najm-auth 1.1.39 → 1.1.41

package/dist/index.js

@@ -67,9 +67,9 @@ var permissionsTable = pgTable("permissions", {
 });
 var tokensTable = pgTable("tokens", {
   ...baseFields(10),
-  userId: text("user_id").references(() => usersTable.id, { onDelete: "cascade" }).unique().notNull(),
+  userId: text("user_id").references(() => usersTable.id, { onDelete: "cascade" }).notNull(),
   token: text("token").notNull(),
-  tokenFamily: text("token_family"),
+  tokenFamily: text("token_family").notNull().unique(),
   previousHash: text("previous_hash"),
   previousValidUntil: timestamp("previous_valid_until", { mode: "string" }),
   previousUsedAt: timestamp("previous_used_at", { mode: "string" }),
@@ -77,6 +77,7 @@ var tokensTable = pgTable("tokens", {
   status: tokenStatusEnum("status").default("active"),
   expiresAt: timestamp("expires_at", { mode: "string" }).notNull()
 }, (table) => ({
+  userIdIdx: index("tokens_user_id_idx").on(table.userId),
   expiresAtIdx: index("tokens_expires_at_idx").on(table.expiresAt)
 }));
 var rolePermissionsTable = pgTable("role_permissions", {
@@ -134,9 +135,9 @@ var permissionsTable2 = sqliteTable("permissions", {
 });
 var tokensTable2 = sqliteTable("tokens", {
   ...baseFields2(10),
-  userId: text2("user_id").references(() => usersTable2.id, { onDelete: "cascade" }).unique().notNull(),
+  userId: text2("user_id").references(() => usersTable2.id, { onDelete: "cascade" }).notNull(),
   token: text2("token").notNull(),
-  tokenFamily: text2("token_family"),
+  tokenFamily: text2("token_family").notNull().unique(),
   previousHash: text2("previous_hash"),
   previousValidUntil: text2("previous_valid_until"),
   previousUsedAt: text2("previous_used_at"),
@@ -144,6 +145,7 @@ var tokensTable2 = sqliteTable("tokens", {
   status: text2("status").$type().default("active"),
   expiresAt: text2("expires_at").notNull()
 }, (table) => ({
+  userIdIdx: index2("tokens_user_id_idx").on(table.userId),
   expiresAtIdx: index2("tokens_expires_at_idx").on(table.expiresAt)
 }));
 var rolePermissionsTable2 = sqliteTable("role_permissions", {
@@ -161,87 +163,6 @@ var authSchema2 = {
   rolePermissions: rolePermissionsTable2
 };
 
-// src/schema/mysql.ts
-import { mysqlTable, varchar, boolean as boolean2, timestamp as timestamp2, mysqlEnum, primaryKey as primaryKey2, int, index as index3 } from "drizzle-orm/mysql-core";
-import { sql as sql3 } from "drizzle-orm";
-import { nanoid as nanoid3 } from "nanoid";
-var baseFields3 = /* @__PURE__ */ __name((idLength = 5) => ({
-  id: varchar("id", { length: 21 }).primaryKey().$defaultFn(() => nanoid3(idLength)),
-  createdAt: timestamp2("created_at", { mode: "string" }).defaultNow(),
-  updatedAt: timestamp2("updated_at", { mode: "string" }).defaultNow().$onUpdate(() => sql3`CURRENT_TIMESTAMP`)
-}), "baseFields");
-var rolesTable3 = mysqlTable("roles", {
-  ...baseFields3(5),
-  name: varchar("name", { length: 255 }).notNull(),
-  description: varchar("description", { length: 1e3 })
-});
-var usersTable3 = mysqlTable("users", {
-  ...baseFields3(8),
-  name: varchar("name", { length: 255 }),
-  email: varchar("email", { length: 255 }).notNull().unique(),
-  emailVerified: boolean2("email_verified").default(false),
-  phone: varchar("phone", { length: 255 }).unique(),
-  phoneVerified: boolean2("phone_verified").default(false),
-  password: varchar("password", { length: 255 }).notNull(),
-  image: varchar("image", { length: 255 }).default("noavatar.png"),
-  status: mysqlEnum("status", [...USER_STATUS]).default("pending"),
-  roleId: varchar("role_id", { length: 21 }).references(() => rolesTable3.id),
-  lastLogin: timestamp2("last_login", { mode: "string" }),
-  failedLoginAttempts: int("failed_login_attempts").default(0),
-  lockoutUntil: timestamp2("lockout_until", { mode: "string" })
-}, (table) => ({
-  roleIdx: index3("users_role_id_idx").on(table.roleId)
-}));
-var permissionsTable3 = mysqlTable("permissions", {
-  ...baseFields3(5),
-  name: varchar("name", { length: 255 }).notNull().unique(),
-  description: varchar("description", { length: 1e3 }),
-  resource: varchar("resource", { length: 255 }).notNull(),
-  action: varchar("action", { length: 255 }).notNull()
-});
-var tokensTable3 = mysqlTable("tokens", {
-  ...baseFields3(10),
-  userId: varchar("user_id", { length: 21 }).references(() => usersTable3.id, { onDelete: "cascade" }).unique().notNull(),
-  token: varchar("token", { length: 500 }).notNull(),
-  tokenFamily: varchar("token_family", { length: 16 }),
-  previousHash: varchar("previous_hash", { length: 500 }),
-  previousValidUntil: timestamp2("previous_valid_until", { mode: "string" }),
-  previousUsedAt: timestamp2("previous_used_at", { mode: "string" }),
-  type: mysqlEnum("type", [...TOKEN_TYPE]).default("refresh"),
-  status: mysqlEnum("status", [...TOKEN_STATUS]).default("active"),
-  expiresAt: timestamp2("expires_at", { mode: "string" }).notNull()
-}, (table) => ({
-  expiresAtIdx: index3("tokens_expires_at_idx").on(table.expiresAt)
-}));
-var rolePermissionsTable3 = mysqlTable("role_permissions", {
-  roleId: varchar("role_id", { length: 21 }).notNull().references(() => rolesTable3.id, { onDelete: "cascade" }),
-  permissionId: varchar("permission_id", { length: 21 }).notNull().references(() => permissionsTable3.id, { onDelete: "cascade" }),
-  createdAt: timestamp2("created_at", { mode: "string" }).defaultNow()
-}, (table) => ({
-  pk: primaryKey2({ columns: [table.roleId, table.permissionId] })
-}));
-var authSchema3 = {
-  users: usersTable3,
-  tokens: tokensTable3,
-  roles: rolesTable3,
-  permissions: permissionsTable3,
-  rolePermissions: rolePermissionsTable3
-};
-
-// src/auth/index.ts
-var auth_exports = {};
-__export(auth_exports, {
-  AUTH_MODULE: () => AUTH_MODULE,
-  AuthController: () => AuthController,
-  AuthGuard: () => AuthGuard,
-  AuthResolver: () => AuthResolver,
-  AuthService: () => AuthService,
-  CookieManager: () => CookieManager,
-  EncryptionService: () => EncryptionService,
-  isAuth: () => isAuth,
-  runAsUser: () => runAsUser
-});
-
 // src/auth/EncryptionService.ts
 import { Inject, Injectable } from "najm-core";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
@@ -469,7 +390,7 @@ import { I18nService } from "najm-i18n";
 import { I18n as I18n3 } from "najm-i18n";
 
 // src/users/UserRepository.ts
-import { eq as eq2, ne, sql as sql4 } from "drizzle-orm";
+import { eq as eq2, ne, sql as sql3 } from "drizzle-orm";
 import { Repository, Inject as Inject3 } from "najm-core";
 import { DB } from "najm-database";
 
@@ -639,7 +560,7 @@ var UserRepository = class UserRepository2 {
     return updatedUser;
   }
   async incrementFailedAttempts(id) {
-    const [updatedUser] = await this.db.update(this.users).set({ failedLoginAttempts: sql4`coalesce(${this.users.failedLoginAttempts}, 0) + 1` }).where(eq2(this.users.id, id)).returning();
+    const [updatedUser] = await this.db.update(this.users).set({ failedLoginAttempts: sql3`coalesce(${this.users.failedLoginAttempts}, 0) + 1` }).where(eq2(this.users.id, id)).returning();
     return updatedUser;
   }
   async resetFailedAttempts(id) {
@@ -1044,7 +965,7 @@ RoleService = __decorate7([
 ], RoleService);
 
 // src/users/UserService.ts
-import { nanoid as nanoid4 } from "nanoid";
+import { nanoid as nanoid3 } from "nanoid";
 
 // src/shared/index.ts
 import * as fs from "fs/promises";
@@ -1254,7 +1175,7 @@ var UserService = class UserService2 {
       Err4("Password is required");
     }
     this.userValidator.validatePasswordStrength(password);
-    let userId = id || nanoid4(10);
+    let userId = id || nanoid3(10);
     await this.userValidator.checkEmailUnique(data.email);
     await this.userValidator.checkUserIdIsUnique(userId);
     const hashedPassword = await this.encryptionService.hashPassword(password);
@@ -1336,7 +1257,7 @@ var UserService = class UserService2 {
       await this.delete(existingUser.id);
     }
     const newAdminUser = await this.create({
-      id: nanoid4(10),
+      id: nanoid3(10),
       // Random ID instead of predictable 'USR00'
       name: config.name || "System Administrator",
       email: config.email,
@@ -1378,10 +1299,10 @@ import { I18n as I18n4 } from "najm-i18n";
 import { CacheService } from "najm-cache";
 import { createHash } from "crypto";
 import jwt from "jsonwebtoken";
-import { nanoid as nanoid5 } from "nanoid";
+import { nanoid as nanoid4 } from "nanoid";
 
 // src/tokens/TokenRepository.ts
-import { and, eq as eq4, isNull } from "drizzle-orm";
+import { and, eq as eq4, isNull, lt } from "drizzle-orm";
 import { Repository as Repository3, Inject as Inject6 } from "najm-core";
 import { DB as DB3 } from "najm-database";
 var __decorate9 = function(decorators, target, key, desc) {
@@ -1410,12 +1331,17 @@ var TokenRepository = class TokenRepository2 {
   get q() {
     return this.queryHelper ??= new AuthQueries(this.db, this.schema);
   }
+  /**
+   * Upsert the refresh-token row for a session, keyed on `tokenFamily` (the
+   * per-login session identifier, unique). A brand-new login inserts a fresh
+   * family row; a refresh rotation updates only that family's row, leaving the
+   * user's other sessions untouched.
+   */
   async storeRefreshToken(tokenData) {
     return await this.db.insert(this.tokens).values(tokenData).onConflictDoUpdate({
-      target: this.tokens.userId,
+      target: this.tokens.tokenFamily,
       set: {
         token: tokenData.token,
-        tokenFamily: tokenData.tokenFamily,
         expiresAt: tokenData.expiresAt,
         previousHash: tokenData.previousHash ?? null,
         previousValidUntil: tokenData.previousValidUntil ?? null,
@@ -1424,27 +1350,37 @@ var TokenRepository = class TokenRepository2 {
     }).returning();
   }
   /**
-   * Claim the previous-token grace slot. Conditional on BOTH the stored
-   * previousHash still matching the presented token AND previousUsedAt being
-   * NULL. Gating on the hash (not just the flag) closes the rotation race: the
-   * winner's rotation rewrites previousHash via storeRefreshToken, so a loser
-   * whose UPDATE lands after that rotation no longer matches and gets zero
-   * rows — exactly one caller ever claims the slot.
+   * Claim the previous-token grace slot for a single family. Conditional on
+   * BOTH the stored previousHash still matching the presented token AND
+   * previousUsedAt being NULL. Gating on the hash (not just the flag) closes
+   * the rotation race: the winner's rotation rewrites previousHash via
+   * storeRefreshToken (and resets previousUsedAt to NULL), so a loser whose
+   * UPDATE lands after that rotation no longer matches and gets zero rows —
+   * exactly one caller ever claims the slot.
    */
-  async markPreviousUsed(userId, previousHash) {
-    return await this.db.update(this.tokens).set({ previousUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and(eq4(this.tokens.userId, userId), eq4(this.tokens.previousHash, previousHash), isNull(this.tokens.previousUsedAt))).returning();
+  async markPreviousUsed(tokenFamily, previousHash) {
+    return await this.db.update(this.tokens).set({ previousUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.previousHash, previousHash), isNull(this.tokens.previousUsedAt))).returning();
   }
-  async getRefreshTokenWithFamily(userId) {
-    const [token] = await this.db.select().from(this.tokens).where(eq4(this.tokens.userId, userId));
+  /** Look up a single session's token row by its family identifier. */
+  async getByFamily(tokenFamily) {
+    const [token] = await this.db.select().from(this.tokens).where(eq4(this.tokens.tokenFamily, tokenFamily));
     return token ?? null;
   }
-  async revokeToken(userId) {
-    const [deletedToken] = await this.db.delete(this.tokens).where(eq4(this.tokens.userId, userId)).returning();
-    return deletedToken;
-  }
-  async revokeByFamily(tokenFamily) {
+  /** Revoke a single session (one family). */
+  async revokeFamily(tokenFamily) {
     return this.db.delete(this.tokens).where(eq4(this.tokens.tokenFamily, tokenFamily)).returning();
   }
+  /** Revoke every session for a user (password change/reset, logout-all). */
+  async revokeAllForUser(userId) {
+    return this.db.delete(this.tokens).where(eq4(this.tokens.userId, userId)).returning();
+  }
+  /**
+   * Opportunistic cleanup: with one row per family (no unique userId), expired
+   * and abandoned sessions accumulate. Delete every expired row.
+   */
+  async deleteExpired() {
+    return this.db.delete(this.tokens).where(lt(this.tokens.expiresAt, (/* @__PURE__ */ new Date()).toISOString())).returning();
+  }
   async isUserExists(userId) {
     const [user] = await this.db.select({ id: this.users.id }).from(this.users).where(eq4(this.users.id, userId)).limit(1);
     return !!user;
@@ -1559,19 +1495,22 @@ var TokenService = class TokenService2 {
       Err5(this.t("errors.tokenVerificationFailed"));
     }
     const sessionKey = this.sessionVersionKey(payload.userId);
-    let activeSessionVersion;
-    if (payload.jti) {
-      const [blacklisted, sessionVersion] = await this.getCacheValues([
-        `${this.blacklistPrefix}${payload.jti}`,
-        sessionKey
-      ]);
-      if (blacklisted !== null) {
-        Err5(this.t("errors.tokenRevoked"));
-      }
-      activeSessionVersion = this.parseSessionVersion(sessionVersion);
-    } else {
-      activeSessionVersion = this.parseSessionVersion(await this.cache.get(sessionKey));
+    const blacklistKey = payload.jti ? `${this.blacklistPrefix}${payload.jti}` : null;
+    const familyKey = payload.tokenFamily ? this.revokedFamilyKey(payload.tokenFamily) : null;
+    const keys = [
+      ...blacklistKey ? [blacklistKey] : [],
+      sessionKey,
+      ...familyKey ? [familyKey] : []
+    ];
+    const values = await this.getCacheValues(keys);
+    const valueByKey = new Map(keys.map((key, i) => [key, values[i]]));
+    if (blacklistKey && valueByKey.get(blacklistKey) != null) {
+      Err5(this.t("errors.tokenRevoked"));
+    }
+    if (familyKey && valueByKey.get(familyKey) != null) {
+      Err5(this.t("errors.tokenRevoked"));
     }
+    const activeSessionVersion = this.parseSessionVersion(valueByKey.get(sessionKey) ?? null);
     const tokenSessionVersion = payload.sessionVersion ?? 0;
     if (tokenSessionVersion !== activeSessionVersion) {
       Err5(this.t("errors.tokenRevoked"));
@@ -1579,15 +1518,19 @@ var TokenService = class TokenService2 {
     return payload;
   }
   verifyRefreshToken(token) {
+    let decoded;
     try {
-      const decoded = jwt.verify(token, this.config.jwt.refreshSecret);
-      if (decoded.type && decoded.type !== "refresh") {
-        Err5(this.t("errors.tokenVerificationFailed"));
