshly rotated row microseconds after the delete and survive it.
+		* This timestamp cannot be outrun that way — it is checked against
+		* `refresh_tokens.session_started_at`, which rotation carries forward.
+		*/
+		tokensValidAfter: timestamp("tokens_valid_after"),
 		createdAt: timestamp("created_at").defaultNow().notNull(),
 		updatedAt: timestamp("updated_at").defaultNow().notNull()
 	});
 	/**
-	* Refresh tokens for long-lived sessions
+	* Refresh tokens for long-lived sessions.
+	*
+	* A row is one token, not one device. Every token minted from the same
+	* sign-in shares a `sessionId`, and rotation ADDS a row rather than
+	* replacing one: the superseded token stays on file, flagged `revoked`
+	* with a `rotatedAt` stamp. That record is what lets the refresh endpoint
+	* tell a client replaying a token it never got an answer for (a response
+	* lost to a redeploy, a second tab racing on boot) apart from a stranger
+	* presenting a token that was never issued. Deleting the old row on sight
+	* — the previous behaviour — made those two cases indistinguishable, and
+	* the legitimate one is overwhelmingly the common one.
+	*
+	* There is deliberately NO unique constraint on (uid, user_agent,
+	* ip_address). Keying a session on the IP meant one row per "device",
+	* so a second browser profile behind the same NAT silently evicted the
+	* first, and a phone changing networks orphaned a row on every hop.
+	* User agent and IP are descriptive metadata for the sessions list;
+	* `sessionId` is the identity.
 	*/
 	const refreshTokens = tableCreator("refresh_tokens", {
 		id: uuid("id").defaultRandom().primaryKey(),
 		uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+		sessionId: uuid("session_id").defaultRandom().notNull(),
 		tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
 		expiresAt: timestamp("expires_at").notNull(),
+		revoked: boolean("revoked").default(false).notNull(),
+		rotatedAt: timestamp("rotated_at"),
+		/**
+		* When the sign-in this token descends from happened — carried across
+		* every rotation, unlike `createdAt`. `users.tokensValidAfter` is
+		* compared against this, so a revocation cannot be outrun by a token
+		* that rotates immediately after it.
+		*/
+		sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
 		userAgent: varchar("user_agent", { length: 500 }),
 		ipAddress: varchar("ip_address", { length: 45 }),
 		createdAt: timestamp("created_at").defaultNow().notNull()
-	}, (table) => ({ uniqueDeviceSession: unique("unique_device_session").on(table.uid, table.userAgent, table.ipAddress) }));
+	}, (table) => ({ sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId) }));
 	/**
 	* Password reset tokens for forgot password flow
 	*/
@@ -21153,6 +21191,7 @@ async function ensureAuthTablesExist(db, collection) {
                 email_verification_sent_at TIMESTAMP WITH TIME ZONE,
                 is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
                 metadata JSONB DEFAULT '{}' NOT NULL,
+                tokens_valid_after TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
             )
@@ -21233,12 +21272,15 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
                 uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                session_id TEXT NOT NULL DEFAULT gen_random_uuid()::text,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+                revoked BOOLEAN DEFAULT FALSE NOT NULL,
+                rotated_at TIMESTAMP WITH TIME ZONE,
+                session_started_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
         `);
 		await db.execute(sql`
@@ -21328,6 +21370,7 @@ async function ensureAuthTablesExist(db, collection) {
 			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
 			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
 			"metadata JSONB DEFAULT '{}' NOT NULL",
+			"tokens_valid_after TIMESTAMP WITH TIME ZONE",
 			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
 			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
 		]) await db.execute(sql`
@@ -21344,42 +21387,36 @@ async function ensureAuthTablesExist(db, collection) {
 			for (const { table_schema } of found) {
 				const qualified = `"${table_schema}"."refresh_tokens"`;
 				try {
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS user_agent TEXT`);
-					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS ip_address TEXT`);
-					await db.execute(sql`UPDATE ${sql.raw(qualified)} SET user_agent = '' WHERE user_agent IS NULL`);
-					await db.execute(sql`UPDATE ${sql.raw(qualified)} SET ip_address = '' WHERE ip_address IS NULL`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_id TEXT`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
+					await db.execute(sql`
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_id = gen_random_uuid()::text
+                        WHERE session_id IS NULL
+                    `);
 					await db.execute(sql`
-                        DELETE FROM ${sql.raw(qualified)} a
-                        USING ${sql.raw(qualified)} b
-                        WHERE a.ctid < b.ctid
-                          AND a.uid = b.uid
-                          AND a.user_agent = b.user_agent
-                          AND a.ip_address = b.ip_address
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_started_at = COALESCE(created_at, NOW())
+                        WHERE session_started_at IS NULL
                     `);
-					const uniques = await db.execute(sql`
-                        SELECT conname, pg_get_constraintdef(oid) AS def
-                        FROM pg_constraint
-                        WHERE conrelid = ${sql.raw(`'${qualified}'`)}::regclass AND contype = 'u'
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET DEFAULT gen_random_uuid()::text`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET DEFAULT NOW()`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET NOT NULL`);
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET NOT NULL`);
+					await db.execute(sql`
+                        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_session
+                        ON ${sql.raw(qualified)}(session_id)
                     `);
-					for (const u of uniques.rows) logger.info(`   ${qualified} unique: ${u.conname} → ${u.def}`);
-					if (uniques.rows.some((u) => {
-						const cols = (u.def.match(/\(([^)]*)\)/)?.[1] || "").split(",").map((c) => c.trim().replace(/"/g, ""));
-						return cols.length === 3 && cols.includes("uid") && cols.includes("user_agent") && cols.includes("ip_address");
-					})) logger.info(`✓ correct device-session unique already present on ${qualified}`);
-					else {
-						await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
-						await db.execute(sql`
-                            ALTER TABLE ${sql.raw(qualified)}
-                                ADD CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
-                        `);
-						logger.info(`✅ Added correct unique_device_session constraint to ${qualified}`);
-					}
+					await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
+					logger.info(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
 				} catch (perTableError) {
 					logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
 				}
 			}
 		} catch (migrationError) {
-			logger.warn(`⚠️  refresh_tokens device-session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
+			logger.warn(`⚠️  refresh_tokens session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
 		}
 		try {
 			if ((await db.execute(sql`
@@ -21871,34 +21908,31 @@ var UserService = class {
 var RefreshTokenService = class {
 	db;
 	refreshTokensTable;
+	usersTable;
 	constructor(db, tableOrTables) {
 		this.db = db;
-		if (tableOrTables && (tableOrTables.refreshTokens || tableOrTables.users)) this.refreshTokensTable = tableOrTables.refreshTokens || refreshTokens;
-		else this.refreshTokensTable = tableOrTables || refreshTokens;
+		if (tableOrTables && (tableOrTables.refreshTokens || tableOrTables.users)) {
+			this.refreshTokensTable = tableOrTables.refreshTokens || refreshTokens;
+			this.usersTable = tableOrTables.users || users;
+		} else {
+			this.refreshTokensTable = tableOrTables || refreshTokens;
+			this.usersTable = users;
+		}
 	}
-	async createToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
-		const safeUserAgent = userAgent || "";
-		const safeIpAddress = ipAddress || "";
-		await this.db.insert(this.refreshTokensTable).values({
-			uid,
-			tokenHash,
-			expiresAt,
-			userAgent: safeUserAgent,
-			ipAddress: safeIpAddress
-		}).onConflictDoUpdate({
-			target: [
-				this.refreshTokensTable.uid,
-				this.refreshTokensTable.userAgent,
-				this.refreshTokensTable.ipAddress
-			],
-			set: {
-				tokenHash,
-				expiresAt
-			}
-		});
+	/**
+	* Whether the table actually carries a column, so a host application that
+	* supplied its own `refresh_tokens` table — one that predates session
+	* grouping — degrades instead of throwing on every sign-in.
