@web-ts-toolkit/express-oidc-vault-redis-store 0.32.0 → 0.33.0

package/index.mjs

@@ -2,41 +2,382 @@
 import {
   OidcVaultStoreConflictError
 } from "@web-ts-toolkit/express-oidc-vault";
+
+// src/keys.ts
 var DEFAULT_KEY_PREFIX = "oidc-vault";
+var prefixKey = (keyPrefix, kind, id) => `${keyPrefix}:${kind}:${id}`;
+var RedisOidcVaultStoreKeys = class {
+  constructor(keyPrefix) {
+    this.keyPrefix = keyPrefix;
+  }
+  keyPrefix;
+  authorizationTransaction(state) {
+    return prefixKey(this.keyPrefix, "txn", state);
+  }
+  exchangeCode(code) {
+    return prefixKey(this.keyPrefix, "exchange", code);
+  }
+  session(sessionId) {
+    return prefixKey(this.keyPrefix, "session", sessionId);
+  }
+  sessionPrefix() {
+    return `${this.keyPrefix}:session:`;
+  }
+  subjectIndex(subject) {
+    return prefixKey(this.keyPrefix, "subject", subject);
+  }
+  subjectIndexPrefix() {
+    return `${this.keyPrefix}:subject:`;
+  }
+  providerSessionIndex(providerSessionId) {
+    return prefixKey(this.keyPrefix, "provider-session", providerSessionId);
+  }
+  providerSessionIndexPrefix() {
+    return `${this.keyPrefix}:provider-session:`;
+  }
+  logicalSessionIndex(logicalSessionId) {
+    return prefixKey(this.keyPrefix, "logical-session", logicalSessionId);
+  }
+  logicalSessionIndexPrefix() {
+    return `${this.keyPrefix}:logical-session:`;
+  }
+  backchannelLogoutTokenJti(jti) {
+    return prefixKey(this.keyPrefix, "backchannel-logout-jti", jti);
+  }
+  rotatedSessionAliasIndex(logicalSessionId) {
+    return prefixKey(this.keyPrefix, "rotated-session-alias-index", logicalSessionId);
+  }
+  rotatedSessionAliasIndexPrefix() {
+    return `${this.keyPrefix}:rotated-session-alias-index:`;
+  }
+  rotatedSessionAlias(sessionId) {
+    return prefixKey(this.keyPrefix, "rotated-session-alias", sessionId);
+  }
+  rotatedSessionAliasPrefix() {
+    return `${this.keyPrefix}:rotated-session-alias:`;
+  }
+  scanPattern() {
+    return `${this.keyPrefix}:*`;
+  }
+};
+
+// src/records.ts
+var serialize = (value) => JSON.stringify(value);
+var OidcVaultRedisStoreRecordError = class extends Error {
+  constructor(recordKind) {
+    super(`OIDC vault Redis store found malformed ${recordKind} record.`);
+    this.name = "OidcVaultRedisStoreRecordError";
+  }
+};
+var isPlainRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isString = (value) => typeof value === "string";
+var isOptionalString = (value) => value === void 0 || isString(value);
+var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);
+var isOptionalFiniteNumber = (value) => value === void 0 || isFiniteNumber(value);
+var isStringRecord = (value) => isPlainRecord(value);
+var validateAuthorizationTransaction = (value) => isPlainRecord(value) && isString(value.state) && isString(value.nonce) && isString(value.pkceVerifier) && isString(value.codeChallenge) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt) && (value.metadata === void 0 || isStringRecord(value.metadata));
+var validateExchangeCodeRecord = (value) => isPlainRecord(value) && isString(value.code) && isString(value.sessionId) && isOptionalString(value.returnTo) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.expiresAt);
+var validateProviderMetadata = (value) => value === void 0 || isPlainRecord(value) && isOptionalString(value.issuer) && isOptionalString(value.clientId);
+var validateSession = (value) => isPlainRecord(value) && isString(value.sessionId) && isOptionalString(value.logicalSessionId) && isString(value.subject) && isOptionalString(value.providerSessionId) && validateProviderMetadata(value.provider) && isString(value.refreshToken) && isString(value.idToken) && isOptionalString(value.accessToken) && isOptionalString(value.scope) && isOptionalFiniteNumber(value.expiresAt) && isFiniteNumber(value.createdAt) && isFiniteNumber(value.updatedAt) && (value.user === void 0 || isPlainRecord(value.user)) && (value.metadata === void 0 || isPlainRecord(value.metadata));
+var parseStoredJson = (value, recordKind, validate) => {
+  if (value === null) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new OidcVaultRedisStoreRecordError(recordKind);
+  }
+  if (!validate(parsed)) {
+    throw new OidcVaultRedisStoreRecordError(recordKind);
+  }
+  return parsed;
+};
+
+// src/scripts.ts
+import { createHash } from "crypto";
 var NON_EXPIRING_INDEX_SCORE = Number.MAX_SAFE_INTEGER;
+var toIndexScore = (expiresAt) => expiresAt ?? NON_EXPIRING_INDEX_SCORE;
+var serializeExpiresAt = (expiresAt) => typeof expiresAt === "number" ? String(expiresAt) : "";
+var evalCommand = (script, keys, args) => [
+  "EVAL",
+  script,
+  String(keys.length),
+  ...keys,
+  ...args
+];
+var scriptSha1 = (script) => createHash("sha1").update(script).digest("hex");
+var NOSCRIPT_ERROR_PREFIX = "NOSCRIPT";
+var isNoScriptError = (error) => {
+  if (error instanceof Error) {
+    return error.message.startsWith(NOSCRIPT_ERROR_PREFIX);
+  }
+  if (typeof error === "string") {
+    return error.startsWith(NOSCRIPT_ERROR_PREFIX);
+  }
+  return false;
+};
+var RedisScriptRunner = class {
+  client;
+  digests = /* @__PURE__ */ new Map();
+  constructor(client) {
+    this.client = client;
+  }
+  /**
+   * Drops every cached script digest. Call after a reconnection or failover
+   * that the store owner knows invalidates the node's script cache. The next
+   * mutation will lazily reload via `SCRIPT LOAD` on the new node.
