Sessions Repository
Component Detail
Data Layer
medium complexity
Shared Component
backend
0
Dependencies
2
Dependents
1
Entities
0
Integrations
Description
Data-access layer managing the sessions and refresh_tokens tables. Handles creation, lookup, rotation, and revocation of session records. Used by Auth Service to enforce single-use refresh token rotation and to support admin-initiated session revocation.
sessions-repository
Sources & reasoning
Rotating refresh tokens and admin-initiated session revocation require reliable CRUD operations against the sessions table. Isolating this as a repository keeps Auth Service free of raw SQL and makes the session lifecycle auditable and testable independently.
No source references — this artifact was included based on reasoning alone (see above).
Responsibilities
- Persist new session records with user ID, tenant, expiry, and signing key reference
- Look up active sessions by refresh token hash
- Rotate refresh tokens atomically (invalidate old, insert new)
- Revoke individual sessions or all sessions for a user
Interfaces
createSession(userId, tenantId, refreshTokenHash, expiresAt) → Session
findByRefreshToken(tokenHash) → Session | null
rotateRefreshToken(oldHash, newHash, newExpiresAt) → Session
revokeSession(sessionId) → void
revokeAllUserSessions(userId) → void
Relationships
Dependents (2)
Components that depend on this component