@shipfox/api-auth 2.0.0

package/src/core/runner-session-token.ts

@@ -0,0 +1,49 @@
+import {
+  RUNNER_SESSION_TOKEN_AUDIENCE,
+  type RunnerSessionTokenClaims,
+  runnerSessionTokenClaimsSchema,
+} from '@shipfox/api-auth-dto';
+import {signHs256, verifyHs256} from '@shipfox/node-jwt';
+import {config} from '#config.js';
+import {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';
+
+// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.
+export type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;
+
+export async function issueRunnerSessionToken(
+  claims: IssueRunnerSessionTokenParams,
+): Promise<string> {
+  const token = await signHs256({
+    payload: {
+      runnerSessionId: claims.runnerSessionId,
+      workspaceId: claims.workspaceId,
+      scope: claims.scope,
+      labels: claims.labels,
+      maxClaims: claims.maxClaims,
+    },
+    secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,
+    expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,
+    audience: RUNNER_SESSION_TOKEN_AUDIENCE,
+  });
+  recordTokenIssued('runner_session');
+  return token;
+}
+
+/** Returns the claims on success, or `null` for any invalid input — never throws. */
+export async function verifyRunnerSessionToken(
+  token: string,
+): Promise<RunnerSessionTokenClaims | null> {
+  try {
+    const claims = await verifyHs256({
+      token,
+      secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,
+      schema: runnerSessionTokenClaimsSchema,
+      audience: RUNNER_SESSION_TOKEN_AUDIENCE,
+    });
+    recordTokenVerified('runner_session', 'ok');
+    return claims;
+  } catch {
+    recordTokenVerified('runner_session', 'rejected');
+    return null;
+  }
+}

package/src/db/db.ts

@@ -0,0 +1,28 @@
+import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';
+import {pgClient} from '@shipfox/node-postgres';
+import {emailVerifications} from './schema/email-verifications.js';
+import {authOutbox} from './schema/outbox.js';
+import {passwordResets} from './schema/password-resets.js';
+import {authRateLimits} from './schema/rate-limits.js';
+import {refreshTokens} from './schema/refresh-tokens.js';
+import {users} from './schema/users.js';
+
+export const schema = {
+  users,
+  passwordResets,
+  refreshTokens,
+  emailVerifications,
+  authOutbox,
+  authRateLimits,
+};
+
+let _db: NodePgDatabase<typeof schema> | undefined;
+
+export function db() {
+  if (!_db) _db = drizzle(pgClient(), {schema});
+  return _db;
+}
+
+export function closeDb(): void {
+  _db = undefined;
+}

package/src/db/email-verifications.test.ts

@@ -0,0 +1,61 @@
+import {hashOpaqueToken} from '@shipfox/node-tokens';
+import {consumeEmailVerification, createEmailVerification} from './email-verifications.js';
+import {createUser} from './users.js';
+
+function emailFor(suffix: string): string {
+  return `${suffix}-${crypto.randomUUID()}@example.com`;
+}
+
+describe('email-verifications db', () => {
+  test('creates a verification and consumes it once', async () => {
+    const user = await createUser({email: emailFor('ev1'), hashedPassword: 'h'});
+    const raw = `verification-${crypto.randomUUID()}`;
+    const verification = await createEmailVerification({
+      userId: user.id,
+      hashedToken: hashOpaqueToken(raw),
+      expiresAt: new Date(Date.now() + 60_000),
+      skipEmail: true,
+    });
+
+    const first = await consumeEmailVerification({hashedToken: verification.hashedToken});
+    const second = await consumeEmailVerification({hashedToken: verification.hashedToken});
+
+    expect(first?.id).toBe(verification.id);
+    expect(second).toBeUndefined();
+  });
+
+  test('rejects expired verification', async () => {
+    const user = await createUser({email: emailFor('ev2'), hashedPassword: 'h'});
+    const verification = await createEmailVerification({
+      userId: user.id,
+      hashedToken: hashOpaqueToken(`expired-v-${crypto.randomUUID()}`),
+      expiresAt: new Date(Date.now() - 60_000),
+      skipEmail: true,
+    });
+
+    const consumed = await consumeEmailVerification({hashedToken: verification.hashedToken});
+
+    expect(consumed).toBeUndefined();
+  });
+
+  test('creating a new verification invalidates prior unused for the same user', async () => {
+    const user = await createUser({email: emailFor('ev3'), hashedPassword: 'h'});
+    const first = await createEmailVerification({
+      userId: user.id,
+      hashedToken: hashOpaqueToken(`first-v-${crypto.randomUUID()}`),
+      expiresAt: new Date(Date.now() + 60_000),
+      skipEmail: true,
+    });
+
+    await createEmailVerification({
+      userId: user.id,
+      hashedToken: hashOpaqueToken(`second-v-${crypto.randomUUID()}`),
+      expiresAt: new Date(Date.now() + 60_000),
+      skipEmail: true,
+    });
+
+    const consumeFirst = await consumeEmailVerification({hashedToken: first.hashedToken});
+
+    expect(consumeFirst).toBeUndefined();
+  });
+});