+   */
+  reset() {
+    this.digests.clear();
+  }
+  /**
+   * Executes an `EVAL`-form command (`['EVAL', scriptBody, keyCount, ...keys,
+   * ...args]`) against the cached script. The leading `EVAL` and script body
+   * are replaced with `EVALSHA` and the script digest so steady-state
+   * mutations do not transmit full script bodies across the wire. The
+   * remaining positional layout (key count, keys, args) is preserved exactly.
+   */
+  async run(command) {
+    if (command[0] !== "EVAL" || typeof command[1] !== "string" || typeof command[2] !== "string") {
+      throw new Error("RedisScriptRunner.run expects an EVAL-form command.");
+    }
+    const script = command[1];
+    const tail = command.slice(2);
+    return this.runDigest(script, tail);
+  }
+  async runDigest(script, tail) {
+    let digest = this.digests.get(script);
+    if (!digest) {
+      digest = scriptSha1(script);
+      this.digests.set(script, digest);
+    }
+    try {
+      return await this.client.sendCommand(["EVALSHA", digest, ...tail]);
+    } catch (error) {
+      if (!isNoScriptError(error)) {
+        throw error;
+      }
+      const loaded = await this.client.sendCommand(["SCRIPT", "LOAD", script]);
+      if (typeof loaded === "string" && loaded.length > 0) {
+        digest = loaded;
+        this.digests.set(script, digest);
+      }
+      return this.client.sendCommand(["EVALSHA", digest, ...tail]);
+    }
+  }
+  /** Exposed for tests: the SHA1 digest the runner would currently send. */
+  digestFor(script) {
+    return this.digests.get(script) ?? scriptSha1(script);
+  }
+};
 var WRITE_SESSION_SCRIPT = `
 local value = ARGV[1]
 local expiresAt = ARGV[2]
 local sessionId = ARGV[3]
 local score = tonumber(ARGV[4])
 local providerIndexKey = ARGV[5]
+local aliasIndexKeyPrefix = ARGV[6]
+
+local function assertStringOrMissing(key)
+  local keyType = redis.call('TYPE', key)['ok']
+
+  if keyType ~= 'none' and keyType ~= 'string' then
+    error('OIDC vault Redis store key has unexpected type')
+  end
+end
+
+local function assertZsetOrMissing(key)
+  local keyType = redis.call('TYPE', key)['ok']
+
+  if keyType ~= 'none' and keyType ~= 'zset' then
+    error('OIDC vault Redis store key has unexpected type')
+  end
+end
+
+assertStringOrMissing(KEYS[1])
+assertStringOrMissing(KEYS[4])
+assertZsetOrMissing(KEYS[2])
+assertZsetOrMissing(KEYS[3])
+
+if providerIndexKey ~= '' then
+  assertZsetOrMissing(providerIndexKey)
+end
+
+local staleAliasLogicalSessionId = nil
+local staleAliasValue = redis.call('GET', KEYS[4])
+
+if staleAliasValue ~= false then
+  local decodedAliasOk, decodedAlias = pcall(cjson.decode, staleAliasValue)
+
+  if decodedAliasOk and type(decodedAlias) == 'string' then
+    staleAliasLogicalSessionId = decodedAlias
+    assertZsetOrMissing(aliasIndexKeyPrefix .. staleAliasLogicalSessionId)
+  end
+end
 
 if expiresAt ~= '' then
-  redis.call('SET', KEYS[1], value, 'PXAT', expiresAt)
+  if redis.call('SET', KEYS[1], value, 'PXAT', expiresAt, 'NX') == false then
+    return 0
+  end
 else
-  redis.call('SET', KEYS[1], value)
+  if redis.call('SET', KEYS[1], value, 'NX') == false then
+    return 0
+  end
 end
 
 redis.call('ZADD', KEYS[2], score, sessionId)
+redis.call('ZADD', KEYS[3], score, sessionId)
 
 if providerIndexKey ~= '' then
   redis.call('ZADD', providerIndexKey, score, sessionId)
 end
 
+if staleAliasValue ~= false then
+  redis.call('DEL', KEYS[4])
+
+  if staleAliasLogicalSessionId ~= nil then
+    redis.call('ZREM', aliasIndexKeyPrefix .. staleAliasLogicalSessionId, sessionId)
+  end
+end
+
 return 1
 `;
 var DELETE_SESSION_SCRIPT = `
-local sessionId = ARGV[1]
-local providerIndexKey = ARGV[2]
+local expected = cjson.decode(ARGV[1])
+local scopeKind = ARGV[2]
+local scopeValue = ARGV[3]
+local issuer = ARGV[4]
+local clientId = ARGV[5]
+local sessionKeyPrefix = ARGV[6]
+local subjectIndexKeyPrefix = ARGV[7]
+local logicalIndexKeyPrefix = ARGV[8]
+local providerIndexKeyPrefix = ARGV[9]
+local aliasIndexKeyPrefix = ARGV[10]
+local aliasKeyPrefix = ARGV[11]
+local expectedLogicalSessionId = expected['logicalSessionId'] or expected['sessionId']
 
-redis.call('DEL', KEYS[1])
-redis.call('ZREM', KEYS[2], sessionId)
+local function assertZsetOrMissing(key)
+  local keyType = redis.call('TYPE', key)['ok']
 
-if providerIndexKey ~= '' then
-  redis.call('ZREM', providerIndexKey, sessionId)
+  if keyType ~= 'none' and keyType ~= 'zset' then
+    error('OIDC vault Redis store key has unexpected type')
+  end
 end
 
-return 1
