@rebasepro/server 0.10.1-canary.31c773c → 0.10.1-canary.811b3da

package/dist/auth/interfaces.d.ts

@@ -119,6 +119,33 @@ export interface RefreshTokenInfo {
     createdAt: Date;
     userAgent?: string | null;
     ipAddress?: string | null;
+    /**
+     * The sign-in this token descends from. Every token minted by rotating
+     * this one carries the same id.
+     *
+     * Optional because a custom {@link TokenRepository} written against an
+     * older release does not supply it; the refresh endpoint then treats the
+     * token as a session of one, which costs reuse tolerance but still works.
+     */
+    sessionId?: string;
+    /**
+     * Set when this token was superseded by a rotation. Being superseded is
+     * not an error — a client whose response was lost still holds it — so it
+     * stays usable to mint a sibling for a short window after this instant.
+     */
+    rotatedAt?: Date | null;
+    /** Hard kill (logout, remote session revoke). Never usable again. */
+    revoked?: boolean;
+    /** When the sign-in happened; carried across rotations, unlike createdAt. */
+    sessionStartedAt?: Date;
+}
+/**
+ * Identity of the sign-in a refresh token belongs to, threaded through
+ * rotation so descendants stay grouped.
+ */
+export interface RefreshTokenSession {
+    id: string;
+    startedAt: Date;
 }
 /**
  * Password reset token info
@@ -278,9 +305,45 @@ export interface RoleRepository {
  */
 export interface TokenRepository {
     /**
-     * Create a new refresh token
+     * Create a new refresh token.
+     *
+     * `session` groups this token with the sign-in it descends from. It is
+     * optional so that repositories written against an older release keep
+     * satisfying this interface; implementations that ignore it degrade to one
+     * session per token.
+     */
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    /**
+     * Mark a token as superseded by a rotation, WITHOUT making it unusable.
+     *
+     * The distinction from deletion is the entire point: a client that never
+     * received the rotated response still holds this token, and must be able
+     * to present it and be recognised. Implementations that omit this method
+     * fall back to {@link TokenRepository.deleteRefreshToken}, which restores
+     * the old, lossy behaviour.
+     */
+    markRefreshTokenRotated?(tokenHash: string): Promise<void>;
+    /**
+     * Hard-kill every token of one sign-in (logout, remote session revoke).
+     * Unlike rotation this is final — no grace, no replay.
+     */
+    revokeRefreshTokenSession?(sessionId: string): Promise<void>;
+    /**
+     * Drop tokens of a session that were superseded before `supersededBefore`,
+     * plus anything already expired. Keeps rotation from growing a row per
+     * refresh forever; called opportunistically, never load-bearing.
+     */
+    pruneRefreshTokens?(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    /**
+     * The instant before which every session of this user is void, or null if
+     * none is set. See `users.tokens_valid_after`.
+     */
+    getTokensValidAfter?(uid: string): Promise<Date | null>;
+    /**
+     * Void every session that began before `at`. Set alongside deleting the
+     * user's tokens so a rotation racing the delete cannot survive it.
      */
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    setTokensValidAfter?(uid: string, at: Date): Promise<void>;
     /**
      * Find a refresh token by hash
      */

package/dist/auth/jwt.d.ts

@@ -65,6 +65,23 @@ export declare function generateRefreshToken(): string;
  * Hash a refresh token for database storage (don't store raw tokens)
  */
 export declare function hashRefreshToken(token: string): string;
+/**
+ * The longest a cookie can live. Chrome (since 104) and RFC 6265bis silently
+ * rewrite any `Max-Age` beyond 400 days down to 400 days, so promising a
+ * browser more is not a stricter policy — it is a policy that differs from
+ * what is actually enforced, which is worse than knowing the ceiling.
+ */
+export declare const MAX_COOKIE_AGE_MS: number;
+/**
+ * How long a refresh token is valid for, in milliseconds.
+ *
+ * Every rotation issues a token with a fresh TTL, so this is a sliding window:
+ * a user who visits at all keeps their session indefinitely, and one who
+ * disappears loses it this long after their last visit. That is what both
+ * Firebase and Supabase do by default, and it is the behaviour people mean
+ * when they say they expect to still be signed in.
+ */
+export declare function getRefreshTokenTtlMs(): number;
 /**
  * Calculate refresh token expiration date
  */

package/dist/auth/routes.d.ts

@@ -47,6 +47,22 @@ export interface AuthModuleConfig {
      * auth endpoints, and CORS must allow credentials (no `origin: "*"`).