package/src/db/email-verifications.ts

@@ -0,0 +1,160 @@
+import {AUTH_EMAIL_VERIFICATION_SEND_REQUESTED, type AuthEventMap} from '@shipfox/api-auth-dto';
+import {writeOutboxEvent} from '@shipfox/node-outbox';
+import {and, desc, eq, gt, isNull, sql} from 'drizzle-orm';
+import type {EmailVerification} from '#core/entities/email-verification.js';
+import type {User} from '#core/entities/user.js';
+import {db} from './db.js';
+import {emailVerifications, toEmailVerification} from './schema/email-verifications.js';
+import {authOutbox} from './schema/outbox.js';
+import {toUser, users} from './schema/users.js';
+
+interface CreateEmailVerificationBaseParams {
+  userId: string;
+  hashedToken: string;
+  expiresAt: Date;
+}
+
+export type CreateEmailVerificationParams = CreateEmailVerificationBaseParams &
+  (
+    | {sendEmail: {email: string; verifyLink: string}; skipEmail?: never}
+    | {sendEmail?: never; skipEmail: true}
+  );
+
+export async function createEmailVerification(
+  params: CreateEmailVerificationParams,
+): Promise<EmailVerification> {
+  return await db().transaction(async (tx) => {
+    await tx
+      .update(emailVerifications)
+      .set({usedAt: sql`now()`})
+      .where(and(eq(emailVerifications.userId, params.userId), isNull(emailVerifications.usedAt)));
+
+    const rows = await tx
+      .insert(emailVerifications)
+      .values({
+        userId: params.userId,
+        hashedToken: params.hashedToken,
+        expiresAt: params.expiresAt,
+      })
+      .returning();
+
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    if (params.sendEmail) {
+      await writeOutboxEvent<AuthEventMap>(tx, authOutbox, {
+        type: AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
+        payload: params.sendEmail,
+      });
+    }
+    return toEmailVerification(row);
+  });
+}
+
+export interface CreateResendEmailVerificationParams {
+  email: string;
+  hashedToken: string;
+  expiresAt: Date;
+  cooldownSeconds: number;
+  sendEmail: {verifyLink: string};
+  now?: Date | undefined;
+}
+
+export interface CreateResendEmailVerificationResult {
+  user?: User | undefined;
+  verification?: EmailVerification | undefined;
+  nextResendAvailableAt: Date;
+}
+
+function secondsAfter(date: Date, seconds: number): Date {
+  return new Date(date.getTime() + seconds * 1000);
+}
+
+export async function createResendEmailVerification(
+  params: CreateResendEmailVerificationParams,
+): Promise<CreateResendEmailVerificationResult> {
+  const now = params.now ?? new Date();
+  const genericNextResendAvailableAt = secondsAfter(now, params.cooldownSeconds);
+
+  return await db().transaction(async (tx) => {
+    const userRows = await tx
+      .select()
+      .from(users)
+      .where(eq(users.email, params.email))
+      .limit(1)
+      .for('update');
+    const userRow = userRows[0];
+    if (!userRow) {
+      return {nextResendAvailableAt: genericNextResendAvailableAt};
+    }
+
+    const user = toUser(userRow);
+    if (user.status !== 'active' || user.emailVerifiedAt !== null) {
+      return {nextResendAvailableAt: genericNextResendAvailableAt};
+    }
+
+    const latestRows = await tx
+      .select()
+      .from(emailVerifications)
+      .where(and(eq(emailVerifications.userId, user.id), isNull(emailVerifications.usedAt)))
+      .orderBy(desc(emailVerifications.createdAt))
+      .limit(1);
+    const latest = latestRows[0] ? toEmailVerification(latestRows[0]) : undefined;
+    if (latest && secondsAfter(latest.createdAt, params.cooldownSeconds) > now) {
+      // Return the same public retry estimate as no-op cases so the endpoint does
+      // not expose existing account state or prior verification timing.
+      return {user, nextResendAvailableAt: genericNextResendAvailableAt};
+    }
+
+    await tx
+      .update(emailVerifications)
+      .set({usedAt: sql`now()`})
+      .where(and(eq(emailVerifications.userId, user.id), isNull(emailVerifications.usedAt)));
+
+    const rows = await tx
+      .insert(emailVerifications)
+      .values({
+        userId: user.id,
+        hashedToken: params.hashedToken,
+        expiresAt: params.expiresAt,
+      })
+      .returning();
+
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    const verification = toEmailVerification(row);
+    if (params.sendEmail) {
+      await writeOutboxEvent<AuthEventMap>(tx, authOutbox, {
+        type: AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
+        payload: {
+          email: user.email,
+          verifyLink: params.sendEmail.verifyLink,
+        },
+      });
+    }
+    return {
+      user,
+      verification,
+      nextResendAvailableAt: secondsAfter(verification.createdAt, params.cooldownSeconds),
+    };
+  });
+}
+
+export async function consumeEmailVerification(params: {
+  hashedToken: string;
+}): Promise<EmailVerification | undefined> {
+  const rows = await db()
+    .update(emailVerifications)
+    .set({usedAt: sql`now()`})
+    .where(
+      and(
+        eq(emailVerifications.hashedToken, params.hashedToken),
+        isNull(emailVerifications.usedAt),
+        gt(emailVerifications.expiresAt, sql`now()`),
+      ),
+    )
+    .returning();
+
+  const row = rows[0];
+  if (!row) return undefined;
+  return toEmailVerification(row);
+}

