authenik8-core 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## [0.1.2] - 2026-03-22
+### Fixed
+- Patched a vulnerability allowing reuse of old refresh tokens.
+- Refresh token rotation now uses Redis locks to prevent concurrent refresh exploits.
+- Concurrent refresh requests are handled safely, ensuring only one succeeds.

package/dist/auth/refreshService.d.ts

@@ -13,10 +13,12 @@ export interface TokenStore {
     get(key: string): Promise<string | null>;
     set?(key: string, value: string, expiry?: number): Promise<void>;
     del?(key: string): Promise<void>;
+    getset?(key: string, value: string, expiry?: number): Promise<string | null>;
 }
 export interface RefreshServiceOptions {
     tokenStore: TokenStore;
     accessTokenSecret: string;
+    redisClient: any;
     refreshTokenSecret: string;
     accessTokenExpiry: SignOptions["expiresIn"];
     rotateRefreshTokens?: boolean;
@@ -33,6 +35,7 @@ export declare class RefreshService {
     private accessTokenExpiry;
     private rotateRefreshTokens;
     private refreshTokenExpiry;
+    private lock;
     constructor(options: RefreshServiceOptions);
     generateRefreshToken(payload: TokenPayload): Promise<string>;
     refresh(refreshToken?: string): Promise<RefreshResult>;

package/dist/auth/refreshService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refreshService.d.ts","sourceRoot":"","sources":["../../src/auth/refreshService.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAI3C,qBAAa,iBAAkB,SAAQ,KAAK;gBAChC,OAAO,SAAgB;CAKlC;AAED,qBAAa,iBAAkB,SAC/B,KAAK;gBACO,OAAO,SAA0B;CAI5C;AAGD,UAAU,YAAY;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACb;AAGD,MAAM,WAAW,UAAU;IAC3B,GAAG,CAAC,GAAG,EAAC,MAAM,GAAE,OAAO,CAAC,MAAM,GAAE,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAC,MAAM,GAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,GAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CAE/B;AACD,MAAM,WAAW,qBAAqB;IACrC,UAAU,EAAC,UAAU,CAAC;IACtB,iBAAiB,EAAC,MAAM,CAAC;IACzB,kBAAkB,EAAC,MAAM,CAAC;IAC1B,iBAAiB,EAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC3C,mBAAmB,CAAC,EAAC,OAAO,CAAC;IAC7B,kBAAkB,CAAC,EAAC,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC9B,WAAW,EAAC,MAAM,CAAC;IACnB,YAAY,CAAC,EAAC,MAAM,CAAC;CACpB;AAGD,qBAAa,cAAc;IAC3B,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,kBAAkB,CAAQ;IAClC,OAAO,CAAC,iBAAiB,CAA0B;IACnD,OAAO,CAAC,mBAAmB,CAAS;IACpC,OAAO,CAAC,kBAAkB,CAAQ;gBAGtB,OAAO,EAAC,qBAAqB;IASlC,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB5D,OAAO,CAAC,YAAY,CAAC,EAAC,MAAM,GAAE,OAAO,CAAC,aAAa,CAAC;CA6C1D"}
+{"version":3,"file":"refreshService.d.ts","sourceRoot":"","sources":["../../src/auth/refreshService.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAI3C,qBAAa,iBAAkB,SAAQ,KAAK;gBAChC,OAAO,SAAgB;CAKlC;AAED,qBAAa,iBAAkB,SAC/B,KAAK;gBACO,OAAO,SAA0B;CAI5C;AAGD,UAAU,YAAY;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACb;AAGD,MAAM,WAAW,UAAU;IAC3B,GAAG,CAAC,GAAG,EAAC,MAAM,GAAE,OAAO,CAAC,MAAM,GAAE,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAC,MAAM,GAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,GAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5E;AAGD,MAAM,WAAW,qBAAqB;IACrC,UAAU,EAAC,UAAU,CAAC;IACtB,iBAAiB,EAAC,MAAM,CAAC;IACzB,WAAW,EAAC,GAAG,CAAC;IAChB,kBAAkB,EAAC,MAAM,CAAC;IAC1B,iBAAiB,EAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC3C,mBAAmB,CAAC,EAAC,OAAO,CAAC;IAC7B,kBAAkB,CAAC,EAAC,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC9B,WAAW,EAAC,MAAM,CAAC;IACnB,YAAY,CAAC,EAAC,MAAM,CAAC;CACpB;AAGD,qBAAa,cAAc;IAC3B,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,kBAAkB,CAAQ;IAClC,OAAO,CAAC,iBAAiB,CAA0B;IACnD,OAAO,CAAC,mBAAmB,CAAS;IACpC,OAAO,CAAC,kBAAkB,CAAQ;IAClC,OAAO,CAAC,IAAI,CAAW;gBAEX,OAAO,EAAC,qBAAqB;IAWlC,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB5D,OAAO,CAAC,YAAY,CAAC,EAAC,MAAM,GAAE,OAAO,CAAC,aAAa,CAAC;CAgE1D"}