+	*/
+	has(column) {
+		return Boolean(this.refreshTokensTable[column]);
 	}
-	async findByHash(tokenHash) {
-		const [token] = await this.db.select({
+	col(column) {
+		return this.refreshTokensTable[column];
+	}
+	/** The columns to read back, narrowed to the ones this table has. */
+	selection() {
+		const selection = {
 			id: this.refreshTokensTable.id,
 			uid: this.refreshTokensTable.uid,
 			tokenHash: this.refreshTokensTable.tokenHash,
@@ -21906,9 +21940,94 @@ var RefreshTokenService = class {
 			createdAt: this.refreshTokensTable.createdAt,
 			userAgent: this.refreshTokensTable.userAgent,
 			ipAddress: this.refreshTokensTable.ipAddress
-		}).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
+		};
+		for (const optional of [
+			"sessionId",
+			"rotatedAt",
+			"revoked",
+			"sessionStartedAt"
+		]) if (this.has(optional)) selection[optional] = this.col(optional);
+		return selection;
+	}
+	async createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
+		const values = {
+			uid,
+			tokenHash,
+			expiresAt,
+			userAgent: userAgent || "",
+			ipAddress: ipAddress || ""
+		};
+		if (session && this.has("sessionId")) values.sessionId = session.id;
+		if (session && this.has("sessionStartedAt")) values.sessionStartedAt = session.startedAt;
+		await this.db.insert(this.refreshTokensTable).values(values);
+	}
+	async findByHash(tokenHash) {
+		const [token] = await this.db.select(this.selection()).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 		return token || null;
 	}
+	/**
+	* Record that a token was rotated away, keeping the row.
+	*
+	* The row is what lets `/auth/refresh` distinguish "you already used this,
+	* here is a fresh one" from "no idea what this is". Deleting it — which is
+	* what this used to do — collapsed both into a 401 and signed the user out
+	* for the crime of losing a response.
+	*/
+	async markRotated(tokenHash) {
+		if (!this.has("rotatedAt")) {
+			await this.deleteByHash(tokenHash);
+			return;
+		}
+		await this.db.update(this.refreshTokensTable).set({ rotatedAt: /* @__PURE__ */ new Date() }).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
+	}
+	/** Final kill of one sign-in: logout, or revoking a device remotely. */
+	async revokeSession(sessionId) {
+		if (!this.has("sessionId")) return;
+		if (this.has("revoked")) {
+			await this.db.update(this.refreshTokensTable).set({
+				revoked: true,
+				...this.has("rotatedAt") ? { rotatedAt: /* @__PURE__ */ new Date() } : {}
+			}).where(eq(this.col("sessionId"), sessionId));
+			return;
+		}
+		await this.db.delete(this.refreshTokensTable).where(eq(this.col("sessionId"), sessionId));
+	}
+	/**
+	* Housekeeping: rotation would otherwise leave a row per refresh forever.
+	* Superseded rows are only needed for as long as a straggler might still
+	* present them, and expired ones are dead weight everywhere.