+local function logicalSessionIdFor(session)
+  return session['logicalSessionId'] or session['sessionId']
+end
+
+local function matchesProviderScope(session)
+  local provider = session['provider']
+
+  if issuer ~= '' and (provider == nil or provider['issuer'] ~= issuer) then
+    return false
+  end
+
+  if clientId ~= '' and (provider == nil or provider['clientId'] ~= clientId) then
+    return false
+  end
+
+  return true
+end
+
+local function matchesScope(session, allowLogicalSuccessor)
+  if allowLogicalSuccessor and logicalSessionIdFor(session) ~= expectedLogicalSessionId then
+    return false
+  end
+
+  if scopeKind == 'single' then
+    if allowLogicalSuccessor then
+      return true
+    end
+
+    return session['sessionId'] == expected['sessionId']
+  end
+
+  if scopeKind == 'logical' then
+    return logicalSessionIdFor(session) == scopeValue
+  end
+
+  if scopeKind == 'subject' then
+    return session['subject'] == scopeValue and matchesProviderScope(session)
+  end
+
+  if scopeKind == 'provider-session' then
+    return session['providerSessionId'] == scopeValue and matchesProviderScope(session)
+  end
+
+  return false
+end
+
+local function deleteRecord(sessionKey, session)
+  local sessionId = session['sessionId']
+  local logicalSessionId = logicalSessionIdFor(session)
+  local aliasIndexKey = aliasIndexKeyPrefix .. logicalSessionId
+  assertZsetOrMissing(subjectIndexKeyPrefix .. session['subject'])
+  assertZsetOrMissing(logicalIndexKeyPrefix .. logicalSessionId)
+  assertZsetOrMissing(aliasIndexKey)
+
+  if session['providerSessionId'] ~= nil then
+    assertZsetOrMissing(providerIndexKeyPrefix .. session['providerSessionId'])
+  end
+
+  local aliasSessionIds = redis.call('ZRANGE', aliasIndexKey, 0, -1)
+
+  if redis.call('DEL', sessionKey) == 0 then
+    return 0
+  end
+
+  redis.call('ZREM', subjectIndexKeyPrefix .. session['subject'], sessionId)
+  redis.call('ZREM', logicalIndexKeyPrefix .. logicalSessionId, sessionId)
+
+  if session['providerSessionId'] ~= nil then
+    redis.call('ZREM', providerIndexKeyPrefix .. session['providerSessionId'], sessionId)
+  end
+
+  for _, aliasSessionId in ipairs(aliasSessionIds) do
+    redis.call('DEL', aliasKeyPrefix .. aliasSessionId)
+  end
+
+  redis.call('DEL', aliasIndexKey)
+
+  return 1
+end
+
+local currentValue = redis.call('GET', KEYS[1])
+
+if currentValue ~= false then
+  local current = cjson.decode(currentValue)
+
+  if matchesScope(current, false) then
+    return deleteRecord(KEYS[1], current)
+  end
+
+  return 0
+end
+
+local deleted = 0
+local logicalIndexKey = logicalIndexKeyPrefix .. expectedLogicalSessionId
+local sessionIds = redis.call('ZRANGE', logicalIndexKey, 0, -1)
+
+for _, sessionId in ipairs(sessionIds) do
+  local sessionKey = sessionKeyPrefix .. sessionId
+  local value = redis.call('GET', sessionKey)
+
+  if value ~= false then
+    local session = cjson.decode(value)
+
+    if matchesScope(session, true) then
+      deleted = deleted + deleteRecord(sessionKey, session)
+    end
+  else
+    redis.call('ZREM', logicalIndexKey, sessionId)
+  end
+end
+
+return deleted
 `;
 var ROTATE_SESSION_SCRIPT = `
 local newValue = ARGV[1]
@@ -46,11 +387,78 @@ local newSessionId = ARGV[4]
 local newScore = tonumber(ARGV[5])
 local oldProviderIndexKey = ARGV[6]
 local newProviderIndexKey = ARGV[7]
+local oldLogicalIndexKey = ARGV[8]
+local newLogicalIndexKey = ARGV[9]
+local oldAliasValue = ARGV[10]
+local oldAliasExpiresAt = ARGV[11]
+local aliasIndexKey = ARGV[12]
+local aliasIndexKeyPrefix = ARGV[13]
+
+local function assertStringOrMissing(key)
+  local keyType = redis.call('TYPE', key)['ok']
+
+  if keyType ~= 'none' and keyType ~= 'string' then
+    error('OIDC vault Redis store key has unexpected type')
+  end
+end
+
+local function assertZsetOrMissing(key)
+  local keyType = redis.call('TYPE', key)['ok']
+
+  if keyType ~= 'none' and keyType ~= 'zset' then
+    error('OIDC vault Redis store key has unexpected type')
+  end
+end
+
+assertStringOrMissing(KEYS[1])
+assertStringOrMissing(KEYS[2])
+assertStringOrMissing(KEYS[5])
+assertStringOrMissing(KEYS[6])
+assertZsetOrMissing(KEYS[3])
+assertZsetOrMissing(KEYS[4])
+
+if oldProviderIndexKey ~= '' then
+  assertZsetOrMissing(oldProviderIndexKey)
+end
+
+if newProviderIndexKey ~= '' then
+  assertZsetOrMissing(newProviderIndexKey)
+end
+
+if oldLogicalIndexKey ~= '' then
+  assertZsetOrMissing(oldLogicalIndexKey)
+end
+
+if newLogicalIndexKey ~= '' then
+  assertZsetOrMissing(newLogicalIndexKey)
+end
+
