refactor(refresh): remove the legacy refresh-token fallback scan#72
Merged
Conversation
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
findRefreshSessionByToken now resolves sessions solely by their indexed refreshTokenLookup fingerprint and returns Session | null. The legacy compatibility path that scanned every pre-fingerprint session and bcrypt-compared each hash on a lookup miss is removed, along with the RefreshSessionLookupResult wrapper and its per-request Session.findAll scan. The refresh controller and tests are updated accordingly. Sessions created before the refreshTokenLookup migration are no longer refreshable and must re-authenticate; those are well past the refresh token TTL, so no active sessions are affected. Closes #18
Bccorb
force-pushed
the
feat/refresh-fallback-telemetry
branch
from
883d99d to
7d89315
Compare
Bccorb
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #18
Summary
Removes the legacy refresh-token fallback scan entirely (superseding the earlier telemetry approach).
findRefreshSessionByTokennow resolves a session solely by its indexedrefreshTokenLookupfingerprint and returnsSession | null. The compatibility path that, on a lookup miss, loaded every pre-fingerprint session (Session.findAll({ refreshTokenLookup: null })) andbcrypt-compared each hash is gone, along with theRefreshSessionLookupResultwrapper and the now-unusedcompareSyncimport.Why now
The
refreshTokenLookupcolumn was added months ago (migration20260423150000-add-refresh-token-lookup). Any session created before it is far past the refresh-token TTL (1h by default), so no active session relies on the fallback. Removing it drops a full-tableSession.findAll+ per-row bcrypt on every lookup miss.Behavior change
Sessions created before the
refreshTokenLookupmigration are no longer refreshable and must re-authenticate. As above, none should be active. The/refreshresponse shape and success path are unchanged.Changes
src/services/sessionService.ts— simplifyfindRefreshSessionByTokento the indexed lookup; returnSession | null; drop the interface andcompareSyncimport.src/controllers/authentication.ts— consume the plain session; remove theusedLegacyFallback/legacyFallbackCandidateshandling.Testing
Typecheck + lint clean; full suite green (495 passed). Rebased onto current
main.