Marc-André BombeckandClaude Opus 4.7 d25e50eaf3 fix(devices): wrap revoke cascade in a single transaction ...

Both DELETE /api/devices/[id] and DELETE /api/auth/me/devices/[id]
performed the same four-write cascade (refresh-token lookup, refresh
revoke, access-token revoke, device delete) as separate Prisma calls.
A partial failure between the third and fourth write left the device
row alive with all its tokens revoked - the user's iPad showed in the
device list as "still registered" but every request returned 401.

Extract the cascade into a shared revokeDeviceCascade() helper and
wrap the writes in prisma.$transaction so they commit atomically.
Both routes now call the helper; the audit-log via tag and the wide
event action name stay route-local.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-11 02:27:47 +02:00

..

__tests__

fix(measurements): show source badge on mobile card too

2026-05-11 02:16:18 +02:00

[id]

fix(devices): wrap revoke cascade in a single transaction

2026-05-11 02:27:47 +02:00

route.ts

fix(devices): enforce global apnsToken uniqueness via partial index

2026-05-11 02:13:47 +02:00