+	*/
+	async prune(uid, sessionId, supersededBefore) {
+		const uidCol = this.refreshTokensTable.uid;
+		const expiresCol = this.refreshTokensTable.expiresAt;
+		if (!this.has("rotatedAt") || !this.has("sessionId")) {
+			await this.db.delete(this.refreshTokensTable).where(sql`${uidCol} = ${uid} AND ${expiresCol} < NOW()`);
+			return;
+		}
+		const rotatedCol = this.col("rotatedAt");
+		const sessionCol = this.col("sessionId");
+		await this.db.delete(this.refreshTokensTable).where(sql`
+            ${uidCol} = ${uid}
+            AND (
+                ${expiresCol} < NOW()
+                OR (
+                    ${sessionCol} = ${sessionId}
+                    AND ${rotatedCol} IS NOT NULL
+                    AND ${rotatedCol} < ${supersededBefore}
+                )
+            )
+        `);
+	}
+	async getTokensValidAfter(uid) {
+		if (!this.usersTable || !this.usersTable.tokensValidAfter) return null;
+		const [row] = await this.db.select({ tokensValidAfter: this.usersTable.tokensValidAfter }).from(this.usersTable).where(eq(this.usersTable.id, uid));
+		const value = row?.tokensValidAfter;
+		return value ? new Date(value) : null;
+	}
+	async setTokensValidAfter(uid, at) {
+		if (!this.usersTable || !this.usersTable.tokensValidAfter) return;
+		await this.db.update(this.usersTable).set({ tokensValidAfter: at }).where(eq(this.usersTable.id, uid));
+	}
 	async deleteByHash(tokenHash) {
 		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.tokenHash, tokenHash));
 	}
@@ -21916,15 +22035,7 @@ var RefreshTokenService = class {
 		await this.db.delete(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid));
 	}
 	async listForUser(uid) {
-		return await this.db.select({
-			id: this.refreshTokensTable.id,
-			uid: this.refreshTokensTable.uid,
-			tokenHash: this.refreshTokensTable.tokenHash,
-			expiresAt: this.refreshTokensTable.expiresAt,
-			createdAt: this.refreshTokensTable.createdAt,
-			userAgent: this.refreshTokensTable.userAgent,
-			ipAddress: this.refreshTokensTable.ipAddress
-		}).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid)).orderBy(this.refreshTokensTable.createdAt);
+		return await this.db.select(this.selection()).from(this.refreshTokensTable).where(eq(this.refreshTokensTable.uid, uid)).orderBy(this.refreshTokensTable.createdAt);
 	}
 	async deleteById(id, uid) {
 		await this.db.delete(this.refreshTokensTable).where(sql`${this.refreshTokensTable.id} = ${id} AND ${this.refreshTokensTable.uid} = ${uid}`);
@@ -22069,8 +22180,23 @@ var PostgresTokenRepository = class {
 		this.passwordResetTokenService = new PasswordResetTokenService(db, tableOrTables);
 		this.magicLinkTokenService = new MagicLinkTokenService(db, tableOrTables);
 	}
-	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
-		await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
+	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
+		await this.refreshTokenService.createToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+	}
+	async markRefreshTokenRotated(tokenHash) {
+		await this.refreshTokenService.markRotated(tokenHash);
+	}
+	async revokeRefreshTokenSession(sessionId) {
+		await this.refreshTokenService.revokeSession(sessionId);
+	}
+	async pruneRefreshTokens(uid, sessionId, supersededBefore) {
+		await this.refreshTokenService.prune(uid, sessionId, supersededBefore);
+	}
+	async getTokensValidAfter(uid) {
+		return this.refreshTokenService.getTokensValidAfter(uid);
+	}
+	async setTokensValidAfter(uid, at) {
+		await this.refreshTokenService.setTokensValidAfter(uid, at);
 	}
 	async findRefreshTokenByHash(tokenHash) {
 		return this.refreshTokenService.findByHash(tokenHash);
@@ -22236,8 +22362,23 @@ var PostgresAuthRepository = class {
 		};
 	}
 	async deleteRole(_id) {}
-	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress) {
-		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress);
+	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
+		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
+	}
+	async markRefreshTokenRotated(tokenHash) {
+		await this.tokenRepository.markRefreshTokenRotated(tokenHash);
+	}
+	async revokeRefreshTokenSession(sessionId) {
+		await this.tokenRepository.revokeRefreshTokenSession(sessionId);
+	}
+	async pruneRefreshTokens(uid, sessionId, supersededBefore) {
+		await this.tokenRepository.pruneRefreshTokens(uid, sessionId, supersededBefore);
+	}
+	async getTokensValidAfter(uid) {
+		return this.tokenRepository.getTokensValidAfter(uid);
+	}
+	async setTokensValidAfter(uid, at) {
+		await this.tokenRepository.setTokensValidAfter(uid, at);
 	}
 	async findRefreshTokenByHash(tokenHash) {
 		return this.tokenRepository.findRefreshTokenByHash(tokenHash);