fix: alot

apps/api/src/auth/auth.service.ts

@@ -64,6 +64,15 @@ export class AuthService {
       throw new UnauthorizedException({ code: 'invalid_refresh_token', message: 'Invalid or expired refresh token' });
     }
 
+    // Revoke first and atomically: of two requests with the same token, only one gets new tokens
+    const claimed = await this.prisma.refreshToken.updateMany({
+      where: { id: stored.id, revokedAt: null },
+      data: { revokedAt: new Date() },
+    });
+    if (claimed.count === 0) {
+      throw new UnauthorizedException({ code: 'invalid_refresh_token', message: 'Invalid or expired refresh token' });
+    }
+
     const user = await this.prisma.clientUser.findUnique({ where: { id: stored.userId } });
     if (!user) {
       throw new UnauthorizedException({ code: 'user_not_found', message: 'User not found' });
@@ -76,11 +85,6 @@ export class AuthService {
     const newHash = crypto.createHash('sha256').update(newRefreshToken).digest('hex');
     const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
 
-    await this.prisma.refreshToken.update({
-      where: { id: stored.id },
-      data: { revokedAt: new Date() },
-    });
-
     await this.prisma.refreshToken.create({
       data: {
         userId: user.id,