keep one active refresh token per user

2026-07-06 09:23:09 +09:00
parent 1afd8096c8
commit 28b34f82de
1 changed files with 11 additions and 2 deletions
@@ -455,8 +455,17 @@ export async function createRefreshToken(userId: string): Promise<string> {
  const token = createOpaqueToken()
  const expiresAt = new Date(Date.now() + config.refreshTokenTtlSeconds * 1000)

-  await Promise.all([
-    redis.set(refreshTokenKey(token), JSON.stringify({ userId }), 'EX', config.refreshTokenTtlSeconds),
+  await redis.set(refreshTokenKey(token), JSON.stringify({ userId }), 'EX', config.refreshTokenTtlSeconds)
+
+  await prisma.$transaction([
+    prisma.refreshToken.updateMany({
+      where: {
+        userId,
+        revokedAt: null,
+        expiresAt: { gt: new Date() }
+      },
+      data: { revokedAt: new Date() }
+    }),
    prisma.refreshToken.create({
      data: {
        userId,