From 0a0c0e313e5941cd85db1d846f871d888da774bd Mon Sep 17 00:00:00 2001
From: Michael Freno <michaelt.freno@gmail.com>
Date: Wed, 7 Jan 2026 16:22:31 -0500
Subject: [PATCH] migrated

---
 src/components/TerminalErrorPage.tsx      |   45 +-
 src/context/auth.tsx                      |   39 +-
 src/lib/auth-query.ts                     |   96 +-
 src/routes/api/auth/signout.ts            |   13 +-
 src/routes/test.tsx                       |    3 +-
 src/server/api/routers/auth.ts            | 1114 +++------------------
 src/server/api/routers/user.ts            |   31 -
 src/server/api/utils.ts                   |   25 +-
 src/server/audit.ts                       |    1 +
 src/server/auth.ts                        |  227 +----
 src/server/security/auth.test.ts          |  486 ---------
 src/server/security/authorization.test.ts |  417 --------
 src/server/session-config.ts              |   51 +
 src/server/session-helpers.ts             |  499 +++++++++
 src/types/user.ts                         |   13 -
 15 files changed, 809 insertions(+), 2251 deletions(-)
 delete mode 100644 src/server/security/auth.test.ts
 delete mode 100644 src/server/security/authorization.test.ts
 create mode 100644 src/server/session-config.ts
 create mode 100644 src/server/session-helpers.ts

diff --git a/src/components/TerminalErrorPage.tsx b/src/components/TerminalErrorPage.tsx
index ee7541b..23056cb 100644
--- a/src/components/TerminalErrorPage.tsx
+++ b/src/components/TerminalErrorPage.tsx
@@ -17,6 +17,23 @@ interface TerminalErrorPageProps {
   disableTerminal?: boolean;
 }
 
+// Safe router hook wrappers that return undefined if outside Route context
+function useSafeNavigate() {
+  try {
+    return useNavigate();
+  } catch {
+    return undefined;
+  }
+}
+
+function useSafeLocation() {
+  try {
+    return useLocation();
+  } catch {
+    return undefined;
+  }
+}
+
 export function TerminalErrorPage(props: TerminalErrorPageProps) {
   const [command, setCommand] = createSignal("");
   const [history, setHistory] = createSignal<CommandHistoryItem[]>([]);
@@ -24,8 +41,8 @@ export function TerminalErrorPage(props: TerminalErrorPageProps) {
   const [btopOpen, setBtopOpen] = createSignal(false);
   let inputRef: HTMLInputElement | undefined;
   let footerRef: HTMLDivElement | undefined;
-  const navigate = useNavigate();
-  const location = useLocation();
+  const navigate = useSafeNavigate();
+  const location = useSafeLocation();
   const { isDark } = useDarkMode();
 
   createEffect(() => {
@@ -107,17 +124,19 @@ export function TerminalErrorPage(props: TerminalErrorPageProps) {
       <div class="text-subtext1">Quick actions:</div>
       {props.quickActions}
 
-      <button
-        onClick={() => navigate!("/")}
-        class="group border-surface0 bg-mantle hover:border-blue hover:bg-surface0 flex w-full cursor-pointer items-center gap-2 border px-4 py-3 text-left transition-all"
-      >
-        <span class="text-green">$</span>
-        <span class="text-blue group-hover:text-sky">cd</span>
-        <span class="text-text group-hover:text-blue">~</span>
-        <span class="text-subtext1 ml-auto opacity-0 transition-opacity group-hover:opacity-100">
-          [Return home]
-        </span>
-      </button>
+      <Show when={navigate}>
+        <button
+          onClick={() => navigate!("/")}
+          class="group border-surface0 bg-mantle hover:border-blue hover:bg-surface0 flex w-full cursor-pointer items-center gap-2 border px-4 py-3 text-left transition-all"
+        >
+          <span class="text-green">$</span>
+          <span class="text-blue group-hover:text-sky">cd</span>
+          <span class="text-text group-hover:text-blue">~</span>
+          <span class="text-subtext1 ml-auto opacity-0 transition-opacity group-hover:opacity-100">
+            [Return home]
+          </span>
+        </button>
+      </Show>
 
       <button
         onClick={() => window.history.back()}
diff --git a/src/context/auth.tsx b/src/context/auth.tsx
index 3e706f4..b592221 100644
--- a/src/context/auth.tsx
+++ b/src/context/auth.tsx
@@ -51,26 +51,25 @@ interface AuthContextType {
 const AuthContext = createContext<AuthContextType>();
 
 export const AuthProvider: ParentComponent = (props) => {
-  // Signal to force re-fetch when auth state changes
-  const [refreshTrigger, setRefreshTrigger] = createSignal(0);
+  // Get server state using createAsync which works with cache()
+  const serverAuth = createAsync(() => getUserState(), { deferStream: true });
 
-  // Get server state via SolidStart query - tracks refreshTrigger for reactivity
-  const serverAuth = createAsync(
-    () => {
-      refreshTrigger(); // Track the signal to force re-run
-      return getUserState();
-    },
-    { deferStream: true }
-  );
-
-  // Refresh callback that invalidates cache and forces re-fetch
+  // Refresh callback that forces re-fetch
   const refreshAuth = () => {
-    revalidate(getUserState.key);
-    setRefreshTrigger((prev) => prev + 1); // Trigger re-fetch
+    // Manually trigger a re-fetch by calling the revalidate function
+    revalidate(["user-auth-state"]);
   };
 
-  // Server-side refresh in getUserState() handles auto-signin during SSR
-  // No client-side fallback needed - server handles everything with httpOnly cookies
+  // Convenience accessors with safe defaults - MUST BE DEFINED BEFORE onMount
+  const isAuthenticated = () => serverAuth()?.isAuthenticated ?? false;
+  const email = () => serverAuth()?.email ?? null;
+  const displayName = () => serverAuth()?.displayName ?? null;
+  const userId = () => serverAuth()?.userId ?? null;
+  const isAdmin = () => serverAuth()?.privilegeLevel === "admin";
+  const isEmailVerified = () => serverAuth()?.emailVerified ?? false;
+
+  // Server handles all token refresh logic
+  // Client just displays the current auth state from server
 
   // Listen for auth refresh events from external sources (token refresh, etc.)
   onMount(() => {
@@ -88,14 +87,6 @@ export const AuthProvider: ParentComponent = (props) => {
     });
   });
 
-  // Convenience accessors with safe defaults
-  const isAuthenticated = () => serverAuth()?.isAuthenticated ?? false;
-  const email = () => serverAuth()?.email ?? null;
-  const displayName = () => serverAuth()?.displayName ?? null;
-  const userId = () => serverAuth()?.userId ?? null;
-  const isAdmin = () => serverAuth()?.privilegeLevel === "admin";
-  const isEmailVerified = () => serverAuth()?.emailVerified ?? false;
-
   // Start/stop token refresh manager based on auth state
   let previousAuth: boolean | undefined = undefined;
   createEffect(() => {
diff --git a/src/lib/auth-query.ts b/src/lib/auth-query.ts
index 6d665a9..e235791 100644
--- a/src/lib/auth-query.ts
+++ b/src/lib/auth-query.ts
@@ -1,13 +1,3 @@
-/**
- * Shared Auth Query
- * Single source of truth for authentication state across the app
- *
- * Security Model:
- * - Server query reads from httpOnly cookies (secure)
- * - Client context syncs from this query (UI convenience)
- * - Server endpoints always validate independently (never trust client)
- */
-
 import { query, revalidate as revalidateKey } from "@solidjs/router";
 import { getRequestEvent } from "solid-js/web";
 
@@ -21,70 +11,31 @@ export interface UserState {
 }
 
 /**
- * Global auth state query - single source of truth
- * Called on server during SSR, cached by SolidStart router
+ * Get current user state from server
+ * Uses cache() to ensure single execution per request and proper SSR hydration
  */
 export const getUserState = query(async (): Promise<UserState> => {
   "use server";
-  const { getPrivilegeLevel, getUserID } = await import("~/server/auth");
+  const { checkAuthStatus } = await import("~/server/auth");
   const { ConnectionFactory } = await import("~/server/utils");
-  const { getCookie, setCookie } = await import("vinxi/http");
-  const event = getRequestEvent()!;
 
-  let privilegeLevel = await getPrivilegeLevel(event.nativeEvent);
-  let userId = await getUserID(event.nativeEvent);
+  const event = getRequestEvent();
 
-  // If no userId but refresh token exists, attempt server-side token refresh
-  // Use a flag cookie to prevent infinite loops (only try once per request)
-  if (!userId) {
-    const refreshToken = getCookie(event.nativeEvent, "refreshToken");
-    const refreshAttempted = getCookie(event.nativeEvent, "_refresh_attempted");
-
-    if (refreshToken && !refreshAttempted) {
-      console.log(
-        "[Auth-Query] Access token expired but refresh token exists, attempting server-side refresh"
-      );
-
-      // Set flag to prevent retry loops (expires immediately, just for this request)
-      setCookie(event.nativeEvent, "_refresh_attempted", "1", {
-        maxAge: 1,
-        path: "/",
-        httpOnly: true
-      });
-
-      try {
-        // Import token rotation function
-        const { attemptTokenRefresh } =
-          await import("~/server/api/routers/auth");
-
-        // Attempt to refresh tokens server-side
-        const refreshed = await attemptTokenRefresh(
-          event.nativeEvent,
-          refreshToken
-        );
-
-        if (refreshed) {
-          console.log("[Auth-Query] Server-side token refresh successful");
-          // Re-check auth state with new tokens
-          privilegeLevel = await getPrivilegeLevel(event.nativeEvent);
-          userId = await getUserID(event.nativeEvent);
-        } else {
-          console.log("[Auth-Query] Server-side token refresh failed");
-        }
-      } catch (error) {
-        console.error(
-          "[Auth-Query] Error during server-side token refresh:",
-          error
-        );
-      }
-    } else if (refreshAttempted) {
-      console.log(
-        "[Auth-Query] Refresh already attempted this request, skipping"
-      );
-    }
+  // Safety check: if no event, we're not in a request context
+  if (!event || !event.nativeEvent) {
+    return {
+      isAuthenticated: false,
+      userId: null,
+      email: null,
+      displayName: null,
+      emailVerified: false,
+      privilegeLevel: "anonymous"
+    };
   }
 
-  if (!userId) {
+  const auth = await checkAuthStatus(event.nativeEvent);
+
+  if (!auth.isAuthenticated || !auth.userId) {
     return {
       isAuthenticated: false,
       userId: null,
@@ -98,7 +49,7 @@ export const getUserState = query(async (): Promise<UserState> => {
   const conn = ConnectionFactory();
   const res = await conn.execute({
     sql: "SELECT email, display_name, email_verified FROM User WHERE id = ?",
-    args: [userId]
+    args: [auth.userId]
   });
 
   if (res.rows.length === 0) {
@@ -116,22 +67,23 @@ export const getUserState = query(async (): Promise<UserState> => {
 
   return {
     isAuthenticated: true,
-    userId,
+    userId: auth.userId,
     email: user.email ?? null,
     displayName: user.display_name ?? null,
     emailVerified: user.email_verified === 1,
-    privilegeLevel
+    privilegeLevel: auth.isAdmin ? "admin" : "user"
   };
-}, "global-auth-state");
+}, "user-auth-state");
 
 /**
  * Revalidate auth state globally
  * Call this after login, logout, token refresh, email verification
  */
 export function revalidateAuth() {
-  revalidateKey(getUserState.key);
+  // Revalidate the cache
+  revalidateKey("user-auth-state");
 
-  // Dispatch browser event to trigger UI updates (client-side only)
+  // Dispatch event to trigger UI updates (client-side only)
   if (typeof window !== "undefined") {
     window.dispatchEvent(new CustomEvent("auth-state-changed"));
 
diff --git a/src/routes/api/auth/signout.ts b/src/routes/api/auth/signout.ts
index 72b1623..f0d5197 100644
--- a/src/routes/api/auth/signout.ts
+++ b/src/routes/api/auth/signout.ts
@@ -1,18 +1,13 @@
 import type { APIEvent } from "@solidjs/start/server";
-import { getCookie, getEvent, setCookie } from "vinxi/http";
+import { getEvent, clearSession } from "vinxi/http";
+import { sessionConfig } from "~/server/session-config";
 
 export async function POST() {
   "use server";
   const event = getEvent()!;
 
-  setCookie(event, "userIDToken", "", {
-    path: "/",
-    httpOnly: true,
-    secure: true,
-    sameSite: "lax",
-    maxAge: 0,
-    expires: new Date(0)
-  });
+  // Clear Vinxi session
+  await clearSession(event, sessionConfig);
 
   return new Response(null, {
     status: 302,
diff --git a/src/routes/test.tsx b/src/routes/test.tsx
index ce2b567..0fcaa3f 100644
--- a/src/routes/test.tsx
+++ b/src/routes/test.tsx
@@ -1158,8 +1158,7 @@ export default function TestPage() {
                 <div>
                   <h3 class="mb-2 text-lg font-semibold">🔴 Admin Required</h3>
                   <p class="mb-2 text-sm">
-                    Maintenance endpoints require admin privileges (userIDToken
-                    cookie with ADMIN_ID).
+                    Maintenance endpoints require admin privileges.
                   </p>
                   <ul class="ml-6 list-disc space-y-1 text-sm">
                     <li>
diff --git a/src/server/api/routers/auth.ts b/src/server/api/routers/auth.ts
index 05ada92..fa93d6f 100644
--- a/src/server/api/routers/auth.ts
+++ b/src/server/api/routers/auth.ts
@@ -1,7 +1,6 @@
 import { createTRPCRouter, publicProcedure } from "../utils";
 import { z } from "zod";
 import { TRPCError } from "@trpc/server";
-import { v4 as uuidV4 } from "uuid";
 import { env } from "~/env/server";
 import {
   ConnectionFactory,
@@ -9,7 +8,6 @@ import {
   checkPassword,
   checkPasswordSafe
 } from "~/server/utils";
-import { SignJWT, jwtVerify } from "jose";
 import { setCookie, getCookie } from "vinxi/http";
 import type { User } from "~/db/types";
 import {
@@ -47,15 +45,17 @@ import {
 import { logAuditEvent } from "~/server/audit";
 import type { H3Event } from "vinxi/http";
 import type { Context } from "../utils";
+import { AUTH_CONFIG, NETWORK_CONFIG, COOLDOWN_TIMERS } from "~/config";
 import {
-  AUTH_CONFIG,
-  NETWORK_CONFIG,
-  COOLDOWN_TIMERS,
-  getAccessTokenExpiry,
-  getAccessCookieMaxAge,
-  getRefreshCookieMaxAge
-} from "~/config";
-import { randomBytes, createHash, timingSafeEqual } from "crypto";
+  createAuthSession,
+  getAuthSession,
+  invalidateAuthSession,
+  rotateAuthSession,
+  revokeTokenFamily
+} from "~/server/session-helpers";
+import { checkAuthStatus } from "~/server/auth";
+import { v4 as uuidV4 } from "uuid";
+import { jwtVerify, SignJWT } from "jose";
 
 /**
  * Safely extract H3Event from Context
@@ -71,552 +71,11 @@ function getH3Event(ctx: Context): H3Event {
   return ctx.event as unknown as H3Event;
 }
 
-// Cookie name constants
-const REFRESH_TOKEN_COOKIE_NAME = "refreshToken" as const;
-const ACCESS_TOKEN_COOKIE_NAME = "userIDToken" as const;
-
 // Zod schemas
 const refreshTokenSchema = z.object({
   rememberMe: z.boolean().optional().default(false)
 });
 