package/dist/auth/refreshService.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RefreshService = exports.InvalidTokenError = exports.MissingTokenError = void 0;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const crypto_1 = require("crypto");
+const lockHelper_1 = require("../utility/lockHelper");
 class MissingTokenError extends Error {
     constructor(message = "Missing Token") {
         super(message);
@@ -29,6 +30,7 @@ class RefreshService {
         this.accessTokenExpiry = (_a = options.accessTokenExpiry) !== null && _a !== void 0 ? _a : "15m";
         this.rotateRefreshTokens = (_b = options.rotateRefreshTokens) !== null && _b !== void 0 ? _b : false;
         this.refreshTokenExpiry = (_c = options.refreshTokenExpiry) !== null && _c !== void 0 ? _c : "7d";
+        this.lock = new lockHelper_1.RedisLock(options.redisClient);
     }
     async generateRefreshToken(payload) {
         if (!payload.userId)
@@ -52,21 +54,40 @@ class RefreshService {
         catch (err) {
             throw new InvalidTokenError();
         }
-        const storedToken = await this.tokenStore.get(`refresh:${decoded.userId}`);
-        if (storedToken !== refreshToken) {
-            throw new InvalidTokenError();
+        const lockKey = `lock:${decoded.userId}`;
+        const lockValue = await this.lock.acquire(lockKey, 5000);
+        if (!lockValue) {
+            throw new InvalidTokenError("Concurrent refresh detected");
         }
-        const newAccessToken = jsonwebtoken_1.default.sign({ userId: decoded.userId, email: decoded.email }, this.accessTokenSecret, { expiresIn: this.accessTokenExpiry });
-        let newRefreshToken;
-        if (this.rotateRefreshTokens && this.tokenStore.set) {
+        //const storedToken= await this.tokenStore.get(`refresh:${decoded.userId}`)
+        try {
             const key = `refresh:${decoded.userId}`;
-            newRefreshToken = jsonwebtoken_1.default.sign({ userId: decoded.userId, email: decoded.email, jti: (0, crypto_1.randomUUID)(), }, this.refreshTokenSecret, { expiresIn: this.refreshTokenExpiry });
-            await this.tokenStore.set(key, newRefreshToken, 60 * 60 * 24 * 7);
+            const storedToken = await this.tokenStore.get(key);
+            if (!storedToken || storedToken !== refreshToken) {
+                throw new InvalidTokenError();
+            }
+            const newAccessToken = jsonwebtoken_1.default.sign({ userId: decoded.userId, email: decoded.email }, this.accessTokenSecret, { expiresIn: this.accessTokenExpiry });
+            let newRefreshToken;
+            if (this.rotateRefreshTokens && this.tokenStore.set) {
+                const key = `refresh:${decoded.userId}`;
+                newRefreshToken = jsonwebtoken_1.default.sign({ userId: decoded.userId, email: decoded.email, jti: (0, crypto_1.randomUUID)(), }, this.refreshTokenSecret, { expiresIn: this.refreshTokenExpiry });
+                if (!this.tokenStore.getset) {
+                    throw new Error("TokenStore must implement getset for atomic refresh rotation");
+                }
+                const PreviousToken = await this.tokenStore.getset(key, newRefreshToken, 60 * 60 * 24 * 7);
+                if (PreviousToken !== refreshToken) {
+                    throw new InvalidTokenError("Concurrent refresh detected");
+                }
+            }
+            return {
+                accessToken: newAccessToken,
+                refreshToken: newRefreshToken !== null && newRefreshToken !== void 0 ? newRefreshToken : refreshToken
+            };
+        }
+        finally {
+            if (lockValue)
+                await this.lock.release(lockKey, lockValue);
         }
-        return {
-            accessToken: newAccessToken,
-            refreshToken: newRefreshToken !== null && newRefreshToken !== void 0 ? newRefreshToken : refreshToken
-        };
     }
 }
 exports.RefreshService = RefreshService;

package/dist/auth/refreshService.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshService.js","sourceRoot":"","sources":["../../src/auth/refreshService.ts"],"names":[],"mappings":";;;;;;AAAA,gEAA+B;AAE/B,mCAAiC;AAGjC,MAAa,iBAAkB,SAAQ,KAAK;IAC5C,YAAY,OAAO,GAAC,eAAe;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAE,mBAAmB,CAAC;IAC/B,CAAC;CACA;AAND,8CAMC;AAED,MAAa,iBAAkB,SAC/B,KAAK;IACL,YAAY,OAAO,GAAG,uBAAuB;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAChC,CAAC;CACA;AAND,8CAMC;AA8BD,MAAa,cAAc;IAS3B,YAAY,OAA6B;;QACzC,IAAI,CAAC,UAAU,GAAI,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,kBAAkB,GAAE,OAAO,CAAC,kBAAkB,CAAC;QACpD,IAAI,CAAC,iBAAiB,GAAE,MAAA,OAAO,CAAC,iBAAiB,mCAAI,KAAK,CAAC;QAC3D,IAAI,CAAC,mBAAmB,GAAG,MAAA,OAAO,CAAC,mBAAmB,mCAAI,KAAK,CAAC;QAChE,IAAI,CAAC,kBAAkB,GAAG,MAAA,OAAO,CAAC,kBAAkB,mCAAI,IAAI,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,OAAqB;QAE/C,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAExF,MAAM,KAAK,GAAG,sBAAG,CAAC,IAAI,CAAC,EAAC,GAAG,OAAO,EAAC,GAAG,EAAC,IAAA,mBAAU,GAAE,GAAE,EAAC,IAAI,CAAC,kBAAkB,EAAE;YAC7E,SAAS,EAAE,IAAI,CAAC,kBAA8C;SAC/D,CAAC,CAAC;QAEH,IAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAC,CAAC;YACxB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CACzB,WAAW,OAAO,CAAC,MAAM,EAAE,EAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAClD,CAAC;QACF,CAAC;QAGD,OAAO,KAAK,CAAA;IACd,CAAC;IAGA,KAAK,CAAC,OAAO,CAAC,YAAoB;QACjC,IAAG,CAAC,YAAY,EAAC,CAAC;YAClB,MAAM,IAAI,iBAAiB,EAAE,CAAA;QAC7B,CAAC;QAEH,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACL,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,YAAY,EAAC,IAAI,CAAC,kBAAkB,CAAiB,CAAC;QAC3E,CAAC;QAAA,OAAM,GAAG,EAAC,CAAC;YACZ,MAAM,IAAI,iBAAiB,EAAE,CAAA;QAC7B,CAAC;QAED,MAAM,WAAW,GAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAIzE,IAAI,WAAW,KAAK,YAAY,EAAC,CAAC;YAClC,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAC9B,CAAC;QAED,MAAM,cAAc,GAAG,sBAAG,CAAC,IAAI,CACvB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAChD,IAAI,CAAC,iBAAiB,EACtB,EAAE,SAAS,EAAE,IAAI,CAAC,iBAAiD,EAAE,CACxE,CAAC;QAEN,IAAI,eAAkC,CAAC;QAEvC,IAAG,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAC,CAAC;YACpD,MAAM,GAAG,GAAG,WAAW,OAAO,CAAC,MAAM,EAAE,CAEtC;YACA,eAAe,GAAE,sBAAG,CAAC,IAAI,CAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,KAAK,EAAG,OAAO,CAAC,KAAK,EAAC,GAAG,EAAC,IAAA,mBAAU,GAAE,GAAE,EACzF,IAAI,CAAC,kBAAkB,EACxB,EAAC,SAAS,EAAC,IAAI,CAAC,kBAAkD,EAAC,CAAC,CAAC;YAErE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAC,eAAe,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QAE/D,CAAC;QAEA,OAAM;YACN,WAAW,EAAC,cAAc;YAC1B,YAAY,EAAC,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,YAAY;SAC3C,CAAC;IACH,CAAC;CACA;AAlFD,wCAkFC"}
+{"version":3,"file":"refreshService.js","sourceRoot":"","sources":["../../src/auth/refreshService.ts"],"names":[],"mappings":";;;;;;AAAA,gEAA+B;AAE/B,mCAAiC;AACjC,sDAA+C;AAE/C,MAAa,iBAAkB,SAAQ,KAAK;IAC5C,YAAY,OAAO,GAAC,eAAe;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAE,mBAAmB,CAAC;IAC/B,CAAC;CACA;AAND,8CAMC;AAED,MAAa,iBAAkB,SAC/B,KAAK;IACL,YAAY,OAAO,GAAG,uBAAuB;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAChC,CAAC;CACA;AAND,8CAMC;AAiCD,MAAa,cAAc;IAS3B,YAAY,OAA6B;;QACzC,IAAI,CAAC,UAAU,GAAI,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,kBAAkB,GAAE,OAAO,CAAC,kBAAkB,CAAC;QACpD,IAAI,CAAC,iBAAiB,GAAE,MAAA,OAAO,CAAC,iBAAiB,mCAAI,KAAK,CAAC;QAC3D,IAAI,CAAC,mBAAmB,GAAG,MAAA,OAAO,CAAC,mBAAmB,mCAAI,KAAK,CAAC;QAChE,IAAI,CAAC,kBAAkB,GAAG,MAAA,OAAO,CAAC,kBAAkB,mCAAI,IAAI,CAAA;QAC5D,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC7C,CAAC;IAGD,KAAK,CAAC,oBAAoB,CAAC,OAAqB;QAE/C,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAExF,MAAM,KAAK,GAAG,sBAAG,CAAC,IAAI,CAAC,EAAC,GAAG,OAAO,EAAC,GAAG,EAAC,IAAA,mBAAU,GAAE,GAAE,EAAC,IAAI,CAAC,kBAAkB,EAAE;YAC7E,SAAS,EAAE,IAAI,CAAC,kBAA8C;SAC/D,CAAC,CAAC;QAEH,IAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAC,CAAC;YACxB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CACzB,WAAW,OAAO,CAAC,MAAM,EAAE,EAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAClD,CAAC;QACF,CAAC;QAGD,OAAO,KAAK,CAAA;IACd,CAAC;IAGA,KAAK,CAAC,OAAO,CAAC,YAAoB;QACjC,IAAG,CAAC,YAAY,EAAC,CAAC;YAClB,MAAM,IAAI,iBAAiB,EAAE,CAAA;QAC7B,CAAC;QAED,IAAI,OAAoB,CAAC;QAC3B,IAAG,CAAC;YAEJ,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,YAAY,EAAC,IAAI,CAAC,kBAAkB,CAAiB,CAAC;QAC3E,CAAC;QAAA,OAAM,GAAG,EAAC,CAAC;YACZ,MAAM,IAAI,iBAAiB,EAAE,CAAA;QAC7B,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAEzD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QAEH,2EAA2E;QAE3E,IAAG,CAAC;YACJ,MAAM,GAAG,GAAG,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAGnD,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,YAAY,EAAC,CAAC;gBAClD,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAC9B,CAAC;YAED,MAAM,cAAc,GAAG,sBAAG,CAAC,IAAI,CACvB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAChD,IAAI,CAAC,iBAAiB,EACtB,EAAE,SAAS,EAAE,IAAI,CAAC,iBAAiD,EAAE,CACxE,CAAC;YAEN,IAAI,eAAkC,CAAC;YAEvC,IAAG,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAC,CAAC;gBACpD,MAAM,GAAG,GAAG,WAAW,OAAO,CAAC,MAAM,EAAE,CAEtC;gBACA,eAAe,GAAE,sBAAG,CAAC,IAAI,CAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,KAAK,EAAG,OAAO,CAAC,KAAK,EAAC,GAAG,EAAC,IAAA,mBAAU,GAAE,GAAE,EACzF,IAAI,CAAC,kBAAkB,EACxB,EAAC,SAAS,EAAC,IAAI,CAAC,kBAAkD,EAAC,CAAC,CAAC;gBAErE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,aAAa,GAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAC,eAAe,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;gBACvF,IAAG,aAAa,KAAK,YAAY,EAAC,CAAC;oBACnC,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAA;gBAAA,CAAC;YAC3D,CAAC;YAEA,OAAM;gBACN,WAAW,EAAC,cAAc;gBAC1B,YAAY,EAAC,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,YAAY;aAC3C,CAAC;QACH,CAAC;gBAAQ,CAAC;YACN,IAAI,SAAS;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;CAEA;AAvGD,wCAuGC"}

package/dist/createAuthenik8.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuthenik8.d.ts","sourceRoot":"","sources":["../src/createAuthenik8.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,eAAe,EAAC,MAAM,gBAAgB,CAAC;AAK/C,OAAO,EAAC,iBAAiB,EAAC,MAAM,gBAAgB,CAAA;AAGhD,eAAO,MAAM,eAAe,GAAU,QAAO,eAAe,KAAG,OAAO,CAAC,iBAAiB,CAuDvF,CAAA"}
+{"version":3,"file":"createAuthenik8.d.ts","sourceRoot":"","sources":["../src/createAuthenik8.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,eAAe,EAAC,MAAM,gBAAgB,CAAC;AAK/C,OAAO,EAAC,iBAAiB,EAAC,MAAM,gBAAgB,CAAA;AAGhD,eAAO,MAAM,eAAe,GAAU,QAAO,eAAe,KAAG,OAAO,CAAC,iBAAiB,CAwDvF,CAAA"}

package/dist/createAuthenik8.js

@@ -19,6 +19,7 @@ const createAuthenik8 = async (config) => {
     });
     const refreshService = new refreshService_1.RefreshService({
         tokenStore,
+        redisClient,
         accessTokenSecret: config.jwtSecret,
         refreshTokenSecret: config.refreshSecret,
         accessTokenExpiry: config.jwtExpiry,

package/dist/createAuthenik8.js.map

@@ -1 +1 @@
-{"version":3,"file":"createAuthenik8.js","sourceRoot":"","sources":["../src/createAuthenik8.ts"],"names":[],"mappings":";;;AAAA,oDAAoD;AACpD,0DAAsD;AAEtD,8DAAkD;AAClD,4DAAuD;AACvD,4CAAyC;AACzC,uDAA4D;AAE5D,+DAAyD;AAElD,MAAM,eAAe,GAAG,KAAK,EAAE,MAAsB,EAA8B,EAAE;;IAE5F,MAAM,WAAW,GAAG,MAAA,MAAM,CAAC,KAAK,mCAAI,MAAM,IAAA,oCAAqB,GAAE,CAAA;IACjE,MAAM,UAAU,GAAG,IAAI,iCAAe,CAAC,WAAW,CAAC,CAAC;IAEnD,MAAM,UAAU,GAAE,IAAI,oBAAU,CAAC;QACjC,SAAS,EAAC,MAAM,CAAC,SAAS;QAC1B,MAAM,EAAC,MAAM,CAAC,SAAS;QACvB,WAAW,EAAC,WAAW;KACtB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;QAC1C,UAAU;QACV,iBAAiB,EAAC,MAAM,CAAC,SAAS;QAClC,kBAAkB,EAAC,MAAM,CAAC,aAAa;QACvC,iBAAiB,EAAC,MAAM,CAAC,SAAS;QAClC,mBAAmB,EAAC,IAAI;KACvB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,0BAAc,CAAC;QACpC,WAAW,EAAC,MAAM,CAAC,KAAK;QACxB,kBAAkB,EAAE,IAAI;QACxB,aAAa,EAAC,IAAI;QAClB,gBAAgB,EAAC,IAAI;KACpB,CAAC,CAAC;IACJ,OAAM;QACL,MAAM;QACN,KAAK,EAAC,WAAW;QACjB,SAAS,EAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,WAAW,EAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;QACnD,UAAU,EAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAEjD,SAAS;QACT,YAAY,EACX,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;QAC5C,oBAAoB,EAAE,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC;QAC/E,UAAU;QACP,SAAS,EAAE,QAAQ,CAAC,qBAAqB,EAAE;QAC1C,WAAW,EAAE,QAAQ,CAAC,mBAAmB,EAAE;QAC3C,MAAM,EAAE,QAAQ,CAAC,gBAAgB,EAAE;QAEnC,sBAAsB;QACtB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAG3C,YAAY;QACb,YAAY,EAAE,IAAA,2BAAY,EAAC,EAAE,SAAS,EACrC,MAAM,CAAC,SAAS;YACX,KAAK,EAAC,WAAW;SACtB,CAAC;QACF,SAAS,EAAC,4BAAS;KAElB,CAAA;AACD,CAAC,CAAA;AAvDY,QAAA,eAAe,mBAuD3B"}
+{"version":3,"file":"createAuthenik8.js","sourceRoot":"","sources":["../src/createAuthenik8.ts"],"names":[],"mappings":";;;AAAA,oDAAoD;AACpD,0DAAsD;AAEtD,8DAAkD;AAClD,4DAAuD;AACvD,4CAAyC;AACzC,uDAA4D;AAE5D,+DAAyD;AAElD,MAAM,eAAe,GAAG,KAAK,EAAE,MAAsB,EAA8B,EAAE;;IAE5F,MAAM,WAAW,GAAG,MAAA,MAAM,CAAC,KAAK,mCAAI,MAAM,IAAA,oCAAqB,GAAE,CAAA;IACjE,MAAM,UAAU,GAAG,IAAI,iCAAe,CAAC,WAAW,CAAC,CAAC;IAEnD,MAAM,UAAU,GAAE,IAAI,oBAAU,CAAC;QACjC,SAAS,EAAC,MAAM,CAAC,SAAS;QAC1B,MAAM,EAAC,MAAM,CAAC,SAAS;QACvB,WAAW,EAAC,WAAW;KACtB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;QAC1C,UAAU;QACV,WAAW;QACX,iBAAiB,EAAC,MAAM,CAAC,SAAS;QAClC,kBAAkB,EAAC,MAAM,CAAC,aAAa;QACvC,iBAAiB,EAAC,MAAM,CAAC,SAAS;QAClC,mBAAmB,EAAC,IAAI;KACvB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,0BAAc,CAAC;QACpC,WAAW,EAAC,MAAM,CAAC,KAAK;QACxB,kBAAkB,EAAE,IAAI;QACxB,aAAa,EAAC,IAAI;QAClB,gBAAgB,EAAC,IAAI;KACpB,CAAC,CAAC;IACJ,OAAM;QACL,MAAM;QACN,KAAK,EAAC,WAAW;QACjB,SAAS,EAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,WAAW,EAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;QACnD,UAAU,EAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAEjD,SAAS;QACT,YAAY,EACX,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;QAC5C,oBAAoB,EAAE,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC;QAC/E,UAAU;QACP,SAAS,EAAE,QAAQ,CAAC,qBAAqB,EAAE;QAC1C,WAAW,EAAE,QAAQ,CAAC,mBAAmB,EAAE;QAC3C,MAAM,EAAE,QAAQ,CAAC,gBAAgB,EAAE;QAEnC,sBAAsB;QACtB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAG3C,YAAY;QACb,YAAY,EAAE,IAAA,2BAAY,EAAC,EAAE,SAAS,EACrC,MAAM,CAAC,SAAS;YACX,KAAK,EAAC,WAAW;SACtB,CAAC;QACF,SAAS,EAAC,4BAAS;KAElB,CAAA;AACD,CAAC,CAAA;AAxDY,QAAA,eAAe,mBAwD3B"}

package/dist/storage/RedisTokenStore.d.ts

@@ -7,10 +7,11 @@ export declare class RedisTokenStore {
     private key;
     private log;
     storeRefreshToken(token: string, userId: string, ttl: number): Promise<void>;
-    getRefreshToken(token: string): Promise<string | null>;
-    deleteRefreshToken(token: string): Promise<void>;
-    blacklistToken(token: string, ttl: number): Promise<void>;
-    isBlacklisted(token: string): Promise<boolean>;
+    getRefreshToken(userId: string): Promise<string | null>;
+    getset(key: string, value: string, expiry?: number): Promise<string | null>;
+    deleteRefreshToken(userId: string): Promise<void>;
+    blacklistToken(userId: string, ttl: number): Promise<void>;
+    isBlacklisted(userId: string): Promise<boolean>;
     incrementRateLimit(ip: string, ttl: number): Promise<number>;
     addToWhitelist(ip: string): Promise<void>;
     removeFromWhitelist(ip: string): Promise<void>;

package/dist/storage/RedisTokenStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RedisTokenStore.d.ts","sourceRoot":"","sources":["../../src/storage/RedisTokenStore.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAEhC,qBAAa,eAAe;IAGd,OAAO,CAAC,KAAK;IAAQ,OAAO,CAAC,KAAK;IAF/C,OAAO,CAAC,MAAM,CAAa;gBAEN,KAAK,EAAE,KAAK,EAAS,KAAK,UAAQ;IAGtD,OAAO,CAAC,GAAG;IAIb,OAAO,CAAC,GAAG;IAKJ,iBAAiB,CAAC,KAAK,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,GAAG,EAAC,MAAM;IAOxD,eAAe,CAAC,KAAK,EAAC,MAAM;IAO5B,kBAAkB,CAAC,KAAK,EAAC,MAAM;IAO/B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;IAMvC,aAAa,CAAC,KAAK,EAAE,MAAM;IAQ3B,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;IAa1C,cAAc,CAAC,EAAE,EAAE,MAAM;IAMzB,mBAAmB,CAAC,EAAE,EAAE,MAAM;IAM9B,aAAa,CAAC,EAAE,EAAE,MAAM;IAM1B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAG/C"}
+{"version":3,"file":"RedisTokenStore.d.ts","sourceRoot":"","sources":["../../src/storage/RedisTokenStore.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAEhC,qBAAa,eAAe;IAGd,OAAO,CAAC,KAAK;IAAQ,OAAO,CAAC,KAAK;IAF/C,OAAO,CAAC,MAAM,CAAa;gBAEN,KAAK,EAAE,KAAK,EAAS,KAAK,UAAQ;IAGtD,OAAO,CAAC,GAAG;IAIb,OAAO,CAAC,GAAG;IAKJ,iBAAiB,CAAC,KAAK,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,GAAG,EAAC,MAAM;IAOxD,eAAe,CAAC,MAAM,EAAC,MAAM;IAM7B,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAY3E,kBAAkB,CAAC,MAAM,EAAC,MAAM;IAOhC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;IAMxC,aAAa,CAAC,MAAM,EAAE,MAAM;IAQ5B,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;IAa1C,cAAc,CAAC,EAAE,EAAE,MAAM;IAMzB,mBAAmB,CAAC,EAAE,EAAE,MAAM;IAM9B,aAAa,CAAC,EAAE,EAAE,MAAM;IAM1B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAG/C"}

package/dist/storage/RedisTokenStore.js

@@ -16,28 +16,36 @@ class RedisTokenStore {
         }
     }
     async storeRefreshToken(token, userId, ttl) {
-        const key = this.key("refresh", token);
+        const key = this.key("refresh", userId);
         await this.redis.set(key, userId, "EX", ttl);
         this.log("SET", key, userId);
     }
-    async getRefreshToken(token) {
-        const key = this.key("refresh", token);
+    async getRefreshToken(userId) {
+        const key = this.key("refresh", userId);
         const value = await this.redis.get(key);
         this.log("GET", key, value);
         return value;
     }
-    async deleteRefreshToken(token) {
-        const key = this.key("refresh", token);
+    async getset(key, value, expiry) {
+        const previous = await this.redis.getset(key, value);
+        if (expiry) {
+            await this.redis.expire(key, expiry);
+        }
+        this.log("GETSET", key, { previous, new: value });
+        return previous;
+    }
+    async deleteRefreshToken(userId) {
+        const key = this.key("refresh", userId);
         await this.redis.del(key);
         this.log("DEL", key);
     }
-    async blacklistToken(token, ttl) {
-        const key = this.key("blacklist", token);
+    async blacklistToken(userId, ttl) {
+        const key = this.key("blacklist", userId);
         await this.redis.set(key, "1", "EX", ttl);
         this.log("SET", key, "blacklisted");
     }
-    async isBlacklisted(token) {
-        const key = this.key("blacklist", token);
+    async isBlacklisted(userId) {
+        const key = this.key("blacklist", userId);
         const exists = await this.redis.exists(key);
         this.log("CHECK", key, exists);
         return exists === 1;

package/dist/storage/RedisTokenStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"RedisTokenStore.js","sourceRoot":"","sources":["../../src/storage/RedisTokenStore.ts"],"names":[],"mappings":";;;AAGA,MAAa,eAAe;IAG1B,YAAoB,KAAY,EAAS,QAAQ,KAAK;QAAlC,UAAK,GAAL,KAAK,CAAO;QAAS,UAAK,GAAL,KAAK,CAAQ;QAF/C,WAAM,GAAG,SAAS,CAAC;IAE+B,CAAC;IAGlD,GAAG,CAAC,GAAG,KAAc;QAC7B,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IAEK,GAAG,CAAC,MAAa,EAAC,GAAU,EAAE,KAAU;QAChD,IAAI,IAAI,CAAC,KAAK,EAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,GAAG,EAAC,EAAC,GAAG,EAAE,KAAK,EAAC,CAAC,CAAA;QAC5C,CAAC;IACF,CAAC;IACA,KAAK,CAAC,iBAAiB,CAAC,KAAY,EAAC,MAAa,EAAC,GAAU;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAC,MAAM,EAAE,IAAI,EAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IAE7B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAY;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAC,KAAK,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAG,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACb,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAY;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,CAAC,CAAC;IAEpB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,GAAW;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,gBAAgB;IAChB,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,GAAW;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe;IACf,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,EAAU;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IACH,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,MAAe;QACnD,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAEtC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAGC,KAAK,CAAC,GAAG,CAAC,GAAW;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF;AA/FD,0CA+FC"}
+{"version":3,"file":"RedisTokenStore.js","sourceRoot":"","sources":["../../src/storage/RedisTokenStore.ts"],"names":[],"mappings":";;;AAGA,MAAa,eAAe;IAG1B,YAAoB,KAAY,EAAS,QAAQ,KAAK;QAAlC,UAAK,GAAL,KAAK,CAAO;QAAS,UAAK,GAAL,KAAK,CAAQ;QAF/C,WAAM,GAAG,SAAS,CAAC;IAE+B,CAAC;IAGlD,GAAG,CAAC,GAAG,KAAc;QAC7B,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IAEK,GAAG,CAAC,MAAa,EAAC,GAAU,EAAE,KAAU;QAChD,IAAI,IAAI,CAAC,KAAK,EAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,GAAG,EAAC,EAAC,GAAG,EAAE,KAAK,EAAC,CAAC,CAAA;QAC5C,CAAC;IACF,CAAC;IACA,KAAK,CAAC,iBAAiB,CAAC,KAAY,EAAC,MAAa,EAAC,GAAU;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAC,MAAM,EAAE,IAAI,EAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IAE7B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAa;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAC,MAAM,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAG,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACb,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAa,EAAE,MAAe;QAEtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAa;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAC,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,CAAC,CAAC;IAEpB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,GAAW;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,gBAAgB;IAChB,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,GAAW;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe;IACf,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,EAAU;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IACH,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,MAAe;QACnD,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAEtC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAGC,KAAK,CAAC,GAAG,CAAC,GAAW;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF;AA1GD,0CA0GC"}

package/dist/tests/con.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=con.test.d.ts.map

package/dist/tests/con.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"con.test.d.ts","sourceRoot":"","sources":["../../src/tests/con.test.ts"],"names":[],"mappings":""}

package/dist/tests/con.test.js

@@ -0,0 +1,71 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const createAuthenik8_1 = require("../createAuthenik8");
+const supertest_1 = __importDefault(require("supertest"));
+const express_1 = __importDefault(require("express"));
+const ioredis_1 = __importDefault(require("ioredis"));
+describe("Refresh Token Concurrency (Integration)", () => {
+    let app;
+    let auth; // or just `any` but this is better
+    let refreshToken;
+    let redisClient;
+    beforeAll(async () => {
+        // Create and verify a connected Redis client (use a separate DB for tests)
+        redisClient = new ioredis_1.default({ host: "localhost", port: 6379, db: 1 });
+        await redisClient.ping(); // ensure connection is established
+        // Pass the connected client as `redis` (not `redisClient`)
+        auth = await (0, createAuthenik8_1.createAuthenik8)({
+            jwtSecret: "test-secret",
+            refreshSecret: "refresh-secret",
+            jwtExpiry: "15m",
+            redis: redisClient, // ✅ correct property name
+        });
+        app = (0, express_1.default)();
+        app.use(express_1.default.json());
+        // Login route – must be async and await the refresh token generation
+        app.post("/login", async (req, res) => {
+            const token = auth.signToken({ userId: "user_1", email: "test@test.com" });
+            refreshToken = await auth.generateRefreshToken({ userId: "user_1", email: "test@test.com" });
+            res.json({ token, refreshToken });
+        });
+        // Refresh route – unchanged but uses the proper error handling
+        app.post("/refresh", async (req, res) => {
+            try {
+                const result = await auth.refreshToken(req.body.refreshToken);
+                res.json(result);
+            }
+            catch (err) {
+                console.error("Refresh error", err);
+                if (err.name === "InvalidTokenError") {
+                    return res.status(401).json({ error: err.message });
+                }
+                return res.status(500).json({ error: err.message });
+            }
+        });
+    });
+    afterAll(async () => {
+        // Clean up the test database and close the client
+        await redisClient.flushdb();
+        await redisClient.quit();
+    });
+    it("should allow only one of two concurrent refresh requests", async () => {
+        // Login to obtain a valid refresh token
+        await (0, supertest_1.default)(app).post("/login").send({});
+        // Fire two concurrent refresh requests
+        const [res1, res2] = await Promise.all([
+            (0, supertest_1.default)(app).post("/refresh").send({ refreshToken }),
+            (0, supertest_1.default)(app).post("/refresh").send({ refreshToken }),
+        ]);
+        // Exactly one should succeed (200) and one should fail with 401
+        const statuses = [res1.status, res2.status].sort();
+        expect(statuses).toEqual([200, 401]);
+        // The successful response must contain new tokens
+        const successRes = res1.status === 200 ? res1 : res2;
+        expect(successRes.body).toHaveProperty("accessToken");
+        expect(successRes.body).toHaveProperty("refreshToken");
+    });
+});
+//# sourceMappingURL=con.test.js.map

package/dist/tests/con.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"con.test.js","sourceRoot":"","sources":["../../src/tests/con.test.ts"],"names":[],"mappings":";;;;;AAAA,wDAAqD;AACrD,0DAAgC;AAChC,sDAA8B;AAC9B,sDAA4B;AAE5B,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,IAAI,GAAoB,CAAC;IACzB,IAAI,IAAiD,CAAC,CAAC,mCAAmC;IAC1F,IAAI,YAAoB,CAAC;IACzB,IAAI,WAAkB,CAAC;IAEvB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,2EAA2E;QAC3E,WAAW,GAAG,IAAI,iBAAK,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,mCAAmC;QAE7D,2DAA2D;QAC3D,IAAI,GAAG,MAAM,IAAA,iCAAe,EAAC;YAC3B,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,gBAAgB;YAC/B,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,WAAW,EAAE,0BAA0B;SAC/C,CAAC,CAAC;QAEH,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAExB,qEAAqE;QACrE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC3E,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC7F,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnB,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAC,GAAG,CAAC,CAAA;gBAElC,IAAG,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAC,CAAC;oBACrC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,KAAK,EAAC,GAAG,CAAC,OAAO,EAAC,CAAC,CAAA;gBAChD,CAAC;gBACA,OAAO,GAAG,CAAC,MAAM,CAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,kDAAkD;QAClD,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,wCAAwC;QACxC,MAAM,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE3C,uCAAuC;QACvC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrC,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC;YACpD,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC;SACrD,CAAC,CAAC;QAEH,gEAAgE;QAChE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAErC,kDAAkD;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/utility/lockHelper.d.ts

@@ -0,0 +1,7 @@
+export declare class RedisLock {
+    private redis;
+    constructor(redis: any);
+    acquire(key: string, ttl?: number): Promise<string | null>;
+    release(key: string, value: string): Promise<void>;
+}
+//# sourceMappingURL=lockHelper.d.ts.map

package/dist/utility/lockHelper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockHelper.d.ts","sourceRoot":"","sources":["../../src/utility/lockHelper.ts"],"names":[],"mappings":"AAEA,qBAAa,SAAS;IACR,OAAO,CAAC,KAAK;gBAAL,KAAK,EAAE,GAAG;IAExB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,SAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgBxD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAWzD"}

package/dist/utility/lockHelper.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisLock = void 0;
+const crypto_1 = require("crypto");
+class RedisLock {
+    constructor(redis) {
+        this.redis = redis;
+    }
+    async acquire(key, ttl = 5000) {
+        const value = (0, crypto_1.randomUUID)();
+        const result = await this.redis.set(key, value, "PX", ttl, "NX");
+        if (result !== "OK")
+            return null;
+        return value;
+    }
+    async release(key, value) {
+        const luaScript = `
+      if redis.call("GET", KEYS[1]) == ARGV[1] then
+        return redis.call("DEL", KEYS[1])
+      else
+        return 0
+      end
+    `;
+        await this.redis.eval(luaScript, 1, key, value);
+    }
+}
+exports.RedisLock = RedisLock;
+//# sourceMappingURL=lockHelper.js.map

package/dist/utility/lockHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockHelper.js","sourceRoot":"","sources":["../../src/utility/lockHelper.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAEpC,MAAa,SAAS;IACpB,YAAoB,KAAU;QAAV,UAAK,GAAL,KAAK,CAAK;IAAG,CAAC;IAElC,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,GAAG,GAAG,IAAI;QACnC,MAAM,KAAK,GAAG,IAAA,mBAAU,GAAE,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CACjC,GAAG,EACH,KAAK,EACL,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAC;QAEF,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,KAAa;QACtC,MAAM,SAAS,GAAG;;;;;;KAMjB,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;CACF;AA9BD,8BA8BC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authenik8-core",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "A modular Node.js authentication SDK with JWT, secure refresh token rotation, and built-in security middleware.",
   "keywords": [
     "authentication",
@@ -33,7 +33,8 @@
     "files": [
       "dist",
       "README.md",
-      "LICENSE"
+      "LICENSE",
+      "CHANGELOG"
     ]
   },
   "devDependencies": {

package/src/auth/refreshService.ts

@@ -1,7 +1,7 @@
 import jwt from "jsonwebtoken";
 import { SignOptions } from "jsonwebtoken";
 import {randomUUID} from "crypto"
-
+import {RedisLock} from "../utility/lockHelper"
 
 export class MissingTokenError extends Error{
 constructor(message="Missing Token")
@@ -30,11 +30,14 @@ export interface TokenStore{
 get(key:string):Promise<string| null>;
 set?(key: string, value: string, expiry?:number):Promise<void>;
 del?(key :string):Promise<void>;
-
+getset?(key: string, value: string, expiry?: number): Promise<string | null>;
 }
+
+
 export interface RefreshServiceOptions {
 	tokenStore:TokenStore;
 	accessTokenSecret:string;
+	redisClient:any;
 	refreshTokenSecret:string;
 	accessTokenExpiry:SignOptions["expiresIn"];
 	rotateRefreshTokens?:boolean;
@@ -54,7 +57,7 @@ private refreshTokenSecret:string;
 private accessTokenExpiry:SignOptions["expiresIn"];
 private rotateRefreshTokens:boolean;
 private refreshTokenExpiry:string;
-
+private lock:RedisLock;
 
 constructor(options:RefreshServiceOptions){
 this.tokenStore =  options.tokenStore;
@@ -63,8 +66,10 @@ this.refreshTokenSecret =options.refreshTokenSecret;
 this.accessTokenExpiry= options.accessTokenExpiry ?? "15m";
 this.rotateRefreshTokens = options.rotateRefreshTokens ?? false;
 this.refreshTokenExpiry = options.refreshTokenExpiry ?? "7d"
+this.lock = new RedisLock(options.redisClient)
  }
 
+
  async generateRefreshToken(payload: TokenPayload): Promise<string> {
 
 	 if (!payload.userId) throw new Error("generateRefreshToken: payload.userId is missing");
@@ -88,19 +93,30 @@ this.refreshTokenExpiry = options.refreshTokenExpiry ?? "7d"
 	 if(!refreshToken){
 	 throw new MissingTokenError()
 	 }
- 
-let decoded:TokenPayload;
-try {
+
+	 let decoded:TokenPayload;
+try{
+
 decoded = jwt.verify(refreshToken,this.refreshTokenSecret) as TokenPayload;
 }catch(err){
 throw new InvalidTokenError()
 }
 
-const storedToken= await this.tokenStore.get(`refresh:${decoded.userId}`)
+const lockKey = `lock:${decoded.userId}`;
+  const lockValue = await this.lock.acquire(lockKey, 5000);
 
+  if (!lockValue) {
+    throw new InvalidTokenError("Concurrent refresh detected");
+  }
+
+//const storedToken= await this.tokenStore.get(`refresh:${decoded.userId}`)
 
+try{
+const key = `refresh:${decoded.userId}`;
+const storedToken = await this.tokenStore.get(key);
 
-if (storedToken !== refreshToken){
+
+if (!storedToken || storedToken !== refreshToken){
 throw new InvalidTokenError();
 }
 
@@ -120,14 +136,21 @@ const key = `refresh:${decoded.userId}`
 	this.refreshTokenSecret,
 {expiresIn:this.refreshTokenExpiry as jwt.SignOptions["expiresIn"]});
 
-await this.tokenStore.set(key,newRefreshToken,60 * 60 * 24 * 7)
-
+if (!this.tokenStore.getset) {
+  throw new Error("TokenStore must implement getset for atomic refresh rotation");
+}
+const PreviousToken =await this.tokenStore.getset(key,newRefreshToken,60 * 60 * 24 * 7)
+if(PreviousToken !== refreshToken){
+throw new InvalidTokenError("Concurrent refresh detected")}
 }
 
  return{
  accessToken:newAccessToken,
  refreshToken:newRefreshToken ?? refreshToken
  };
-}
+}finally {
+    if (lockValue) await this.lock.release(lockKey, lockValue);
+  }
 }
 
+}

package/src/createAuthenik8.ts

@@ -21,6 +21,7 @@ const tokenStore = new RedisTokenStore(redisClient);
 
 	const refreshService = new RefreshService({
 	tokenStore,
+	redisClient,
 	accessTokenSecret:config.jwtSecret,
 	refreshTokenSecret:config.refreshSecret,
 	accessTokenExpiry:config.jwtExpiry,

package/src/storage/RedisTokenStore.ts

@@ -17,34 +17,45 @@ console.log(`[Redis ${action}]`,{key, value})
  }
 }
  async storeRefreshToken(token:string,userId:string,ttl:number){
- const key = this.key("refresh", token);
+ const key = this.key("refresh", userId);
  await this.redis.set(key,userId, "EX",ttl);
  this.log("SET", key, userId)
 
 }
 
-async getRefreshToken(token:string){
-const key = this.key("refresh",token);
+async getRefreshToken(userId:string){
+const key = this.key("refresh",userId);
 const value = await this.redis.get(key);
 this.log("GET",key , value);
 return value;
 }
+async getset(key: string, value: string, expiry?: number): Promise<string | null> {
 
-async deleteRefreshToken(token:string){
-const key = this.key("refresh",token);
+  const previous = await this.redis.getset(key, value);
+
+  if (expiry) {
+    await this.redis.expire(key, expiry);
+  }
+
+  this.log("GETSET", key, { previous, new: value });
+  return previous;
+}
+
+async deleteRefreshToken(userId:string){
+const key = this.key("refresh",userId);
 await this.redis.del(key);
 this.log("DEL",key);
 
 }
 
-async blacklistToken(token: string, ttl: number) {
-    const key = this.key("blacklist", token);
+async blacklistToken(userId: string, ttl: number) {
+    const key = this.key("blacklist", userId);
     await this.redis.set(key, "1", "EX", ttl);
     this.log("SET", key, "blacklisted");
   }
 
-  async isBlacklisted(token: string) {
-    const key = this.key("blacklist", token);
+  async isBlacklisted(userId: string) {
+    const key = this.key("blacklist", userId);
     const exists = await this.redis.exists(key);
     this.log("CHECK", key, exists);
     return exists === 1;

package/src/tests/con.test.ts

@@ -0,0 +1,76 @@
+import { createAuthenik8 } from "../createAuthenik8";
+import request from "supertest";
+import express from "express";
+import Redis from "ioredis";
+
+describe("Refresh Token Concurrency (Integration)", () => {
+  let app: express.Express;
+  let auth: Awaited<ReturnType<typeof createAuthenik8>>; // or just `any` but this is better
+  let refreshToken: string;
+  let redisClient: Redis;
+
+  beforeAll(async () => {
+    // Create and verify a connected Redis client (use a separate DB for tests)
+    redisClient = new Redis({ host: "localhost", port: 6379, db: 1 });
+    await redisClient.ping(); // ensure connection is established
+
+    // Pass the connected client as `redis` (not `redisClient`)
+    auth = await createAuthenik8({
+      jwtSecret: "test-secret",
+      refreshSecret: "refresh-secret",
+      jwtExpiry: "15m",
+      redis: redisClient, // ✅ correct property name
+    });
+
+    app = express();
+    app.use(express.json());
+
+    // Login route – must be async and await the refresh token generation
+    app.post("/login", async (req, res) => {
+      const token = auth.signToken({ userId: "user_1", email: "test@test.com" });
+      refreshToken = await auth.generateRefreshToken({ userId: "user_1", email: "test@test.com" });
+      res.json({ token, refreshToken });
+    });
+
+    // Refresh route – unchanged but uses the proper error handling
+    app.post("/refresh", async (req, res) => {
+      try {
+        const result = await auth.refreshToken(req.body.refreshToken);
+        res.json(result);
+      } catch (err: any) {
+	      console.error("Refresh error",err)
+
+	      if(err.name === "InvalidTokenError"){
+	      return res.status(401).json({error:err.message})
+	      }
+        return res.status( 500).json({ error: err.message });
+      }
+    });
+  });
+
+  afterAll(async () => {
+    // Clean up the test database and close the client
+    await redisClient.flushdb();
+    await redisClient.quit();
+  });
+
+  it("should allow only one of two concurrent refresh requests", async () => {
+    // Login to obtain a valid refresh token
+    await request(app).post("/login").send({});
+
+    // Fire two concurrent refresh requests
+    const [res1, res2] = await Promise.all([
+      request(app).post("/refresh").send({ refreshToken }),
+      request(app).post("/refresh").send({ refreshToken }),
+    ]);
+
+    // Exactly one should succeed (200) and one should fail with 401
+    const statuses = [res1.status, res2.status].sort();
+    expect(statuses).toEqual([200, 401]);
+
+    // The successful response must contain new tokens
+    const successRes = res1.status === 200 ? res1 : res2;
+    expect(successRes.body).toHaveProperty("accessToken");
+    expect(successRes.body).toHaveProperty("refreshToken");
+  });
+});

package/src/utility/lockHelper.ts

@@ -0,0 +1,33 @@
+import { randomUUID } from "crypto";
+
+export class RedisLock {
+  constructor(private redis: any) {}
+
+  async acquire(key: string, ttl = 5000): Promise<string | null> {
+    const value = randomUUID();
+
+    const result = await this.redis.set(
+      key,
+      value,
+      "PX",
+      ttl,
+      "NX"
+    );
+
+    if (result !== "OK") return null;
+
+    return value;
+  }
+
+  async release(key: string, value: string): Promise<void> {
+    const luaScript = `
+      if redis.call("GET", KEYS[1]) == ARGV[1] then
+        return redis.call("DEL", KEYS[1])
+      else
+        return 0
+      end
+    `;
+
+    await this.redis.eval(luaScript, 1, key, value);
+  }
+}

package/.env

@@ -1,2 +0,0 @@
-REDIS_HOST="127.0.0.1"
-