@solidxai/core 0.1.13-beta.18 → 0.1.13-beta.19

package/dist/services/refresh-token-ids-storage.service.d.ts

@@ -1,21 +1,40 @@
 import { Cache } from 'cache-manager';
 import { AuthenticationService } from './authentication.service';
+import { SettingService } from './setting.service';
 export declare class InvalidatedRefreshTokenError extends Error {
 }
 type RefreshTokenState = {
     currentRefreshToken: string;
     previousRefreshToken: string;
+    previousValidUntil?: number;
+};
+export type RefreshTokenClaims = {
+    deviceKey?: string;
+    epoch?: number;
+};
+export type RotatedRefreshToken = {
+    refreshToken: string;
+    deviceKey?: string;
 };
 export declare class RefreshTokenIdsStorageService {
     private cacheManager;
     private readonly authenticationService;
-    constructor(cacheManager: Cache, authenticationService: AuthenticationService);
-    insert(userId: number, refreshToken: string, previousRefreshToken?: string): Promise<void>;
-    validate(userId: number, refreshToken: string): Promise<boolean>;
-    invalidate(userId: number): Promise<void>;
-    validateAndRotate(user: any, refreshToken: string): Promise<string>;
+    private readonly settingService;
+    constructor(cacheManager: Cache, authenticationService: AuthenticationService, settingService: SettingService);
+    areConcurrentLoginsAllowed(): boolean;
+    insert(userId: number, refreshToken: string, previousRefreshToken?: string, deviceKey?: string): Promise<void>;
+    invalidate(userId: number, deviceKey?: string): Promise<void>;
+    invalidateAll(userId: number): Promise<void>;
+    getEpoch(userId: number): Promise<number | undefined>;
+    validateAndRotate(user: any, refreshToken: string, claims?: RefreshTokenClaims): Promise<RotatedRefreshToken>;
+    getCurrentRefreshTokenState(userId: number, deviceKey?: string): Promise<RefreshTokenState | undefined>;
     private getKey;
-    getCurrentRefreshTokenState(userId: number): Promise<RefreshTokenState | undefined>;
+    private getEpochKey;
+    private resolveNextDeviceKey;
+    private isEpochCurrent;
+    private getStateTtlMs;
+    private isRefreshTokenState;
+    private isWithinGraceWindow;
 }
 export {};
 //# sourceMappingURL=refresh-token-ids-storage.service.d.ts.map

package/dist/services/refresh-token-ids-storage.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token-ids-storage.service.d.ts","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,qBAAa,4BAA6B,SAAQ,KAAK;CAAI;AAE3D,KAAK,iBAAiB,GAAG;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,qBAEa,6BAA6B;IAeX,OAAO,CAAC,YAAY;IAE3C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAFP,YAAY,EAAE,KAAK,EAEjC,qBAAqB,EAAE,qBAAqB;IAG3D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ1F,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUhE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoEzE,OAAO,CAAC,MAAM;IAId,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;CAGtF"}
+{"version":3,"file":"refresh-token-ids-storage.service.d.ts","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,qBAAa,4BAA6B,SAAQ,KAAK;CAAI;AAe3D,KAAK,iBAAiB,GAAG;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAM7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAQF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IAGrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,qBACa,6BAA6B;IAEX,OAAO,CAAC,YAAY;IAE3C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAHA,YAAY,EAAE,KAAK,EAEjC,qBAAqB,EAAE,qBAAqB,EAC5C,cAAc,EAAE,cAAc;IAenD,0BAA0B,IAAI,OAAO;IAI/B,MAAM,CACR,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,oBAAoB,CAAC,EAAE,MAAM,EAC7B,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAeV,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa7D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc5C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIrD,iBAAiB,CACnB,IAAI,EAAE,GAAG,EACT,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,kBAAuB,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAwD/B,2BAA2B,CACvB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAIzC,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,oBAAoB;YAOd,cAAc;IAc5B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,mBAAmB;CAoB9B"}