package/src/db/migrations.ts

@@ -0,0 +1,4 @@
+import {dirname, resolve} from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+export const migrationsPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../drizzle');

package/src/db/password-resets.test.ts

@@ -0,0 +1,61 @@
+import {hashOpaqueToken} from '@shipfox/node-tokens';
+import {consumePasswordReset, createPasswordReset} from './password-resets.js';
+import {createUser} from './users.js';
+
+function emailFor(suffix: string): string {
+  return `${suffix}-${crypto.randomUUID()}@example.com`;
+}
+
+describe('password-resets db', () => {
+  test('creates a reset and consumes it once', async () => {
+    const user = await createUser({email: emailFor('pr1'), hashedPassword: 'h'});
+    const raw = `test-token-${crypto.randomUUID()}`;
+    const reset = await createPasswordReset({
+      userId: user.id,
+      hashedToken: hashOpaqueToken(raw),
+      expiresAt: new Date(Date.now() + 60_000),
+      skipEmail: true,
+    });
+
+    const first = await consumePasswordReset({hashedToken: reset.hashedToken});
+    const second = await consumePasswordReset({hashedToken: reset.hashedToken});
+
+    expect(first?.id).toBe(reset.id);
+    expect(second).toBeUndefined();
+  });
+
+  test('rejects expired token', async () => {
+    const user = await createUser({email: emailFor('pr2'), hashedPassword: 'h'});
+    const reset = await createPasswordReset({
+      userId: user.id,
+      hashedToken: hashOpaqueToken(`expired-${crypto.randomUUID()}`),
+      expiresAt: new Date(Date.now() - 60_000),
+      skipEmail: true,
+    });
+
+    const consumed = await consumePasswordReset({hashedToken: reset.hashedToken});
+
+    expect(consumed).toBeUndefined();
+  });
+
+  test('creating a new reset invalidates prior unused resets for the same user', async () => {
+    const user = await createUser({email: emailFor('pr3'), hashedPassword: 'h'});
+    const first = await createPasswordReset({
+      userId: user.id,
+      hashedToken: hashOpaqueToken(`first-${crypto.randomUUID()}`),
+      expiresAt: new Date(Date.now() + 60_000),
+      skipEmail: true,
+    });
+
+    await createPasswordReset({
+      userId: user.id,
+      hashedToken: hashOpaqueToken(`second-${crypto.randomUUID()}`),
+      expiresAt: new Date(Date.now() + 60_000),
+      skipEmail: true,
+    });
+
+    const consumeFirst = await consumePasswordReset({hashedToken: first.hashedToken});
+
+    expect(consumeFirst).toBeUndefined();
+  });
+});