-/**
- * Generate a cryptographically secure refresh token
- * @returns Base64URL-encoded random token (32 bytes = 256 bits)
- */
-function generateRefreshToken(): string {
-  return randomBytes(32).toString("base64url");
-}
-
-/**
- * Hash refresh token for storage (one-way hash)
- * Using SHA-256 since refresh tokens are high-entropy random values
- * @param token - Plaintext refresh token
- * @returns Hex-encoded hash
- */
-function hashRefreshToken(token: string): string {
-  return createHash("sha256").update(token).digest("hex");
-}
-
-/**
- * Validate refresh token against database
- * Uses timing-safe comparison to prevent timing attacks
- * @param token - Plaintext refresh token from client
- * @param sessionId - Session ID to validate against
- * @returns Session record if valid, null otherwise
- */
-async function validateRefreshToken(
-  token: string,
-  sessionId: string
-): Promise<{
-  id: string;
-  user_id: string;
-  token_family: string;
-  parent_session_id: string | null;
-  rotation_count: number;
-  expires_at: string;
-  revoked: number;
-} | null> {
-  const conn = ConnectionFactory();
-  const tokenHash = hashRefreshToken(token);
-
-  try {
-    const result = await conn.execute({
-      sql: `SELECT id, user_id, token_family, parent_session_id, 
-                   rotation_count, expires_at, revoked, refresh_token_hash
-            FROM Session 
-            WHERE id = ?`,
-      args: [sessionId]
-    });
-
-    if (result.rows.length === 0) {
-      return null;
-    }
-
-    const session = result.rows[0];
-    const storedHash = session.refresh_token_hash as string;
-
-    // Timing-safe comparison to prevent timing attacks
-    if (
-      !timingSafeEqual(
-        Buffer.from(tokenHash, "hex"),
-        Buffer.from(storedHash, "hex")
-      )
-    ) {
-      return null;
-    }
-
-    // Check if revoked
-    if (session.revoked === 1) {
-      return null;
-    }
-
-    // Check if expired
-    const expiresAt = new Date(session.expires_at as string);
-    if (expiresAt < new Date()) {
-      return null;
-    }
-
-    return {
-      id: session.id as string,
-      user_id: session.user_id as string,
-      token_family: session.token_family as string,
-      parent_session_id: session.parent_session_id as string | null,
-      rotation_count: session.rotation_count as number,
-      expires_at: session.expires_at as string,
-      revoked: session.revoked as number
-    };
-  } catch (error) {
-    console.error("Refresh token validation error:", error);
-    return null;
-  }
-}
-
-/**
- * Invalidate a specific session
- * Sets revoked flag without deleting (for audit trail)
- * @param sessionId - Session ID to invalidate
- */
-async function invalidateSession(sessionId: string): Promise<void> {
-  const conn = ConnectionFactory();
-  console.log(`[Session] Invalidating session ${sessionId}`);
-  await conn.execute({
-    sql: "UPDATE Session SET revoked = 1 WHERE id = ?",
-    args: [sessionId]
-  });
-}
-
-/**
- * Revoke all sessions in a token family
- * Used when breach is detected (token reuse)
- * @param tokenFamily - Token family ID to revoke
- * @param reason - Reason for revocation (for audit)
- */
-async function revokeTokenFamily(
-  tokenFamily: string,
-  reason: string = "breach_detected"
-): Promise<void> {
-  const conn = ConnectionFactory();
-
-  // Get all sessions in family for audit log
-  const sessions = await conn.execute({
-    sql: "SELECT id, user_id FROM Session WHERE token_family = ? AND revoked = 0",
-    args: [tokenFamily]
-  });
-
-  // Revoke all sessions in family
-  console.log(
-    `[Token Family] Revoking entire family ${tokenFamily} (reason: ${reason}). Sessions affected: ${sessions.rows.length}`
-  );
-  await conn.execute({
-    sql: "UPDATE Session SET revoked = 1 WHERE token_family = ?",
-    args: [tokenFamily]
-  });
-
-  // Log audit events for each affected session
-  for (const session of sessions.rows) {
-    await logAuditEvent({
-      userId: session.user_id as string,
-      eventType: "auth.token_family_revoked",
-      eventData: {
-        tokenFamily,
-        sessionId: session.id as string,
-        reason
-      },
-      success: true
-    });
-  }
-
-  console.warn(`Token family ${tokenFamily} revoked: ${reason}`);
-}
-
-/**
- * Detect if a token is being reused after rotation
- * Implements grace period for race conditions
- * @param sessionId - Session ID being validated
- * @returns true if reuse detected (and revocation occurred), false otherwise
- */
-async function detectTokenReuse(sessionId: string): Promise<boolean> {
-  const conn = ConnectionFactory();
-
-  // Check if this session has already been rotated (has child session)
-  const childCheck = await conn.execute({
-    sql: `SELECT id, created_at FROM Session 
-          WHERE parent_session_id = ? 
-          ORDER BY created_at DESC 
-          LIMIT 1`,
-    args: [sessionId]
-  });
-
-  if (childCheck.rows.length === 0) {
-    // No child session, this is legitimate first use
-    return false;
-  }
-
-  const childSession = childCheck.rows[0];
-  const childCreatedAt = new Date(childSession.created_at as string);
-  const now = new Date();
-  const timeSinceRotation = now.getTime() - childCreatedAt.getTime();
-
-  // Grace period for race conditions (e.g., slow network, retries)
-  if (timeSinceRotation < AUTH_CONFIG.REFRESH_TOKEN_REUSE_WINDOW_MS) {
-    console.warn(
-      `[Token Reuse] Within grace period (${timeSinceRotation}ms < ${AUTH_CONFIG.REFRESH_TOKEN_REUSE_WINDOW_MS}ms), allowing for session ${sessionId}`
-    );
-    return false;
-  }
-
-  // Reuse detected outside grace period - this is a breach!
-  console.error(
-    `[Token Reuse] BREACH DETECTED! Session ${sessionId} rotated ${timeSinceRotation}ms ago (grace period: ${AUTH_CONFIG.REFRESH_TOKEN_REUSE_WINDOW_MS}ms). Child session: ${childSession.id}`
-  );
-
-  // Get token family and revoke entire family
-  const sessionInfo = await conn.execute({
-    sql: "SELECT token_family, user_id FROM Session WHERE id = ?",
-    args: [sessionId]
-  });
-
-  if (sessionInfo.rows.length > 0) {
-    const tokenFamily = sessionInfo.rows[0].token_family as string;
-    const userId = sessionInfo.rows[0].user_id as string;
-
-    await revokeTokenFamily(tokenFamily, "token_reuse_detected");
-
-    // Log critical security event
-    await logAuditEvent({
-      userId,
-      eventType: "auth.token_reuse_detected",
-      eventData: {
-        sessionId,
-        tokenFamily,
-        timeSinceRotation
-      },
-      success: false
-    });
-
-    return true;
-  }
-
-  return false;
-}
-
-/**
- * Rotate refresh token: invalidate old, issue new tokens
- * Implements automatic breach detection
- * @param oldRefreshToken - Current refresh token from client
- * @param oldSessionId - Current session ID from JWT
- * @param rememberMe - Whether to extend session lifetime
- * @param ipAddress - Client IP address for new session
- * @param userAgent - Client user agent for new session
- * @returns New tokens or null if rotation fails
- */
-async function rotateRefreshToken(
-  oldRefreshToken: string,
-  oldSessionId: string,
-  rememberMe: boolean,
-  ipAddress: string,
-  userAgent: string
-): Promise<{
-  accessToken: string;
-  refreshToken: string;
-  sessionId: string;
-} | null> {
-  console.log(`[Token Rotation] Starting rotation for session ${oldSessionId}`);
-
-  // Step 1: Validate old refresh token
-  const oldSession = await validateRefreshToken(oldRefreshToken, oldSessionId);
-
-  if (!oldSession) {
-    console.warn(
-      `[Token Rotation] Invalid refresh token during rotation for session ${oldSessionId}`
-    );
-    return null;
-  }
-
-  console.log(
-    `[Token Rotation] Refresh token validated for session ${oldSessionId}`
-  );
-
-  // Step 2: Detect token reuse (breach detection)
-  const reuseDetected = await detectTokenReuse(oldSessionId);
-  if (reuseDetected) {
-    console.error(
-      `[Token Rotation] Token reuse detected for session ${oldSessionId}`
-    );
-    // Token family already revoked by detectTokenReuse
-    return null;
-  }
-
-  console.log(
-    `[Token Rotation] No token reuse detected for session ${oldSessionId}`
-  );
-
-  // Step 3: Check rotation limit
-  if (oldSession.rotation_count >= AUTH_CONFIG.MAX_ROTATION_COUNT) {
-    console.warn(
-      `[Token Rotation] Max rotation count reached for session ${oldSessionId}`
-    );
-    await invalidateSession(oldSessionId);
-    return null;
-  }
-
-  console.log(
-    `[Token Rotation] Rotation count OK (${oldSession.rotation_count}/${AUTH_CONFIG.MAX_ROTATION_COUNT})`
-  );
-
-  // Step 4: Generate new tokens
-  const newRefreshToken = generateRefreshToken();
-  const refreshExpiry = rememberMe
-    ? AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_LONG
-    : AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_SHORT;
-
-  // Step 5: Create new session (linked to old via parent_session_id)
-  const { sessionId: newSessionId, tokenFamily } = await createSession(
-    oldSession.user_id,
-    refreshExpiry,
-    ipAddress,
-    userAgent,
-    newRefreshToken,
-    oldSessionId, // parent session for audit trail
-    oldSession.token_family // reuse family
-  );
-
-  // Step 6: Create new access token
-  const newAccessToken = await createJWT(
-    oldSession.user_id,
-    newSessionId,
-    getAccessTokenExpiry()
-  );
-
-  // Step 7: Invalidate old session (after new one is created successfully)
-  await invalidateSession(oldSessionId);
-
-  // Step 8: Log rotation event
-  await logAuditEvent({
-    userId: oldSession.user_id,
-    eventType: "auth.token_rotated",
-    eventData: {
-      oldSessionId,
-      newSessionId,
-      tokenFamily,
-      rotationCount: oldSession.rotation_count + 1
-    },
-    success: true
-  });
-
-  return {
-    accessToken: newAccessToken,
-    refreshToken: newRefreshToken,
-    sessionId: newSessionId
-  };
-}
-
-/**
- * Extract session ID from access token (JWT)
- * @param accessToken - JWT access token
- * @returns Session ID or null if invalid
- */
-async function getSessionIdFromToken(
-  accessToken: string
-): Promise<string | null> {
-  try {
-    const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-    const { payload } = await jwtVerify(accessToken, secret);
-    return (payload.sid as string) || null;
-  } catch (error) {
-    return null;
-  }
-}
-
-/**
- * Create JWT with session tracking
- * @param userId - User ID
- * @param sessionId - Session ID for revocation tracking
- * @param expiresIn - Token expiration time (e.g., "14d", "12h")
- */
-async function createJWT(
-  userId: string,
-  sessionId: string,
-  expiresIn: string = AUTH_CONFIG.JWT_EXPIRY
-): Promise<string> {
-  const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-  const token = await new SignJWT({
-    id: userId,
-    sid: sessionId, // Session ID for revocation
-    iat: Math.floor(Date.now() / 1000)
-  })
-    .setProtectedHeader({ alg: "HS256" })
-    .setExpirationTime(expiresIn)
-    .sign(secret);
-  return token;
-}
-
-/**
- * Create a new session in the database with refresh token support
- * @param userId - User ID
- * @param expiresIn - Refresh token expiration (e.g., "7d", "90d")
- * @param ipAddress - Client IP address
- * @param userAgent - Client user agent string
- * @param refreshToken - Plaintext refresh token to hash and store
- * @param parentSessionId - ID of parent session if this is a rotation (null for new sessions)
- * @param tokenFamily - Token family UUID for rotation chain (generated if null)
- * @returns Object with sessionId and tokenFamily
- */
-async function createSession(
-  userId: string,
-  expiresIn: string,
-  ipAddress: string,
-  userAgent: string,
-  refreshToken: string,
-  parentSessionId: string | null = null,
-  tokenFamily: string | null = null
-): Promise<{ sessionId: string; tokenFamily: string }> {
-  const conn = ConnectionFactory();
-  const sessionId = uuidV4();
-  const family = tokenFamily || uuidV4();
-  const tokenHash = hashRefreshToken(refreshToken);
-
-  // Calculate refresh token expiration
-  const expiresAt = new Date();
-  if (expiresIn.endsWith("d")) {
-    const days = parseInt(expiresIn);
-    expiresAt.setDate(expiresAt.getDate() + days);
-  } else if (expiresIn.endsWith("h")) {
-    const hours = parseInt(expiresIn);
-    expiresAt.setHours(expiresAt.getHours() + hours);
-  } else if (expiresIn.endsWith("m")) {
-    const minutes = parseInt(expiresIn);
-    expiresAt.setMinutes(expiresAt.getMinutes() + minutes);
-  }
-
-  // Calculate access token expiry (always shorter than refresh token)
-  const accessExpiresAt = new Date();
-  const accessExpiry = getAccessTokenExpiry();
-  if (accessExpiry.endsWith("m")) {
-    const minutes = parseInt(accessExpiry);
-    accessExpiresAt.setMinutes(accessExpiresAt.getMinutes() + minutes);
-  } else if (accessExpiry.endsWith("h")) {
-    const hours = parseInt(accessExpiry);
-    accessExpiresAt.setHours(accessExpiresAt.getHours() + hours);
-  }
-
-  // Get rotation count from parent if exists
-  let rotationCount = 0;
-  if (parentSessionId) {
-    const parentResult = await conn.execute({
-      sql: "SELECT rotation_count FROM Session WHERE id = ?",
-      args: [parentSessionId]
-    });
-    if (parentResult.rows.length > 0) {
-      rotationCount = (parentResult.rows[0].rotation_count as number) + 1;
-    }
-  }
-
-  await conn.execute({
-    sql: `INSERT INTO Session 
-          (id, user_id, token_family, refresh_token_hash, parent_session_id,
-           rotation_count, expires_at, access_token_expires_at, ip_address, user_agent)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-    args: [
-      sessionId,
-      userId,
-      family,
-      tokenHash,
-      parentSessionId,
-      rotationCount,
-      expiresAt.toISOString(),
-      accessExpiresAt.toISOString(),
-      ipAddress,
-      userAgent
-    ]
-  });
-
-  return { sessionId, tokenFamily: family };
-}
-
-/**
- * TEMPORARY WRAPPER: Backward compatibility for old session creation
- * TODO: Remove this after migrating all callers to use refresh tokens (Tasks 05-06)
- * @deprecated Use createSession with refresh tokens instead
- */
-async function createSessionLegacy(
-  userId: string,
-  expiresIn: string,
-  ipAddress: string,
-  userAgent: string
-): Promise<string> {
-  // Generate a temporary refresh token for legacy sessions
-  const refreshToken = generateRefreshToken();
-  const { sessionId } = await createSession(
-    userId,
-    expiresIn,
-    ipAddress,
-    userAgent,
-    refreshToken
-  );
-  return sessionId;
-}
-
-/**
- * Helper to set authentication cookies including CSRF token
- */
-/**
- * Helper to set authentication cookies including CSRF token
- * Sets both access token (short-lived) and refresh token (long-lived)
- * @param event - H3Event
- * @param accessToken - JWT access token
- * @param refreshToken - Refresh token
- * @param rememberMe - Whether to use extended refresh token expiry
- */
-function setAuthCookies(
-  event: any,
-  accessToken: string,
-  refreshToken: string,
-  rememberMe: boolean = false
-) {
-  // Access token cookie (short-lived, always same duration)
-  // Session cookies (no maxAge) vs persistent cookies (with maxAge)
-  const accessCookieOptions: any = {
-    path: "/",
-    httpOnly: true,
-    secure: env.NODE_ENV === "production",
-    sameSite: "strict"
-  };
-
-  if (rememberMe) {
-    // Persistent cookie - survives browser restart
-    accessCookieOptions.maxAge = getAccessCookieMaxAge();
-  }
-  // else: session cookie - expires when browser closes (no maxAge)
-
-  setCookie(event, ACCESS_TOKEN_COOKIE_NAME, accessToken, accessCookieOptions);
-
-  // Refresh token cookie (varies based on rememberMe)
-  const refreshCookieOptions: any = {
-    path: "/",
-    httpOnly: true,
-    secure: env.NODE_ENV === "production",
-    sameSite: "strict"
-  };
-
-  if (rememberMe) {
-    // Persistent cookie - long-lived (90 days)
-    refreshCookieOptions.maxAge = getRefreshCookieMaxAge(true);
-  }
-  // else: session cookie - expires when browser closes (no maxAge)
-
-  setCookie(
-    event,
-    REFRESH_TOKEN_COOKIE_NAME,
-    refreshToken,
-    refreshCookieOptions
-  );
-
-  // CSRF token for authenticated session
-  setCSRFToken(event);
-}
-
 async function sendEmail(to: string, subject: string, htmlContent: string) {
   const apiKey = env.SENDINBLUE_KEY;
   const apiUrl = "https://api.sendinblue.com/v3/smtp/email";
@@ -658,112 +117,48 @@ async function sendEmail(to: string, subject: string, htmlContent: string) {
  * Attempt server-side token refresh for SSR
  * Called from getUserState() when access token is expired but refresh token exists
  * @param event - H3Event from SSR
- * @param refreshToken - Refresh token from httpOnly cookie
- * @returns true if refresh succeeded, false otherwise
+ * @param refreshToken - Refresh token from httpOnly cookie (unused, kept for API compatibility)
+ * @returns userId if refresh succeeded, null otherwise
  */
 export async function attemptTokenRefresh(
   event: H3Event,
   refreshToken: string
-): Promise<boolean> {
+): Promise<string | null> {
   try {
-    // Step 1: Find session by refresh token hash
-    // (Access token may not exist if user closed browser and returned later)
-    const conn = ConnectionFactory();
-    const tokenHash = hashRefreshToken(refreshToken);
+    console.log("[Token Refresh SSR] Attempting server-side refresh");
 