package/dist/services/refresh-token-ids-storage.service.js

@@ -15,69 +15,106 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RefreshTokenIdsStorageService = exports.InvalidatedRefreshTokenError = void 0;
 const cache_manager_1 = require("@nestjs/cache-manager");
 const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
 const authentication_service_1 = require("./authentication.service");
+const setting_service_1 = require("./setting.service");
 class InvalidatedRefreshTokenError extends Error {
 }
 exports.InvalidatedRefreshTokenError = InvalidatedRefreshTokenError;
+const PREVIOUS_TOKEN_GRACE_MS = 60 * 1000;
+const STATE_TTL_BUFFER_SECONDS = 60;
 let RefreshTokenIdsStorageService = class RefreshTokenIdsStorageService {
-    constructor(cacheManager, authenticationService) {
+    constructor(cacheManager, authenticationService, settingService) {
         this.cacheManager = cacheManager;
         this.authenticationService = authenticationService;
+        this.settingService = settingService;
     }
-    async insert(userId, refreshToken, previousRefreshToken) {
+    areConcurrentLoginsAllowed() {
+        return !this.settingService.getConfigValue("preventConcurrentLogins");
+    }
+    async insert(userId, refreshToken, previousRefreshToken, deviceKey) {
         const refreshTokenState = {
             currentRefreshToken: refreshToken,
             previousRefreshToken: previousRefreshToken ?? "",
+            ...(previousRefreshToken
+                ? { previousValidUntil: Date.now() + PREVIOUS_TOKEN_GRACE_MS }
+                : {}),
         };
-        await this.cacheManager.set(this.getKey(userId), refreshTokenState);
+        await this.cacheManager.set(this.getKey(userId, deviceKey), refreshTokenState, this.getStateTtlMs());
     }
-    async validate(userId, refreshToken) {
-        const storedId = await this.cacheManager.get(this.getKey(userId));
-        if (storedId !== refreshToken) {
-            throw new InvalidatedRefreshTokenError();
-        }
-        return storedId === refreshToken;
+    async invalidate(userId, deviceKey) {
+        await this.cacheManager.del(this.getKey(userId, deviceKey));
     }
-    async invalidate(userId) {
+    async invalidateAll(userId) {
+        const currentEpoch = (await this.getEpoch(userId)) ?? 0;
+        await this.cacheManager.set(this.getEpochKey(userId), currentEpoch + 1, this.getStateTtlMs());
         await this.cacheManager.del(this.getKey(userId));
     }
-    async validateAndRotate(user, refreshToken) {
-        let valid = false;
-        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id));
-        let newRefreshToken;
-        if (refreshTokenState &&
-            typeof refreshTokenState === 'object' &&
-            'currentRefreshToken' in refreshTokenState &&
-            'previousRefreshToken' in refreshTokenState) {
-            if (refreshTokenState.currentRefreshToken === refreshToken) {
-                valid = true;
-                newRefreshToken = await this.authenticationService.generateRefreshToken(user, refreshTokenState.currentRefreshToken);
-                setTimeout(async () => {
-                    const state = (await this.cacheManager.get(this.getKey(user.id)));
-                    if (state && state.currentRefreshToken === newRefreshToken) {
-                        await this.cacheManager.set(this.getKey(user.id), {
-                            currentRefreshToken: newRefreshToken,
-                            previousRefreshToken: "",
-                        });
-                    }
-                }, 1 * 60 * 1000);
+    async getEpoch(userId) {
+        return (await this.cacheManager.get(this.getEpochKey(userId))) ?? undefined;
+    }
+    async validateAndRotate(user, refreshToken, claims = {}) {
+        const { deviceKey, epoch } = claims;
+        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id, deviceKey));
+        if (!this.isRefreshTokenState(refreshTokenState)) {
+            throw new InvalidatedRefreshTokenError();
+        }
+        if (deviceKey && !(await this.isEpochCurrent(user.id, epoch))) {
+            throw new InvalidatedRefreshTokenError();
+        }
+        if (refreshTokenState.currentRefreshToken === refreshToken) {
+            const nextDeviceKey = this.resolveNextDeviceKey(deviceKey);
+            const rotated = await this.authenticationService.generateRefreshToken(user, refreshToken, nextDeviceKey);
+            if (nextDeviceKey !== deviceKey) {
+                await this.cacheManager.del(this.getKey(user.id, deviceKey));
             }
-            else if (refreshTokenState.previousRefreshToken === refreshToken) {
-                valid = true;
-                const existingRefreshTokenState = (await this.cacheManager.get(this.getKey(user.id)));
-                newRefreshToken = existingRefreshTokenState?.currentRefreshToken;
+            return { refreshToken: rotated, deviceKey: nextDeviceKey };
+        }
+        if (refreshTokenState.previousRefreshToken && refreshTokenState.previousRefreshToken === refreshToken) {
+            if (!this.isWithinGraceWindow(refreshTokenState)) {
+                throw new InvalidatedRefreshTokenError();
             }
+            return { refreshToken: refreshTokenState.currentRefreshToken, deviceKey };
         }
-        if (!valid) {
-            throw new InvalidatedRefreshTokenError();
+        throw new InvalidatedRefreshTokenError();
+    }
+    getCurrentRefreshTokenState(userId, deviceKey) {
+        return this.cacheManager.get(this.getKey(userId, deviceKey));
+    }
+    getKey(userId, deviceKey) {
+        return deviceKey ? `user-${userId}-${deviceKey}` : `user-${userId}`;
+    }
+    getEpochKey(userId) {
+        return `user-epoch-${userId}`;
+    }
+    resolveNextDeviceKey(deviceKey) {
+        if (!this.areConcurrentLoginsAllowed()) {
+            return undefined;
         }
-        return newRefreshToken;
+        return deviceKey ?? (0, crypto_1.randomUUID)();
     }
-    getKey(userId) {
-        return `user-${userId}`;
+    async isEpochCurrent(userId, epoch) {
+        const storedEpoch = await this.getEpoch(userId);
+        if (storedEpoch === undefined) {
+            return true;
+        }
+        return epoch === storedEpoch;
+    }
+    getStateTtlMs() {
+        const refreshTokenTtlSeconds = Number(this.settingService.getConfigValue("refreshTokenTtl"));
+        return (refreshTokenTtlSeconds + STATE_TTL_BUFFER_SECONDS) * 1000;
     }
-    getCurrentRefreshTokenState(userId) {
-        return this.cacheManager.get(this.getKey(userId));
+    isRefreshTokenState(state) {
+        return (!!state &&
+            typeof state === 'object' &&
+            'currentRefreshToken' in state &&
+            'previousRefreshToken' in state);
+    }
+    isWithinGraceWindow(state) {
+        if (state.previousValidUntil === undefined) {
+            return true;
+        }
+        return Date.now() < state.previousValidUntil;
     }
 };
 exports.RefreshTokenIdsStorageService = RefreshTokenIdsStorageService;
@@ -85,6 +122,7 @@ exports.RefreshTokenIdsStorageService = RefreshTokenIdsStorageService = __decora
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(cache_manager_1.CACHE_MANAGER)),
     __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => authentication_service_1.AuthenticationService))),
-    __metadata("design:paramtypes", [Object, authentication_service_1.AuthenticationService])
+    __metadata("design:paramtypes", [Object, authentication_service_1.AuthenticationService,
+        setting_service_1.SettingService])
 ], RefreshTokenIdsStorageService);
 //# sourceMappingURL=refresh-token-ids-storage.service.js.map