package/src/db/password-resets.ts

@@ -0,0 +1,69 @@
+import {AUTH_PASSWORD_RESET_SEND_REQUESTED, type AuthEventMap} from '@shipfox/api-auth-dto';
+import {writeOutboxEvent} from '@shipfox/node-outbox';
+import {and, eq, gt, isNull, sql} from 'drizzle-orm';
+import type {PasswordReset} from '#core/entities/password-reset.js';
+import {db} from './db.js';
+import {authOutbox} from './schema/outbox.js';
+import {passwordResets, toPasswordReset} from './schema/password-resets.js';
+
+interface CreatePasswordResetBaseParams {
+  userId: string;
+  hashedToken: string;
+  expiresAt: Date;
+}
+
+export type CreatePasswordResetParams = CreatePasswordResetBaseParams &
+  (
+    | {sendEmail: {email: string; resetLink: string; expiresInHours: number}; skipEmail?: never}
+    | {sendEmail?: never; skipEmail: true}
+  );
+
+export async function createPasswordReset(
+  params: CreatePasswordResetParams,
+): Promise<PasswordReset> {
+  return await db().transaction(async (tx) => {
+    await tx
+      .update(passwordResets)
+      .set({usedAt: sql`now()`})
+      .where(and(eq(passwordResets.userId, params.userId), isNull(passwordResets.usedAt)));
+
+    const rows = await tx
+      .insert(passwordResets)
+      .values({
+        userId: params.userId,
+        hashedToken: params.hashedToken,
+        expiresAt: params.expiresAt,
+      })
+      .returning();
+
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    if (params.sendEmail) {
+      await writeOutboxEvent<AuthEventMap>(tx, authOutbox, {
+        type: AUTH_PASSWORD_RESET_SEND_REQUESTED,
+        payload: params.sendEmail,
+      });
+    }
+    return toPasswordReset(row);
+  });
+}
+
+export async function consumePasswordReset(params: {
+  hashedToken: string;
+}): Promise<PasswordReset | undefined> {
+  const rows = await db()
+    .update(passwordResets)
+    .set({usedAt: sql`now()`})
+    .where(
+      and(
+        eq(passwordResets.hashedToken, params.hashedToken),
+        isNull(passwordResets.usedAt),
+        gt(passwordResets.expiresAt, sql`now()`),
+      ),
+    )
+    .returning();
+
+  const row = rows[0];
+  if (!row) return undefined;
+  return toPasswordReset(row);
+}