+assertZsetOrMissing(aliasIndexKey)
+
+local staleTargetAliasLogicalSessionId = nil
+local staleTargetAliasValue = redis.call('GET', KEYS[6])
+
+if staleTargetAliasValue ~= false then
+  local decodedAliasOk, decodedAlias = pcall(cjson.decode, staleTargetAliasValue)
+
+  if decodedAliasOk and type(decodedAlias) == 'string' then
+    staleTargetAliasLogicalSessionId = decodedAlias
+    assertZsetOrMissing(aliasIndexKeyPrefix .. staleTargetAliasLogicalSessionId)
+  end
+end
 
 if redis.call('EXISTS', KEYS[1]) == 0 then
   return 0
 end
 
+if oldSessionId == newSessionId then
+  return 2
+end
+
+if redis.call('EXISTS', KEYS[2]) == 1 then
+  return 2
+end
+
 if newExpiresAt ~= '' then
   redis.call('SET', KEYS[2], newValue, 'PXAT', newExpiresAt)
 else
@@ -69,14 +477,101 @@ if newProviderIndexKey ~= '' then
   redis.call('ZADD', newProviderIndexKey, newScore, newSessionId)
 end
 
+if oldLogicalIndexKey ~= '' then
+  redis.call('ZREM', oldLogicalIndexKey, oldSessionId)
+end
+
+if newLogicalIndexKey ~= '' then
+  redis.call('ZADD', newLogicalIndexKey, newScore, newSessionId)
+end
+
+if staleTargetAliasValue ~= false then
+  redis.call('DEL', KEYS[6])
+
+  if staleTargetAliasLogicalSessionId ~= nil then
+    redis.call('ZREM', aliasIndexKeyPrefix .. staleTargetAliasLogicalSessionId, newSessionId)
+  end
+end
+
+if oldAliasExpiresAt ~= '' then
+  redis.call('SET', KEYS[5], oldAliasValue, 'PXAT', oldAliasExpiresAt)
+else
+  redis.call('SET', KEYS[5], oldAliasValue)
+end
+
+redis.call('ZADD', aliasIndexKey, newScore, oldSessionId)
+
 return 1
 `;
-var serialize = (value) => JSON.stringify(value);
-var parseJson = (value) => value ? JSON.parse(value) : null;
-var prefixKey = (keyPrefix, kind, id) => `${keyPrefix}:${kind}:${id}`;
+var buildWriteSessionCommand = (keys, session) => evalCommand(
+  WRITE_SESSION_SCRIPT,
+  [
+    keys.session(session.sessionId),
+    keys.subjectIndex(session.subject),
+    keys.logicalSessionIndex(session.logicalSessionId ?? session.sessionId),
+    keys.rotatedSessionAlias(session.sessionId)
+  ],
+  [
+    serialize(session),
+    serializeExpiresAt(session.expiresAt),
+    session.sessionId,
+    String(toIndexScore(session.expiresAt)),
+    session.providerSessionId ? keys.providerSessionIndex(session.providerSessionId) : "",
+    keys.rotatedSessionAliasIndexPrefix()
+  ]
+);
+var buildDeleteSessionCommand = (keys, session, scope) => evalCommand(
+  DELETE_SESSION_SCRIPT,
+  [keys.session(session.sessionId)],
+  [
+    serialize(session),
+    scope.kind,
+    "value" in scope ? scope.value : "",
+    "issuer" in scope ? scope.issuer ?? "" : "",
+    "clientId" in scope ? scope.clientId ?? "" : "",
+    keys.sessionPrefix(),
+    keys.subjectIndexPrefix(),
+    keys.logicalSessionIndexPrefix(),
+    keys.providerSessionIndexPrefix(),
+    keys.rotatedSessionAliasIndexPrefix(),
+    keys.rotatedSessionAliasPrefix()
+  ]
+);
+var buildRotateSessionCommand = (keys, previousSession, nextSession) => evalCommand(
+  ROTATE_SESSION_SCRIPT,
+  [
+    keys.session(previousSession.sessionId),
+    keys.session(nextSession.sessionId),
+    keys.subjectIndex(previousSession.subject),
+    keys.subjectIndex(nextSession.subject),
+    keys.rotatedSessionAlias(previousSession.sessionId),
+    keys.rotatedSessionAlias(nextSession.sessionId)
+  ],
+  [
+    serialize(nextSession),
+    serializeExpiresAt(nextSession.expiresAt),
+    previousSession.sessionId,
+    nextSession.sessionId,
+    String(toIndexScore(nextSession.expiresAt)),
+    previousSession.providerSessionId ? keys.providerSessionIndex(previousSession.providerSessionId) : "",
+    nextSession.providerSessionId ? keys.providerSessionIndex(nextSession.providerSessionId) : "",
+    keys.logicalSessionIndex(previousSession.logicalSessionId ?? previousSession.sessionId),
+    keys.logicalSessionIndex(nextSession.logicalSessionId ?? nextSession.sessionId),
+    serialize(nextSession.logicalSessionId ?? nextSession.sessionId),
+    serializeExpiresAt(nextSession.expiresAt),
+    keys.rotatedSessionAliasIndex(nextSession.logicalSessionId ?? nextSession.sessionId),
+    keys.rotatedSessionAliasIndexPrefix()
+  ]
+);
+
+// src/index.ts
+var INDEX_CLEANUP_SCAN_COUNT = 100;
+var INDEX_REVOCATION_SCAN_COUNT = 250;
+var isRecord = (value) => typeof value === "object" && value !== null;
+var isUnsupportedClusterClient = (client) => isRecord(client) && typeof client.getSlotMaster === "function" && typeof client.nodeClient === "function" && Array.isArray(client.masters) && Array.isArray(client.slots);
 var toSubjectDeleteInput = (input) => typeof input === "string" ? { subject: input } : input;
 var toProviderSessionDeleteInput = (input) => typeof input === "string" ? { providerSessionId: input } : input;
-var toIndexScore = (expiresAt) => expiresAt ?? NON_EXPIRING_INDEX_SCORE;
+var toLogicalSessionDeleteInput = (input) => typeof input === "string" ? { logicalSessionId: input } : input;
 var matchesProviderScope = (session, input) => {
   if (input.issuer !== void 0 && session.provider?.issuer !== input.issuer) {
     return false;
@@ -87,169 +582,325 @@ var matchesProviderScope = (session, input) => {
   return true;
 };
 var RedisOidcVaultStore = class {
+  client;
+  keys;
+  now;
+  scriptRunner;
+  indexCleanupCursor = "0";
   constructor(options) {
-    if (!options.client.sendCommand) {
-      throw new Error("Redis store client must implement sendCommand for atomic vault operations.");
+    if (typeof options.client.sendCommand !== "function") {
+      throw new Error("Redis store client must implement sendCommand(args) for atomic vault operations.");
+    }
+    if (isUnsupportedClusterClient(options.client)) {
+      throw new Error(
+        "Redis store supports standalone Redis and Redis Sentinel clients only. Redis Cluster is not supported because vault scripts touch multiple keys without a cluster hash-slot adapter."
+      );
     }
     this.client = options.client;
-    this.keyPrefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX;
+    this.keys = new RedisOidcVaultStoreKeys(options.keyPrefix ?? DEFAULT_KEY_PREFIX);
     this.now = options.now ?? Date.now;
+    this.scriptRunner = new RedisScriptRunner(options.client);
   }
   async createAuthorizationTransaction(input) {
-    await this.setJson(this.authorizationTransactionKey(input.state), input, input.expiresAt);
+    await this.setJson(this.keys.authorizationTransaction(input.state), input, input.expiresAt);
   }
   async consumeAuthorizationTransaction(state) {
-    return this.consumeJson(this.authorizationTransactionKey(state));
+    return this.consumeJson(
+      this.keys.authorizationTransaction(state),
+      "authorization transaction",
+      validateAuthorizationTransaction
+    );
   }
   async createExchangeCode(input) {
-    await this.setJson(this.exchangeCodeKey(input.code), input, input.expiresAt);
+    await this.setJson(this.keys.exchangeCode(input.code), input, input.expiresAt);
   }
   async consumeExchangeCode(code) {
-    return this.consumeJson(this.exchangeCodeKey(code));
+    return this.consumeJson(this.keys.exchangeCode(code), "exchange code", validateExchangeCodeRecord);
   }
   async createSession(input) {
     const timestamp = this.now();
     const session = {
       ...input,
+      logicalSessionId: input.logicalSessionId ?? input.sessionId,
       createdAt: input.createdAt ?? timestamp,
       updatedAt: input.updatedAt ?? timestamp
     };
-    await this.writeSessionRecord(session);
+    const written = await this.writeSessionRecord(session);
+    if (!written) {
+      throw new OidcVaultStoreConflictError("OIDC vault session already exists.");
+    }
+    await this.cleanupStaleIndexKeys();
     return session;
   }
   async getSession(sessionId) {
-    return this.getJson(this.sessionKey(sessionId));
+    return this.getJson(this.keys.session(sessionId), "session", validateSession, { deleteMalformed: true });
   }
   async rotateSession(input) {
     const previousSession = await this.getSession(input.sessionId);
     if (!previousSession) {
       throw new OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
     }
-    const rotated = await this.rotateSessionRecord(previousSession, input.nextSession);
+    if (input.nextSession.sessionId === input.sessionId) {
+      throw new OidcVaultStoreConflictError("OIDC vault session rotation target must use a different session ID.");
+    }
+    const nextSession = {
+      ...input.nextSession,
+      logicalSessionId: input.nextSession.logicalSessionId ?? previousSession.logicalSessionId ?? previousSession.sessionId
+    };
+    const rotated = await this.rotateSessionRecord(previousSession, nextSession);
     if (!rotated) {
       throw new OidcVaultStoreConflictError("OIDC vault session no longer exists for rotation.");
     }
-    return input.nextSession;
+    await this.cleanupStaleIndexKeys();
+    return nextSession;
   }
   async deleteSession(sessionId) {
     const session = await this.getSession(sessionId);
     if (!session) {
-      await this.client.del(this.sessionKey(sessionId));
