keep one active refresh token per user

src/auth/repository.ts

@@ -455,8 +455,17 @@ export async function createRefreshToken(userId: string): Promise<string> {
   const token = createOpaqueToken()
   const expiresAt = new Date(Date.now() + config.refreshTokenTtlSeconds * 1000)
 
-  await Promise.all([
+  await redis.set(refreshTokenKey(token), JSON.stringify({ userId }), 'EX', config.refreshTokenTtlSeconds)
-    redis.set(refreshTokenKey(token), JSON.stringify({ userId }), 'EX', config.refreshTokenTtlSeconds),
+
+  await prisma.$transaction([
+    prisma.refreshToken.updateMany({
+      where: {
+        userId,
+        revokedAt: null,
+        expiresAt: { gt: new Date() }
+      },
+      data: { revokedAt: new Date() }
+    }),
     prisma.refreshToken.create({
       data: {
         userId,