      */
     cookieAuth?: CookieAuthConfig;
+    /**
+     * How long a refresh token stays usable after it has been rotated away,
+     * in seconds. Default 10, matching GoTrue's `refresh_token_reuse_interval`.
+     *
+     * Rotation is only safe if the client is guaranteed to receive the
+     * replacement, and no network guarantees that. A pod rolls mid-response, a
+     * laptop suspends, a second tab boots at the same instant — and the client
+     * is left holding a token the database has moved past. Within this window
+     * that client is handed a fresh token of the same session instead of a
+     * 401, which is the difference between a hiccup and being silently signed
+     * out of an app you were using.
+     *
+     * Widen it if your clients are flaky or your deploys are long; the cost is
+     * how long a captured token stays useful to someone who copied it.
+     */
+    refreshTokenReuseIntervalSeconds?: number;
 }
 /**
  * Configuration for httpOnly refresh-token cookies.

package/dist/index.es.js

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { a as getAccessTokenExpiry, d as require_jsonwebtoken, f as __commonJSMin, h as __toESM, i as generateRefreshToken, l as verifyAccessToken, m as __require, n as generateAccessToken, o as getRefreshTokenExpiry, p as __exportAll, r as generateDownloadToken, s as hashRefreshToken, t as configureJwt, u as verifyDownloadToken } from "./jwt-B3zjddCa.js";
+import { _ as __toESM, a as generateRefreshToken, c as getRefreshTokenTtlMs, d as verifyAccessToken, f as verifyDownloadToken, g as __require, h as __exportAll, i as generateDownloadToken, l as hashRefreshToken, m as __commonJSMin, n as configureJwt, o as getAccessTokenExpiry, p as require_jsonwebtoken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS } from "./jwt-Dj7r7QX7.js";
 import { _ as RebaseApiError, a as policy, c as isPostgresCollectionConfig, d as REST_TO_CANONICAL, f as toCanonicalOp, g as Vector, h as GeoPoint, i as isSQLAdmin, l as CANONICAL_TO_REST, m as EntityRelation, o as getCollectionDataPath, p as EntityReference, r as getDataSourceCapabilities, s as getDeclaredSubcollections, t as DEFAULT_STORAGE_SOURCE_KEY, u as NULL_OPS, v as RebaseClientError } from "./src-CsHhSKbi.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
@@ -9888,7 +9888,10 @@ function mountMfaRoutes(router, config, ops, parseBody, applyTransformHook) {
 		const roleIds = (await authRepo.getUserRoles(userCtx.uid)).map((r) => r.id);
 		const accessToken = generateAccessToken(userCtx.uid, roleIds, "aal2");
 		const refreshToken = generateRefreshToken();
-		await authRepo.createRefreshToken(userCtx.uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
+		await authRepo.createRefreshToken(userCtx.uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown", {
+			id: randomUUID$1(),
+			startedAt: /* @__PURE__ */ new Date()
+		});
 		if (ops.onMfaVerified) ops.onMfaVerified(userCtx.uid, factor.id).catch((err) => {
 			logger.error("[AuthHooks] onMfaVerified error", { error: err instanceof Error ? err.message : err });
 		});
@@ -9959,7 +9962,8 @@ function setRefreshCookie(c, refreshToken, config) {
 	let cookie = `${settings.name}=${encodeURIComponent(refreshToken)}; Path=${settings.path}; HttpOnly; SameSite=${settings.sameSite}`;
 	if (isSecure) cookie += "; Secure";
 	if (settings.domain) cookie += `; Domain=${settings.domain}`;
-	cookie += `; Max-Age=${720 * 60 * 60}`;
+	const maxAgeSeconds = Math.floor(Math.min(getRefreshTokenTtlMs(), MAX_COOKIE_AGE_MS) / 1e3);
+	cookie += `; Max-Age=${maxAgeSeconds}`;
 	c.header("Set-Cookie", cookie, { append: true });
 }
 /**
@@ -10025,12 +10029,14 @@ function mountSessionRoutes(opts) {
 		const refreshToken = readRefreshToken(c, parseBody(logoutSchema, await c.req.json().catch(() => ({}))), config.cookieAuth);
 		if (refreshToken) {
 			const tokenHash = hashRefreshToken(refreshToken);
-			await authRepo.deleteRefreshToken(tokenHash);
+			const sessionId = (await authRepo.findRefreshTokenByHash(tokenHash).catch(() => null))?.sessionId;