package/src/db/rate-limits.ts

@@ -0,0 +1,69 @@
+import {lt, sql} from 'drizzle-orm';
+import {db} from './db.js';
+import {authRateLimits} from './schema/rate-limits.js';
+
+export interface ConsumeAuthRateLimitParams {
+  action: string;
+  scope: string;
+  identifierHmac: string;
+  windowStart: Date;
+  expiresAt: Date;
+  timeoutMs: number;
+}
+
+export interface ConsumeAuthRateLimitResult {
+  count: number;
+  expiresAt: Date;
+}
+
+export async function consumeAuthRateLimit(
+  params: ConsumeAuthRateLimitParams,
+): Promise<ConsumeAuthRateLimitResult> {
+  return await db().transaction(async (tx) => {
+    await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);
+
+    const rows = await tx
+      .insert(authRateLimits)
+      .values({
+        action: params.action,
+        scope: params.scope,
+        identifierHmac: params.identifierHmac,
+        windowStart: params.windowStart,
+        count: 1,
+        expiresAt: params.expiresAt,
+      })
+      .onConflictDoUpdate({
+        target: [
+          authRateLimits.action,
+          authRateLimits.scope,
+          authRateLimits.identifierHmac,
+          authRateLimits.windowStart,
+        ],
+        set: {
+          count: sql`${authRateLimits.count} + 1`,
+          updatedAt: sql`now()`,
+        },
+      })
+      .returning({count: authRateLimits.count, expiresAt: authRateLimits.expiresAt});
+
+    const row = rows[0];
+    if (!row) throw new Error('Rate limit upsert returned no rows');
+    return row;
+  });
+}
+
+let nextPruneAt = 0;
+
+export async function pruneExpiredAuthRateLimits(
+  params: {now?: Date | undefined; minIntervalMs?: number | undefined} = {},
+): Promise<number | undefined> {
+  const now = params.now ?? new Date();
+  const minIntervalMs = params.minIntervalMs ?? 60_000;
+  if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;
+
+  nextPruneAt = now.getTime() + minIntervalMs;
+
+  const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));
+
+  return result.rowCount ?? 0;
+}

