From 28b34f82de9de726625e0fa43571e0fec174e076 Mon Sep 17 00:00:00 2001
From: chyoo <chyoo@futuredrive.net>
Date: Mon, 6 Jul 2026 09:23:09 +0900
Subject: [PATCH] keep one active refresh token per user

---
 src/auth/repository.ts | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/auth/repository.ts b/src/auth/repository.ts
index b6c9f8d..ccf92c2 100644
--- a/src/auth/repository.ts
+++ b/src/auth/repository.ts
@@ -455,8 +455,17 @@ export async function createRefreshToken(userId: string): Promise<string> {
   const token = createOpaqueToken()
   const expiresAt = new Date(Date.now() + config.refreshTokenTtlSeconds * 1000)
 
-  await Promise.all([
-    redis.set(refreshTokenKey(token), JSON.stringify({ userId }), 'EX', config.refreshTokenTtlSeconds),
+  await redis.set(refreshTokenKey(token), JSON.stringify({ userId }), 'EX', config.refreshTokenTtlSeconds)
+
+  await prisma.$transaction([
+    prisma.refreshToken.updateMany({
+      where: {
+        userId,
+        revokedAt: null,
+        expiresAt: { gt: new Date() }
+      },
+      data: { revokedAt: new Date() }
+    }),
     prisma.refreshToken.create({
       data: {
         userId,