+			if (sessionId && authRepo.revokeRefreshTokenSession) await authRepo.revokeRefreshTokenSession(sessionId);
+			else await authRepo.deleteRefreshToken(tokenHash);
 		}
 		clearRefreshCookie(c, config.cookieAuth);
 		const authHeader = c.req.header("authorization");
 		if (ops.afterLogout && authHeader?.startsWith("Bearer ")) {
-			const { verifyAccessToken } = await import("./jwt-B3zjddCa.js").then((n) => n.c);
+			const { verifyAccessToken } = await import("./jwt-Dj7r7QX7.js").then((n) => n.u);
 			const payload = verifyAccessToken(authHeader.substring(7));
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -10047,12 +10053,20 @@ function mountSessionRoutes(opts) {
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const currentRefreshToken = c.req.header("x-refresh-token");
 		const currentTokenHash = currentRefreshToken ? hashRefreshToken(currentRefreshToken) : null;
-		const mappedSessions = (await authRepo.listRefreshTokensForUser(userCtx.uid)).map((s) => ({
+		const tokens = await authRepo.listRefreshTokensForUser(userCtx.uid);
+		const bySession = /* @__PURE__ */ new Map();
+		for (const token of tokens) {
+			if (token.revoked) continue;
+			const key = token.sessionId ?? token.id;
+			const existing = bySession.get(key);
+			if (!existing || existing.createdAt < token.createdAt) bySession.set(key, token);
+		}
+		const mappedSessions = [...bySession.values()].map((s) => ({
 			id: s.id,
 			userAgent: s.userAgent,
 			ipAddress: s.ipAddress,
-			createdAt: s.createdAt,
-			isCurrentSession: currentTokenHash ? s.tokenHash === currentTokenHash : false
+			createdAt: s.sessionStartedAt ?? s.createdAt,
+			isCurrentSession: currentTokenHash ? tokens.some((t) => t.tokenHash === currentTokenHash && (t.sessionId ?? t.id) === (s.sessionId ?? s.id)) : false
 		}));
 		return c.json({ sessions: mappedSessions });
 	});
@@ -10064,6 +10078,7 @@ function mountSessionRoutes(opts) {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		await authRepo.deleteAllRefreshTokensForUser(userCtx.uid);
+		await authRepo.setTokensValidAfter?.(userCtx.uid, /* @__PURE__ */ new Date()).catch(() => void 0);
 		return c.json({
 			success: true,
 			message: "All sessions revoked successfully"
@@ -10078,7 +10093,9 @@ function mountSessionRoutes(opts) {
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const id = c.req.param("id");
 		if (!id) throw ApiError.badRequest("Session ID is required", "INVALID_INPUT");
-		await authRepo.deleteRefreshTokenById(id, userCtx.uid);
+		const target = (await authRepo.listRefreshTokensForUser(userCtx.uid).catch(() => [])).find((t) => t.id === id);
+		if (target?.sessionId && authRepo.revokeRefreshTokenSession) await authRepo.revokeRefreshTokenSession(target.sessionId);
+		else await authRepo.deleteRefreshTokenById(id, userCtx.uid);
 		return c.json({
 			success: true,
 			message: "Session revoked successfully"
@@ -10442,7 +10459,10 @@ function createAuthRoutes(config) {
 		}
 		const accessToken = generateAccessToken(uid, roleIds, "aal1", customClaims);
 		const refreshToken = generateRefreshToken();
-		await authRepo.createRefreshToken(uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress);
+		await authRepo.createRefreshToken(uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, {
+			id: randomUUID$1(),
+			startedAt: /* @__PURE__ */ new Date()
+		});
 		return {
 			roleIds,
 			accessToken,
@@ -10675,6 +10695,7 @@ function createAuthRoutes(config) {
 		await authRepo.updatePassword(storedToken.uid, passwordHash);
 		await authRepo.markPasswordResetTokenUsed(tokenHash);
 		await authRepo.deleteAllRefreshTokensForUser(storedToken.uid);
+		await authRepo.setTokensValidAfter?.(storedToken.uid, /* @__PURE__ */ new Date()).catch(() => void 0);
 		if (ops.onPasswordReset) ops.onPasswordReset(storedToken.uid).catch((err) => {
 			logger.error("[AuthHooks] onPasswordReset error", { error: err instanceof Error ? err.message : err });
 		});
@@ -10699,6 +10720,7 @@ function createAuthRoutes(config) {
 		const passwordHash = await ops.hashPassword(newPassword);
 		await authRepo.updatePassword(user.id, passwordHash);
