fix(auth): preserve existing sessions on login

src/worker/routes/auth.ts

@@ -19,7 +19,6 @@ import {
   createSession,
   randomBase64Url,
   revokeSessionByTokenHash,
-  revokeUserSessions,
   sha256Hex,
 } from '../services/sessions';
 import {refreshGoogleUserAvatar, synchronizeGoogleUser} from '../services/users';
@@ -108,7 +107,6 @@ authRoutes.get('/callback', async (c) => {
     const identity = await verifyGoogleIdToken(c.env, config, idToken, consumed.nonce);
     const user = await synchronizeGoogleUser(c.env.DB, identity);
     await refreshGoogleUserAvatar(c.env.ATTACHMENTS, user);
-    await revokeUserSessions(c.env.DB, user.id, now);
     const session = await createSession(c.env.DB, user.id, now);
     c.header('Set-Cookie', sessionCookie(session.token, config));
     return c.redirect('/');

src/worker/services/sessions.ts

@@ -115,20 +115,6 @@ export async function revokeSessionByTokenHash(
     .run();
 }
 
-export async function revokeUserSessions(
-  db: D1Database,
-  userId: string,
-  now = nowSeconds(),
-) {
-  await db
-    .prepare(
-      `UPDATE user_sessions SET revoked_at = ?
-       WHERE user_id = ? AND revoked_at IS NULL`,
-    )
-    .bind(now, userId)
-    .run();
-}
-
 export async function cleanupExpiredAuthRecords(db: D1Database, now = nowSeconds()) {
   await db.batch([
     db

test/auth/auth.test.ts

@@ -419,7 +419,7 @@ describe('Google OAuth authorization code flow', () => {
     });
   });
 
-  it('rotates existing sessions on login while preserving D1 admin authority', async () => {
+  it('keeps existing sessions alive on login while preserving D1 admin authority', async () => {
     const oldCookie = await createSessionCookie();
     await env.DB.prepare(
       "UPDATE users SET is_admin = 1 WHERE google_subject = 'google-member'",
@@ -432,9 +432,11 @@ describe('Google OAuth authorization code flow', () => {
     const loggedIn = await callback(state);
     const newCookie = cookieToken(loggedIn.headers.get('Set-Cookie')!);
 
-    expect((await SELF.fetch(endpoint, {headers: {Cookie: oldCookie}})).status).toBe(401);
-    const session = await SELF.fetch(endpoint, {headers: {Cookie: newCookie}});
-    expect(await session.json()).toMatchObject({user: {role: 'admin'}});
+    const oldSession = await SELF.fetch(endpoint, {headers: {Cookie: oldCookie}});
+    expect(oldSession.status).toBe(200);
+    expect(await oldSession.json()).toMatchObject({user: {role: 'admin'}});
+    const newSession = await SELF.fetch(endpoint, {headers: {Cookie: newCookie}});
+    expect(await newSession.json()).toMatchObject({user: {role: 'admin'}});
   });
 });