@rebasepro/server 0.10.0 → 0.10.1-canary.18115ba

package/dist/auth/interfaces.d.ts

@@ -119,6 +119,33 @@ export interface RefreshTokenInfo {
     createdAt: Date;
     userAgent?: string | null;
     ipAddress?: string | null;
+    /**
+     * The sign-in this token descends from. Every token minted by rotating
+     * this one carries the same id.
+     *
+     * Optional because a custom {@link TokenRepository} written against an
+     * older release does not supply it; the refresh endpoint then treats the
+     * token as a session of one, which costs reuse tolerance but still works.
+     */
+    sessionId?: string;
+    /**
+     * Set when this token was superseded by a rotation. Being superseded is
+     * not an error — a client whose response was lost still holds it — so it
+     * stays usable to mint a sibling for a short window after this instant.
+     */
+    rotatedAt?: Date | null;
+    /** Hard kill (logout, remote session revoke). Never usable again. */
+    revoked?: boolean;
+    /** When the sign-in happened; carried across rotations, unlike createdAt. */
+    sessionStartedAt?: Date;
+}
+/**
+ * Identity of the sign-in a refresh token belongs to, threaded through
+ * rotation so descendants stay grouped.
+ */
+export interface RefreshTokenSession {
+    id: string;
+    startedAt: Date;
 }
 /**
  * Password reset token info
@@ -278,9 +305,45 @@ export interface RoleRepository {
  */
 export interface TokenRepository {
     /**
-     * Create a new refresh token
+     * Create a new refresh token.
+     *
+     * `session` groups this token with the sign-in it descends from. It is
+     * optional so that repositories written against an older release keep
+     * satisfying this interface; implementations that ignore it degrade to one
+     * session per token.
+     */
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    /**
+     * Mark a token as superseded by a rotation, WITHOUT making it unusable.
+     *
+     * The distinction from deletion is the entire point: a client that never
+     * received the rotated response still holds this token, and must be able
+     * to present it and be recognised. Implementations that omit this method
+     * fall back to {@link TokenRepository.deleteRefreshToken}, which restores
+     * the old, lossy behaviour.
+     */
+    markRefreshTokenRotated?(tokenHash: string): Promise<void>;
+    /**
+     * Hard-kill every token of one sign-in (logout, remote session revoke).
+     * Unlike rotation this is final — no grace, no replay.
+     */
+    revokeRefreshTokenSession?(sessionId: string): Promise<void>;
+    /**
+     * Drop tokens of a session that were superseded before `supersededBefore`,
+     * plus anything already expired. Keeps rotation from growing a row per
+     * refresh forever; called opportunistically, never load-bearing.
+     */
+    pruneRefreshTokens?(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    /**
+     * The instant before which every session of this user is void, or null if
+     * none is set. See `users.tokens_valid_after`.
+     */
+    getTokensValidAfter?(uid: string): Promise<Date | null>;
+    /**
+     * Void every session that began before `at`. Set alongside deleting the
+     * user's tokens so a rotation racing the delete cannot survive it.
      */
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    setTokensValidAfter?(uid: string, at: Date): Promise<void>;
     /**
      * Find a refresh token by hash
      */

package/dist/auth/jwt.d.ts

@@ -65,6 +65,23 @@ export declare function generateRefreshToken(): string;
  * Hash a refresh token for database storage (don't store raw tokens)
  */
 export declare function hashRefreshToken(token: string): string;
+/**
+ * The longest a cookie can live. Chrome (since 104) and RFC 6265bis silently
+ * rewrite any `Max-Age` beyond 400 days down to 400 days, so promising a
+ * browser more is not a stricter policy — it is a policy that differs from
+ * what is actually enforced, which is worse than knowing the ceiling.
+ */
+export declare const MAX_COOKIE_AGE_MS: number;
+/**
+ * How long a refresh token is valid for, in milliseconds.
+ *
+ * Every rotation issues a token with a fresh TTL, so this is a sliding window:
+ * a user who visits at all keeps their session indefinitely, and one who
+ * disappears loses it this long after their last visit. That is what both
+ * Firebase and Supabase do by default, and it is the behaviour people mean
+ * when they say they expect to still be signed in.
+ */
+export declare function getRefreshTokenTtlMs(): number;
 /**
  * Calculate refresh token expiration date
  */

package/dist/auth/routes.d.ts

@@ -47,6 +47,22 @@ export interface AuthModuleConfig {
      * auth endpoints, and CORS must allow credentials (no `origin: "*"`).
      */
     cookieAuth?: CookieAuthConfig;
+    /**
+     * How long a refresh token stays usable after it has been rotated away,
+     * in seconds. Default 10, matching GoTrue's `refresh_token_reuse_interval`.
+     *
+     * Rotation is only safe if the client is guaranteed to receive the
+     * replacement, and no network guarantees that. A pod rolls mid-response, a
+     * laptop suspends, a second tab boots at the same instant — and the client
+     * is left holding a token the database has moved past. Within this window
+     * that client is handed a fresh token of the same session instead of a
+     * 401, which is the difference between a hiccup and being silently signed
+     * out of an app you were using.
+     *
+     * Widen it if your clients are flaky or your deploys are long; the cost is
+     * how long a captured token stays useful to someone who copied it.
+     */
+    refreshTokenReuseIntervalSeconds?: number;
 }
 /**
  * Configuration for httpOnly refresh-token cookies.