 		await authRepo.deleteAllRefreshTokensForUser(user.id);
+		await authRepo.setTokensValidAfter?.(user.id, /* @__PURE__ */ new Date()).catch(() => void 0);
 		return c.json({
 			success: true,
 			message: "Password has been changed successfully"
@@ -10762,15 +10784,34 @@ function createAuthRoutes(config) {
 		if (!refreshToken) throw ApiError.unauthenticated("No refresh token presented", "NO_SESSION");
 		const tokenHash = hashRefreshToken(refreshToken);
 		const storedToken = await authRepo.findRefreshTokenByHash(tokenHash);
-		if (!storedToken) {
+		if (!storedToken) throw ApiError.unauthorized("Invalid refresh token", "INVALID_TOKEN");
+		if (storedToken.revoked) {
 			clearRefreshCookie(c, config.cookieAuth);
-			throw ApiError.unauthorized("Invalid refresh token", "INVALID_TOKEN");
+			throw ApiError.unauthorized("Session has been revoked", "SESSION_REVOKED");
 		}
 		if (/* @__PURE__ */ new Date() > storedToken.expiresAt) {
 			await authRepo.deleteRefreshToken(tokenHash);
 			clearRefreshCookie(c, config.cookieAuth);
 			throw ApiError.unauthorized("Refresh token expired", "TOKEN_EXPIRED");
 		}
+		const sessionStartedAt = storedToken.sessionStartedAt ?? storedToken.createdAt;
+		const tokensValidAfter = await authRepo.getTokensValidAfter?.(storedToken.uid).catch(() => null);
+		if (tokensValidAfter && sessionStartedAt < tokensValidAfter) {
+			await authRepo.deleteRefreshToken(tokenHash);
+			clearRefreshCookie(c, config.cookieAuth);
+			throw ApiError.unauthorized("Session has been revoked", "SESSION_REVOKED");
+		}
+		const reuseWindowMs = Math.max(0, config.refreshTokenReuseIntervalSeconds ?? 10) * 1e3;
+		const supersededAt = storedToken.rotatedAt ? new Date(storedToken.rotatedAt) : null;
+		if (supersededAt && Date.now() - supersededAt.getTime() > reuseWindowMs) {
+			logger.warn("[Auth] Refresh token replayed after the reuse window", {
+				uid: storedToken.uid,
+				sessionId: storedToken.sessionId,
+				supersededSecondsAgo: Math.round((Date.now() - supersededAt.getTime()) / 1e3),
+				userAgent: c.req.header("user-agent") || "unknown"
+			});
+			throw ApiError.unauthorized("Refresh token already used", "TOKEN_ALREADY_USED");
+		}
 		const roleIds = (await authRepo.getUserRoles(storedToken.uid)).map((r) => r.id);
 		const user = await authRepo.getUserById(storedToken.uid).catch((err) => {
 			logger.warn("[Auth] Could not load user during token refresh; returning tokens only", {
@@ -10792,8 +10833,16 @@ function createAuthRoutes(config) {
 		const newRefreshToken = generateRefreshToken();
 		const userAgent = c.req.header("user-agent") || "unknown";
 		const ipAddress = c.req.header("x-forwarded-for") || "unknown";
-		await authRepo.deleteRefreshToken(tokenHash);
-		await authRepo.createRefreshToken(storedToken.uid, hashRefreshToken(newRefreshToken), getRefreshTokenExpiry(), userAgent, ipAddress);
+		const session = {
+			id: storedToken.sessionId ?? storedToken.id,
+			startedAt: sessionStartedAt
+		};
+		if (!supersededAt) if (authRepo.markRefreshTokenRotated) await authRepo.markRefreshTokenRotated(tokenHash);
+		else await authRepo.deleteRefreshToken(tokenHash);
+		await authRepo.createRefreshToken(storedToken.uid, hashRefreshToken(newRefreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, session);
+		authRepo.pruneRefreshTokens?.(storedToken.uid, session.id, new Date(Date.now() - reuseWindowMs)).catch((err) => {
+			logger.warn("[Auth] Refresh token prune failed", { error: err instanceof Error ? err.message : String(err) });
+		});
 		const tokensOnlyResponse = { tokens: {
 			accessToken: newAccessToken,
 			refreshToken: newRefreshToken,
@@ -15032,19 +15081,39 @@ function createAuth(transport, options) {
 	*/
 	function isFatalRefreshError(err) {
 		if (!(err instanceof RebaseApiError)) return false;
+		if (err.code === "TOKEN_ALREADY_USED") return false;
 		if (err.code === "INVALID_TOKEN" || err.code === "TOKEN_EXPIRED") return true;
 		return err.status === 401 || err.status === 403;
 	}
+	/**
+	* Drop this client's session without telling the server.