+      const logicalSessionId = await this.getJson(
+        this.keys.rotatedSessionAlias(sessionId),
+        "rotated session alias",
+        isString,
+        { deleteMalformed: true }
+      );
+      if (logicalSessionId) {
+        await this.deleteSessionsByLogicalSessionId(logicalSessionId);
+        await this.deleteRotatedSessionAliasesByLogicalSessionId(logicalSessionId);
+      }
+      await this.client.del(this.keys.session(sessionId));
       return;
     }
-    await this.deleteSessionRecord(session);
+    await this.deleteSessionRecord(session, { kind: "single" });
+    await this.deleteRotatedSessionAliasesByLogicalSessionId(session.logicalSessionId ?? session.sessionId);
+  }
+  async deleteSessionsByLogicalSessionId(input) {
+    const resolved = toLogicalSessionDeleteInput(input);
+    return this.deleteSessionsFromIndex(this.keys.logicalSessionIndex(resolved.logicalSessionId), resolved);
+  }
+  async consumeBackchannelLogoutTokenJti(input) {
+    const now = this.now();
+    if (!Number.isFinite(input.expiresAt) || input.expiresAt <= now) {
+      return false;
+    }
+    const result = await this.client.set(this.keys.backchannelLogoutTokenJti(input.jti), "1", {
+      PXAT: input.expiresAt,
+      NX: true
+    });
+    return result === "OK" || result === true;
   }
   async deleteSessionsBySubject(input) {
     const resolved = toSubjectDeleteInput(input);
-    return this.deleteSessionsFromIndex(this.subjectIndexKey(resolved.subject), resolved);
+    return this.deleteSessionsFromIndex(this.keys.subjectIndex(resolved.subject), resolved);
   }
   async deleteSessionsByProviderSessionId(input) {
     const resolved = toProviderSessionDeleteInput(input);
-    return this.deleteSessionsFromIndex(this.providerSessionIndexKey(resolved.providerSessionId), resolved);
+    return this.deleteSessionsFromIndex(this.keys.providerSessionIndex(resolved.providerSessionId), resolved);
   }
   async setJson(key, value, expiresAt) {
     const options = typeof expiresAt === "number" ? { PXAT: expiresAt } : void 0;
     await this.client.set(key, serialize(value), options);
   }
-  async getJson(key) {
-    return parseJson(await this.client.get(key));
+  async getJson(key, recordKind, validate, options) {
+    try {
+      return parseStoredJson(await this.client.get(key), recordKind, validate);
+    } catch (error) {
+      if (options?.deleteMalformed && error instanceof OidcVaultRedisStoreRecordError) {
+        await this.client.del(key);
+        return null;
+      }
+      throw error;
+    }
   }
-  async consumeJson(key) {
+  async consumeJson(key, recordKind, validate) {
     const value = await this.sendCommand(["GETDEL", key]);
-    return typeof value === "string" ? parseJson(value) : null;
-  }
-  authorizationTransactionKey(state) {
-    return prefixKey(this.keyPrefix, "txn", state);
+    try {
+      return typeof value === "string" ? parseStoredJson(value, recordKind, validate) : null;
+    } catch (error) {
+      if (error instanceof OidcVaultRedisStoreRecordError) {
+        return null;
+      }
+      throw error;
+    }
   }
-  exchangeCodeKey(code) {
-    return prefixKey(this.keyPrefix, "exchange", code);
+  async writeSessionRecord(session) {
+    const result = await this.runScript(buildWriteSessionCommand(this.keys, session));
+    return result === 1 || result === "1";
   }
-  sessionKey(sessionId) {
-    return prefixKey(this.keyPrefix, "session", sessionId);
+  async deleteSessionRecord(session, scope) {
+    const result = await this.runScript(buildDeleteSessionCommand(this.keys, session, scope));
+    return typeof result === "number" ? result : Number(result);
   }
-  subjectIndexKey(subject) {
-    return prefixKey(this.keyPrefix, "subject", subject);
+  async rotateSessionRecord(previousSession, nextSession) {
+    const result = await this.runScript(buildRotateSessionCommand(this.keys, previousSession, nextSession));
+    if (result === 2 || result === "2") {
+      throw new OidcVaultStoreConflictError("OIDC vault session rotation target already exists.");
+    }
+    return result === 1 || result === "1";
   }
-  providerSessionIndexKey(providerSessionId) {
-    return prefixKey(this.keyPrefix, "provider-session", providerSessionId);
+  async runScript(command) {
+    return this.scriptRunner.run(command);
   }
-  async writeSessionRecord(session) {
-    await this.sendCommand([
-      "EVAL",
-      WRITE_SESSION_SCRIPT,
-      "2",
-      this.sessionKey(session.sessionId),
