machine-bridge-mcp 1.2.10 → 2.0.0

package/src/worker/nonce-store.ts

@@ -0,0 +1,79 @@
+interface NonceStorage {
+  get<T = unknown>(key: string): Promise<T | undefined>;
+  put(key: string, value: unknown): Promise<void>;
+}
+
+interface TransactionalNonceStorage extends NonceStorage {
+  transaction<T>(callback: (transaction: NonceStorage) => Promise<T>): Promise<T>;
+}
+
+export async function consumeBoundedNonce(
+  storage: DurableObjectStorage | NonceStorage,
+  options: {
+    key: string;
+    nonce: string;
+    expiresAt: number;
+    now: number;
+    noncePattern: RegExp;
+    maximum: number;
+  },
+): Promise<boolean> {
+  validateOptions(options);
+  const consume = (target: NonceStorage) => consumeInStorage(target, options);
+  if (hasTransactions(storage)) return storage.transaction(consume);
+  return consume(storage);
+}
+
+async function consumeInStorage(
+  storage: NonceStorage,
+  options: {
+    key: string;
+    nonce: string;
+    expiresAt: number;
+    now: number;
+    noncePattern: RegExp;
+    maximum: number;
+  },
+): Promise<boolean> {
+  const raw = await storage.get<unknown>(options.key);
+  if (raw !== undefined && !validNonceRecord(raw, options.noncePattern)) return false;
+  const nonces: Record<string, number> = raw ? { ...raw as Record<string, number> } : {};
+  for (const [nonce, expiresAt] of Object.entries(nonces)) {
+    if (expiresAt <= options.now) delete nonces[nonce];
+  }
+  if (nonces[options.nonce]) return false;
+  nonces[options.nonce] = options.expiresAt;
+  const entries = Object.entries(nonces).sort((left, right) => left[1] - right[1] || left[0].localeCompare(right[0]));
+  while (entries.length > options.maximum) {
+    const [nonce] = entries.shift()!;
+    delete nonces[nonce];
+  }
+  await storage.put(options.key, nonces);
+  return true;
+}
+
+function validateOptions(options: {
+  key: string;
+  nonce: string;
+  expiresAt: number;
+  now: number;
+  noncePattern: RegExp;
+  maximum: number;
+}): void {
+  if (!/^[a-z][a-z0-9-]{1,127}$/.test(options.key)) throw new Error("nonce-store key is invalid");
+  if (!options.noncePattern.test(options.nonce)) throw new Error("nonce-store nonce is invalid");
+  if (!Number.isSafeInteger(options.now) || options.now <= 0) throw new Error("nonce-store current time is invalid");
+  if (!Number.isSafeInteger(options.expiresAt) || options.expiresAt <= options.now) throw new Error("nonce-store expiration is invalid");
+  if (!Number.isSafeInteger(options.maximum) || options.maximum < 1 || options.maximum > 4096) throw new Error("nonce-store maximum is invalid");
+}
+
+function validNonceRecord(value: unknown, noncePattern: RegExp): value is Record<string, number> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  return Object.entries(value).every(([nonce, expiresAt]) => (
+    noncePattern.test(nonce) && Number.isSafeInteger(expiresAt) && expiresAt > 0
+  ));
+}
+
+function hasTransactions(storage: DurableObjectStorage | NonceStorage): storage is TransactionalNonceStorage {
+  return typeof (storage as Partial<TransactionalNonceStorage>).transaction === "function";
+}

package/src/worker/oauth-controller.ts

@@ -1,5 +1,5 @@
 import { DEFAULT_ACCOUNT_ROLE, normalizeAccountRole, type AccountRole } from "./access.ts";
-import { accountAdminAuthorized, handleAccountAdminOperation } from "./account-admin.ts";
+import { accountAdminAuthorized, consumeAccountAdminNonce, handleAccountAdminOperation } from "./account-admin.ts";
 import { exchangeOAuthToken } from "./oauth-tokens.ts";
 import {
   AUTH_BLOCK_SECONDS, accountByName, authorizationIdentity, emptyOAuthStore,
@@ -24,7 +24,7 @@ const MAX_AUTH_FAILURE_IDENTITIES = 200;
 
 export interface OAuthControllerEnv {
   ACCOUNT_ADMIN_SECRET: string;
-  DAEMON_SHARED_SECRET: string;
+  DAEMON_DEVICE_PUBLIC_KEY: string;
   OAUTH_TOKEN_VERSION: string;
 }
 
@@ -32,6 +32,7 @@ export interface AuthorizedToken {
   tokenKey: string;
   accountId: string;
   accountVersion: number;
+  clientId: string;
   role: AccountRole;
 }
 
@@ -105,11 +106,15 @@ export class OAuthController {
   }
 
   async handleAccountAdmin(request: Request, operation: "accounts" | "rotate-password"): Promise<Response> {
-    if (!(await accountAdminAuthorized(request, this.env.ACCOUNT_ADMIN_SECRET ?? ""))) return json({ error: "unauthorized" }, 401);
     return this.withOAuthLock(async () => {
+      const now = Math.floor(Date.now() / 1000);
+      const authorization = await accountAdminAuthorized(request, this.env.ACCOUNT_ADMIN_SECRET ?? "", now);
+      if (!authorization || !(await consumeAccountAdminNonce(this.ctx.storage, authorization, now))) {
+        return json({ error: "unauthorized" }, 401);
+      }
       const store = await this.oauthStore();
       return handleAccountAdminOperation({
-        request, operation, store, now: Math.floor(Date.now() / 1000),
+        request, operation, store, now,
         save: () => this.ctx.storage.put("oauth", store),
       });
     });
@@ -265,7 +270,7 @@ export class OAuthController {
       }
       return {
         tokenKey: key, accountId: account.account_id,
-        accountVersion: account.version, role: account.role,
+        accountVersion: account.version, clientId: record.client_id, role: account.role,
       };
     });
   }
@@ -283,7 +288,7 @@ export class OAuthController {
   }
 
   identityKey(): string {
-    const key = this.env.OAUTH_TOKEN_VERSION || this.env.DAEMON_SHARED_SECRET || this.env.ACCOUNT_ADMIN_SECRET;
+    const key = this.env.OAUTH_TOKEN_VERSION || this.env.ACCOUNT_ADMIN_SECRET;
     if (!key) throw new HttpError(503, "server_not_configured", "OAuth identity key is not configured");
     return key;
   }

package/src/worker/oauth-refresh-families.ts

@@ -0,0 +1,172 @@
+import {
+  emptyOAuthRefreshStore,
+  isCurrentOAuthRefreshStore,
+  upgradeOAuthRefreshStore,
+  type OAuthRefreshStore,
+  type OAuthStore,
+} from "./oauth-state.ts";
+import { HttpError } from "./http.ts";
+
+export const OAUTH_REFRESH_STORE_KEY = "oauth-refresh";
+const MAX_CONSUMED_REFRESH_TOKENS = 4096;
+const MAX_REVOKED_REFRESH_FAMILIES = 1024;
+const TOKEN_HASH_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const FAMILY_ID_PATTERN = /^mcp_family_[A-Za-z0-9_-]{43}$/;
+
+export async function loadOAuthRefreshStore(
+  oauthStore: OAuthStore,
+  storage: DurableObjectStorage,
+): Promise<OAuthRefreshStore> {
+  const raw = await storage.get<unknown>(OAUTH_REFRESH_STORE_KEY);
+  const store = raw === undefined ? emptyOAuthRefreshStore() : upgradeOAuthRefreshStore(raw);
+  if (!store || !validRefreshStoreRecords(store)) {
+    throw new HttpError(503, "oauth_refresh_state_schema_mismatch", "OAuth refresh-token state requires operator repair");
+  }
+  const migrated = raw !== undefined && !isCurrentOAuthRefreshStore(raw);
+  let changed = false;
+  const now = Math.floor(Date.now() / 1000);
+  for (const [token, value] of Object.entries(store.tokens)) {
+    const account = oauthStore.accounts[value.account_id];
+    const client = oauthStore.clients[value.client_id];
+    if (
+      value.expires_at <= now
+      || value.family_expires_at <= now
+      || Boolean(store.revoked_families[value.family_id])
+      || !account
+      || !account.active
+      || account.version !== value.account_version
+      || account.role !== value.role
+      || !client
+    ) {
+      delete store.tokens[token];
+      changed = true;
+    }
+  }
+  for (const [token, value] of Object.entries(store.consumed)) {
+    if (value.expires_at <= now) {
+      delete store.consumed[token];
+      changed = true;
+    }
+  }
+  for (const [familyId, value] of Object.entries(store.revoked_families)) {
+    if (value.expires_at <= now) {
+      delete store.revoked_families[familyId];
+      changed = true;
+    }
+  }
+  if (pruneOAuthRefreshReplayState(store)) changed = true;
+  if (changed || migrated) await storage.put(OAUTH_REFRESH_STORE_KEY, store);
+  return store;
+}
+
+
+export function recordConsumedRefreshToken(
+  store: OAuthRefreshStore,
+  tokenHash: string,
+  familyId: string,
+  expiresAt: number,
+  consumedAt = Math.floor(Date.now() / 1000),
+): void {
+  if (!TOKEN_HASH_PATTERN.test(tokenHash) || !FAMILY_ID_PATTERN.test(familyId)) {
+    throw new Error("consumed refresh-token identity is invalid");
+  }
+  if (!Number.isSafeInteger(consumedAt) || !Number.isSafeInteger(expiresAt) || consumedAt <= 0 || expiresAt <= consumedAt) {
+    throw new Error("consumed refresh-token lifetime is invalid");
+  }
+  store.consumed[tokenHash] = { family_id: familyId, consumed_at: consumedAt, expires_at: expiresAt };
+  pruneOAuthRefreshReplayState(store);
+}
+
+export function pruneOAuthRefreshReplayState(store: OAuthRefreshStore): boolean {
+  let changed = false;
+  const consumed = Object.entries(store.consumed).sort((left, right) => (
+    left[1].consumed_at - right[1].consumed_at || left[0].localeCompare(right[0])
+  ));
+  while (consumed.length > MAX_CONSUMED_REFRESH_TOKENS) {
+    const [tokenHash] = consumed.shift()!;
+    delete store.consumed[tokenHash];
+    changed = true;
+  }
+  const revoked = Object.entries(store.revoked_families).sort((left, right) => (
+    left[1].expires_at - right[1].expires_at || left[0].localeCompare(right[0])
+  ));
+  while (revoked.length > MAX_REVOKED_REFRESH_FAMILIES) {
+    const [familyId] = revoked.shift()!;
+    delete store.revoked_families[familyId];
+    changed = true;
+  }
+  return changed;
+}
+
+function validRefreshStoreRecords(store: OAuthRefreshStore): boolean {
+  return Object.entries(store.tokens).every(([key, token]) => (
+    TOKEN_HASH_PATTERN.test(key)
+    && plainRecord(token)
+    && /^mcp_client_[A-Za-z0-9_-]{43}$/.test(token.client_id)
+    && /^acct_[A-Za-z0-9_-]{20,96}$/.test(token.account_id)
+    && Number.isSafeInteger(token.account_version)
+    && token.account_version > 0
+    && ["reviewer", "editor", "operator", "owner"].includes(token.role)
+    && typeof token.scope === "string"
+    && token.scope.length > 0
+    && token.scope.length <= 256
+    && validHttpsResource(token.resource)
+    && typeof token.version === "string"
+    && token.version.length > 0
+    && token.version.length <= 256
+    && FAMILY_ID_PATTERN.test(token.family_id)
+    && validTimestamp(token.issued_at)
+    && validTimestamp(token.expires_at)
+    && validTimestamp(token.family_expires_at)
+    && token.issued_at < token.expires_at
+    && token.expires_at <= token.family_expires_at
+  )) && Object.entries(store.consumed).every(([key, token]) => (
+    TOKEN_HASH_PATTERN.test(key)
+    && plainRecord(token)
+    && FAMILY_ID_PATTERN.test(token.family_id)
+    && validTimestamp(token.consumed_at)
+    && validTimestamp(token.expires_at)
+    && token.consumed_at < token.expires_at
+  )) && Object.entries(store.revoked_families).every(([familyId, value]) => (
+    FAMILY_ID_PATTERN.test(familyId)
+    && plainRecord(value)
+    && value.reason === "replay"
+    && validTimestamp(value.expires_at)
+  ));
+}
+
+function validTimestamp(value: unknown): value is number {
+  return Number.isSafeInteger(value) && Number(value) > 0;
+}
+
+function validHttpsResource(value: unknown): boolean {
+  if (typeof value !== "string" || value.length > 2048) return false;
+  try {
+    const url = new URL(value);
+    const secure = url.protocol === "https:";
+    const loopback = url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+    return (secure || loopback) && !url.username && !url.password && !url.hash;
+  } catch {
+    return false;
+  }
+}
+
+function plainRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+export function revokeOAuthRefreshFamily(
+  oauthStore: OAuthStore,
+  refreshStore: OAuthRefreshStore,
+  familyId: string,
+  expiresAt: number,
+): void {
+  for (const [key, token] of Object.entries(refreshStore.tokens)) {
+    if (token.family_id === familyId) delete refreshStore.tokens[key];
+  }
+  for (const [key, token] of Object.entries(oauthStore.tokens)) {
+    if (token.family_id === familyId) delete oauthStore.tokens[key];
+  }
+  refreshStore.revoked_families[familyId] = { expires_at: expiresAt, reason: "replay" };
+  pruneOAuthRefreshReplayState(refreshStore);
+}

package/src/worker/oauth-state.ts

@@ -1,7 +1,7 @@
 import { normalizeAccountRole, type AccountRole } from "./access.ts";
 
 const OAUTH_STORE_SCHEMA_VERSION = 1;
-const OAUTH_REFRESH_STORE_SCHEMA_VERSION = 1;
+const OAUTH_REFRESH_STORE_SCHEMA_VERSION = 2;
 export const OFFLINE_ACCESS_SCOPE = "offline_access";
 const PASSWORD_TOKEN_PATTERN = /^[a-z][a-z0-9_]{2,31}_[A-Za-z0-9_-]{43}$/;
 const ACCOUNT_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]{1,62}[a-z0-9]$/;
@@ -51,13 +51,31 @@ export interface OAuthToken {
   resource: string;
   version: string;
   expires_at: number;
+  family_id?: string;
 }
 
-export type OAuthRefreshToken = OAuthToken;
+export interface OAuthRefreshToken extends OAuthToken {
+  family_id: string;
+  family_expires_at: number;
+  issued_at: number;
+}
+
+export interface ConsumedOAuthRefreshToken {
+  family_id: string;
+  consumed_at: number;
+  expires_at: number;
+}
+
+export interface RevokedOAuthRefreshFamily {
+  expires_at: number;
+  reason: "replay";
+}
 
 export interface OAuthRefreshStore {
   schema_version: number;
   tokens: Record<string, OAuthRefreshToken>;
+  consumed: Record<string, ConsumedOAuthRefreshToken>;
+  revoked_families: Record<string, RevokedOAuthRefreshFamily>;
 }
 
 export interface OAuthFailure {
@@ -105,6 +123,8 @@ export function emptyOAuthRefreshStore(): OAuthRefreshStore {
   return {
     schema_version: OAUTH_REFRESH_STORE_SCHEMA_VERSION,
     tokens: {},
+    consumed: {},
+    revoked_families: {},
   };
 }
 
@@ -122,7 +142,32 @@ export function isCurrentOAuthStore(value: unknown): value is OAuthStore {
 export function isCurrentOAuthRefreshStore(value: unknown): value is OAuthRefreshStore {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const store = value as Partial<OAuthRefreshStore>;
-  return store.schema_version === OAUTH_REFRESH_STORE_SCHEMA_VERSION && isRecord(store.tokens);
+  return store.schema_version === OAUTH_REFRESH_STORE_SCHEMA_VERSION
+    && isRecord(store.tokens)
+    && isRecord(store.consumed)
+    && isRecord(store.revoked_families);
+}
+
+export function upgradeOAuthRefreshStore(value: unknown): OAuthRefreshStore | null {
+  if (isCurrentOAuthRefreshStore(value)) return value;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const legacy = value as { schema_version?: unknown; tokens?: unknown };
+  if (legacy.schema_version !== 1 || !isRecord(legacy.tokens)) return null;
+  const upgraded = emptyOAuthRefreshStore();
+  const now = Math.floor(Date.now() / 1000);
+  for (const [key, raw] of Object.entries(legacy.tokens)) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const token = raw as OAuthToken;
+    if (!Number.isSafeInteger(token.expires_at) || token.expires_at <= now) continue;
+    const familyId = randomToken("mcp_family");
+    upgraded.tokens[key] = {
+      ...token,
+      family_id: familyId,
+      family_expires_at: token.expires_at,
+      issued_at: now,
+    };
+  }
+  return upgraded;
 }
 
 export function normalizeOAuthScope(value: unknown, serverName: string): string | null {

package/src/worker/oauth-tokens.ts

@@ -1,18 +1,19 @@
 import {
-  emptyOAuthRefreshStore, isCurrentOAuthRefreshStore, normalizeOAuthScope, pkceS256,
-  pruneClientRecordByExpiry, pruneRecordByExpiry, randomToken, safeEqual, sha256Hex,
+  normalizeOAuthScope, pkceS256, pruneClientRecordByExpiry, pruneRecordByExpiry,
+  randomToken, safeEqual, sha256Hex,
   type OAuthCode, type OAuthRefreshStore, type OAuthRefreshToken, type OAuthStore,
 } from "./oauth-state.ts";
 import { HttpError, json, parseRequestBody } from "./http.ts";
+import { loadOAuthRefreshStore, OAUTH_REFRESH_STORE_KEY, recordConsumedRefreshToken, revokeOAuthRefreshFamily } from "./oauth-refresh-families.ts";
 
-const ACCESS_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30;
-const REFRESH_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 90;
+const ACCESS_TOKEN_TTL_SECONDS = 15 * 60;
+const REFRESH_TOKEN_IDLE_TTL_SECONDS = 60 * 60 * 24 * 14;
+const REFRESH_TOKEN_FAMILY_TTL_SECONDS = 60 * 60 * 24 * 30;
 const OAUTH_BODY_LIMIT_BYTES = 64 * 1024;
 const MAX_ACCESS_TOKENS = 500;
 const MAX_ACCESS_TOKENS_PER_CLIENT = 20;
 const MAX_REFRESH_TOKENS = 500;
 const MAX_REFRESH_TOKENS_PER_CLIENT = 20;
-const OAUTH_REFRESH_STORE_KEY = "oauth-refresh";
 
 type OAuthLock = <T>(callback: () => Promise<T>) => Promise<T>;
 
@@ -53,7 +54,7 @@ async function exchangeAuthorizationCode(
   }
   return options.withLock(async () => {
     const oauthStore = await options.loadOAuthStore();
-    const refreshStore = await loadRefreshStore(oauthStore, options);
+    const refreshStore = await loadOAuthRefreshStore(oauthStore, options.storage);
     const record = oauthStore.codes[code];
     if (!record) return json({ error: "invalid_grant" }, 400);
     if (String(body.client_id ?? "") !== record.client_id || String(body.redirect_uri ?? "") !== record.redirect_uri) {
@@ -85,10 +86,22 @@ async function exchangeRefreshToken(
   if (!/^mcp_rt_[A-Za-z0-9_-]{43}$/.test(refreshToken)) return json({ error: "invalid_grant" }, 400);
   return options.withLock(async () => {
     const oauthStore = await options.loadOAuthStore();
-    const refreshStore = await loadRefreshStore(oauthStore, options);
+    const refreshStore = await loadOAuthRefreshStore(oauthStore, options.storage);
     const refreshKey = `sha256:${await sha256Hex(refreshToken)}`;
     const record = refreshStore.tokens[refreshKey];
-    if (!record) return json({ error: "invalid_grant" }, 400);
+    if (!record) {
+      const consumed = refreshStore.consumed[refreshKey];
+      if (consumed && consumed.expires_at > Math.floor(Date.now() / 1000)) {
+        revokeOAuthRefreshFamily(oauthStore, refreshStore, consumed.family_id, consumed.expires_at);
+        await saveOAuthStores(oauthStore, refreshStore, options.storage);
+      }
+      return json({ error: "invalid_grant" }, 400);
+    }
+    if (refreshStore.revoked_families[record.family_id]) {
+      delete refreshStore.tokens[refreshKey];
+      await options.storage.put(OAUTH_REFRESH_STORE_KEY, refreshStore);
+      return json({ error: "invalid_grant" }, 400);
+    }
     if (String(body.client_id ?? "") !== record.client_id) {
       return json({ error: "invalid_grant", error_description: "client mismatch" }, 400);
     }
@@ -117,44 +130,31 @@ async function exchangeRefreshToken(
       return json({ error: "invalid_grant" }, 400);
     }
 
-    const issued = await issueTokenPair(oauthStore, refreshStore, record, options.tokenVersion);
+    let issued: IssuedTokenPair;
+    try {
+      issued = await issueTokenPair(oauthStore, refreshStore, record, options.tokenVersion);
+    } catch (error) {
+      if (error instanceof HttpError && error.code === "invalid_grant") {
+        delete refreshStore.tokens[refreshKey];
+        await options.storage.put(OAUTH_REFRESH_STORE_KEY, refreshStore);
+        return json({ error: "invalid_grant" }, 400);
+      }
+      throw error;
+    }
     delete refreshStore.tokens[refreshKey];
+    recordConsumedRefreshToken(
+      refreshStore,
+      refreshKey,
+      record.family_id,
+      record.family_expires_at,
+      Math.floor(Date.now() / 1000),
+    );
     client.last_used_at = Math.floor(Date.now() / 1000);
     await saveOAuthStores(oauthStore, refreshStore, options.storage);
     return tokenResponse(issued, record.scope);
   });
 }
 
-async function loadRefreshStore(
-  oauthStore: OAuthStore,
-  options: OAuthTokenExchangeOptions,
-): Promise<OAuthRefreshStore> {
-  const raw = await options.storage.get<unknown>(OAUTH_REFRESH_STORE_KEY);
-  if (raw !== undefined && !isCurrentOAuthRefreshStore(raw)) {
-    throw new HttpError(503, "oauth_refresh_state_schema_mismatch", "OAuth refresh-token state requires operator repair");
-  }
-  const store = isCurrentOAuthRefreshStore(raw) ? raw : emptyOAuthRefreshStore();
-  let changed = false;
-  const now = Math.floor(Date.now() / 1000);
-  for (const [token, value] of Object.entries(store.tokens)) {
-    const account = oauthStore.accounts[value.account_id];
-    const client = oauthStore.clients[value.client_id];
-    if (
-      value.expires_at <= now
-      || !account
-      || !account.active
-      || account.version !== value.account_version
-      || account.role !== value.role
-      || !client
-    ) {
-      delete store.tokens[token];
-      changed = true;
-    }
-  }
-  if (changed) await options.storage.put(OAUTH_REFRESH_STORE_KEY, store);
-  return store;
-}
-
 async function issueTokenPair(
   oauthStore: OAuthStore,
   refreshStore: OAuthRefreshStore,
@@ -163,6 +163,11 @@ async function issueTokenPair(
 ): Promise<IssuedTokenPair> {
   if (!tokenVersion) throw new HttpError(503, "server_error", "OAuth token version is not configured");
   const now = Math.floor(Date.now() / 1000);
+  const familyId = "family_id" in source && source.family_id ? source.family_id : randomToken("mcp_family");
+  const familyExpiresAt = "family_expires_at" in source && source.family_expires_at
+    ? source.family_expires_at
+    : now + REFRESH_TOKEN_FAMILY_TTL_SECONDS;
+  if (familyExpiresAt <= now) throw new HttpError(400, "invalid_grant", "refresh-token family expired");
   const accessToken = randomToken("mcp_at");
   const refreshToken = randomToken("mcp_rt");
   const common = {
@@ -173,6 +178,7 @@ async function issueTokenPair(
     scope: source.scope,
     resource: source.resource,
     version: tokenVersion,
+    family_id: familyId,
   };
   oauthStore.tokens[`sha256:${await sha256Hex(accessToken)}`] = {
     ...common,
@@ -180,7 +186,10 @@ async function issueTokenPair(
   };
   refreshStore.tokens[`sha256:${await sha256Hex(refreshToken)}`] = {
     ...common,
-    expires_at: now + REFRESH_TOKEN_TTL_SECONDS,
+    family_id: familyId,
+    family_expires_at: familyExpiresAt,
+    issued_at: now,
+    expires_at: Math.min(now + REFRESH_TOKEN_IDLE_TTL_SECONDS, familyExpiresAt),
   };
   pruneClientRecordByExpiry(oauthStore.tokens, source.client_id, MAX_ACCESS_TOKENS_PER_CLIENT);
   pruneRecordByExpiry(oauthStore.tokens, MAX_ACCESS_TOKENS);