[dowski]

This simplifies the schema and the behavior. With the old model, a previously issued refresh token could outlast a token issued under an updated (shortened) TTL. Now a presented token is compared against the current TTL and newly issued tokens will always last longer than previously issued ones.

This is a schema breaking change: refreshTokens.expiresAt is removed, so clear the auth/refreshTokens and auth/sessions tables before updating.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
auth-v2	Ready	Preview	Oct 28, 2026 8:43pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
convex-auth-docs	Ignored		Oct 28, 2026 8:43pm UTC

[dowski]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Count every revoked session in revokeOtherSessions #786
• Erase expired sessions with a background batch worker loop #785
• Move the session and TTL helpers out of public.ts #784
• Compute refresh token expiry using the time it was issued and the current TTL #781 👈 (View in Graphite)
• Enforce a 100 session max per-user #783
• Session revocation support #759 : 3 other dependent PRs (#760 , #775 , #779 )
• Move to stateful session auth #757
• Remove the sessions.lastRefreshedAt field #758
• reboot

This stack of pull requests is managed by Graphite. Learn more about stacking.

[pkg-pr-new]

npm i https://pkg.pr.new/@convex-dev/auth@781

commit: a712847

[cubic-dev-ai]

1 issue found across 7 files

<sub>This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Re-trigger cubic</sub>

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/core/src/server/setup.ts">

<violation number="1" location="packages/core/src/server/setup.ts:215">
P3: This new refresh-token description conflicts with the function-level documentation above, which still says TTL changes affect only newly minted tokens. Update the function-level text to distinguish access-token changes from refresh-token changes so generated API docs do not publish contradictory expiry behavior.</violation>
</file>