-      this.subjectIndexKey(session.subject),
-      serialize(session),
-      this.serializeExpiresAt(session.expiresAt),
-      session.sessionId,
-      String(toIndexScore(session.expiresAt)),
-      session.providerSessionId ? this.providerSessionIndexKey(session.providerSessionId) : ""
-    ]);
+  async cleanupExpiredIndexMembers(indexKey) {
+    await this.sendCommand(["ZREMRANGEBYSCORE", indexKey, "-inf", String(await this.redisServerTime())]);
   }
-  async deleteSessionRecord(session) {
-    await this.sendCommand([
-      "EVAL",
-      DELETE_SESSION_SCRIPT,
-      "2",
-      this.sessionKey(session.sessionId),
-      this.subjectIndexKey(session.subject),
-      session.sessionId,
-      session.providerSessionId ? this.providerSessionIndexKey(session.providerSessionId) : ""
+  async cleanupStaleIndexKeys() {
+    const response = await this.sendCommand([
+      "SCAN",
+      this.indexCleanupCursor,
+      "MATCH",
+      this.keys.scanPattern(),
+      "COUNT",
+      String(INDEX_CLEANUP_SCAN_COUNT)
     ]);
+    if (!Array.isArray(response) || typeof response[0] !== "string" || !Array.isArray(response[1])) {
+      throw new Error("OIDC vault Redis store received an unexpected SCAN response.");
+    }
+    this.indexCleanupCursor = response[0];
+    const indexKeyPrefixes = [
+      this.keys.subjectIndexPrefix(),
+      this.keys.providerSessionIndexPrefix(),
+      this.keys.logicalSessionIndexPrefix(),
+      this.keys.rotatedSessionAliasIndexPrefix()
+    ];
+    const indexKeys = response[1].filter(
+      (key) => typeof key === "string" && indexKeyPrefixes.some((prefix) => key.startsWith(prefix))
+    );
+    for (const indexKey of indexKeys) {
+      if (await this.redisKeyType(indexKey) === "zset") {
+        await this.cleanupExpiredIndexMembers(indexKey);
+      }
+    }
   }
-  async rotateSessionRecord(previousSession, nextSession) {
-    const result = await this.sendCommand([
-      "EVAL",
-      ROTATE_SESSION_SCRIPT,
-      "4",
-      this.sessionKey(previousSession.sessionId),
-      this.sessionKey(nextSession.sessionId),
-      this.subjectIndexKey(previousSession.subject),
-      this.subjectIndexKey(nextSession.subject),
-      serialize(nextSession),
-      this.serializeExpiresAt(nextSession.expiresAt),
-      previousSession.sessionId,
-      nextSession.sessionId,
-      String(toIndexScore(nextSession.expiresAt)),
-      previousSession.providerSessionId ? this.providerSessionIndexKey(previousSession.providerSessionId) : "",
-      nextSession.providerSessionId ? this.providerSessionIndexKey(nextSession.providerSessionId) : ""
-    ]);
-    return result === 1 || result === "1";
+  async redisKeyType(key) {
+    const response = await this.sendCommand(["TYPE", key]);
+    if (typeof response === "string") {
+      return response;
+    }
+    if (isPlainRecord(response) && typeof response.ok === "string") {
+      return response.ok;
+    }
+    throw new Error("OIDC vault Redis store received an unexpected TYPE response.");
   }
-  async cleanupExpiredIndexMembers(indexKey) {
-    await this.sendCommand(["ZREMRANGEBYSCORE", indexKey, "-inf", String(this.now())]);
+  async redisServerTime() {
+    const response = await this.sendCommand(["TIME"]);
+    if (!Array.isArray(response) || response.length < 2) {
+      throw new Error("OIDC vault Redis store received an unexpected TIME response.");
+    }
+    const seconds = Number(response[0]);
+    const microseconds = Number(response[1]);
+    if (!Number.isFinite(seconds) || !Number.isFinite(microseconds)) {
+      throw new Error("OIDC vault Redis store received an unexpected TIME response.");
+    }
+    return seconds * 1e3 + Math.floor(microseconds / 1e3);
   }
   async getSessionIdsFromIndex(indexKey) {
     const response = await this.sendCommand(["ZRANGE", indexKey, "0", "-1"]);
     return Array.isArray(response) ? response.filter((value) => typeof value === "string") : [];
   }
+  async scanSessionIdsFromIndex(indexKey, cursor) {
+    const response = await this.sendCommand(["ZSCAN", indexKey, cursor, "COUNT", String(INDEX_REVOCATION_SCAN_COUNT)]);
+    if (!Array.isArray(response) || typeof response[0] !== "string" || !Array.isArray(response[1])) {
+      throw new Error("OIDC vault Redis store received an unexpected ZSCAN response.");
+    }
+    const rawEntries = response[1];
+    const sessionIds = [];
+    for (let index = 0; index < rawEntries.length; index += 2) {
+      const sessionId = rawEntries[index];
+      if (typeof sessionId === "string") {
