Data Layer medium complexity backend
0
Dependencies
0
Dependents
1
Entities
0
Integrations

Description

Manages persistent storage and retrieval of session records, including refresh token hashes and revocation state. It provides the query interface AuthService uses to validate and rotate tokens and to enforce per-user session limits.

Feature: Email & Password Login

session-repository

Sources & reasoning

Line 42 explicitly designates email/password as the MVP login method, with BankID/Vipps deferred to Fase 2. Line 319 repeats this in the Fase 1 MVP scope list. This is the entry-point authentication mechanism that unblocks all other features at launch, mapping to MVP by ordinal phase position.

Responsibilities

  • Persist session records linking user IDs to hashed refresh tokens and expiry timestamps
  • Query sessions by refresh token hash for validation and rotation
  • Mark sessions as revoked on logout or admin action
  • Delete expired or revoked sessions to prevent unbounded table growth
  • List active sessions per user for admin session-management views

Interfaces

createSession(userId: string, tokenHash: string, expiresAt: Date): Promise<Session>
findByTokenHash(tokenHash: string): Promise<Session | null>
revokeSession(sessionId: string): Promise<void>
revokeAllByUserId(userId: string): Promise<void>
deleteExpired(): Promise<number>

Related Data Entities (1)

Data entities managed by this component