package/dist/services/refresh-token-ids-storage.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token-ids-storage.service.js","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,yDAAsD;AACtD,2CAAgE;AAEhE,qEAAiE;AAGjE,MAAa,4BAA6B,SAAQ,KAAK;CAAI;AAA3D,oEAA2D;AASpD,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IActC,YACmC,YAAmB,EAEjC,qBAA4C;QAF9B,iBAAY,GAAZ,YAAY,CAAO;QAEjC,0BAAqB,GAArB,qBAAqB,CAAuB;IAC7D,CAAC;IAEL,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,YAAoB,EAAE,oBAA6B;QAC5E,MAAM,iBAAiB,GAAsB;YACzC,mBAAmB,EAAE,YAAY;YACjC,oBAAoB,EAAE,oBAAoB,IAAI,EAAE;SACnD,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,YAAoB;QAG/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,QAAQ,KAAK,YAAY,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAS,EAAE,YAAoB;QACnD,IAAI,KAAK,GAAG,KAAK,CAAC;QAIlB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAkC,CAAC;QAc7G,IAAI,eAAmC,CAAC;QACxC,IACI,iBAAiB;YACjB,OAAO,iBAAiB,KAAK,QAAQ;YACrC,qBAAqB,IAAI,iBAAiB;YAC1C,sBAAsB,IAAI,iBAAiB,EAC7C,CAAC;YACC,IAAI,iBAAiB,CAAC,mBAAmB,KAAK,YAAY,EAAE,CAAC;gBAEzD,KAAK,GAAG,IAAI,CAAC;gBAEb,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;gBAUrH,UAAU,CAAC,KAAK,IAAI,EAAE;oBAClB,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAQ,CAAC;oBACzE,IAAI,KAAK,IAAI,KAAK,CAAC,mBAAmB,KAAK,eAAe,EAAE,CAAC;wBACzD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;4BAC9C,mBAAmB,EAAE,eAAe;4BACpC,oBAAoB,EAAE,EAAE;yBAC3B,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,IAAI,iBAAiB,CAAC,oBAAoB,KAAK,YAAY,EAAE,CAAC;gBAEjE,KAAK,GAAG,IAAI,CAAC;gBAGb,MAAM,yBAAyB,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAkC,CAAC;gBACvH,eAAe,GAAG,yBAAyB,EAAE,mBAAmB,CAAC;YACrE,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QAGD,OAAO,eAAe,CAAC;IAC3B,CAAC;IAEO,MAAM,CAAC,MAAc;QACzB,OAAO,QAAQ,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,2BAA2B,CAAC,MAAc;QACtC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;CACJ,CAAA;AArHY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,mBAAU,GAAE;IAiBJ,WAAA,IAAA,eAAM,EAAC,6BAAa,CAAC,CAAA;IACrB,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8CAAqB,CAAC,CAAC,CAAA;6CACR,8CAAqB;GAjBxD,6BAA6B,CAqHzC","sourcesContent":["import { CACHE_MANAGER } from '@nestjs/cache-manager';\nimport { Inject, Injectable, forwardRef } from '@nestjs/common';\nimport { Cache } from 'cache-manager';\nimport { AuthenticationService } from './authentication.service';\n\n// TODO: Ideally this should be in a separate file - putting this here for brevity\nexport class InvalidatedRefreshTokenError extends Error { }\n\ntype RefreshTokenState = {\n    currentRefreshToken: string;\n    previousRefreshToken: string;\n};\n\n@Injectable()\n// export class RefreshTokenIdsStorageService implements OnApplicationBootstrap, OnApplicationShutdown {\nexport class RefreshTokenIdsStorageService {\n    // private redisClient: Redis;\n    // onApplicationBootstrap() {\n    //     // TODO: Ideally, we should move this to the dedicated \"RedisModule\" instead of initiating the connection here.\n    //     this.redisClient = new Redis({\n    //         // TODO: According to best practices, we should use the environment variables here instead.\n    //         host: 'localhost',\n    //         port: 6379,\n    //     });\n    // }\n    // onApplicationShutdown(signal?: string) {\n    //     return this.redisClient.quit();\n    // }\n\n    constructor(\n        @Inject(CACHE_MANAGER) private cacheManager: Cache,\n        @Inject(forwardRef(() => AuthenticationService))\n        private readonly authenticationService: AuthenticationService\n    ) { }\n\n    async insert(userId: number, refreshToken: string, previousRefreshToken?: string): Promise<void> {\n        const refreshTokenState: RefreshTokenState = {\n            currentRefreshToken: refreshToken,\n            previousRefreshToken: previousRefreshToken ?? \"\",\n        };\n        await this.cacheManager.set(this.getKey(userId), refreshTokenState);\n    }\n\n    async validate(userId: number, refreshToken: string): Promise<boolean> {\n        // TODO: Assume you get this shape out of the cache {\"currentRefreshToken\": \"\", \"previousRefreshToken\": \"\"}\n        // Then you will compare against the currentRefreshToken.\n        const storedId = await this.cacheManager.get(this.getKey(userId));\n        if (storedId !== refreshToken) {\n            throw new InvalidatedRefreshTokenError();\n        }\n        return storedId === refreshToken;\n    }\n\n    async invalidate(userId: number): Promise<void> {\n        await this.cacheManager.del(this.getKey(userId));\n    }\n\n    async validateAndRotate(user: any, refreshToken: string): Promise<string> {\n        let valid = false;\n\n        // TODO: Assume you get this shape out of the cache {\"currentRefreshToken\": \"\", \"previousRefreshToken\": \"\"}\n        // Then you will compare against the currentRefreshToken.