+        sessionIds.push(sessionId);
+      }
+    }
+    return { cursor: response[0], sessionIds };
+  }
+  async getSessionRecords(sessionIds) {
+    if (sessionIds.length === 0) {
+      return [];
+    }
+    const response = await this.sendCommand(["MGET", ...sessionIds.map((sessionId) => this.keys.session(sessionId))]);
+    if (!Array.isArray(response)) {
+      throw new Error("OIDC vault Redis store received an unexpected MGET response.");
+    }
+    return Promise.all(
+      response.map(async (value, index) => {
+        try {
+          return typeof value === "string" ? parseStoredJson(value, "session", validateSession) : null;
+        } catch (error) {
+          if (error instanceof OidcVaultRedisStoreRecordError) {
+            await this.client.del(this.keys.session(sessionIds[index]));
+            return null;
+          }
+          throw error;
+        }
+      })
+    );
+  }
   async removeSessionIdFromIndex(indexKey, sessionId) {
     await this.sendCommand(["ZREM", indexKey, sessionId]);
   }
   async deleteSessionsFromIndex(indexKey, scope) {
     await this.cleanupExpiredIndexMembers(indexKey);
-    const sessionIds = await this.getSessionIdsFromIndex(indexKey);
-    if (sessionIds.length === 0) {
-      return 0;
-    }
     let deleted = 0;
-    for (const sessionId of sessionIds) {
-      const session = await this.getSession(sessionId);
-      if (!session) {
-        await this.removeSessionIdFromIndex(indexKey, sessionId);
+    let cursor = "0";
+    do {
+      const batch = await this.scanSessionIdsFromIndex(indexKey, cursor);
+      cursor = batch.cursor;
+      if (batch.sessionIds.length === 0) {
         continue;
       }
-      if (!matchesProviderScope(session, scope)) {
-        continue;
+      const sessions = await this.getSessionRecords(batch.sessionIds);
+      for (const [index, sessionId] of batch.sessionIds.entries()) {
+        const session = sessions[index];
+        if (!session) {
+          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          continue;
+        }
+        if ("logicalSessionId" in scope && (session.logicalSessionId ?? session.sessionId) !== scope.logicalSessionId) {
+          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          continue;
+        }
+        if ("subject" in scope && session.subject !== scope.subject) {
+          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          continue;
+        }
+        if ("providerSessionId" in scope && session.providerSessionId !== scope.providerSessionId) {
+          await this.removeSessionIdFromIndex(indexKey, sessionId);
+          continue;
+        }
+        if (!("logicalSessionId" in scope) && !matchesProviderScope(session, scope)) {
+          continue;
+        }
+        const revoked = await this.deleteSessionRecord(session, this.toDeleteScriptScope(scope));
+        if (revoked > 0) {
+          await this.deleteRotatedSessionAliasesByLogicalSessionId(session.logicalSessionId ?? session.sessionId);
+          deleted += revoked;
+        }
       }
-      await this.deleteSessionRecord(session);
-      deleted += 1;
-    }
+    } while (cursor !== "0");
     return deleted;
   }
-  serializeExpiresAt(expiresAt) {
-    return typeof expiresAt === "number" ? String(expiresAt) : "";
+  toDeleteScriptScope(scope) {
+    if ("logicalSessionId" in scope) {
+      return { kind: "logical", value: scope.logicalSessionId };
+    }
+    if ("subject" in scope) {
+      return { kind: "subject", value: scope.subject, issuer: scope.issuer, clientId: scope.clientId };
+    }
+    return {
+      kind: "provider-session",
+      value: scope.providerSessionId,
+      issuer: scope.issuer,
+      clientId: scope.clientId
+    };
+  }
+  async deleteRotatedSessionAliasesByLogicalSessionId(logicalSessionId) {
+    const aliasIndexKey = this.keys.rotatedSessionAliasIndex(logicalSessionId);
+    await this.cleanupExpiredIndexMembers(aliasIndexKey);
+    const aliasSessionIds = await this.getSessionIdsFromIndex(aliasIndexKey);
+    if (aliasSessionIds.length === 0) {
+      return;
+    }
+    await this.client.del(aliasSessionIds.map((sessionId) => this.keys.rotatedSessionAlias(sessionId)));
+    await this.client.del(aliasIndexKey);
   }
   async sendCommand(args) {
     return this.client.sendCommand(args);
@@ -259,5 +910,6 @@ function createRedisOidcVaultStore(options) {
   return new RedisOidcVaultStore(options);
 }
 export {
+  OidcVaultRedisStoreRecordError,
   createRedisOidcVaultStore
 };