najm-auth 3.1.1 → 3.1.3

package/dist/{NajmAuthClient-DqGucYXi.d.ts → NajmAuthClient-ZtXTIUSF.d.ts}

@@ -11,7 +11,15 @@ interface FetchClientConfig {
 }
 declare class FetchClient {
     private config;
+    private authenticatedRequests;
+    private authenticatedRequestsBlocked;
     constructor(config: FetchClientConfig);
+    /** Abort requests carrying the current session before logout invalidates it. */
+    abortAuthenticatedRequests(): void;
+    /** Block new authenticated traffic and abort anything already in flight. */
+    blockAuthenticatedRequests(): void;
+    /** Reopen authenticated traffic after login or authoritative hydration. */
+    allowAuthenticatedRequests(): void;
     get<T>(path: string, opts?: RequestOptions): Promise<T>;
     post<T>(path: string, opts?: RequestOptions): Promise<T>;
     put<T>(path: string, opts?: RequestOptions): Promise<T>;
@@ -37,8 +45,11 @@ declare class NajmAuthClient {
     private refreshTimer;
     private refreshCircuitTimer;
     private refreshPromise;
+    private refreshAbortController;
     private fetchUserPromise;
     private refreshFailures;
+    private authGeneration;
+    private refreshBlocked;
     private _hydrated;
     private listeners;
     private eventListeners;

package/dist/client/index.d.ts

@@ -1,4 +1,4 @@
-export { F as FetchClient, H as HydrateSession, N as NajmAuthClient, c as createAuthClient } from '../NajmAuthClient-DqGucYXi.js';
+export { F as FetchClient, H as HydrateSession, N as NajmAuthClient, c as createAuthClient } from '../NajmAuthClient-ZtXTIUSF.js';
 import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../types-BaSfgxqE.js';
 export { b as AuthClientConfig, h as AuthError, f as AuthEvent, g as AuthEventHandler, i as AuthEventMap, e as AuthState, A as AuthUser, j as AuthenticatedLogin, C as CredentialSetupPending, L as LoginCredentials, c as LoginResult, d as OAuthLoginOptions, O as OAuthProvider, a as RequestOptions, R as RetryConfig, k as ServerResponse, l as TokenPair } from '../types-BaSfgxqE.js';
 

package/dist/client/index.js

@@ -32,6 +32,24 @@ var FetchClient = class {
   static {
     __name(this, "FetchClient");
   }
+  authenticatedRequests = /* @__PURE__ */ new Set();
+  authenticatedRequestsBlocked = false;
+  /** Abort requests carrying the current session before logout invalidates it. */
+  abortAuthenticatedRequests() {
+    for (const controller of this.authenticatedRequests) {
+      controller.abort();
+    }
+    this.authenticatedRequests.clear();
+  }
+  /** Block new authenticated traffic and abort anything already in flight. */
+  blockAuthenticatedRequests() {
+    this.authenticatedRequestsBlocked = true;
+    this.abortAuthenticatedRequests();
+  }
+  /** Reopen authenticated traffic after login or authoritative hydration. */
+  allowAuthenticatedRequests() {
+    this.authenticatedRequestsBlocked = false;
+  }
   async get(path, opts) {
     return this.request("GET", path, opts);
   }
@@ -79,7 +97,10 @@ var FetchClient = class {
       throw err;
     }
   }
-  doFetch(method, path, opts) {
+  async doFetch(method, path, opts) {
+    if (!opts?.skipAuth && this.authenticatedRequestsBlocked) {
+      throw new Error("Authenticated requests unavailable after logout");
+    }
     const url = `${this.config.baseURL}${path}`;
     const headers = {
       "Accept": "application/json",
@@ -97,18 +118,35 @@ var FetchClient = class {
       headers["Content-Type"] = "application/json";
       body = JSON.stringify(opts.body);
     }
-    let signal = opts?.signal;
+    const controller = new AbortController();
+    const forwardedSignals = [];
+    if (opts?.signal) forwardedSignals.push(opts.signal);
     const timeout = opts?.timeout ?? this.config.timeout;
-    if (timeout && !signal && typeof AbortSignal !== "undefined" && "timeout" in AbortSignal) {
-      signal = AbortSignal.timeout(timeout);
-    }
-    return fetch(url, {
-      method,
-      headers,
-      body,
-      signal,
-      credentials: this.config.credentials ?? "include"
-    });
+    if (timeout && typeof AbortSignal !== "undefined" && "timeout" in AbortSignal) {
+      forwardedSignals.push(AbortSignal.timeout(timeout));
+    }
+    const abort = /* @__PURE__ */ __name(() => controller.abort(), "abort");
+    for (const signal of forwardedSignals) {
+      if (signal.aborted) abort();
+      else signal.addEventListener("abort", abort, { once: true });
+    }
+    if (!opts?.skipAuth) {
+      this.authenticatedRequests.add(controller);
+    }
+    try {
+      return await fetch(url, {
+        method,
+        headers,
+        body,
+        signal: controller.signal,
+        credentials: this.config.credentials ?? "include"
+      });
+    } finally {
+      this.authenticatedRequests.delete(controller);
+      for (const signal of forwardedSignals) {
+        signal.removeEventListener("abort", abort);
+      }
+    }
   }
   async parseBody(res) {
     const ct = res.headers.get("content-type") ?? "";
@@ -230,8 +268,11 @@ var NajmAuthClient = class _NajmAuthClient {
   refreshTimer = null;
   refreshCircuitTimer = null;
   refreshPromise = null;
+  refreshAbortController = null;
   fetchUserPromise = null;
   refreshFailures = 0;
+  authGeneration = 0;
+  refreshBlocked = false;
   _hydrated = false;
   // Subscriptions (for React useSyncExternalStore)
   listeners = /* @__PURE__ */ new Set();
@@ -253,6 +294,8 @@ var NajmAuthClient = class _NajmAuthClient {
       return { ...setup };
     }
     const authenticated = res.data;
+    this.refreshBlocked = false;
+    this.api.allowAuthenticatedRequests();
     this.applyTokens(authenticated);
     if (authenticated.user) {
       this.state = { ...this.state, user: authenticated.user };
@@ -301,6 +344,8 @@ var NajmAuthClient = class _NajmAuthClient {
     window.location.assign(res.data.authorizationUrl);
   }
   async completeOAuthLogin() {
+    this.refreshBlocked = false;
+    this.api.allowAuthenticatedRequests();
     await this.refresh();
     const user = await this.fetchUser();
     if (!user) throw new Error("OAuth session could not be completed");
@@ -309,22 +354,37 @@ var NajmAuthClient = class _NajmAuthClient {
     return user;
   }
   async logout() {
+    this.authGeneration += 1;
+    this.refreshBlocked = true;
+    const pendingRefresh = this.refreshPromise;
+    this.refreshAbortController?.abort();
+    this.api.blockAuthenticatedRequests();
     this.resetState();
     this.tabSync?.broadcastLogout();
     this.emit("logout", null);
     try {
-      await this.api.post(`${this.prefix}/logout`);
+      await pendingRefresh?.catch(() => void 0);
+      await this.api.post(`${this.prefix}/logout`, { skipAuth: true });
     } catch (err) {
       this.emit("logoutError", err);
     }
   }
   async refresh() {
+    if (this.refreshBlocked) {
+      throw new Error("Refresh unavailable after logout");
+    }
     if (this.refreshFailures >= _NajmAuthClient.MAX_REFRESH_FAILURES) {
       throw new Error("Session expired (circuit open)");
     }
     if (!this.refreshPromise) {
-      this.refreshPromise = this._refreshWithCircuit().finally(() => {
+      const generation = this.authGeneration;
+      const controller = new AbortController();
+      this.refreshAbortController = controller;
+      this.refreshPromise = this._refreshWithCircuit(generation, controller.signal).finally(() => {
         this.refreshPromise = null;
+        if (this.refreshAbortController === controller) {
+          this.refreshAbortController = null;
+        }
       });
     }
     return this.refreshPromise;
@@ -403,10 +463,14 @@ var NajmAuthClient = class _NajmAuthClient {
     this._hydrated = true;
     this.resetRefreshFailures();
     if (!session || !session.user) {
+      if (this.refreshBlocked) this.api.blockAuthenticatedRequests();
+      else this.api.allowAuthenticatedRequests();
       this.state = { ...INITIAL_STATE };
       this.notify();
       return;
     }
+    this.refreshBlocked = false;
+    this.api.allowAuthenticatedRequests();
     this.state = {
       ...this.state,
       user: session.user,
@@ -460,6 +524,10 @@ var NajmAuthClient = class _NajmAuthClient {
   // Cleanup
   // =========================================================================
   destroy() {
+    this.authGeneration += 1;
+    this.refreshAbortController?.abort();
+    this.refreshAbortController = null;
+    this.api.blockAuthenticatedRequests();
     this.clearRefreshTimer();
     this.clearRefreshCircuitTimer();
     this.tabSync?.destroy();
@@ -472,11 +540,13 @@ var NajmAuthClient = class _NajmAuthClient {
   // =========================================================================
   // Internals
   // =========================================================================
-  async _refreshWithCircuit() {
+  async _refreshWithCircuit(generation, signal) {
     try {
-      await this._doRefresh();
+      const applied = await this._doRefresh(generation, signal);
+      if (!applied) return;
       this.resetRefreshFailures();
     } catch (err) {
+      if (generation !== this.authGeneration) return;
       const shouldOpenCircuit = this.registerRefreshFailure(err);
       if (shouldOpenCircuit) {
         this.resetState();
@@ -489,14 +559,16 @@ var NajmAuthClient = class _NajmAuthClient {
       throw err;
     }
   }
-  async _doRefresh() {
+  async _doRefresh(generation, signal) {
     const res = await this.api.post(
       `${this.prefix}/refresh`,
-      { skipAuth: true }
+      { skipAuth: true, signal }
     );
+    if (generation !== this.authGeneration) return false;
     this.applyTokens(res.data);
     this.tabSync?.broadcastSync(this.getSyncPayload());
     this.emit("tokenRefresh", null);
+    return true;
   }
   async handleUnauthorized() {
     try {
@@ -578,12 +650,22 @@ var NajmAuthClient = class _NajmAuthClient {
   handleTabMessage(msg) {
     switch (msg.type) {
       case "logout":
+        this.authGeneration += 1;
+        this.refreshBlocked = true;
+        this.refreshAbortController?.abort();
+        this.api.blockAuthenticatedRequests();
         this.clearRefreshTimer();
         this.state = { ...INITIAL_STATE };
         this.notify();
         this.emit("logout", null);
         break;
       case "sync":
+        if (msg.state.isAuthenticated) {
+          this.refreshBlocked = false;
+          this.api.allowAuthenticatedRequests();
+        } else {
+          this.api.blockAuthenticatedRequests();
+        }
         this.state = {
           ...this.state,
           accessToken: msg.state.accessToken,

package/dist/client/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
-import { N as NajmAuthClient, H as HydrateSession } from '../../NajmAuthClient-DqGucYXi.js';
+import { N as NajmAuthClient, H as HydrateSession } from '../../NajmAuthClient-ZtXTIUSF.js';
 import { e as AuthState, A as AuthUser, c as LoginResult, h as AuthError, L as LoginCredentials, d as OAuthLoginOptions, f as AuthEvent, i as AuthEventMap } from '../../types-BaSfgxqE.js';
 
 interface AuthProviderProps {

package/dist/client/server/index.d.ts

@@ -1,5 +1,5 @@
 import { A as AuthUser, R as RetryConfig } from '../../types-BaSfgxqE.js';
-import { F as FetchClient, N as NajmAuthClient } from '../../NajmAuthClient-DqGucYXi.js';
+import { F as FetchClient, N as NajmAuthClient } from '../../NajmAuthClient-ZtXTIUSF.js';
 export { withAuthMiddleware } from '../edge.js';
 import { G as GetSessionConfig, S as ServerSession$1 } from '../../getSession-BthP85UA.js';
 export { A as AuthConfigError, a as AuthTransportError, N as NoSessionError, g as getSession } from '../../getSession-BthP85UA.js';

package/dist/client/server/index.js

@@ -595,6 +595,24 @@ var FetchClient = class {
   static {
     __name(this, "FetchClient");
   }
+  authenticatedRequests = /* @__PURE__ */ new Set();
+  authenticatedRequestsBlocked = false;
+  /** Abort requests carrying the current session before logout invalidates it. */
+  abortAuthenticatedRequests() {
+    for (const controller of this.authenticatedRequests) {
+      controller.abort();
+    }
+    this.authenticatedRequests.clear();
+  }
+  /** Block new authenticated traffic and abort anything already in flight. */
+  blockAuthenticatedRequests() {
+    this.authenticatedRequestsBlocked = true;
+    this.abortAuthenticatedRequests();
+  }
+  /** Reopen authenticated traffic after login or authoritative hydration. */
+  allowAuthenticatedRequests() {
+    this.authenticatedRequestsBlocked = false;
+  }
   async get(path, opts) {
     return this.request("GET", path, opts);
   }
@@ -642,7 +660,10 @@ var FetchClient = class {
       throw err;
     }
   }
-  doFetch(method, path, opts) {
+  async doFetch(method, path, opts) {
+    if (!opts?.skipAuth && this.authenticatedRequestsBlocked) {
+      throw new Error("Authenticated requests unavailable after logout");
+    }
     const url = `${this.config.baseURL}${path}`;
     const headers = {
       "Accept": "application/json",
@@ -660,18 +681,35 @@ var FetchClient = class {
       headers["Content-Type"] = "application/json";
       body = JSON.stringify(opts.body);
     }
-    let signal = opts?.signal;
+    const controller = new AbortController();
+    const forwardedSignals = [];
+    if (opts?.signal) forwardedSignals.push(opts.signal);
     const timeout = opts?.timeout ?? this.config.timeout;
-    if (timeout && !signal && typeof AbortSignal !== "undefined" && "timeout" in AbortSignal) {
-      signal = AbortSignal.timeout(timeout);
+    if (timeout && typeof AbortSignal !== "undefined" && "timeout" in AbortSignal) {
+      forwardedSignals.push(AbortSignal.timeout(timeout));
+    }
+    const abort = /* @__PURE__ */ __name(() => controller.abort(), "abort");
+    for (const signal of forwardedSignals) {
+      if (signal.aborted) abort();
+      else signal.addEventListener("abort", abort, { once: true });
+    }
+    if (!opts?.skipAuth) {
+      this.authenticatedRequests.add(controller);
+    }
+    try {
+      return await fetch(url, {
+        method,
+        headers,
+        body,
+        signal: controller.signal,
+        credentials: this.config.credentials ?? "include"
+      });
+    } finally {
+      this.authenticatedRequests.delete(controller);
+      for (const signal of forwardedSignals) {
+        signal.removeEventListener("abort", abort);
+      }
     }
-    return fetch(url, {
-      method,
-      headers,
-      body,
-      signal,
-      credentials: this.config.credentials ?? "include"
-    });
   }
   async parseBody(res) {
     const ct = res.headers.get("content-type") ?? "";
@@ -939,8 +977,11 @@ var NajmAuthClient = class _NajmAuthClient {
   refreshTimer = null;
   refreshCircuitTimer = null;
   refreshPromise = null;
+  refreshAbortController = null;
   fetchUserPromise = null;
   refreshFailures = 0;
+  authGeneration = 0;
+  refreshBlocked = false;
   _hydrated = false;
   // Subscriptions (for React useSyncExternalStore)
   listeners = /* @__PURE__ */ new Set();
@@ -962,6 +1003,8 @@ var NajmAuthClient = class _NajmAuthClient {
       return { ...setup };
     }
     const authenticated2 = res.data;
+    this.refreshBlocked = false;
+    this.api.allowAuthenticatedRequests();
     this.applyTokens(authenticated2);
     if (authenticated2.user) {
       this.state = { ...this.state, user: authenticated2.user };
@@ -1010,6 +1053,8 @@ var NajmAuthClient = class _NajmAuthClient {
     window.location.assign(res.data.authorizationUrl);
   }
   async completeOAuthLogin() {
+    this.refreshBlocked = false;
+    this.api.allowAuthenticatedRequests();
     await this.refresh();
     const user = await this.fetchUser();
     if (!user) throw new Error("OAuth session could not be completed");
@@ -1018,22 +1063,37 @@ var NajmAuthClient = class _NajmAuthClient {
     return user;
   }
   async logout() {
+    this.authGeneration += 1;
+    this.refreshBlocked = true;
+    const pendingRefresh = this.refreshPromise;
+    this.refreshAbortController?.abort();
+    this.api.blockAuthenticatedRequests();
     this.resetState();
     this.tabSync?.broadcastLogout();
     this.emit("logout", null);
     try {
-      await this.api.post(`${this.prefix}/logout`);
+      await pendingRefresh?.catch(() => void 0);
+      await this.api.post(`${this.prefix}/logout`, { skipAuth: true });
     } catch (err) {
       this.emit("logoutError", err);
     }
   }
   async refresh() {
+    if (this.refreshBlocked) {
+      throw new Error("Refresh unavailable after logout");
+    }
     if (this.refreshFailures >= _NajmAuthClient.MAX_REFRESH_FAILURES) {
       throw new Error("Session expired (circuit open)");
     }
     if (!this.refreshPromise) {
-      this.refreshPromise = this._refreshWithCircuit().finally(() => {
+      const generation = this.authGeneration;
+      const controller = new AbortController();
+      this.refreshAbortController = controller;
+      this.refreshPromise = this._refreshWithCircuit(generation, controller.signal).finally(() => {
         this.refreshPromise = null;
+        if (this.refreshAbortController === controller) {
+          this.refreshAbortController = null;
+        }
       });
     }
     return this.refreshPromise;
@@ -1112,10 +1172,14 @@ var NajmAuthClient = class _NajmAuthClient {
     this._hydrated = true;
     this.resetRefreshFailures();
     if (!session || !session.user) {
+      if (this.refreshBlocked) this.api.blockAuthenticatedRequests();
+      else this.api.allowAuthenticatedRequests();
       this.state = { ...INITIAL_STATE };
       this.notify();
       return;
     }
+    this.refreshBlocked = false;
+    this.api.allowAuthenticatedRequests();
     this.state = {
       ...this.state,
       user: session.user,
@@ -1169,6 +1233,10 @@ var NajmAuthClient = class _NajmAuthClient {
   // Cleanup
   // =========================================================================
   destroy() {
+    this.authGeneration += 1;
+    this.refreshAbortController?.abort();
+    this.refreshAbortController = null;
+    this.api.blockAuthenticatedRequests();
     this.clearRefreshTimer();
     this.clearRefreshCircuitTimer();
     this.tabSync?.destroy();
@@ -1181,11 +1249,13 @@ var NajmAuthClient = class _NajmAuthClient {
   // =========================================================================
   // Internals
   // =========================================================================
-  async _refreshWithCircuit() {
+  async _refreshWithCircuit(generation, signal) {
     try {
-      await this._doRefresh();
+      const applied = await this._doRefresh(generation, signal);
+      if (!applied) return;
       this.resetRefreshFailures();
     } catch (err) {
+      if (generation !== this.authGeneration) return;
       const shouldOpenCircuit = this.registerRefreshFailure(err);
       if (shouldOpenCircuit) {
         this.resetState();
@@ -1198,14 +1268,16 @@ var NajmAuthClient = class _NajmAuthClient {
       throw err;
     }
   }
-  async _doRefresh() {
+  async _doRefresh(generation, signal) {
     const res = await this.api.post(
       `${this.prefix}/refresh`,
-      { skipAuth: true }
+      { skipAuth: true, signal }
     );
+    if (generation !== this.authGeneration) return false;
     this.applyTokens(res.data);
     this.tabSync?.broadcastSync(this.getSyncPayload());
     this.emit("tokenRefresh", null);
+    return true;
   }
   async handleUnauthorized() {
     try {
@@ -1287,12 +1359,22 @@ var NajmAuthClient = class _NajmAuthClient {
   handleTabMessage(msg) {
     switch (msg.type) {
       case "logout":
+        this.authGeneration += 1;
+        this.refreshBlocked = true;
+        this.refreshAbortController?.abort();
+        this.api.blockAuthenticatedRequests();
         this.clearRefreshTimer();
         this.state = { ...INITIAL_STATE };
         this.notify();
         this.emit("logout", null);
         break;
       case "sync":
+        if (msg.state.isAuthenticated) {
+          this.refreshBlocked = false;
+          this.api.allowAuthenticatedRequests();
+        } else {
+          this.api.blockAuthenticatedRequests();
+        }
         this.state = {
           ...this.state,
           accessToken: msg.state.accessToken,

package/dist/index.d.ts

@@ -980,6 +980,19 @@ declare class TokenRepository {
         previousValidUntil?: string | null;
         previousUsedAt?: string | null;
     }): Promise<any>;
+    /**
+     * Rotate an existing refresh-token family with compare-and-swap semantics.
+     * This can never insert a family deleted by a concurrent logout.
+     */
+    rotateRefreshToken(tokenData: {
+        userId: string;
+        token: string;
+        tokenFamily: string;
+        expiresAt: string;
+        previousHash: string;
+        previousValidUntil: string;
+        previousUsedAt?: string | null;
+    }, expectedCurrentHash: string): Promise<any>;
     /**
      * Claim the previous-token grace slot for a single family. Conditional on
      * BOTH the stored previousHash still matching the presented token AND
@@ -1110,6 +1123,7 @@ declare class TokenService {
         userId: string;
         tokenFamily?: string;
     }): string;
+    private createTokenPair;
     generateTokens(userId: string, tokenFamily?: string): Promise<{
         userId: string;
         tokenFamily: string;
@@ -1140,6 +1154,11 @@ declare class TokenService {
      * This prevents token theft in case of database breach
      */
     storeRefreshToken(userId: string, refreshToken: string, tokenFamily: string): Promise<void>;
+    /**
+     * Rotate only the family row observed by refreshTokens(). This conditional
+     * update fails closed if logout deleted the family or another refresh won.
+     */
+    private rotateTokens;
     /**
      * Refresh tokens with secure token comparison
      * Compares provided token with hashed version in database

package/dist/index.js

@@ -1639,6 +1639,19 @@ var TokenRepository = class TokenRepository2 {
       }
     }).returning();
   }
+  /**
+   * Rotate an existing refresh-token family with compare-and-swap semantics.
+   * This can never insert a family deleted by a concurrent logout.
+   */
+  async rotateRefreshToken(tokenData, expectedCurrentHash) {
+    return await this.db.update(this.tokens).set({
+      token: tokenData.token,
+      expiresAt: tokenData.expiresAt,
+      previousHash: tokenData.previousHash,
+      previousValidUntil: tokenData.previousValidUntil,
+      previousUsedAt: tokenData.previousUsedAt ?? null
+    }).where(and(eq4(this.tokens.tokenFamily, tokenData.tokenFamily), eq4(this.tokens.userId, tokenData.userId), eq4(this.tokens.token, expectedCurrentHash))).returning();
+  }
   /**
    * Claim the previous-token grace slot for a single family. Conditional on
    * BOTH the stored previousHash still matching the presented token AND
@@ -2022,8 +2035,7 @@ var TokenService = class TokenService2 {
   generateRefreshToken(data) {
     return this.signRefreshToken({ userId: data.userId, tokenFamily: data.tokenFamily ?? nanoid4(16) }).token;
   }
-  async generateTokens(userId, tokenFamily) {
-    const family = tokenFamily ?? nanoid4(16);
+  async createTokenPair(userId, family) {
     const { roleName, permissions } = await this.tokenRepository.getRoleAndPermissions(userId);
     const accessTokenData = {
       userId,
@@ -2033,7 +2045,6 @@ var TokenService = class TokenService2 {
     };
     const access = await this.signAccessToken(accessTokenData);
     const refresh = this.signRefreshToken({ userId, tokenFamily: family });
-    await this.storeRefreshToken(userId, refresh.token, family);
     return {
       userId,
       tokenFamily: family,
@@ -2046,6 +2057,12 @@ var TokenService = class TokenService2 {
       refreshTokenExpiresAt: refresh.expiresAt
     };
   }
+  async generateTokens(userId, tokenFamily) {
+    const family = tokenFamily ?? nanoid4(16);
+    const generated = await this.createTokenPair(userId, family);
+    await this.storeRefreshToken(userId, generated.refreshToken, family);
+    return generated;
+  }
   // ============ TOKEN BLACKLIST (Cache) ============
   /**
    * Blacklist an access token by its jti
@@ -2100,6 +2117,27 @@ var TokenService = class TokenService2 {
       previousUsedAt: null
     });
   }
+  /**
+   * Rotate only the family row observed by refreshTokens(). This conditional
+   * update fails closed if logout deleted the family or another refresh won.
+   */
+  async rotateTokens(userId, tokenFamily, expectedCurrentHash) {
+    const generated = await this.createTokenPair(userId, tokenFamily);
+    const expireInSecond = timestring2(this.config.jwt.refreshExpiresIn, "s");
+    const rotated = await this.tokenRepository.rotateRefreshToken({
+      userId,
+      token: this.hashToken(generated.refreshToken),
+      tokenFamily,
+      expiresAt: new Date(Date.now() + expireInSecond * 1e3).toISOString(),
+      previousHash: expectedCurrentHash,
+      previousValidUntil: new Date(Date.now() + TokenService_1.PREVIOUS_GRACE_SECONDS * 1e3).toISOString(),
+      previousUsedAt: null
+    }, expectedCurrentHash);
+    if (!rotated?.length) {
+      Err7(this.t("errors.refreshTokenInvalid"), 401);
+    }
+    return generated;
+  }
   /**
    * Refresh tokens with secure token comparison
    * Compares provided token with hashed version in database
@@ -2117,7 +2155,7 @@ var TokenService = class TokenService2 {
     const presentedHash = this.hashToken(refreshToken);
     await this.requireActiveRefreshUser(userId, tokenFamily);
     if (presentedHash === stored.token) {
-      return this.generateTokens(userId, tokenFamily);
+      return this.rotateTokens(userId, tokenFamily, stored.token);
     }
     const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
     if (canRecover) {
@@ -2125,7 +2163,7 @@ var TokenService = class TokenService2 {
       if (!claimed?.length) {
         Err7(this.t("errors.refreshTokenInvalid"), 401);
       }
-      return this.generateTokens(userId, tokenFamily);
+      return this.rotateTokens(userId, tokenFamily, stored.token);
     }
     await this.revokeSuspectRefreshFamily(userId, tokenFamily);
     Err7(this.t("errors.refreshTokenInvalid"), 401);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "3.1.1",
+  "version": "3.1.3",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [