fix(auth): refactor refresh token to have same family id on same session

Author: devxsameer

src/modules/auth/auth.repository.ts

@@ -1,7 +1,7 @@
 // src/modules/auth/auth.repository.ts
 import { db } from "@/db/index.js";
 import { refreshTokensTable } from "@/db/schema/tokens.js";
-import { and, eq, isNull } from "drizzle-orm";
+import { and, eq, gt, isNull } from "drizzle-orm";
 
 export function saveRefreshToken(data: {
   userId: string;
@@ -21,7 +21,8 @@ export function findValidRefreshToken(tokenHash: string) {
     .where(
       and(
         eq(refreshTokensTable.tokenHash, tokenHash),
-        isNull(refreshTokensTable.revokedAt)
+        isNull(refreshTokensTable.revokedAt),
+        gt(refreshTokensTable.expiresAt, new Date())
       )
     )
     .limit(1);
@@ -51,4 +52,4 @@ export function revokeAllUserTokens(userId: string) {
         isNull(refreshTokensTable.revokedAt)
       )
     );
-}
+}

src/modules/auth/auth.service.ts

@@ -46,7 +46,8 @@ export async function signup(
     `📧 Verify email: ${process.env.FRONTEND_URL}/verify-email?token=${verificationToken}`
   );
 
-  const { accessToken, refreshToken } = await issueTokens(user, meta);
+  const familyId = generateFamilyId();
+  const { accessToken, refreshToken } = await issueTokens(user, meta, familyId);
 
   return {
     user: presentUser(user),
@@ -72,7 +73,8 @@ export async function login(
     throw new UnauthorizedError("Invalid credentials");
   }
 
-  const { accessToken, refreshToken } = await issueTokens(user, meta);
+  const familyId = generateFamilyId();
+  const { accessToken, refreshToken } = await issueTokens(user, meta, familyId);
 
   return {
     user: presentUser(user),
@@ -95,24 +97,23 @@ export async function refresh(refreshToken: string, meta: RequestMeta) {
 
   await AuthRepo.revokeTokenFamily(stored.familyId);
 
-  return issueTokens(user, meta);
+  return issueTokens(user, meta, stored.familyId);
 }
 
 export async function logout(refreshToken: string) {
   const tokenHash = hashToken(refreshToken);
   await AuthRepo.revokeRefreshToken(tokenHash);
 }
 
-async function issueTokens(user: any, meta: RequestMeta) {
+async function issueTokens(user: any, meta: RequestMeta, familyId: string) {
   const accessToken = signAccessToken(user.id, user.role, user.isReadOnly);
 
   const refreshToken = generateOpaqueToken();
-  const familyId = generateFamilyId();
 
   await AuthRepo.saveRefreshToken({
     userId: user.id,
     tokenHash: hashToken(refreshToken),
-    familyId,
+    familyId: familyId,
     expiresAt: new Date(Date.now() + REFRESH_TOKEN_TTL),
     ipAddress: meta.ip,
     userAgent: meta.userAgent,