[dowski]

This is just a reorganization ahead of making use of the helpers and constants in an upcoming batch worker based cleanup loop.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
auth-v2	Ready	Preview	Oct 28, 2026 8:43pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
convex-auth-docs	Ignored		Oct 28, 2026 8:43pm UTC

[dowski]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Count every revoked session in revokeOtherSessions #786
• Erase expired sessions with a background batch worker loop #785
• Move the session and TTL helpers out of public.ts #784 👈 (View in Graphite)
• Compute refresh token expiry using the time it was issued and the current TTL #781
• Enforce a 100 session max per-user #783
• Session revocation support #759 : 3 other dependent PRs (#760 , #775 , #779 )
• Move to stateful session auth #757
• Remove the sessions.lastRefreshedAt field #758
• reboot

This stack of pull requests is managed by Graphite. Learn more about stacking.

[pkg-pr-new]

npm i https://pkg.pr.new/@convex-dev/auth@784

commit: 57d586a

[cubic-dev-ai]

1 issue found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/core/src/component/expiry.ts">

<violation number="1" location="packages/core/src/component/expiry.ts:32">
P2: `NaN` and `Infinity` pass this check, and a non-finite refresh TTL makes the refresh expiry comparison always false. Reject non-finite TTLs here with `Number.isFinite` so misconfiguration cannot create non-expiring sessions.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: NaN and Infinity pass this check, and a non-finite refresh TTL makes the refresh expiry comparison always false. Reject non-finite TTLs here with Number.isFinite so misconfiguration cannot create non-expiring sessions.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At packages/core/src/component/expiry.ts, line 32:

<comment>`NaN` and `Infinity` pass this check, and a non-finite refresh TTL makes the refresh expiry comparison always false. Reject non-finite TTLs here with `Number.isFinite` so misconfiguration cannot create non-expiring sessions.</comment>

<file context>
@@ -0,0 +1,61 @@
+    args.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
+  const refreshTokenTtlSeconds =
+    args.refreshTokenTtlSeconds ?? DEFAULT_REFRESH_TOKEN_TTL_SECONDS;
+  if (accessTokenTtlSeconds <= 0 || refreshTokenTtlSeconds <= 0) {
+    throw new Error("Token TTLs must be positive.");
+  }
</file context>

Suggested change

	if (accessTokenTtlSeconds <= 0 || refreshTokenTtlSeconds <= 0) {
	if (
	!Number.isFinite(accessTokenTtlSeconds) ||
	!Number.isFinite(refreshTokenTtlSeconds) ||
	accessTokenTtlSeconds <= 0 ||
	refreshTokenTtlSeconds <= 0
	) {