[HouMinXi]

Summary

• Revoking an access token by its display prefix updated every live token that shared that prefix, while the route reported one success. token_prefix has no unique constraint, so a shared prefix is possible.
• A prefix that matches more than one live token now revokes none and the route returns 409. An exact id still revokes that one token. Revoking an already-revoked token returns success, so a retry after a lost response does not come back as 404.
• Every successful verification rewrote last_used_at, and one management request verifies the same token more than once. The stored stamp is now reused for 60 seconds.

Related Issues

• Closes fix(auth): access-token store — non-unique prefix revoke, per-verification writes, non-idempotent revoke #15126

Validation

• Change type: other (access-token store)
• Focused tests: node --import tsx/esm --test tests/unit/access-tokens-db.test.ts tests/unit/cli-token-delete-route.test.ts (18 pass)
• eslint on the changed files, with the repo suppression file
• Reconciled with release/v3.8.52 @ 23a1148486
• New and updated tests cover the change
• Defect injection: letting a shared prefix revoke the first match, and removing the 409 branch, each turns its assertion red, and both were restored

Tests Added Or Updated

• tests/unit/access-tokens-db.test.ts (updated)
• tests/unit/cli-token-delete-route.test.ts (added)

Coverage Notes

• The tests plant two tokens with one prefix and assert neither is revoked, assert an already-revoked token returns success, and assert two verifications inside the window write once.

Reviewer Notes

• No migration adds a unique constraint on token_prefix. Existing rows can already share a prefix, so the revoke refuses the ambiguous case instead of assuming it cannot happen.