-      }
-      return decoded.userId;
+      decoded = jwt.verify(token, this.config.jwt.refreshSecret);
     } catch {
       Err5(this.t("errors.tokenVerificationFailed"));
     }
+    if (decoded.type && decoded.type !== "refresh") {
+      Err5(this.t("errors.tokenVerificationFailed"));
+    }
+    if (!decoded.tokenFamily) {
+      Err5(this.t("errors.tokenVerificationFailed"));
+    }
+    return { userId: decoded.userId, tokenFamily: decoded.tokenFamily };
   }
   static PREVIOUS_GRACE_SECONDS = 120;
   /**
@@ -1606,9 +1549,9 @@ var TokenService = class TokenService2 {
     if (!refreshToken) {
       Err5(this.t("errors.refreshTokenMissing"));
     }
-    const userId = this.verifyRefreshToken(refreshToken);
-    const stored = await this.tokenRepository.getRefreshTokenWithFamily(userId);
-    if (!stored) {
+    const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
+    const stored = await this.tokenRepository.getByFamily(tokenFamily);
+    if (!stored || stored.userId !== userId) {
       Err5(this.t("errors.refreshTokenInvalid"));
     }
     const presentedHash = this.hashToken(refreshToken);
@@ -1653,7 +1596,7 @@ var TokenService = class TokenService2 {
     return jwt.decode(token);
   }
   async signAccessToken(data) {
-    const jti = nanoid5(16);
+    const jti = nanoid4(16);
     const sessionVersion = await this.getUserSessionVersion(data.userId);
     const expiresAt = this.expiresAt(this.config.jwt.accessExpiresIn);
     if (sessionVersion > 0) {
@@ -1670,30 +1613,33 @@ var TokenService = class TokenService2 {
     return (await this.signAccessToken(data)).token;
   }
   /**
-   * Generate refresh token with unique jti
+   * Generate refresh token with unique jti. The token carries its session's
+   * family so rotation/revocation can target a single session.
    */
   signRefreshToken(data) {
-    const jti = nanoid5(16);
+    const jti = nanoid4(16);
     const expiresAt = this.expiresAt(this.config.jwt.refreshExpiresIn);
     const token = jwt.sign({ ...data, jti, type: "refresh", exp: expiresAt }, this.config.jwt.refreshSecret);
     return { token, expiresAt };
   }
   generateRefreshToken(data) {
-    return this.signRefreshToken(data).token;
+    return this.signRefreshToken({ userId: data.userId, tokenFamily: data.tokenFamily ?? nanoid4(16) }).token;
   }
   async generateTokens(userId, tokenFamily) {
-    const family = tokenFamily ?? nanoid5(16);
+    const family = tokenFamily ?? nanoid4(16);
     const { roleName, permissions } = await this.tokenRepository.getRoleAndPermissions(userId);
     const accessTokenData = {
       userId,
       roles: roleName ? [roleName] : [],
-      permissions: permissions ?? []
+      permissions: permissions ?? [],
+      tokenFamily: family
     };
     const access = await this.signAccessToken(accessTokenData);
-    const refresh = this.signRefreshToken({ userId });
+    const refresh = this.signRefreshToken({ userId, tokenFamily: family });
     await this.storeRefreshToken(userId, refresh.token, family);
     return {
       userId,
+      tokenFamily: family,
       roles: accessTokenData.roles,
       permissions: accessTokenData.permissions,
       accessToken: access.token,
@@ -1743,7 +1689,7 @@ var TokenService = class TokenService2 {
   async storeRefreshToken(userId, refreshToken, tokenFamily) {
     const expireInSecond = timestring2(this.config.jwt.refreshExpiresIn, "s");
     const hashedToken = this.hashToken(refreshToken);
-    const existing = await this.tokenRepository.getRefreshTokenWithFamily(userId);
+    const existing = await this.tokenRepository.getByFamily(tokenFamily);
     const previousHash = existing?.token ?? null;
     const previousValidUntil = previousHash ? new Date(Date.now() + TokenService_1.PREVIOUS_GRACE_SECONDS * 1e3).toISOString() : null;
     await this.tokenRepository.storeRefreshToken({
@@ -1765,28 +1711,45 @@ var TokenService = class TokenService2 {
     if (!refreshToken) {
       Err5(this.t("errors.refreshTokenMissing"));
     }
-    const userId = this.verifyRefreshToken(refreshToken);
-    const stored = await this.tokenRepository.getRefreshTokenWithFamily(userId);
-    if (!stored) {
+    const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
+    const stored = await this.tokenRepository.getByFamily(tokenFamily);
+    if (!stored || stored.userId !== userId) {
       Err5(this.t("errors.refreshTokenInvalid"));
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
-      return this.generateTokens(userId, stored.tokenFamily ?? void 0);
+      return this.generateTokens(userId, tokenFamily);
     }
     const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
     if (canRecover) {
-      const claimed = await this.tokenRepository.markPreviousUsed(userId, presentedHash);
+      const claimed = await this.tokenRepository.markPreviousUsed(tokenFamily, presentedHash);
       if (!claimed?.length) {
         Err5(this.t("errors.refreshTokenInvalid"));
       }
-      return this.generateTokens(userId, stored.tokenFamily ?? void 0);
+      return this.generateTokens(userId, tokenFamily);
     }
-    await this.revokeSuspectRefreshFamily(userId, stored.tokenFamily ?? null);
+    await this.revokeSuspectRefreshFamily(userId, tokenFamily);
     Err5(this.t("errors.refreshTokenInvalid"));
   }
-  async revokeToken(userId) {
-    return this.tokenRepository.revokeToken(userId);
+  /** Revoke every refresh session for a user (password change/reset, logout-all). */
+  async revokeAllForUser(userId) {
+    return this.tokenRepository.revokeAllForUser(userId);
+  }
+  /** Revoke a single refresh session (one family). */
+  async revokeFamily(tokenFamily) {
+    await this.markFamilyRevoked(tokenFamily);
+    return this.tokenRepository.revokeFamily(tokenFamily);
+  }
+  /**
+   * Opportunistic cleanup of expired/abandoned sessions. With one row per
+   * family (no unique userId), abandoned logins would otherwise accumulate.
+   * Best-effort — never let cleanup failure break the calling flow.
+   */
+  async deleteExpiredSessions() {
+    try {
+      await this.tokenRepository.deleteExpired();
+    } catch {
+    }
   }
   async invalidateUserAccessTokens(userId) {
     const nextVersion = await this.getUserSessionVersion(userId) + 1;
@@ -1802,27 +1765,99 @@ var TokenService = class TokenService2 {
     }
     return user;
   }
+  get revokedFamilyPrefix() {
+    return "auth:revoked-family:";
+  }
+  revokedFamilyKey(tokenFamily) {
+    return `${this.revokedFamilyPrefix}${tokenFamily}`;
+  }
+  /**
+   * Mark a family as revoked in cache for the access-token TTL, so every
+   * access token minted for that family (not just the presented one) is
+   * rejected by verifyAccessToken until it would have expired anyway.
+   */
+  async markFamilyRevoked(tokenFamily) {
+    await this.cache.set(this.revokedFamilyKey(tokenFamily), "1", this.accessTokenTtlMs());
+  }
+  /**
+   * Revoke only the suspect family — NOT the whole user. Bumping the global
+   * per-user session version here would kill every device's access tokens on a
+   * single family's reuse detection. Instead drop the family's refresh row and
+   * mark the family revoked so its access tokens stop verifying.
+   */
   async revokeSuspectRefreshFamily(userId, tokenFamily) {
-    await this.invalidateUserAccessTokens(userId);
     if (tokenFamily) {
-      await this.tokenRepository.revokeByFamily(tokenFamily);
+      await this.revokeFamily(tokenFamily);
       return;
     }
-    await this.revokeToken(userId);
+    await this.invalidateUserAccessTokens(userId);
+    await this.revokeAllForUser(userId);
   }
   /**
-   * Logout user - blacklist access token and revoke refresh token
+   * Logout the CURRENT session only — blacklist the presented access token,
+   * mark its family revoked, and delete that family's refresh row. Other
+   * devices/sessions for the same user keep working. Use a password change or
+   * reset (revoke-all) to terminate every session.
+   *
+   * The family is resolved from, in order: a verified Bearer access token's
+   * `tokenFamily` claim, then a verified refresh cookie whose hash still
+   * matches the current family row. If neither is available, fall back to
+   * revoke-all.
    */
   async logout(userId, authorization) {
+    let tokenFamily = null;
     if (authorization) {
+      let accessToken = null;
       try {
-        const accessToken = this.extractAccessToken(authorization);
-        await this.blacklistCurrentToken(accessToken);
+        accessToken = this.extractAccessToken(authorization);
       } catch {
       }
+      if (accessToken) {
+        try {
+          const decoded = await this.verifyAccessToken(accessToken);
+          if (decoded.userId === userId && decoded.tokenFamily) {
+            tokenFamily = decoded.tokenFamily;
+          }
+        } catch {
+        }
+        await this.blacklistCurrentToken(accessToken);
+      }
+    }
+    if (!tokenFamily) {
+      tokenFamily = await this.resolveRefreshCookieFamily(userId);
+    }
+    if (tokenFamily) {
+      await this.revokeFamily(tokenFamily);
+      return;
     }
     await this.invalidateUserAccessTokens(userId);
-    await this.revokeToken(userId);
+    await this.revokeAllForUser(userId);
+  }
+  /**
+   * Resolve a logout target from the refresh cookie only if the cookie maps to
+   * the user's current/valid family row. This mirrors resolveUserFromCookie()
+   * without throwing, because logout can still fall back to revoke-all.
+   */
+  async resolveRefreshCookieFamily(userId) {
+    const refreshToken = this.cookieManager.getRefreshToken();
+    if (!refreshToken)
+      return null;
+    try {
+      const decoded = this.verifyRefreshToken(refreshToken);
+      if (decoded.userId !== userId)
+        return null;
+      const stored = await this.tokenRepository.getByFamily(decoded.tokenFamily);
+      if (!stored || stored.userId !== userId)
+        return null;
+      const presentedHash = this.hashToken(refreshToken);
+      if (presentedHash === stored.token) {
+        return decoded.tokenFamily;
+      }
+      const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
+      return canRecover ? decoded.tokenFamily : null;
+    } catch {
+      return null;
+    }
   }
   // ============ PASSWORD RESET TOKENS ============
   /**
@@ -1830,7 +1865,7 @@ var TokenService = class TokenService2 {
    * Returns both the plain token (to send via email) and userId for identification
    */
   async generateResetToken(userId) {
-    const jti = nanoid5(16);
+    const jti = nanoid4(16);
     const resetData = {
       userId,
       type: "reset",
@@ -1972,6 +2007,7 @@ var AuthService = class AuthService2 {
     if ((user.failedLoginAttempts ?? 0) > 0 || user.lockoutUntil) {
       await this.userService.resetFailedAttempts(user.id);
     }
+    await this.tokenService.deleteExpiredSessions();
     const generated = await this.tokenService.generateTokens(user.id);
     this.cookieManager.setRefreshToken(generated.refreshToken);
     await this.userService.updateLastLogin(user.id);
@@ -1982,7 +2018,7 @@ var AuthService = class AuthService2 {
       roles,
       permissions
     });
-    const { userId: _userId, roles: _roles, permissions: _permissions, ...tokens } = generated;
+    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, ...tokens } = generated;
     return { ...tokens, user: sanitized };
   }
   async refreshTokens() {
@@ -1996,7 +2032,7 @@ var AuthService = class AuthService2 {
         permissions: generated.permissions
       });
     }
-    const { userId: _userId, roles: _roles, permissions: _permissions, ...tokens } = generated;
+    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, ...tokens } = generated;
     return tokens;
   }
   async logoutUser(userId, authorization) {
@@ -2005,6 +2041,15 @@ var AuthService = class AuthService2 {
     this.cookieManager.clearSessionCookie();
     return { data: null, message: this.t("auth.success.logout") };
   }
+  /**
+   * Prune expired refresh sessions for every user. Login already prunes
+   * opportunistically; expose this so consumers can also run it from a
+   * scheduled job (cron / queue) to reclaim rows from users who never return.