\n        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id)) as RefreshTokenState | undefined;\n\n        // Use the authentication service to generate a new refresh token, set it in the currentRefreshToken in scenario 1 and return.\n\n        // if UI.refresh_token is matching with Cache.currentRefreshToken\n        //   then invalidate (updated cache state, no need to delete anything), then generate new token and return.\n        //   also set a setTimeout to run after X minutes, this will simply update the RefreshTokenCacheState to this object {\"currentRefreshToken\": \"R2\",\"justInvalidatedRefreshToken\": \"\"}\n        // valid=true\n\n        //   - if UI.refresh_token is matching Cache.justInvalidatedRefreshToken        \n        //       then use the Cache.currentRefreshToken, generate new access token and return.\n        //       We do not modify the cache state at all.\n        // valid=true\n\n        let newRefreshToken: string | undefined;\n        if (\n            refreshTokenState &&\n            typeof refreshTokenState === 'object' &&\n            'currentRefreshToken' in refreshTokenState &&\n            'previousRefreshToken' in refreshTokenState\n        ) {\n            if (refreshTokenState.currentRefreshToken === refreshToken) {\n                // Scenario 1: Token matches currentRefreshToken\n                valid = true;\n                // Rotate tokens: move current to previous, set new current (simulate generation)\n                newRefreshToken = await this.authenticationService.generateRefreshToken(user, refreshTokenState.currentRefreshToken); // Replace with real token generation logic\n\n\n                //   updated cache state\n                // await this.cacheManager.set(this.getKey(user.id), {\n                //     currentRefreshToken: newRefreshToken,\n                //     previousRefreshToken: refreshTokenState.currentRefreshToken,\n                // });\n\n                // Optionally, set a timeout to clear previousRefreshToken after X minutes\n                setTimeout(async () => {\n                    const state = (await this.cacheManager.get(this.getKey(user.id))) as any;\n                    if (state && state.currentRefreshToken === newRefreshToken) {\n                        await this.cacheManager.set(this.getKey(user.id), {\n                            currentRefreshToken: newRefreshToken,\n                            previousRefreshToken: \"\",\n                        });\n                    }\n                }, 1 * 60 * 1000); // 5 minutes\n            } else if (refreshTokenState.previousRefreshToken === refreshToken) {\n                // Scenario 2: Token matches previousRefreshToken\n                valid = true;\n                // Do not modify cache\n                // Generate new refresh token based on currentRefreshToken\n                const existingRefreshTokenState = (await this.cacheManager.get(this.getKey(user.id))) as RefreshTokenState | undefined;\n                newRefreshToken = existingRefreshTokenState?.currentRefreshToken;\n            }\n        }\n\n\n        if (!valid) {\n            throw new InvalidatedRefreshTokenError();\n        }\n\n        // TODO: return the refresh token either currentRefreshToken\n        return newRefreshToken; // Fallback to the provided tokenId if no new token was generated\n    }\n\n    private getKey(userId: number): string {\n        return `user-${userId}`;\n    }\n\n    getCurrentRefreshTokenState(userId: number): Promise<RefreshTokenState | undefined> {\n        return this.cacheManager.get(this.getKey(userId));\n    }\n}\n"]}
+{"version":3,"file":"refresh-token-ids-storage.service.js","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,yDAAsD;AACtD,2CAAgE;AAEhE,mCAAoC;AAEpC,qEAAiE;AACjE,uDAAmD;AAGnD,MAAa,4BAA6B,SAAQ,KAAK;CAAI;AAA3D,oEAA2D;AAO3D,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAM1C,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAgC7B,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACtC,YACmC,YAAmB,EAEjC,qBAA4C,EAC5C,cAA8B;QAHhB,iBAAY,GAAZ,YAAY,CAAO;QAEjC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;IAC/C,CAAC;IAcL,0BAA0B;QACtB,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,yBAAyB,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,MAAM,CACR,MAAc,EACd,YAAoB,EACpB,oBAA6B,EAC7B,SAAkB;QAElB,MAAM,iBAAiB,GAAsB;YACzC,mBAAmB,EAAE,YAAY;YACjC,oBAAoB,EAAE,oBAAoB,IAAI,EAAE;YAChD,GAAG,CAAC,oBAAoB;gBACpB,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACvB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAC9B,iBAAiB,EACjB,IAAI,CAAC,aAAa,EAAE,CACvB,CAAC;IACN,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAkB;QAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAWD,KAAK,CAAC,aAAa,CAAC,MAAc;QAC9B,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EACxB,YAAY,GAAG,CAAC,EAGhB,IAAI,CAAC,aAAa,EAAE,CACvB,CAAC;QAGF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QACzB,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,iBAAiB,CACnB,IAAS,EACT,YAAoB,EACpB,SAA6B,EAAE;QAE/B,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAMpC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CACD,CAAC;QAEnC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QAKD,IAAI,iBAAiB,CAAC,mBAAmB,KAAK,YAAY,EAAE,CAAC;YACzD,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CACjE,IAAI,EACJ,YAAY,EACZ,aAAa,CAChB,CAAC;YAEF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAM9B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACjE,CAAC;YAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,CAAC;QAMD,IAAI,iBAAiB,CAAC,oBAAoB,IAAI,iBAAiB,CAAC,oBAAoB,KAAK,YAAY,EAAE,CAAC;YACpG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,4BAA4B,EAAE,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC;QAC9E,CAAC;QAED,MAAM,IAAI,4BAA4B,EAAE,CAAC;IAC7C,CAAC;IAED,2BAA2B,CACvB,MAAc,EACd,SAAkB;QAElB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,MAAM,CAAC,MAAc,EAAE,SAAkB;QAC7C,OAAO,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;IACxE,CAAC;IAIO,WAAW,CAAC,MAAc;QAC9B,OAAO,cAAc,MAAM,EAAE,CAAC;IAClC,CAAC;IAUO,oBAAoB,CAAC,SAAkB;QAC3C,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,SAAS,IAAI,IAAA,mBAAU,GAAE,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,KAAc;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAIhD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,KAAK,WAAW,CAAC;IACjC,CAAC;IAKO,aAAa;QACjB,MAAM,sBAAsB,GAAG,MAAM,CACjC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,iBAAiB,CAAC,CAC1E,CAAC;QACF,OAAO,CAAC,sBAAsB,GAAG,wBAAwB,CAAC,GAAG,IAAI,CAAC;IACtE,CAAC;IAEO,mBAAmB,CAAC,KAAc;QACtC,OAAO,CACH,CAAC,CAAC,KAAK;YACP,OAAO,KAAK,KAAK,QAAQ;YACzB,qBAAqB,IAAI,KAAK;YAC9B,sBAAsB,IAAI,KAAK,CAClC,CAAC;IACN,CAAC;IAEO,mBAAmB,CAAC,KAAwB;QAehD,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC;IACjD,CAAC;CACJ,CAAA;AAzNY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAGJ,WAAA,IAAA,eAAM,EAAC,6BAAa,CAAC,CAAA;IACrB,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8CAAqB,CAAC,CAAC,CAAA;6CACR,8CAAqB;QAC5B,gCAAc;GAL1C,6BAA6B,CAyNzC","sourcesContent":["import { CACHE_MANAGER } from '@nestjs/cache-manager';\nimport { Inject, Injectable, forwardRef } from '@nestjs/common';\nimport { Cache } from 'cache-manager';\nimport { randomUUID } from 'crypto';\nimport type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';\nimport { AuthenticationService } from './authentication.service';\nimport { SettingService } from './setting.service';\n\n// TODO: Ideally this should be in a separate file - putting this here for brevity\nexport class InvalidatedRefreshTokenError extends Error { }\n\n// How long a rotated-out refresh token stays acceptable. This window is the\n// point of keeping a previous token at all: concurrent requests from one user\n// must not break each other. core-ui's single-flight guard is module-level and\n// therefore per tab, so two tabs crossing the refresh threshold together will\n// both present the same token - the second one is served from here.\nconst PREVIOUS_TOKEN_GRACE_MS = 60 * 1000;\n\n// The cache entry must outlive the JWT it holds. If it expired first, refresh\n// would fail with ACCESS_DENIED (InvalidatedRefreshTokenError) rather than the\n// SESSION_EXPIRED that the token's own `exp` produces - the same event\n// reported two different ways.\nconst STATE_TTL_BUFFER_SECONDS = 60;\n\ntype RefreshTokenState = {\n    currentRefreshToken: string;\n    previousRefreshToken: string;\n    // Absolute epoch-ms deadline after which previousRefreshToken is refused.\n    // Stored rather than scheduled: an in-process timer is lost when the pod\n    // restarts, which used to leave the rotated-out token valid until the next\n    // rotation instead of for one minute. Optional because entries written\n    // before this field existed will not carry it.\n    previousValidUntil?: number;\n};\n\n/**\n * The bucket-identifying claims carried on a refresh token. Absent on tokens\n * issued before per-device sessions existed, and on tokens issued while\n * preventConcurrentLogins is on - which is exactly how the read path tells the\n * two schemes apart without consulting any setting.\n */\nexport type RefreshTokenClaims = {\n    deviceKey?: string;\n    epoch?: number;\n};\n\nexport type RotatedRefreshToken = {\n    refreshToken: string;\n    // The bucket the rotated token now lives in. Differs from the incoming\n    // deviceKey only when a pre-migration token was just moved into one.\n    deviceKey?: string;\n};\n\n@Injectable()\nexport class RefreshTokenIdsStorageService {\n    constructor(\n        @Inject(CACHE_MANAGER) private cacheManager: Cache,\n        @Inject(forwardRef(() => AuthenticationService))\n        private readonly authenticationService: AuthenticationService,\n        private readonly settingService: SettingService,\n    ) { }\n\n    /**\n     * The inverse of the `preventConcurrentLogins` setting, and the only place\n     * it is interpreted.