+	*
+	* `signOut()` is a user action: it POSTs /logout, which revokes the whole
+	* sign-in. That is the wrong hammer for a refresh that failed. Our token
+	* may be stale precisely because a sibling tab holds a live one, and
+	* logging out on its behalf would turn one tab's bad luck into everybody
+	* being signed out — the exact failure this work exists to remove.
+	*/
+	function abandonSessionLocally() {
+		currentSession = null;
+		clearStoredSession();
+		if (refreshTimeout) {
+			clearTimeout(refreshTimeout);
+			refreshTimeout = null;
+		}
+		transport.setToken(null);
+		emit("SIGNED_OUT", null);
+	}
 	async function attemptScheduledRefresh(attempt) {
 		try {
 			await refreshSession();
 		} catch (err) {
 			if (isFatalRefreshError(err)) {
-				signOut();
+				abandonSessionLocally();
 				return;
 			}
 			if (attempt >= MAX_REFRESH_RETRIES) {
-				signOut();
+				abandonSessionLocally();
 				return;
 			}
 			const backoff = Math.min(REFRESH_RETRY_BASE_MS * 2 ** attempt, REFRESH_RETRY_MAX_MS);
@@ -15265,9 +15334,42 @@ function createAuth(transport, options) {
 		transport.setToken(null);
 		emit("SIGNED_OUT", null);
 	}
+	/**
+	* Serialise refreshes across TABS, not just within one.
+	*
+	* The in-flight promise below covers callers inside a single JavaScript
+	* context. It does nothing about the far more common case: two tabs of the
+	* same app booting together, each firing its own /refresh with the same
+	* cookie. The server tolerates that now (superseded tokens stay usable for
+	* a grace window), but tolerating a stampede is not the same as avoiding
+	* one, and every extra rotation is another chance to end up holding a
+	* token whose response never arrived.
+	*
+	* Web Locks are best-effort on purpose. supabase-js shipped this and then
+	* spent a year fielding deadlock reports — a lock held by a crashed or
+	* frozen tab must never be able to wedge sign-in — so a lock we cannot
+	* take within the timeout is simply not taken, and the refresh proceeds
+	* unserialised, exactly as it did before.
+	*/
+	const REFRESH_LOCK_NAME = "rebase-auth-refresh";
+	const REFRESH_LOCK_TIMEOUT_MS = 5e3;
+	async function withRefreshLock(fn) {
+		const locks = globalThis.navigator?.locks;
+		if (!locks?.request) return fn();
+		const controller = new AbortController();
+		const giveUp = setTimeout(() => controller.abort(), REFRESH_LOCK_TIMEOUT_MS);
+		try {
+			return await locks.request(REFRESH_LOCK_NAME, { signal: controller.signal }, async () => fn());
+		} catch (e) {
+			if (e?.name !== "AbortError") throw e;
+			return fn();
+		} finally {
+			clearTimeout(giveUp);
+		}
+	}
 	function refreshSession() {
 		if (inFlightRefresh) return inFlightRefresh;
-		inFlightRefresh = doRefreshSession().finally(() => {
+		inFlightRefresh = withRefreshLock(() => doRefreshSession()).finally(() => {
 			inFlightRefresh = null;
 		});
 		return inFlightRefresh;
@@ -21782,7 +21884,7 @@ var rebaseEnvSchema = object({
 	ADMIN_CONNECTION_STRING: string().url().optional(),
 	JWT_SECRET: string().min(32, "JWT_SECRET must be at least 32 characters long"),
 	JWT_ACCESS_EXPIRES_IN: string().default("1h"),
-	JWT_REFRESH_EXPIRES_IN: string().default("30d"),
+	JWT_REFRESH_EXPIRES_IN: string().default("400d"),
 	GOOGLE_CLIENT_ID: string().optional(),
 	GOOGLE_CLIENT_SECRET: string().optional(),
 	REBASE_SERVICE_KEY: string().optional(),