package/src/db/refresh-tokens.test.ts

@@ -0,0 +1,164 @@
+import {hashOpaqueToken} from '@shipfox/node-tokens';
+import {
+  createRefreshToken,
+  findActiveRefreshTokenByHash,
+  findRefreshTokenByHash,
+  revokeRefreshTokenByHash,
+  revokeRefreshTokensForUser,
+  rotateRefreshToken,
+} from './refresh-tokens.js';
+import {createUser} from './users.js';
+
+function emailFor(suffix: string): string {
+  return `${suffix}-${crypto.randomUUID()}@example.com`;
+}
+
+describe('refresh-tokens db', () => {
+  test('creates and finds an active refresh token', async () => {
+    const user = await createUser({email: emailFor('rt-create'), hashedPassword: 'h'});
+    const hashedToken = hashOpaqueToken(`refresh-${crypto.randomUUID()}`);
+
+    const created = await createRefreshToken({
+      userId: user.id,
+      hashedToken,
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    const found = await findActiveRefreshTokenByHash({hashedToken});
+
+    expect(created.userId).toBe(user.id);
+    expect(found?.id).toBe(created.id);
+  });
+
+  test('rejects expired refresh tokens', async () => {
+    const user = await createUser({email: emailFor('rt-exp'), hashedPassword: 'h'});
+    const hashedToken = hashOpaqueToken(`expired-${crypto.randomUUID()}`);
+    await createRefreshToken({
+      userId: user.id,
+      hashedToken,
+      expiresAt: new Date(Date.now() - 60_000),
+    });
+
+    const found = await findActiveRefreshTokenByHash({hashedToken});
+
+    expect(found).toBeUndefined();
+  });
+
+  test('rotates a token once, creates the successor, and only the first caller wins', async () => {
+    const user = await createUser({email: emailFor('rt-rotate'), hashedPassword: 'h'});
+    const currentHashedToken = hashOpaqueToken(`current-${crypto.randomUUID()}`);
+    const nextHashedToken = hashOpaqueToken(`next-${crypto.randomUUID()}`);
+    const created = await createRefreshToken({
+      userId: user.id,
+      hashedToken: currentHashedToken,
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+
+    const won = await rotateRefreshToken({
+      id: created.id,
+      currentHashedToken,
+      nextHashedToken,
+      expiresAt: new Date(Date.now() + 120_000),
+    });
+    const lost = await rotateRefreshToken({
+      id: created.id,
+      currentHashedToken,
+      nextHashedToken: hashOpaqueToken(`lost-${crypto.randomUUID()}`),
+      expiresAt: new Date(Date.now() + 120_000),
+    });
+    const successor = await findActiveRefreshTokenByHash({hashedToken: nextHashedToken});
+
+    expect(won?.rotatedAt).toBeInstanceOf(Date);
+    expect(lost).toBeUndefined();
+    expect(successor?.hashedToken).toBe(nextHashedToken);
+  });
+
+  test('rolls back the rotation when successor creation fails', async () => {
+    const user = await createUser({email: emailFor('rt-rotate-rollback'), hashedPassword: 'h'});
+    const currentHashedToken = hashOpaqueToken(`current-${crypto.randomUUID()}`);
+    const duplicateHashedToken = hashOpaqueToken(`duplicate-${crypto.randomUUID()}`);
+    const created = await createRefreshToken({
+      userId: user.id,
+      hashedToken: currentHashedToken,
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    await createRefreshToken({
+      userId: user.id,
+      hashedToken: duplicateHashedToken,
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+
+    const failed = rotateRefreshToken({
+      id: created.id,
+      currentHashedToken,
+      nextHashedToken: duplicateHashedToken,
+      expiresAt: new Date(Date.now() + 120_000),
+    });
+
+    await expect(failed).rejects.toThrow();
+    const active = await findActiveRefreshTokenByHash({hashedToken: currentHashedToken});
+    expect(active?.id).toBe(created.id);
+    expect(active?.rotatedAt).toBeNull();
+  });
+
+  test('rotated tokens drop out of the active lookup but stay findable for the grace window', async () => {
+    const user = await createUser({email: emailFor('rt-rotated-find'), hashedPassword: 'h'});
+    const currentHashedToken = hashOpaqueToken(`current-${crypto.randomUUID()}`);
+    const nextHashedToken = hashOpaqueToken(`next-${crypto.randomUUID()}`);
+    const created = await createRefreshToken({
+      userId: user.id,
+      hashedToken: currentHashedToken,
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    await rotateRefreshToken({
+      id: created.id,
+      currentHashedToken,
+      nextHashedToken,
+      expiresAt: new Date(Date.now() + 120_000),
+    });
+
+    const active = await findActiveRefreshTokenByHash({hashedToken: currentHashedToken});
+    const found = await findRefreshTokenByHash({hashedToken: currentHashedToken});
+
+    expect(active).toBeUndefined();
+    expect(found?.id).toBe(created.id);
+    expect(found?.rotatedAt).toBeInstanceOf(Date);
+  });
+
+  test('revokes a single refresh token by hash', async () => {
+    const user = await createUser({email: emailFor('rt-revoke'), hashedPassword: 'h'});
+    const hashedToken = hashOpaqueToken(`revoke-${crypto.randomUUID()}`);
+    await createRefreshToken({
+      userId: user.id,
+      hashedToken,
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+
+    await revokeRefreshTokenByHash({hashedToken});
+    const found = await findActiveRefreshTokenByHash({hashedToken});
+
+    expect(found).toBeUndefined();
+  });
+
+  test('revokes all user refresh tokens except the selected session', async () => {
+    const user = await createUser({email: emailFor('rt-revoke-user'), hashedPassword: 'h'});
+    const keepHash = hashOpaqueToken(`keep-${crypto.randomUUID()}`);
+    const revokeHash = hashOpaqueToken(`revoke-${crypto.randomUUID()}`);
+    const keep = await createRefreshToken({
+      userId: user.id,
+      hashedToken: keepHash,
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    await createRefreshToken({
+      userId: user.id,
+      hashedToken: revokeHash,
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+
+    await revokeRefreshTokensForUser({userId: user.id, exceptRefreshTokenId: keep.id});
+    const kept = await findActiveRefreshTokenByHash({hashedToken: keepHash});
+    const revoked = await findActiveRefreshTokenByHash({hashedToken: revokeHash});
+
+    expect(kept?.id).toBe(keep.id);
+    expect(revoked).toBeUndefined();
+  });
+});