\n     *\n     * That setting already promises, when off, that sessions may coexist;\n     * splitting the refresh-token keyspace per device is what finally delivers\n     * it. When it is on, its stated purpose is a single live session, so\n     * per-device keys would be meaningless and the original single slot is kept.\n     *\n     * This governs the WRITE path only. Reads always branch on the token's own\n     * claim, so toggling the setting never invalidates a live session.\n     */\n    areConcurrentLoginsAllowed(): boolean {\n        return !this.settingService.getConfigValue<SolidCoreSetting>(\"preventConcurrentLogins\");\n    }\n\n    async insert(\n        userId: number,\n        refreshToken: string,\n        previousRefreshToken?: string,\n        deviceKey?: string,\n    ): Promise<void> {\n        const refreshTokenState: RefreshTokenState = {\n            currentRefreshToken: refreshToken,\n            previousRefreshToken: previousRefreshToken ?? \"\",\n            ...(previousRefreshToken\n                ? { previousValidUntil: Date.now() + PREVIOUS_TOKEN_GRACE_MS }\n                : {}),\n        };\n        await this.cacheManager.set(\n            this.getKey(userId, deviceKey),\n            refreshTokenState,\n            this.getStateTtlMs(),\n        );\n    }\n\n    async invalidate(userId: number, deviceKey?: string): Promise<void> {\n        await this.cacheManager.del(this.getKey(userId, deviceKey));\n    }\n\n    /**\n     * Bulk invalidation - \"log out everywhere\", and the right hook for password\n     * change or forced deactivation.\n     *\n     * Per-device buckets cannot be enumerated through cache-manager, so this\n     * bumps a per-user epoch that every per-device token carries as a claim.\n     * One write invalidates every outstanding token without a scan and without\n     * the read-modify-write race an index of device keys would have.\n     */\n    async invalidateAll(userId: number): Promise<void> {\n        const currentEpoch = (await this.getEpoch(userId)) ?? 0;\n        await this.cacheManager.set(\n            this.getEpochKey(userId),\n            currentEpoch + 1,\n            // Outlives every bucket that could hold a pre-bump token: those were\n            // written earlier, so they expire no later than this key does.\n            this.getStateTtlMs(),\n        );\n        // Single-slot mode and pre-migration entries live under the bare key,\n        // which carries no epoch claim - delete it directly.\n        await this.cacheManager.del(this.getKey(userId));\n    }\n\n    async getEpoch(userId: number): Promise<number | undefined> {\n        return (await this.cacheManager.get<number>(this.getEpochKey(userId))) ?? undefined;\n    }\n\n    async validateAndRotate(\n        user: any,\n        refreshToken: string,\n        claims: RefreshTokenClaims = {},\n    ): Promise<RotatedRefreshToken> {\n        const { deviceKey, epoch } = claims;\n\n        // The read key comes from the token's own claim, never from a setting.\n        // A token issued under either scheme therefore stays valid when\n        // preventConcurrentLogins is toggled - in both directions - and a\n        // pre-migration token still finds the bare key it was written to.\n        const refreshTokenState = await this.cacheManager.get(\n            this.getKey(user.id, deviceKey),\n        ) as RefreshTokenState | undefined;\n\n        if (!this.isRefreshTokenState(refreshTokenState)) {\n            throw new InvalidatedRefreshTokenError();\n        }\n\n        if (deviceKey && !(await this.isEpochCurrent(user.id, epoch))) {\n            throw new InvalidatedRefreshTokenError();\n        }\n\n        // Scenario 1: the live token. Rotate it. generateRefreshToken calls\n        // insert(), which writes the new state and stamps the grace deadline\n        // onto the token being rotated out.\n        if (refreshTokenState.currentRefreshToken === refreshToken) {\n            const nextDeviceKey = this.resolveNextDeviceKey(deviceKey);\n            const rotated = await this.authenticationService.generateRefreshToken(\n                user,\n                refreshToken,\n                nextDeviceKey,\n            );\n\n            if (nextDeviceKey !== deviceKey) {\n                // The session changed buckets - either migrating out of the\n                // pre-deploy single slot, or collapsing back into it because\n                // preventConcurrentLogins was switched on. The new state is\n                // already written; drop the key it came from so nothing is\n                // left behind.\n                await this.cacheManager.del(this.getKey(user.id, deviceKey));\n            }\n\n            return { refreshToken: rotated, deviceKey: nextDeviceKey };\n        }\n\n        // Scenario 2: the token just rotated out. This is the concurrent-request\n        // case the previous slot exists for - a second in-flight request that\n        // was issued the old token before the first one rotated it. Hand back\n        // the live token so it succeeds, provided the grace window is still open.\n        if (refreshTokenState.previousRefreshToken && refreshTokenState.previousRefreshToken === refreshToken) {\n            if (!this.isWithinGraceWindow(refreshTokenState)) {\n                throw new InvalidatedRefreshTokenError();\n            }\n            return { refreshToken: refreshTokenState.currentRefreshToken, deviceKey };\n        }\n\n        throw new InvalidatedRefreshTokenError();\n    }\n\n    getCurrentRefreshTokenState(\n        userId: number,\n        deviceKey?: string,\n    ): Promise<RefreshTokenState | undefined> {\n        return this.cacheManager.get(this.getKey(userId, deviceKey));\n    }\n\n    private getKey(userId: number, deviceKey?: string): string {\n        return deviceKey ? `user-${userId}-${deviceKey}` : `user-${userId}`;\n    }\n\n    // Deliberately not `user-${userId}-epoch`, which a device key of the\n    // literal string \"epoch\" would collide with.\n    private getEpochKey(userId: number): string {\n        return `user-epoch-${userId}`;\n    }\n\n    /**\n     * Which bucket a rotated token should land in. The setting is consulted\n     * first so that turning preventConcurrentLogins ON collapses existing\n     * per-device sessions back into the single slot on their next refresh -\n     * where normal last-login-wins applies, which is what that setting means.\n     * Leaving them in their own buckets would keep concurrent sessions alive\n     * while the setting claimed to forbid them.\n     */\n    private resolveNextDeviceKey(deviceKey?: string): string | undefined {\n        if (!this.areConcurrentLoginsAllowed()) {\n            return undefined;\n        }\n        return deviceKey ?? randomUUID();\n    }\n\n    private async isEpochCurrent(userId: number, epoch?: number): Promise<boolean> {\n        const storedEpoch = await this.getEpoch(userId);\n        // Nothing has ever been bulk-invalidated for this user - or the cache\n        // was flushed, in which case every bucket is gone and the token is\n        // already dead by the read above. Either way, accept.\n        if (storedEpoch === undefined) {\n            return true;\n        }\n        return epoch === storedEpoch;\n    }\n\n    // cache-manager v5 expects milliseconds; refreshTokenTtl is configured in\n    // seconds. Without an explicit TTL these entries never expire - neither\n    // cache path supplies a default - and the keyspace grows without bound.\n    private getStateTtlMs(): number {\n        const refreshTokenTtlSeconds = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>(\"refreshTokenTtl\"),\n        );\n        return (refreshTokenTtlSeconds + STATE_TTL_BUFFER_SECONDS) * 1000;\n    }\n\n    private isRefreshTokenState(state: unknown): state is RefreshTokenState {\n        return (\n            !!state &&\n            typeof state === 'object' &&\n            'currentRefreshToken' in state &&\n            'previousRefreshToken' in state\n        );\n    }\n\n    private isWithinGraceWindow(state: RefreshTokenState): boolean {\n        // TRANSITIONAL - safe to delete one refreshTokenTtl after this ships.\n        //\n        // Entries written before previousValidUntil existed carry no deadline\n        // to test. They are accepted so that the deploy rejects nobody: a tab\n        // that legitimately rotated moments earlier keeps working. The cost is\n        // that for such an entry the previous token stays acceptable until its\n        // own JWT `exp` rather than for 60s - which is exactly how the old code\n        // already behaved whenever its in-process timer was lost to a restart,\n        // so this is an unfixed pre-existing case, not a new one.\n        //\n        // It self-heals: the user's next rotation writes a new-format state\n        // with a deadline. Once every pre-deploy entry has rotated or expired\n        // (one refreshTokenTtl), this branch is unreachable - drop it, and the\n        // undefined case becomes a rejection.\n        if (state.previousValidUntil === undefined) {\n            return true;\n        }\n        return Date.now() < state.previousValidUntil;\n    }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidxai/core",
-  "version": "0.1.13-beta.18",
+  "version": "0.1.13-beta.19",
   "description": "This module is a NestJS module containing all the required core providers required by a Solid application",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -45,7 +45,7 @@
     "bcrypt": "^5.1.1",
     "bson": "^6.10.1",
     "cache-manager": "^5.5.2",
-    "cache-manager-redis-store": "^3.0.1",
+    "cache-manager-redis-yet": "^5.1.5",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.1",
     "cron-parser": "^5.5.0",

package/src/config/cache.options.ts

@@ -1,6 +1,14 @@
 import { CacheModuleAsyncOptions } from '@nestjs/cache-manager';
 import { ConfigModule, ConfigService } from '@nestjs/config';
-import { redisStore } from 'cache-manager-redis-store';
+// cache-manager-redis-yet, not cache-manager-redis-store. The latter stops at
+// 3.0.1 and implements the cache-manager v4 store contract: it expects an
+// options object and reads `options.ttl` in seconds. cache-manager v5 calls
+// `store.set(key, value, ttl)` with a bare number of milliseconds, so that
+// store found no `.ttl`, fell back to an unset default, and issued a plain
+// `SET` - silently discarding every TTL passed anywhere in the app and leaving
+// Redis keys that never expire. redis-yet implements the v5 contract and
+// writes with `PX`, so millisecond TTLs land correctly.
+import { redisStore } from 'cache-manager-redis-yet';
 import { isRedisConfigured } from 'src/helpers/environment.helper';
 
 export const CacheManagerOptions: CacheModuleAsyncOptions = {

package/src/controllers/authentication.controller.ts

@@ -107,8 +107,11 @@ export class AuthenticationController {
     @Post('logout')
     @Public()
     @HttpCode(HttpStatus.OK)
-    async logout(@Body('refreshToken') refreshToken: string) {
-        return this.authService.logout(refreshToken);
+    async logout(
+        @Body('refreshToken') refreshToken: string,
+        @Body('allDevices') allDevices?: boolean,
+    ) {
+        return this.authService.logout(refreshToken, allDevices === true);
     }
 
     @ApiBearerAuth("jwt")

package/src/helpers/solid-microservice-adapter.service.ts

@@ -79,7 +79,12 @@ export class SolidMicroserviceAdapter {
     const responseData = response.data as SolidxIamAuthResponse;
     const ttlSeconds = this.getJwtTtlSeconds(responseData?.data?.accessToken);
     if (ttlSeconds && ttlSeconds > 0) {
-      await this.cacheManager.set(cacheKey, responseData, ttlSeconds);
+      // cache-manager v5 expects milliseconds. This previously passed seconds,
+      // which the old Redis store discarded outright - so the entry simply
+      // never expired. Now that TTLs are honoured, passing seconds unconverted
+      // would expire the cached token ~1000x too early and re-authenticate
+      // against IAM on nearly every call.
+      await this.cacheManager.set(cacheKey, responseData, ttlSeconds * 1000);
     }
 
     return responseData;

package/src/interfaces/active-user-data.interface.ts

@@ -22,6 +22,15 @@ export interface ActiveUserData {
    */
   sessionId?: string;
 
+  /**
+   * Identifies which per-device refresh-token bucket this session belongs to.
+   * Present only while concurrent logins are permitted; mutually exclusive with
+   * sessionId, which exists only when they are not. Carried on the access token
+   * so bearer-authenticated endpoints that need this session's refresh token
+   * can find it.
+   */
+  deviceKey?: string;
+
   /**
    * The subject's (user) roles.
    * These are part of the JWT token, we simply decode them.

package/src/services/api-key.service.ts

@@ -131,7 +131,19 @@ export class ApiKeyService {
 
         const user = apiKeyRecord.user;
 
-        const tokens = await this.authenticationService.generateTokens(user);
+        // Keyed on the API key record so every call for this key reuses one
+        // refresh-token bucket. Without it each call mints a fresh key and
+        // therefore a new bucket with a refreshTokenTtl lifetime - a client
+        // polling this endpoint would accumulate them without bound.
+        //
+        // The consequence is that replicas sharing one API key share one
+        // bucket and invalidate each other, which is exactly the behaviour
+        // before per-device sessions existed, and is benign here: an API key
+        // is a permanent credential, so a failed refresh just re-mints.
+        const tokens = await this.authenticationService.generateTokens(
+            user,
+            `apikey-${apiKeyRecord.id}`,
+        );
 
 
         return {