+   * Best-effort — safe to call repeatedly.
+   */
+  async pruneExpiredSessions() {
+    await this.tokenService.deleteExpiredSessions();
+  }
   async getUserProfile(userData) {
     const lang = this.i18nService.getCurrentLanguage();
     return {
@@ -2077,7 +2122,7 @@ var AuthService = class AuthService2 {
     this.userValidator.validatePasswordStrength(newPassword);
     await this.userService.update(userId, { password: newPassword });
     await this.tokenService.invalidateUserAccessTokens(userId);
-    await this.tokenService.revokeToken(userId);
+    await this.tokenService.revokeAllForUser(userId);
     this.cookieManager.clearRefreshToken();
     this.cookieManager.clearSessionCookie();
     return { message: this.t("success.passwordChanged") };
@@ -2087,7 +2132,7 @@ var AuthService = class AuthService2 {
     this.userValidator.validatePasswordStrength(newPassword);
     await this.userService.update(userId, { password: newPassword });
     await this.tokenService.invalidateUserAccessTokens(userId);
-    await this.tokenService.revokeToken(userId);
+    await this.tokenService.revokeAllForUser(userId);
     this.cookieManager.clearRefreshToken();
     this.cookieManager.clearSessionCookie();
     return { message: this.t("success.passwordReset") };
@@ -3577,7 +3622,7 @@ var revokeTokenDto = z4.object({
 });
 
 // src/ownership/scopedOwnership.ts
-import { aliasedTable, eq as eq6, getTableColumns, sql as sql5 } from "drizzle-orm";
+import { aliasedTable, eq as eq6, getTableColumns, sql as sql4 } from "drizzle-orm";
 var DEFAULT_ADMIN_ROLES = ["admin"];
 var DRIZZLE_NAME = /* @__PURE__ */ Symbol.for("drizzle:Name");
 var DRIZZLE_BASE_NAME = /* @__PURE__ */ Symbol.for("drizzle:BaseName");
@@ -3714,7 +3759,7 @@ var OwnershipToken = class {
       return query;
     const rule = this._rules[role];
     if (!rule)
-      return query.where(sql5`1 = 0`);
+      return query.where(sql4`1 = 0`);
     const { query: q, condition } = rule(uid, query);
     return q.where(condition);
   }
@@ -3729,7 +3774,7 @@ var OwnershipToken = class {
       return { query, condition: null };
     const rule = this._rules[role];
     if (!rule)
-      return { query, condition: sql5`1 = 0` };
+      return { query, condition: sql4`1 = 0` };
     return rule(uid, query);
   }
 };
@@ -4088,7 +4133,7 @@ __name(Policy, "Policy");
 
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
-import { sql as sql6, and as and3 } from "drizzle-orm";
+import { sql as sql5, and as and3 } from "drizzle-orm";
 import { Injectable as Injectable12, Inject as Inject12, DI as DI2, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
 var __decorate24 = function(decorators, target, key, desc) {
@@ -4177,7 +4222,7 @@ function Owned(token) {
             return query;
           const user = getUser(this);
           if (!user)
-            return query.where(sql6`1 = 0`);
+            return query.where(sql5`1 = 0`);
           return token.applyScope(user.id, user.role, query);
         };
       },
@@ -4365,14 +4410,12 @@ var selectSchema = /* @__PURE__ */ __name((config) => {
   switch (dialect) {
     case "sqlite":
       return authSchema2;
-    case "mysql":
-      return authSchema3;
     case "pg":
     default:
       return authSchema;
   }
 }, "selectSchema");
-var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email()).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(auth_exports, users_exports, roles_exports, permissions_exports, tokens_exports, ScopeContext).config(AUTH_CONFIG, mergeConfig(config)).set(AUTH_SCHEMA, selectSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
+var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email()).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, ScopeContext).config(AUTH_CONFIG, mergeConfig(config)).set(AUTH_SCHEMA, selectSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
 
 // src/seed.ts
 var toSeedId = /* @__PURE__ */ __name((prefix, value) => {