najm-auth 1.1.19 → 1.1.20

package/dist/index.d.ts

@@ -683,8 +683,10 @@ declare class TokenService {
     validateRefreshSession(refreshToken: string): Promise<string>;
     /**
      * Read the refresh cookie and return the userId it belongs to.
-     * Validates against DB to ensure the session is still active.
-     * Throws if the cookie is missing, invalid, or revoked.
+     * Lightweight check: verifies JWT signature and ensures the user
+     * has an active session in the DB. Does NOT compare token hashes,
+     * so it is safe to call concurrently with token rotation.
+     * Throws if the cookie is missing, invalid, or the session was revoked.
      */
     resolveUserFromCookie(): Promise<string>;
     getUser(auth: string): Promise<any>;

package/dist/index.js

@@ -1408,24 +1408,28 @@ var TokenService = class TokenService2 {
     }
     const isValid = this.hashToken(refreshToken) === stored.token;
     if (!isValid) {
-      if (stored.tokenFamily) {
-        await this.tokenRepository.revokeByFamily(stored.tokenFamily);
-      }
       Err5(this.t("errors.refreshTokenInvalid"));
     }
     return userId;
   }
   /**
    * Read the refresh cookie and return the userId it belongs to.
-   * Validates against DB to ensure the session is still active.
-   * Throws if the cookie is missing, invalid, or revoked.
+   * Lightweight check: verifies JWT signature and ensures the user
+   * has an active session in the DB. Does NOT compare token hashes,
+   * so it is safe to call concurrently with token rotation.
+   * Throws if the cookie is missing, invalid, or the session was revoked.
    */
   async resolveUserFromCookie() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
       Err5(this.t("errors.refreshTokenMissing"));
     }
-    return this.validateRefreshSession(refreshToken);
+    const userId = this.verifyRefreshToken(refreshToken);
+    const stored = await this.tokenRepository.getRefreshTokenWithFamily(userId);
+    if (!stored) {
+      Err5(this.t("errors.refreshTokenInvalid"));
+    }
+    return userId;
   }
   // ============ USER RETRIEVAL (MAIN METHOD) ============
   async getUser(auth2) {
@@ -1552,9 +1556,6 @@ var TokenService = class TokenService2 {
     }
     const isValid = this.hashToken(refreshToken) === stored.token;
     if (!isValid) {
-      if (stored.tokenFamily) {
-        await this.tokenRepository.revokeByFamily(stored.tokenFamily);
-      }
       Err5(this.t("errors.refreshTokenInvalid"));
     }
     return this.generateTokens(userId, stored.tokenFamily ?? void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "1.1.19",
+  "version": "1.1.20",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [