svc-infra 0.1.589__py3-none-any.whl → 0.1.706__py3-none-any.whl

svc_infra/api/fastapi/auth/routers/apikey_router.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 from datetime import datetime, timedelta, timezone
-from typing import List, Optional
+from typing import Any, List, Optional, cast
 from uuid import UUID
 
 from fastapi import HTTPException, Query
@@ -62,7 +62,7 @@ def apikey_router():
         if owner_id != caller_id and not getattr(p.user, "is_superuser", False):
             raise HTTPException(403, "forbidden")
 
-        plaintext, prefix, hashed = ApiKey.make_secret()
+        plaintext, prefix, hashed = ApiKey.make_secret()  # type: ignore[attr-defined]
         expires = (
             (datetime.now(timezone.utc) + timedelta(hours=payload.ttl_hours))
             if payload.ttl_hours
@@ -98,9 +98,9 @@ def apikey_router():
         description="List API keys. Non-superusers see only their own keys.",
     )
     async def list_keys(sess: SqlSessionDep, p: Identity):
-        q = select(ApiKey)
+        q: Any = select(ApiKey)
         if not getattr(p.user, "is_superuser", False):
-            q = q.where(ApiKey.user_id == p.user.id)
+            q = q.where(ApiKey.user_id == p.user.id)  # type: ignore[attr-defined]
         rows = (await sess.execute(q)).scalars().all()
         return [
             ApiKeyOut(
@@ -124,7 +124,7 @@ def apikey_router():
         description="Revoke an API key",
     )
     async def revoke_key(key_id: str, sess: SqlSessionDep, p: Identity):
-        row = await sess.get(ApiKey, key_id)
+        row = await cast(Any, sess).get(ApiKey, key_id)
         if not row:
             raise HTTPException(404, "not_found")
 
@@ -148,7 +148,7 @@ def apikey_router():
         p: Identity,
         force: bool = Query(False, description="Allow deleting an active key if True"),
     ):
-        row = await sess.get(ApiKey, key_id)
+        row = await cast(Any, sess).get(ApiKey, key_id)
         if not row:
             return  # 204
 

svc_infra/api/fastapi/auth/routers/oauth_router.py

@@ -10,9 +10,9 @@ from urllib.parse import urlencode, urlparse
 import jwt
 from authlib.integrations.base_client.errors import OAuthError
 from authlib.integrations.starlette_client import OAuth
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import RedirectResponse
-from fastapi_users.authentication import AuthenticationBackend
+from fastapi_users.authentication import AuthenticationBackend, Strategy
 from fastapi_users.password import PasswordHelper
 from sqlalchemy import select
 from starlette import status
@@ -20,7 +20,10 @@ from starlette.responses import Response
 
 from svc_infra.api.fastapi.auth.mfa.pre_auth import get_mfa_pre_jwt_writer
 from svc_infra.api.fastapi.auth.policy import AuthPolicy, DefaultAuthPolicy
-from svc_infra.api.fastapi.auth.settings import get_auth_settings, parse_redirect_allow_hosts
+from svc_infra.api.fastapi.auth.settings import (
+    get_auth_settings,
+    parse_redirect_allow_hosts,
+)
 from svc_infra.api.fastapi.db.sql.session import SqlSessionDep
 from svc_infra.api.fastapi.dual.public import public_router
 from svc_infra.api.fastapi.paths.auth import (
@@ -28,6 +31,9 @@ from svc_infra.api.fastapi.paths.auth import (
     OAUTH_LOGIN_PATH,
     OAUTH_REFRESH_PATH,
 )
+from svc_infra.app.env import require_secret
+from svc_infra.security.models import RefreshToken
+from svc_infra.security.session import issue_session_and_refresh, rotate_session_refresh
 
 
 def _gen_pkce_pair() -> tuple[str, str]:
@@ -38,14 +44,19 @@ def _gen_pkce_pair() -> tuple[str, str]:
     return verifier, challenge
 
 
-def _validate_redirect(url: str, allow_hosts: list[str], *, require_https: bool) -> None:
+def _validate_redirect(
+    url: str, allow_hosts: list[str], *, require_https: bool
+) -> None:
     """Validate that a redirect URL is allowed and secure."""
     p = urlparse(url)
     if not p.netloc:
         return
-    host_port = p.hostname.lower() + (f":{p.port}" if p.port else "")
+    if not p.hostname:
+        raise HTTPException(400, "redirect_not_allowed")
+    hostname = p.hostname
+    host_port = hostname.lower() + (f":{p.port}" if p.port else "")
     allowed = {h.lower() for h in allow_hosts}
-    if host_port not in allowed and p.hostname.lower() not in allowed:
+    if host_port not in allowed and hostname.lower() not in allowed:
         raise HTTPException(400, "redirect_not_allowed")
     if require_https and p.scheme != "https":
         raise HTTPException(400, "https_required")
@@ -75,7 +86,11 @@ def _coerce_expires_at(token: dict | None) -> datetime | None:
 def _cookie_name(st) -> str:
     """Get the cookie name with appropriate security prefix."""
     name = getattr(st, "auth_cookie_name", "svc_auth")
-    if st.session_cookie_secure and not st.session_cookie_domain and not name.startswith("__Host-"):
+    if (
+        st.session_cookie_secure
+        and not st.session_cookie_domain
+        and not name.startswith("__Host-")
+    ):
         name = "__Host-" + name
     return name
 
@@ -86,7 +101,9 @@ def _cookie_domain(st):
     return d or None
 
 
-def _register_oauth_providers(oauth: OAuth, providers: Dict[str, Dict[str, Any]]) -> None:
+def _register_oauth_providers(
+    oauth: OAuth, providers: Dict[str, Dict[str, Any]]
+) -> None:
     """Register all OAuth providers with the OAuth client."""
     for name, cfg in providers.items():
         kind = cfg.get("kind")
@@ -185,7 +202,9 @@ async def _extract_user_info_github(
     """Extract user information from GitHub provider."""
     u = (await client.get("user", token=token)).json()
     emails_resp = (await client.get("user/emails", token=token)).json()
-    primary = next((e for e in emails_resp if e.get("primary") and e.get("verified")), None)
+    primary = next(
+        (e for e in emails_resp if e.get("primary") and e.get("verified")), None
+    )
 
     if not primary:
         raise HTTPException(400, "unverified_email")
@@ -193,7 +212,9 @@ async def _extract_user_info_github(
     email = primary["email"]
     email_verified = True
     full_name = u.get("name") or u.get("login")
-    provider_user_id = str(u.get("id")) if isinstance(u, dict) and u.get("id") is not None else None
+    provider_user_id = (
+        str(u.get("id")) if isinstance(u, dict) and u.get("id") is not None else None
+    )
 
     return email, full_name, provider_user_id, email_verified, {"user": u}
 
@@ -208,7 +229,9 @@ async def _extract_user_info_linkedin(
     )
 
     em = (
-        await client.get("emailAddress?q=members&projection=(elements*(handle~))", token=token)
+        await client.get(
+            "emailAddress?q=members&projection=(elements*(handle~))", token=token
+        )
     ).json()
 
     email = None
@@ -247,9 +270,15 @@ async def _extract_user_info_from_provider(
         raise HTTPException(400, "Unsupported provider kind")
 
 
-async def _find_or_create_user(session, user_model, email: str, full_name: str | None) -> Any:
+async def _find_or_create_user(
+    session, user_model, email: str, full_name: str | None
+) -> Any:
     """Find existing user by email or create a new one."""
-    existing = (await session.execute(select(user_model).filter_by(email=email))).scalars().first()
+    existing = (
+        (await session.execute(select(user_model).filter_by(email=email)))
+        .scalars()
+        .first()
+    )
 
     if existing:
         return existing
@@ -261,11 +290,14 @@ async def _find_or_create_user(session, user_model, email: str, full_name: str |
         is_verified=True,
     )
 
-    # Set hashed password for OAuth users
+    # Set hashed password for OAuth users - use cryptographically random password
+    # OAuth users authenticate via provider, not password, so this is never used
+    # but must be unpredictable to prevent password-based login attacks
+    random_password = secrets.token_urlsafe(32)
     if hasattr(user, "hashed_password"):
-        user.hashed_password = PasswordHelper().hash("!oauth!")
+        user.hashed_password = PasswordHelper().hash(random_password)
     elif hasattr(user, "password_hash"):
-        user.password_hash = PasswordHelper().hash("!oauth!")
+        user.password_hash = PasswordHelper().hash(random_password)
 
     if full_name and hasattr(user, "full_name"):
         setattr(user, "full_name", full_name)
@@ -352,10 +384,18 @@ async def _update_provider_account(
     else:
         # Update existing link if values have changed
         dirty = False
-        if hasattr(link, "access_token") and access_token and link.access_token != access_token:
+        if (
+            hasattr(link, "access_token")
+            and access_token
+            and link.access_token != access_token
+        ):
             link.access_token = access_token
             dirty = True
-        if hasattr(link, "refresh_token") and refresh_token and link.refresh_token != refresh_token:
+        if (
+            hasattr(link, "refresh_token")
+            and refresh_token
+            and link.refresh_token != refresh_token
+        ):
             link.refresh_token = refresh_token
             dirty = True
         if hasattr(link, "expires_at") and expires_at and link.expires_at != expires_at:
@@ -368,19 +408,24 @@ async def _update_provider_account(
             await session.flush()
 
 
-def _determine_final_redirect_url(request: Request, provider: str, post_login_redirect: str) -> str:
+def _determine_final_redirect_url(
+    request: Request, provider: str, post_login_redirect: str
+) -> str:
     """Determine the final redirect URL after successful authentication."""
     st = get_auth_settings()
-    redirect_url = str(
-        getattr(st, "post_login_redirect", post_login_redirect) or post_login_redirect
+    # Prioritize the parameter passed to the router over settings
+    redirect_url = str(post_login_redirect or getattr(st, "post_login_redirect", "/"))
+    allow_hosts = parse_redirect_allow_hosts(
+        getattr(st, "redirect_allow_hosts_raw", None)
     )
-    allow_hosts = parse_redirect_allow_hosts(getattr(st, "redirect_allow_hosts_raw", None))
     require_https = bool(getattr(st, "session_cookie_secure", False))
 
     _validate_redirect(redirect_url, allow_hosts, require_https=require_https)
 
     # Prefer ?next or the stashed value from /login
-    nxt = request.query_params.get("next") or request.session.pop(f"oauth:{provider}:next", None)
+    nxt = request.query_params.get("next") or request.session.pop(
+        f"oauth:{provider}:next", None
+    )
     if nxt:
         try:
             _validate_redirect(nxt, allow_hosts, require_https=require_https)
@@ -391,7 +436,9 @@ def _determine_final_redirect_url(request: Request, provider: str, post_login_re
     return redirect_url
 
 
-async def _validate_oauth_state(request: Request, provider: str) -> tuple[str | None, str | None]:
+async def _validate_oauth_state(
+    request: Request, provider: str
+) -> tuple[str | None, str | None]:
     """Validate OAuth state and extract session values."""
     provided_state = request.query_params.get("state")
     expected_state = request.session.pop(f"oauth:{provider}:state", None)
@@ -404,7 +451,9 @@ async def _validate_oauth_state(request: Request, provider: str) -> tuple[str |
     return verifier, nonce
 
 
-async def _exchange_code_for_token(client, request: Request, verifier: str | None, provider: str):
+async def _exchange_code_for_token(
+    client, request: Request, verifier: str | None, provider: str
+):
     """Exchange OAuth authorization code for access token."""
     try:
         return await client.authorize_access_token(request, code_verifier=verifier)
@@ -435,7 +484,13 @@ async def _process_user_authentication(
 
     # Ensure provider link exists
     await _update_provider_account(
-        session, provider_account_model, user, provider, provider_user_id, token, raw_claims
+        session,
+        provider_account_model,
+        user,
+        provider,
+        provider_user_id,
+        token,
+        raw_claims,
     )
 
     return user
@@ -444,11 +499,18 @@ async def _process_user_authentication(
 async def _validate_and_decode_jwt_token(raw_token: str) -> str:
     """Validate and decode JWT token to extract user ID."""
     st = get_auth_settings()
-    secret = (
-        st.jwt.secret.get_secret_value()
-        if getattr(st, "jwt", None) and getattr(st.jwt, "secret", None)
-        else "dev-change-me"
+    jwt_settings = getattr(st, "jwt", None)
+    jwt_secret = (
+        getattr(jwt_settings, "secret", None) if jwt_settings is not None else None
     )
+    if jwt_secret:
+        secret = jwt_secret.get_secret_value()
+    else:
+        secret = require_secret(
+            None,
+            "JWT_SECRET (via auth settings jwt.secret for token validation)",
+            dev_default="dev-only-jwt-validation-secret-not-for-production",
+        )
 
     try:
         payload = jwt.decode(
@@ -460,23 +522,31 @@ async def _validate_and_decode_jwt_token(raw_token: str) -> str:
         user_id = payload.get("sub")
         if not user_id:
             raise HTTPException(401, "invalid_token")
-        return user_id
+        return cast(str, user_id)
     except Exception:
         raise HTTPException(401, "invalid_token")
 
 
 async def _set_cookie_on_response(
-    resp: Response, auth_backend: AuthenticationBackend, user: Any
+    resp: Response,
+    strategy: Strategy[Any, Any],
+    user: Any,
+    *,
+    refresh_raw: str,
 ) -> None:
-    """Set authentication cookie on response."""
+    """Set authentication (JWT) and refresh cookies on response."""
     st = get_auth_settings()
-    strategy = auth_backend.get_strategy()
     jwt_token = await strategy.write_token(user)
 
-    same_site_lit = cast(Literal["lax", "strict", "none"], str(st.session_cookie_samesite).lower())
+    same_site_lit = cast(
+        Literal["lax", "strict", "none"], str(st.session_cookie_samesite).lower()
+    )
     if same_site_lit == "none" and not bool(st.session_cookie_secure):
-        raise HTTPException(500, "session_cookie_samesite=None requires session_cookie_secure=True")
+        raise HTTPException(
+            500, "session_cookie_samesite=None requires session_cookie_secure=True"
+        )
 
+    # Access/Auth cookie (short-lived JWT)
     resp.set_cookie(
         key=_cookie_name(st),
         value=jwt_token,
@@ -488,6 +558,18 @@ async def _set_cookie_on_response(
         path="/",
     )
 
+    # Refresh cookie (opaque token, longer lived)
+    resp.set_cookie(
+        key=getattr(st, "session_cookie_name", "svc_session"),
+        value=refresh_raw,
+        max_age=60 * 60 * 24 * 7,  # 7 days default
+        httponly=True,
+        secure=bool(st.session_cookie_secure),
+        samesite=same_site_lit,
+        domain=_cookie_domain(st),
+        path="/",
+    )
+
 
 def _clean_oauth_session_state(request: Request, provider: str) -> None:
     """Clean up transient OAuth session state."""
@@ -504,7 +586,9 @@ async def _handle_mfa_redirect(
 
     pre = await get_mfa_pre_jwt_writer().write(user)
     qs = urlencode({"mfa": "required", "pre_token": pre})
-    return RedirectResponse(url=f"{redirect_url}?{qs}", status_code=status.HTTP_302_FOUND)
+    return RedirectResponse(
+        url=f"{redirect_url}?{qs}", status_code=status.HTTP_302_FOUND
+    )
 
 
 def oauth_router_with_backend(
@@ -581,7 +665,12 @@ def _create_oauth_router(
         responses={302: {"description": "Redirect to app (or MFA redirect)."}},
         description="OAuth callback endpoint.",
     )
-    async def oauth_callback(request: Request, provider: str, session: SqlSessionDep):
+    async def oauth_callback(
+        request: Request,
+        provider: str,
+        session: SqlSessionDep,
+        strategy: Strategy[Any, Any] = Depends(auth_backend.get_strategy),
+    ):
         """Handle OAuth callback and complete authentication."""
         # Handle provider-side errors up front
         if err := request.query_params.get("error"):
@@ -602,14 +691,22 @@ def _create_oauth_router(
 
         # Extract user information from provider
         cfg = providers.get(provider, {})
-        email, full_name, provider_user_id, email_verified, raw_claims = (
-            await _extract_user_info_from_provider(request, client, token, provider, cfg, nonce)
+        (
+            email,
+            full_name,
+            provider_user_id,
+            email_verified,
+            raw_claims,
+        ) = await _extract_user_info_from_provider(
+            request, client, token, provider, cfg, nonce
         )
 
         if email_verified is False:
             raise HTTPException(400, "unverified_email")
         if not email:
             raise HTTPException(400, "No email from provider")
+        if not provider_user_id:
+            raise HTTPException(400, "No user ID from provider")
 
         # Process user authentication
         user = await _process_user_authentication(
@@ -629,7 +726,9 @@ def _create_oauth_router(
             raise HTTPException(401, "account_disabled")
 
         # Determine final redirect URL
-        redirect_url = _determine_final_redirect_url(request, provider, post_login_redirect)
+        redirect_url = _determine_final_redirect_url(
+            request, provider, post_login_redirect
+        )
 
         # Handle MFA if required (do NOT set last_login yet; do it after MFA)
         mfa_response = await _handle_mfa_redirect(policy, user, redirect_url)
@@ -641,9 +740,33 @@ def _create_oauth_router(
         user.last_login = datetime.now(timezone.utc)
         await session.commit()
 
-        # Create response with auth cookie
+        # Create session + initial refresh token
+        raw_refresh, _rt = await issue_session_and_refresh(
+            session,
+            user_id=user.id,
+            tenant_id=getattr(user, "tenant_id", None),
+            user_agent=str(request.headers.get("user-agent", ""))[:512],
+            ip_hash=None,
+        )
+
+        # Generate JWT token for the response
+        jwt_token = await strategy.write_token(user)
+
+        # If redirecting to a different origin, append token as URL fragment for frontend to extract
+        # This handles cross-port scenarios like localhost:8000 -> localhost:3000
+        parsed_redirect = urlparse(redirect_url)
+        request_origin = f"{request.url.scheme}://{request.url.netloc}"
+        redirect_origin = f"{parsed_redirect.scheme}://{parsed_redirect.netloc}"
+
+        if redirect_origin and redirect_origin != request_origin:
+            # Cross-origin redirect: append token as URL fragment
+            # Fragment is not sent to server, only accessible to client-side JS
+            separator = "#" if not parsed_redirect.fragment else "&"
+            redirect_url = f"{redirect_url}{separator}access_token={jwt_token}"
+
+        # Create response with auth + refresh cookies (for same-origin requests)
         resp = RedirectResponse(url=redirect_url, status_code=status.HTTP_302_FOUND)
-        await _set_cookie_on_response(resp, auth_backend, user)
+        await _set_cookie_on_response(resp, strategy, user, refresh_raw=raw_refresh)
 
         # Clean up session state
         _clean_oauth_session_state(request, provider)
@@ -663,48 +786,63 @@ def _create_oauth_router(
         responses={204: {"description": "Cookie refreshed"}},
         description="Refresh authentication token.",
     )
-    async def refresh(request: Request, session: SqlSessionDep):
+    async def refresh(
+        request: Request,
+        session: SqlSessionDep,
+        strategy: Strategy[Any, Any] = Depends(auth_backend.get_strategy),
+    ):
         """Refresh authentication token."""
         st = get_auth_settings()
 
-        # Read and validate cookie
-        name = _cookie_name(st)
-        raw = request.cookies.get(name)
-        if not raw:
+        # Read and validate auth JWT cookie
+        name_auth = _cookie_name(st)
+        raw_auth = request.cookies.get(name_auth)
+        if not raw_auth:
             raise HTTPException(401, "missing_token")
 
-        # Validate and decode JWT token
-        user_id = await _validate_and_decode_jwt_token(raw)
+        # Validate and decode JWT token to get user id
+        user_id = await _validate_and_decode_jwt_token(raw_auth)
 
         # Load user
-        user = await session.get(user_model, user_id)
+        user = await cast(Any, session).get(user_model, user_id)
         if not user:
             raise HTTPException(401, "invalid_token")
 
-        # Handle MFA if required
-        if await policy.should_require_mfa(user):
-            pre = await get_mfa_pre_jwt_writer().write(user)
-            redirect_url = str(getattr(st, "post_login_redirect", "/"))
-            allow_hosts = parse_redirect_allow_hosts(getattr(st, "redirect_allow_hosts_raw", None))
-            require_https = bool(getattr(st, "session_cookie_secure", False))
-            _validate_redirect(redirect_url, allow_hosts, require_https=require_https)
-
-            nxt = request.query_params.get("next")
-            if nxt:
-                try:
-                    _validate_redirect(nxt, allow_hosts, require_https=require_https)
-                    redirect_url = nxt
-                except HTTPException:
-                    pass
-
-            qs = urlencode({"mfa": "required", "pre_token": pre})
-            return RedirectResponse(url=f"{redirect_url}?{qs}", status_code=status.HTTP_302_FOUND)
-
-        # Create response with new token
-        resp = Response(status_code=204)
-        await _set_cookie_on_response(resp, auth_backend, user)
-
-        # Optional: notify policy hook
+        # Obtain refresh cookie
+        refresh_cookie_name = getattr(st, "session_cookie_name", "svc_session")
+        raw_refresh = request.cookies.get(refresh_cookie_name)
+        if not raw_refresh:
+            raise HTTPException(401, "missing_refresh_token")
+
+        # Lookup refresh token row by hash
+        from sqlalchemy import select
+
+        from svc_infra.security.models import hash_refresh_token
+
+        token_hash = hash_refresh_token(raw_refresh)
+        found: RefreshToken | None = (
+            (
+                await session.execute(
+                    select(RefreshToken).where(RefreshToken.token_hash == token_hash)
+                )
+            )
+            .scalars()
+            .first()
+        )
+        if (
+            not found
+            or found.revoked_at
+            or (found.expires_at and found.expires_at < datetime.now(timezone.utc))
+        ):
+            raise HTTPException(401, "invalid_refresh_token")
+
+        # Rotate refresh token
+        new_raw, _new_rt = await rotate_session_refresh(session, current=found)
+
+        # Write response (204) with new cookies
+        resp = Response(status_code=status.HTTP_204_NO_CONTENT)
+        await _set_cookie_on_response(resp, strategy, user, refresh_raw=new_raw)
+        # Policy hook: trigger after successful rotation; suppress hook errors
         if hasattr(policy, "on_token_refresh"):
             try:
                 await policy.on_token_refresh(user)
@@ -713,4 +851,5 @@ def _create_oauth_router(
 
         return resp
 
+    # Return router at end of factory
     return router

svc_infra/api/fastapi/auth/routers/session_router.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import List
+
+from fastapi import APIRouter, HTTPException
+from sqlalchemy import select
+
+from svc_infra.api.fastapi.auth.security import Identity
+from svc_infra.api.fastapi.db.sql.session import SqlSessionDep
+from svc_infra.security.models import AuthSession
+from svc_infra.security.permissions import RequirePermission
+
+
+def build_session_router() -> APIRouter:
+    router = APIRouter(prefix="/sessions", tags=["sessions"])
+
+    @router.get(
+        "/me",
+        response_model=list[dict],
+        dependencies=[RequirePermission("security.session.list")],
+    )
+    async def list_my_sessions(
+        identity: Identity, session: SqlSessionDep
+    ) -> List[dict]:
+        stmt = select(AuthSession).where(AuthSession.user_id == identity.user.id)
+        rows = (await session.execute(stmt)).scalars().all()
+        return [
+            {
+                "id": str(r.id),
+                "user_agent": r.user_agent,
+                "ip_hash": r.ip_hash,
+                "revoked": bool(r.revoked_at),
+                "last_seen_at": r.last_seen_at.isoformat() if r.last_seen_at else None,
+                "created_at": r.created_at.isoformat() if r.created_at else None,
+            }
+            for r in rows
+        ]
+
+    @router.post(
+        "/{session_id}/revoke",
+        status_code=204,
+        dependencies=[RequirePermission("security.session.revoke")],
+    )
+    async def revoke_session(session_id: str, identity: Identity, db: SqlSessionDep):
+        # Load session and ensure it belongs to the user (non-admin users cannot revoke others)
+        s = await db.get(AuthSession, session_id)
+        if not s:
+            raise HTTPException(404, "session_not_found")
+        # Basic ownership check; could extend for admin bypass later
+        if s.user_id != identity.user.id:
+            raise HTTPException(403, "forbidden")
+        if s.revoked_at:
+            return  # already revoked
+        s.revoked_at = datetime.now(timezone.utc)
+        s.revoke_reason = "user_revoked"
+        # Revoke all refresh tokens for this session
+        for rt in s.refresh_tokens:
+            if not rt.revoked_at:
+                rt.revoked_at = s.revoked_at
+                rt.revoke_reason = "session_revoked"
+        await db.flush()
+
+    return router
+
+
+__all__ = ["build_session_router"]