[dowski]

This simplifies the schema and the behavior. With the old model, a previously issued refresh token could outlast a token issued under an updated (shortened) TTL. Now a presented token is compared against the current TTL and newly issued tokens will always last longer than previously issued ones.

This is a schema breaking change: refreshTokens.expiresAt is removed, so clear the auth/refreshTokens and auth/sessions tables before updating.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
auth-v2	Ready	Preview	Oct 27, 2026 3:04pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
convex-auth-docs	Ignored		Oct 27, 2026 3:04pm UTC

[dowski]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Count every revoked session in revokeOtherSessions #786
• Erase expired sessions with a background batch worker loop #785
• Move the session and TTL helpers out of public.ts #784
• Compute refresh token expiry using the time it was issued and the current TTL #781 👈 (View in Graphite)
• Cap the absolute max sessions per user at 100 #783
• Session revocation support #759 : 3 other dependent PRs (#760 , #775 , #779 )
• Move to stateful session auth #757
• Remove the sessions.lastRefreshedAt field #758
• reboot

This stack of pull requests is managed by Graphite. Learn more about stacking.

[pkg-pr-new]

npm i https://pkg.pr.new/@convex-dev/auth@781

commit: 7ddc492