-    const sessionResult = await conn.execute({
-      sql: `SELECT id, user_id, expires_at, revoked 
-            FROM Session 
-            WHERE refresh_token_hash = ? 
-            AND revoked = 0`,
-      args: [tokenHash]
-    });
-
-    if (sessionResult.rows.length === 0) {
-      console.warn(
-        "[Token Refresh SSR] No valid session found for refresh token"
-      );
-      return false;
+    // Step 1: Get current session from Vinxi
+    const session = await getAuthSession(event);
+    if (!session) {
+      console.warn("[Token Refresh SSR] No valid session found");
+      return null;
     }
 
-    const session = sessionResult.rows[0];
-    const sessionId = session.id as string;
-
-    // Check if session is expired
-    const expiresAt = new Date(session.expires_at as string);
-    if (expiresAt < new Date()) {
-      console.warn("[Token Refresh SSR] Session expired");
-      return false;
-    }
-
-    // Step 2: Determine rememberMe from existing session
-    const now = new Date();
-    const daysUntilExpiry =
-      (expiresAt.getTime() - now.getTime()) / (1000 * 60 * 60 * 24);
-    // If expires in > 30 days, assume rememberMe was true
-    const rememberMe = daysUntilExpiry > 30;
-
-    // Step 3: Get client info
+    // Step 2: Get client info for rotation
     const clientIP = getClientIP(event);
     const userAgent = getUserAgent(event);
 
-    // Step 4: Rotate tokens
-    console.log(`[Token Refresh SSR] Rotating tokens for session ${sessionId}`);
-    const rotated = await rotateRefreshToken(
-      refreshToken,
-      sessionId,
-      rememberMe,
+    // Step 3: Rotate session (includes validation, breach detection, cookie update)
+    console.log(
+      `[Token Refresh SSR] Rotating tokens for session ${session.sessionId}`
+    );
+    const newSession = await rotateAuthSession(
+      event,
+      session,
       clientIP,
       userAgent
     );
 
-    if (!rotated) {
+    if (!newSession) {
       console.warn("[Token Refresh SSR] Token rotation failed");
-      return false;
+      return null;
     }
 
-    // Step 5: Set new cookies
-    const accessCookieOptions: any = {
-      path: "/",
-      httpOnly: true,
-      secure: env.NODE_ENV === "production",
-      sameSite: "strict"
-    };
-
-    if (rememberMe) {
-      accessCookieOptions.maxAge = getAccessCookieMaxAge();
-    }
-
-    setCookie(
-      event,
-      ACCESS_TOKEN_COOKIE_NAME,
-      rotated.accessToken,
-      accessCookieOptions
-    );
-
-    const refreshCookieOptions: any = {
-      path: "/",
-      httpOnly: true,
-      secure: env.NODE_ENV === "production",
-      sameSite: "strict"
-    };
-
-    if (rememberMe) {
-      refreshCookieOptions.maxAge = getRefreshCookieMaxAge(true);
-    }
-
-    setCookie(
-      event,
-      REFRESH_TOKEN_COOKIE_NAME,
-      rotated.refreshToken,
-      refreshCookieOptions
-    );
-
     console.log("[Token Refresh SSR] Token refresh successful");
-    return true;
+    return newSession.userId;
   } catch (error) {
     console.error("[Token Refresh SSR] Error:", error);
-    return false;
+    return null;
   }
 }
 
@@ -895,35 +290,23 @@ export const authRouter = createTRPCRouter({
           }
         }
 
-        // Determine token expiry (OAuth defaults to long expiry for better UX)
-        const accessExpiry = getAccessTokenExpiry();
-        const refreshExpiry = AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_LONG;
+        const isAdmin = userId === env.ADMIN_ID;
 
-        // Generate refresh token
-        const refreshToken = generateRefreshToken();
-
-        // Create session with client info
+        // Create session with Vinxi (OAuth defaults to remember me)
         const clientIP = getClientIP(getH3Event(ctx));
         const userAgent = getUserAgent(getH3Event(ctx));
-        const { sessionId } = await createSession(
-          userId,
-          refreshExpiry,
-          clientIP,
-          userAgent,
-          refreshToken
-        );
-
-        // Create access token
-        const accessToken = await createJWT(userId, sessionId, accessExpiry);
-
-        // Set cookies
-        setAuthCookies(
+        await createAuthSession(
           getH3Event(ctx),
-          accessToken,
-          refreshToken,
-          true // OAuth defaults to remember
+          userId,
+          isAdmin,
+          true, // OAuth defaults to remember
+          clientIP,
+          userAgent
         );
 
+        // Set CSRF token for authenticated session
+        setCSRFToken(getH3Event(ctx));
+
         // Log successful OAuth login
         await logAuditEvent({
           userId,
@@ -1083,35 +466,23 @@ export const authRouter = createTRPCRouter({
           }
         }
 
-        // Determine token expiry (OAuth defaults to long expiry for better UX)
-        const accessExpiry = getAccessTokenExpiry();
-        const refreshExpiry = AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_LONG;
+        const isAdmin = userId === env.ADMIN_ID;
 
-        // Generate refresh token
-        const refreshToken = generateRefreshToken();
-
-        // Create session with client info
+        // Create session with Vinxi (OAuth defaults to remember me)
         const clientIP = getClientIP(getH3Event(ctx));
         const userAgent = getUserAgent(getH3Event(ctx));
-        const { sessionId } = await createSession(
-          userId,
-          refreshExpiry,
-          clientIP,
-          userAgent,
-          refreshToken
-        );
-
-        // Create access token
-        const accessToken = await createJWT(userId, sessionId, accessExpiry);
-
-        // Set cookies
-        setAuthCookies(
+        await createAuthSession(
           getH3Event(ctx),
-          accessToken,
-          refreshToken,
-          true // OAuth defaults to remember
+          userId,
+          isAdmin,
+          true, // OAuth defaults to remember
+          clientIP,
+          userAgent
         );
 
+        // Set CSRF token for authenticated session
+        setCSRFToken(getH3Event(ctx));
+
         // Log successful OAuth login
         await logAuditEvent({
           userId,
@@ -1207,38 +578,23 @@ export const authRouter = createTRPCRouter({
         }
 
         const userId = (res.rows[0] as unknown as User).id;
+        const isAdmin = userId === env.ADMIN_ID;
 
-        // Determine token expiry based on rememberMe
-        const accessExpiry = getAccessTokenExpiry();
-        const refreshExpiry = rememberMe
-          ? AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_LONG
-          : AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_SHORT;
-
-        // Generate refresh token
-        const refreshToken = generateRefreshToken();
-
-        // Create session with client info
+        // Create session with Vinxi (handles DB + encrypted cookie)
         const clientIP = getClientIP(getH3Event(ctx));
         const userAgent = getUserAgent(getH3Event(ctx));
-        const { sessionId } = await createSession(
-          userId,
-          refreshExpiry,
-          clientIP,
-          userAgent,
-          refreshToken
-        );
-
-        // Create access token
-        const accessToken = await createJWT(userId, sessionId, accessExpiry);
-
-        // Set cookies
-        setAuthCookies(
+        await createAuthSession(
           getH3Event(ctx),
-          accessToken,
-          refreshToken,
-          rememberMe || false
+          userId,
+          isAdmin,
+          rememberMe || false,
+          clientIP,
+          userAgent
         );
 
+        // Set CSRF token for authenticated session
+        setCSRFToken(getH3Event(ctx));
+
         // Log successful email link login
         await logAuditEvent({
           userId,
@@ -1380,35 +736,23 @@ export const authRouter = createTRPCRouter({
           args: [userId, email, passwordHash, "email"]
         });
 
-        // Determine token expiry (registration defaults to short expiry)
-        const accessExpiry = getAccessTokenExpiry();
-        const refreshExpiry = AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_SHORT; // Default to 7 days
-
-        // Generate refresh token
-        const refreshToken = generateRefreshToken();
-
         // Create session with client info
         const clientIP = getClientIP(getH3Event(ctx));
         const userAgent = getUserAgent(getH3Event(ctx));
-        const { sessionId } = await createSession(
-          userId,
-          refreshExpiry,
-          clientIP,
-          userAgent,
-          refreshToken
-        );
+        const isAdmin = userId === env.ADMIN_ID;
 
-        // Create access token
-        const accessToken = await createJWT(userId, sessionId, accessExpiry);
-
-        // Set cookies
-        setAuthCookies(
+        await createAuthSession(
           getH3Event(ctx),
-          accessToken,
-          refreshToken,
-          false // Registration defaults to non-remember
+          userId,
+          isAdmin,
+          false, // Registration defaults to non-remember
+          clientIP,
+          userAgent
         );
 
+        // Set CSRF token
+        setCSRFToken(getH3Event(ctx));
+
         // Log successful registration
         await logAuditEvent({
           userId,
@@ -1562,36 +906,22 @@ export const authRouter = createTRPCRouter({
         // Reset rate limits on successful login
         await resetLoginRateLimits(email, clientIP);
 
-        // Determine token expiry based on rememberMe
-        const accessExpiry = getAccessTokenExpiry(); // Always 15m
-        const refreshExpiry = rememberMe
-          ? AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_LONG
-          : AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_SHORT;
+        const isAdmin = user.id === env.ADMIN_ID;
 
-        // Create refresh token
-        const refreshToken = generateRefreshToken();
-
-        // Create session with client info (reuse clientIP from rate limiting)
+        // Create session with Vinxi
         const userAgent = getUserAgent(getH3Event(ctx));
-        const { sessionId } = await createSession(
-          user.id,
-          refreshExpiry,
-          clientIP,
-          userAgent,
-          refreshToken
-        );
-
-        // Create access token (short-lived)
-        const accessToken = await createJWT(user.id, sessionId, accessExpiry);
-
-        // Set both tokens in cookies with proper maxAge
-        setAuthCookies(
+        await createAuthSession(
           getH3Event(ctx),
-          accessToken,
-          refreshToken,
-          rememberMe || false
+          user.id,
+          isAdmin,
+          rememberMe || false,
+          clientIP,
+          userAgent
         );
 
+        // Set CSRF token for authenticated session
+        setCSRFToken(getH3Event(ctx));
+
         // Log successful login (wrap in try-catch to ensure it never blocks auth flow)
         try {
           await logAuditEvent({
@@ -1961,16 +1291,6 @@ export const authRouter = createTRPCRouter({
         // Mark token as used
         await markPasswordResetTokenUsed(tokenId);
 
-        // Clear authentication cookies
-        setCookie(getH3Event(ctx), "emailToken", "", {
-          maxAge: 0,
-          path: "/"
-        });
-        setCookie(getH3Event(ctx), "userIDToken", "", {
-          maxAge: 0,
-          path: "/"
-        });
-
         // Log successful password reset
         const { ipAddress, userAgent } = getAuditContext(getH3Event(ctx));
         await logAuditEvent({
@@ -2160,148 +1480,44 @@ export const authRouter = createTRPCRouter({
 
   refreshToken: publicProcedure
     .input(refreshTokenSchema)
-    .mutation(async ({ ctx, input }) => {
-      const { rememberMe } = input;
-
+    .mutation(async ({ ctx }) => {
       try {
-        // Step 1: Get current access token from cookie
-        const currentAccessToken = getCookie(
-          getH3Event(ctx),
-          ACCESS_TOKEN_COOKIE_NAME
-        );
-        if (!currentAccessToken) {
+        const event = getH3Event(ctx);
+
+        // Step 1: Get current session from Vinxi
+        const session = await getAuthSession(event);
+        if (!session) {
           throw new TRPCError({
             code: "UNAUTHORIZED",
-            message: "No access token found"
+            message: "No valid session found"
           });
         }
 
-        // Step 2: Extract session ID from access token (even if expired)
-        let sessionId: string | null = null;
-        try {
-          const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-          // Don't verify expiration, we expect it might be expired
-          const { payload } = await jwtVerify(currentAccessToken, secret, {
-            clockTolerance: 60 * 60 * 24 // 24h tolerance for expired tokens
-          });
-          sessionId = payload.sid as string;
-        } catch (error) {
-          // If we can't even decode, try manual parsing
-          const parts = currentAccessToken.split(".");
-          if (parts.length === 3) {
-            try {
-              const payloadBase64 = parts[1];
-              const payload = JSON.parse(
-                Buffer.from(payloadBase64, "base64url").toString()
-              );
-              sessionId = payload.sid;
-            } catch (e) {
-              throw new TRPCError({
-                code: "UNAUTHORIZED",
-                message: "Invalid access token format"
-              });
-            }
-          }
-        }
+        // Step 2: Get client info for rotation
+        const clientIP = getClientIP(event);
+        const userAgent = getUserAgent(event);
 
-        if (!sessionId) {
-          throw new TRPCError({
-            code: "UNAUTHORIZED",
-            message: "Could not extract session ID from token"
-          });
-        }
-
-        // Step 3: Get refresh token from cookie
-        const refreshToken = getCookie(
-          getH3Event(ctx),
-          REFRESH_TOKEN_COOKIE_NAME
-        );
-        if (!refreshToken) {
-          throw new TRPCError({
-            code: "UNAUTHORIZED",
-            message: "No refresh token found"
-          });
-        }
-
-        // Step 4: Get client info for new session
-        const clientIP = getClientIP(getH3Event(ctx));
-        const userAgent = getUserAgent(getH3Event(ctx));
-
-        // Step 5: Rotate tokens (includes all validation and breach detection)
-        const rotated = await rotateRefreshToken(
-          refreshToken,
-          sessionId,
-          rememberMe,
+        // Step 3: Rotate session (includes validation, breach detection, cookie update)
+        const newSession = await rotateAuthSession(
+          event,
+          session,
           clientIP,
           userAgent
         );
 
-        if (!rotated) {
-          // Rotation failed - could be invalid token, reuse detected, etc.
-          // Clear cookies to force re-login
-          setCookie(getH3Event(ctx), ACCESS_TOKEN_COOKIE_NAME, "", {
-            maxAge: 0,
-            path: "/"
-          });
-          setCookie(getH3Event(ctx), REFRESH_TOKEN_COOKIE_NAME, "", {
-            maxAge: 0,
-            path: "/"
-          });
-
+        if (!newSession) {
+          // Rotation failed - session invalid, reuse detected, or max rotations reached
+          await invalidateAuthSession(event, session.sessionId);
           throw new TRPCError({
             code: "UNAUTHORIZED",
             message: "Token refresh failed - please login again"
           });
         }
 
-        // Step 6: Set new access token cookie
-        // Session cookies (no maxAge) vs persistent cookies (with maxAge)
-        const accessCookieOptions: any = {
-          path: "/",
-          httpOnly: true,
-          secure: env.NODE_ENV === "production",
-          sameSite: "strict"
-        };
+        // Step 4: Refresh CSRF token
+        setCSRFToken(event);
 
-        if (rememberMe) {
-          // Persistent cookie - survives browser restart
-          accessCookieOptions.maxAge = getAccessCookieMaxAge();
-        }
-        // else: session cookie - expires when browser closes (no maxAge)
-
-        setCookie(
-          getH3Event(ctx),
-          ACCESS_TOKEN_COOKIE_NAME,
-          rotated.accessToken,
-          accessCookieOptions
-        );
-
-        // Step 7: Set new refresh token cookie
-        const refreshCookieOptions: any = {
-          path: "/",
-          httpOnly: true,
-          secure: env.NODE_ENV === "production",
-          sameSite: "strict"
-        };
-
-        if (rememberMe) {
-          // Persistent cookie - long-lived (90 days)
-          refreshCookieOptions.maxAge = getRefreshCookieMaxAge(true);
-        }
-        // else: session cookie - expires when browser closes (no maxAge)
-
-        setCookie(
-          getH3Event(ctx),
-          REFRESH_TOKEN_COOKIE_NAME,
-          rotated.refreshToken,
-          refreshCookieOptions
-        );
-
-        // Step 8: Refresh CSRF token
-        setCSRFToken(getH3Event(ctx));
-
-        // Step 9: Opportunistic cleanup (serverless-friendly)
-        // Run asynchronously without blocking the response
+        // Step 5: Opportunistic cleanup (serverless-friendly)
         import("~/server/token-cleanup")
           .then((module) => module.opportunisticCleanup())
           .catch((err) => console.error("Opportunistic cleanup failed:", err));
@@ -2311,7 +1527,6 @@ export const authRouter = createTRPCRouter({
           message: "Token refreshed successfully"
         };
       } catch (error) {
-        // Log error but don't expose details to client
         console.error("Token refresh error:", error);
 
         if (error instanceof TRPCError) {
@@ -2326,112 +1541,33 @@ export const authRouter = createTRPCRouter({
     }),
 
   signOut: publicProcedure.mutation(async ({ ctx }) => {
-    let userId: string | null = null;
-    let tokenFamily: string | null = null;
-    let sessionId: string | null = null;
-
     try {
-      // Step 1: Get user ID and token family from access token
-      const token = getCookie(getH3Event(ctx), "userIDToken");
-      if (token) {
-        try {
-          const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-          const { payload } = await jwtVerify(token, secret, {
-            clockTolerance: 60 * 60 * 24 // Allow expired tokens
-          });
-          userId = payload.id as string;
-          sessionId = payload.sid as string;
+      // Step 1: Get current session
+      const session = await getAuthSession(getH3Event(ctx));
 
-          // Get token family from session
-          if (sessionId) {
-            const conn = ConnectionFactory();
-            const sessionResult = await conn.execute({
-              sql: "SELECT token_family FROM Session WHERE id = ?",
-              args: [sessionId]
-            });
+      if (session) {
+        // Step 2: Revoke entire token family (all devices)
+        await revokeTokenFamily(session.tokenFamily, "user_logout");
+        console.log(`Token family ${session.tokenFamily} revoked on signout`);
 
-            if (sessionResult.rows.length > 0) {
-              tokenFamily = sessionResult.rows[0].token_family as string;
-            }
-          }
-        } catch (e) {
-          // Token verification failed, try to decode without verification
-          try {
-            const parts = token.split(".");
-            if (parts.length === 3) {
-              const payload = JSON.parse(
-                Buffer.from(parts[1], "base64url").toString()
-              );
-              userId = payload.id;
-              sessionId = payload.sid;
-
-              // Still try to get token family
-              if (sessionId) {
-                const conn = ConnectionFactory();
-                const sessionResult = await conn.execute({
-                  sql: "SELECT token_family FROM Session WHERE id = ?",
-                  args: [sessionId]
-                });
-
-                if (sessionResult.rows.length > 0) {
-                  tokenFamily = sessionResult.rows[0].token_family as string;
-                }
-              }
-            }
-          } catch (decodeError) {
-            console.error("Could not decode token for signout:", decodeError);
-          }
-        }
-      }
-
-      // Step 2: Revoke entire token family if found
-      if (tokenFamily) {
-        await revokeTokenFamily(tokenFamily, "user_logout");
-        console.log(`Token family ${tokenFamily} revoked on signout`);
-      } else if (sessionId) {
-        // Fallback: revoke just this session if family not found
-        await invalidateSession(sessionId);
-        console.log(`Session ${sessionId} invalidated on signout`);
+        // Step 3: Log signout event
+        const { ipAddress, userAgent } = getAuditContext(getH3Event(ctx));
+        await logAuditEvent({
+          userId: session.userId,
+          eventType: "auth.logout",
+          eventData: { sessionId: session.sessionId },
+          ipAddress,
+          userAgent,
+          success: true
+        });
       }
     } catch (e) {
-      console.error("Error during signout token revocation:", e);
-      // Continue with cookie clearing even if revocation fails
+      console.error("Error during signout:", e);
+      // Continue with session clearing even if revocation fails
     }
 
-    // Step 3: Clear all auth cookies
-    setCookie(getH3Event(ctx), "userIDToken", "", {
-      maxAge: 0,
-      path: "/"
-    });
-    setCookie(getH3Event(ctx), "refreshToken", "", {
-      maxAge: 0,
-      path: "/"
-    });
-    setCookie(getH3Event(ctx), "emailToken", "", {
-      maxAge: 0,
-      path: "/"
-    });
-    setCookie(getH3Event(ctx), "csrf-token", "", {
-      maxAge: 0,
-      path: "/"
-    });
-
-    // Step 4: Log signout event
-    if (userId) {
-      const { ipAddress, userAgent } = getAuditContext(getH3Event(ctx));
-      await logAuditEvent({
-        userId,
-        eventType: "auth.signout",
-        eventData: {
-          sessionId: sessionId || "unknown",
-          tokenFamily: tokenFamily || "unknown",
-          method: "manual"
-        },
-        ipAddress,
-        userAgent,
-        success: true
-      });
-    }
+    // Step 4: Clear Vinxi session (clears encrypted cookie)
+    await invalidateAuthSession(getH3Event(ctx), "");
 
     return { success: true };
   }),
diff --git a/src/server/api/routers/user.ts b/src/server/api/routers/user.ts
index 5671695..69f7a8f 100644
--- a/src/server/api/routers/user.ts
+++ b/src/server/api/routers/user.ts
@@ -68,10 +68,6 @@ export const userRouter = createTRPCRouter({
 
       const user = res.rows[0] as unknown as User;
 
-      setCookie(ctx.event.nativeEvent, "emailToken", email, {
-        path: "/"
-      });
-
       return toUserProfile(user);
     }),
 
@@ -194,15 +190,6 @@ export const userRouter = createTRPCRouter({
         args: [newPasswordHash, userId]
       });
 
-      setCookie(ctx.event.nativeEvent, "emailToken", "", {
-        maxAge: 0,
-        path: "/"
-      });
-      setCookie(ctx.event.nativeEvent, "userIDToken", "", {
-        maxAge: 0,
-        path: "/"
-      });
-
       return { success: true, message: "success" };
     }),
 
@@ -255,15 +242,6 @@ export const userRouter = createTRPCRouter({
         args: [passwordHash, userId]
       });
 
-      setCookie(ctx.event.nativeEvent, "emailToken", "", {
-        maxAge: 0,
-        path: "/"
-      });
-      setCookie(ctx.event.nativeEvent, "userIDToken", "", {
-        maxAge: 0,
-        path: "/"
-      });
-
       return { success: true, message: "success" };
     }),
 
@@ -324,15 +302,6 @@ export const userRouter = createTRPCRouter({
         args: [null, 0, null, "user deleted", null, null, userId]
       });
 
-      setCookie(ctx.event.nativeEvent, "emailToken", "", {
-        maxAge: 0,
-        path: "/"
-      });
-      setCookie(ctx.event.nativeEvent, "userIDToken", "", {
-        maxAge: 0,
-        path: "/"
-      });
-
       return { success: true, message: "deleted" };
     })
 });
diff --git a/src/server/api/utils.ts b/src/server/api/utils.ts
index f473986..cbcbb98 100644
--- a/src/server/api/utils.ts
+++ b/src/server/api/utils.ts
@@ -1,10 +1,10 @@
 import { initTRPC, TRPCError } from "@trpc/server";
 import type { APIEvent } from "@solidjs/start/server";
-import { getCookie, setCookie } from "vinxi/http";
-import { jwtVerify, type JWTPayload } from "jose";
+import { getCookie } from "vinxi/http";
 import { env } from "~/env/server";
 import { logVisit, enrichAnalyticsEntry } from "~/server/analytics";
 import { getRequestIP } from "vinxi/http";
+import { getAuthSession } from "~/server/session-helpers";
 
 export type Context = {
   event: APIEvent;
@@ -13,26 +13,15 @@ export type Context = {
 };
 
 async function createContextInner(event: APIEvent): Promise<Context> {
-  const userIDToken = getCookie(event.nativeEvent, "userIDToken");
+  // Get auth session from Vinxi encrypted session
+  const session = await getAuthSession(event.nativeEvent);
 
   let userId: string | null = null;
   let privilegeLevel: "anonymous" | "user" | "admin" = "anonymous";
 
-  if (userIDToken) {
-    try {
-      const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-      const { payload } = await jwtVerify(userIDToken, secret);
-
-      if (payload.id && typeof payload.id === "string") {
-        userId = payload.id;
-        privilegeLevel = payload.id === env.ADMIN_ID ? "admin" : "user";
-      }
-    } catch (err) {
-      setCookie(event.nativeEvent, "userIDToken", "", {
-        maxAge: 0,
-        expires: new Date("2016-10-05")
-      });
-    }
+  if (session && session.userId) {
+    userId = session.userId;
+    privilegeLevel = session.isAdmin ? "admin" : "user";
   }
 
   const req = event.nativeEvent.node?.req || event.nativeEvent;
diff --git a/src/server/audit.ts b/src/server/audit.ts
index be445a6..ace1fef 100644
--- a/src/server/audit.ts
+++ b/src/server/audit.ts
@@ -30,6 +30,7 @@ export type AuditEventType =
   | "security.csrf.failed"
   | "security.suspicious.activity"
   | "admin.action"
+  | "auth.session_created"
   | "system.session_cleanup";
 
 /**
diff --git a/src/server/auth.ts b/src/server/auth.ts
index 8af223b..88295cf 100644
--- a/src/server/auth.ts
+++ b/src/server/auth.ts
@@ -1,191 +1,63 @@
-import { getCookie, setCookie, type H3Event } from "vinxi/http";
-import { jwtVerify } from "jose";
+import type { H3Event } from "vinxi/http";
 import { OAuth2Client } from "google-auth-library";
 import type { Row } from "@libsql/client/web";
 import { env } from "~/env/server";
-import { ConnectionFactory } from "./database";
+import { getAuthSession } from "./session-helpers";
 
 /**
- * Extract cookie value from H3Event (works in both production and tests)
- * Falls back to manual header parsing if vinxi's getCookie fails
+ * Check authentication status
+ * Consolidates getUserID, getPrivilegeLevel, and checkAuthStatus into single function
+ * @param event - H3Event
+ * @returns Object with isAuthenticated, userId, and isAdmin flags
  */
-function getCookieValue(event: H3Event, name: string): string | undefined {
-  try {
-    // Try vinxi's getCookie first
-    return getCookie(event, name);
-  } catch (e) {
-    // Fallback for tests: parse cookie header manually
-    try {
-      const cookieHeader =
-        event.headers?.get("cookie") || event.node?.req?.headers?.cookie || "";
-      const cookies = cookieHeader
-        .split(";")
-        .map((c) => c.trim())
-        .reduce(
-          (acc, cookie) => {
-            const [key, value] = cookie.split("=");
-            if (key && value) acc[key] = value;
-            return acc;
-          },
-          {} as Record<string, string>
-        );
-      return cookies[name];
-    } catch {
-      return undefined;
-    }
-  }
-}
-
-/**
- * Clear cookie (works in both production and tests)
- */
-function clearCookie(event: H3Event, name: string): void {
-  try {
-    setCookie(event, name, "", {
-      maxAge: 0,
-      expires: new Date("2016-10-05")
-    });
-  } catch (e) {
-    // In tests, setCookie might fail silently
-  }
-}
-
-/**
- * Validate session and update last_used timestamp
- * @param sessionId - Session ID from JWT
- * @param userId - User ID from JWT
- * @returns true if session is valid, false otherwise
- */
-async function validateSession(
-  sessionId: string,
-  userId: string
-): Promise<boolean> {
-  try {
-    const conn = ConnectionFactory();
-    const result = await conn.execute({
-      sql: `SELECT revoked, expires_at FROM Session 
-            WHERE id = ? AND user_id = ?`,
-      args: [sessionId, userId]
-    });
-
-    if (result.rows.length === 0) {
-      // Session doesn't exist
-      return false;
-    }
-
-    const session = result.rows[0];
-
-    // Check if session is revoked
-    if (session.revoked === 1) {
-      return false;
-    }
-
-    // Check if session is expired
-    const expiresAt = new Date(session.expires_at as string);
-    if (expiresAt < new Date()) {
-      return false;
-    }
-
-    // Update last_used timestamp (fire and forget, don't block)
-    conn
-      .execute({
-        sql: "UPDATE Session SET last_used = datetime('now') WHERE id = ?",
-        args: [sessionId]
-      })
-      .catch((err) =>
-        console.error("Failed to update session last_used:", err)
-      );
-
-    return true;
-  } catch (e) {
-    console.error("Session validation error:", e);
-    return false;
-  }
-}
-
-export async function getPrivilegeLevel(
-  event: H3Event
-): Promise<"anonymous" | "admin" | "user"> {
-  try {
-    const userIDToken = getCookieValue(event, "userIDToken");
-
-    if (userIDToken) {
-      try {
-        const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-        const { payload } = await jwtVerify(userIDToken, secret);
-
-        if (payload.id && typeof payload.id === "string") {
-          // Validate session if session ID is present
-          if (payload.sid) {
-            const isValidSession = await validateSession(
-              payload.sid as string,
-              payload.id
-            );
-            if (!isValidSession) {
-              clearCookie(event, "userIDToken");
-              return "anonymous";
-            }
-          }
-
-          return payload.id === env.ADMIN_ID ? "admin" : "user";
-        }
-      } catch (err) {
-        // Silently clear invalid token (401s are expected for non-authenticated users)
-        clearCookie(event, "userIDToken");
-      }
-    }
-  } catch (e) {
-    return "anonymous";
-  }
-  return "anonymous";
-}
-
-export async function getUserID(event: H3Event): Promise<string | null> {
-  try {
-    const userIDToken = getCookieValue(event, "userIDToken");
-
-    if (userIDToken) {
-      try {
-        const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-        const { payload } = await jwtVerify(userIDToken, secret);
-
-        if (payload.id && typeof payload.id === "string") {
-          // Validate session if session ID is present
-          if (payload.sid) {
-            const isValidSession = await validateSession(
-              payload.sid as string,
-              payload.id
-            );
-            if (!isValidSession) {
-              clearCookie(event, "userIDToken");
-              return null;
-            }
-          }
-
-          return payload.id;
-        }
-      } catch (err) {
-        // Silently clear invalid token (401s are expected for non-authenticated users)
-        clearCookie(event, "userIDToken");
-      }
-    }
-  } catch (e) {
-    return null;
-  }
-  return null;
-}
-
 export async function checkAuthStatus(event: H3Event): Promise<{
   isAuthenticated: boolean;
   userId: string | null;
+  isAdmin: boolean;
 }> {
-  const userId = await getUserID(event);
-  return {
-    isAuthenticated: !!userId,
-    userId
-  };
+  try {
+    const session = await getAuthSession(event);
+
+    if (!session || !session.userId) {
+      return {
+        isAuthenticated: false,
+        userId: null,
+        isAdmin: false
+      };
+    }
+
+    return {
+      isAuthenticated: true,
+      userId: session.userId,
+      isAdmin: session.isAdmin
+    };
+  } catch (error) {
+    console.error("Auth check error:", error);
+    return {
+      isAuthenticated: false,
+      userId: null,
+      isAdmin: false
+    };
+  }
 }
 
+/**
+ * Get user ID from session
+ * @param event - H3Event
+ * @returns User ID or null if not authenticated
+ */
+export async function getUserID(event: H3Event): Promise<string | null> {
+  const auth = await checkAuthStatus(event);
+  return auth.userId;
+}
+
+/**
+ * Validate Lineage mobile app authentication request
+ * Supports email (JWT), Apple (user string), and Google (OAuth token) providers
+ * @param auth_token - Authentication token from the app
+ * @param userRow - User database row
+ * @returns true if valid, false otherwise
+ */
 export async function validateLineageRequest({
   auth_token,
   userRow
@@ -196,6 +68,7 @@ export async function validateLineageRequest({
   const { provider, email } = userRow;
   if (provider === "email") {
     try {
+      const { jwtVerify } = await import("jose");
       const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
       const { payload } = await jwtVerify(auth_token, secret);
       if (email !== payload.email) {
@@ -210,7 +83,7 @@ export async function validateLineageRequest({
       return false;
     }
   } else if (provider == "google") {
-    const CLIENT_ID = process.env().VITE_GOOGLE_CLIENT_ID_MAGIC_DELVE;
+    const CLIENT_ID = env.VITE_GOOGLE_CLIENT_ID_MAGIC_DELVE;
     if (!CLIENT_ID) {
       console.error("Missing VITE_GOOGLE_CLIENT_ID_MAGIC_DELVE");
       return false;
diff --git a/src/server/security/auth.test.ts b/src/server/security/auth.test.ts
deleted file mode 100644
index 3021156..0000000
--- a/src/server/security/auth.test.ts
+++ /dev/null
@@ -1,486 +0,0 @@
-/**
- * Authentication Security Tests
- * Tests for authentication mechanisms including JWT, session management, and timing attacks
- */
-
-import { describe, it, expect, beforeEach } from "bun:test";
-import { getUserID, getPrivilegeLevel, checkAuthStatus } from "~/server/auth";
-import {
-  createMockEvent,
-  createTestJWT,
-  createExpiredJWT,
-  createInvalidSignatureJWT,
-  measureTime
-} from "./test-utils";
-import { jwtVerify, SignJWT } from "jose";
-import { env } from "~/env/server";
-
-describe("Authentication Security", () => {
-  describe("JWT Token Validation", () => {
-    it("should validate correct JWT tokens", async () => {
-      const userId = "test-user-123";
-      const token = await createTestJWT(userId);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBe(userId);
-    });
-
-    it("should reject expired JWT tokens", async () => {
-      const userId = "test-user-123";
-      const expiredToken = await createExpiredJWT(userId);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: expiredToken }
-      });
-
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBeNull();
-    });
-
-    it("should reject JWT tokens with invalid signature", async () => {
-      const userId = "test-user-123";
-      const invalidToken = await createInvalidSignatureJWT(userId);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: invalidToken }
-      });
-
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBeNull();
-    });
-
-    it("should reject malformed JWT tokens", async () => {
-      const event = createMockEvent({
-        cookies: { userIDToken: "not-a-valid-jwt" }
-      });
-
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBeNull();
-    });
-
-    it("should reject empty JWT tokens", async () => {
-      const event = createMockEvent({
-        cookies: { userIDToken: "" }
-      });
-
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBeNull();
-    });
-
-    it("should reject JWT tokens with missing user ID", async () => {
-      const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-      const tokenWithoutId = await new SignJWT({})
-        .setProtectedHeader({ alg: "HS256" })
-        .setExpirationTime("1h")
-        .sign(secret);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: tokenWithoutId }
-      });
-
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBeNull();
-    });
-
-    it("should reject JWT tokens with invalid user ID type", async () => {
-      const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-      const tokenWithNumberId = await new SignJWT({ id: 12345 })
-        .setProtectedHeader({ alg: "HS256" })
-        .setExpirationTime("1h")
-        .sign(secret);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: tokenWithNumberId }
-      });
-
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBeNull();
-    });
-
-    it("should handle missing cookie gracefully", async () => {
-      const event = createMockEvent({});
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBeNull();
-    });
-  });
-
-  describe("JWT Token Tampering", () => {
-    it("should detect modified JWT payload", async () => {
-      const userId = "test-user-123";
-      const token = await createTestJWT(userId);
-
-      // Tamper with the payload (middle part of JWT)
-      const parts = token.split(".");
-      const tamperedPayload = Buffer.from(
-        JSON.stringify({ id: "attacker-id" })
-      ).toString("base64url");
-      const tamperedToken = `${parts[0]}.${tamperedPayload}.${parts[2]}`;
-
-      const event = createMockEvent({
-        cookies: { userIDToken: tamperedToken }
-      });
-
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBeNull();
-    });
-
-    it("should detect modified JWT signature", async () => {
-      const userId = "test-user-123";
-      const token = await createTestJWT(userId);
-
-      // Tamper with the signature (last part of JWT)
-      const parts = token.split(".");
-      const tamperedToken = `${parts[0]}.${parts[1]}.modified-signature`;
-
-      const event = createMockEvent({
-        cookies: { userIDToken: tamperedToken }
-      });
-
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBeNull();
-    });
-
-    it("should reject none algorithm JWT tokens", async () => {
-      // Try to create a token with 'none' algorithm (security vulnerability)
-      const payload = Buffer.from(
-        JSON.stringify({ id: "attacker-id", exp: Date.now() / 1000 + 3600 })
-      ).toString("base64url");
-      const header = Buffer.from(
-        JSON.stringify({ alg: "none", typ: "JWT" })
-      ).toString("base64url");
-      const noneToken = `${header}.${payload}.`;
-
-      const event = createMockEvent({
-        cookies: { userIDToken: noneToken }
-      });
-
-      const extractedUserId = await getUserID(event);
-      expect(extractedUserId).toBeNull();
-    });
-  });
-
-  describe("Privilege Level Security", () => {
-    it("should return admin privilege for admin user", async () => {
-      const adminId = env.ADMIN_ID;
-      const token = await createTestJWT(adminId);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("admin");
-    });
-
-    it("should return user privilege for regular user", async () => {
-      const userId = "regular-user-123";
-      const token = await createTestJWT(userId);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("user");
-    });
-
-    it("should return anonymous privilege for unauthenticated request", async () => {
-      const event = createMockEvent({});
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("anonymous");
-    });
-
-    it("should return anonymous privilege for invalid token", async () => {
-      const event = createMockEvent({
-        cookies: { userIDToken: "invalid-token" }
-      });
-
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("anonymous");
-    });
-
-    it("should not allow privilege escalation through token manipulation", async () => {
-      const userId = "regular-user-123";
-      const token = await createTestJWT(userId);
-
-      // Even if attacker modifies the token, signature verification will fail
-      const parts = token.split(".");
-      const fakeAdminPayload = Buffer.from(
-        JSON.stringify({ id: env.ADMIN_ID })
-      ).toString("base64url");
-      const fakeAdminToken = `${parts[0]}.${fakeAdminPayload}.${parts[2]}`;
-
-      const event = createMockEvent({
-        cookies: { userIDToken: fakeAdminToken }
-      });
-
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("anonymous"); // Token validation fails
-    });
-  });
-
-  describe("Session Management", () => {
-    it("should identify authenticated sessions correctly", async () => {
-      const userId = "test-user-123";
-      const token = await createTestJWT(userId);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const authStatus = await checkAuthStatus(event);
-      expect(authStatus.isAuthenticated).toBe(true);
-      expect(authStatus.userId).toBe(userId);
-    });
-
-    it("should identify unauthenticated sessions correctly", async () => {
-      const event = createMockEvent({});
-      const authStatus = await checkAuthStatus(event);
-
-      expect(authStatus.isAuthenticated).toBe(false);
-      expect(authStatus.userId).toBeNull();
-    });
-
-    it("should handle session with expired token", async () => {
-      const userId = "test-user-123";
-      const expiredToken = await createExpiredJWT(userId);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: expiredToken }
-      });
-
-      const authStatus = await checkAuthStatus(event);
-      expect(authStatus.isAuthenticated).toBe(false);
-      expect(authStatus.userId).toBeNull();
-    });
-  });
-
-  describe("Timing Attack Prevention", () => {
-    it("should have consistent timing for valid and invalid tokens", async () => {
-      const userId = "test-user-123";
-      const validToken = await createTestJWT(userId);
-      const invalidToken = "invalid-token";
-
-      // Measure time for valid token
-      const validEvent = createMockEvent({
-        cookies: { userIDToken: validToken }
-      });
-      const { duration: validDuration } = await measureTime(() =>
-        getUserID(validEvent)
-      );
-
-      // Measure time for invalid token
-      const invalidEvent = createMockEvent({
-        cookies: { userIDToken: invalidToken }
-      });
-      const { duration: invalidDuration } = await measureTime(() =>
-        getUserID(invalidEvent)
-      );
-
-      // Timing difference should be minimal (within reasonable variance)
-      // This helps prevent timing attacks to enumerate valid tokens
-      const timingDifference = Math.abs(validDuration - invalidDuration);
-
-      // Allow up to 5ms variance (accounts for system variations)
-      expect(timingDifference).toBeLessThan(5);
-    });
-
-    it("should have consistent timing for different user privilege levels", async () => {
-      const adminId = env.ADMIN_ID;
-      const userId = "regular-user-123";
-
-      const adminToken = await createTestJWT(adminId);
-      const userToken = await createTestJWT(userId);
-
-      // Measure time for admin privilege check
-      const adminEvent = createMockEvent({
-        cookies: { userIDToken: adminToken }
-      });
-      const { duration: adminDuration } = await measureTime(() =>
-        getPrivilegeLevel(adminEvent)
-      );
-
-      // Measure time for user privilege check
-      const userEvent = createMockEvent({
-        cookies: { userIDToken: userToken }
-      });
-      const { duration: userDuration } = await measureTime(() =>
-        getPrivilegeLevel(userEvent)
-      );
-
-      const timingDifference = Math.abs(adminDuration - userDuration);
-      expect(timingDifference).toBeLessThan(5);
-    });
-  });
-
-  describe("Token Expiration", () => {
-    it("should respect token expiration time", async () => {
-      const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-      const userId = "test-user-123";
-
-      // Create token expiring in 1 second
-      const shortLivedToken = await new SignJWT({ id: userId })
-        .setProtectedHeader({ alg: "HS256" })
-        .setExpirationTime("1s")
-        .sign(secret);
-
-      // Should work immediately
-      const event1 = createMockEvent({
-        cookies: { userIDToken: shortLivedToken }
-      });
-      const id1 = await getUserID(event1);
-      expect(id1).toBe(userId);
-
-      // Wait for token to expire
-      await new Promise((resolve) => setTimeout(resolve, 1500));
-
-      // Should fail after expiration
-      const event2 = createMockEvent({
-        cookies: { userIDToken: shortLivedToken }
-      });
-      const id2 = await getUserID(event2);
-      expect(id2).toBeNull();
-    });
-
-    it("should handle tokens with very long expiration", async () => {
-      const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-      const userId = "test-user-123";
-
-      const longLivedToken = await new SignJWT({ id: userId })
-        .setProtectedHeader({ alg: "HS256" })
-        .setExpirationTime("365d") // 1 year
-        .sign(secret);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: longLivedToken }
-      });
-
-      const extractedId = await getUserID(event);
-      expect(extractedId).toBe(userId);
-    });
-
-    it("should reject tokens with past expiration timestamps", async () => {
-      const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-      const userId = "test-user-123";
-
-      const pastToken = await new SignJWT({ id: userId })
-        .setProtectedHeader({ alg: "HS256" })
-        .setExpirationTime(Math.floor(Date.now() / 1000) - 3600) // 1 hour ago
-        .sign(secret);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: pastToken }
-      });
-
-      const extractedId = await getUserID(event);
-      expect(extractedId).toBeNull();
-    });
-  });
-
-  describe("Edge Cases", () => {
-    it("should handle very long JWT tokens", async () => {
-      const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-      const largePayload = {
-        id: "test-user-123",
-        extraData: "x".repeat(10000) // 10KB of extra data
-      };
-
-      const largeToken = await new SignJWT(largePayload)
-        .setProtectedHeader({ alg: "HS256" })
-        .setExpirationTime("1h")
-        .sign(secret);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: largeToken }
-      });
-
-      const extractedId = await getUserID(event);
-      expect(extractedId).toBe("test-user-123");
-    });
-
-    it("should handle special characters in user IDs", async () => {
-      const specialUserId = "user-with-special-!@#$%^&*()";
-      const token = await createTestJWT(specialUserId);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const extractedId = await getUserID(event);
-      expect(extractedId).toBe(specialUserId);
-    });
-
-    it("should handle unicode user IDs", async () => {
-      const unicodeUserId = "user-with-unicode-🔐🛡️";
-      const token = await createTestJWT(unicodeUserId);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const extractedId = await getUserID(event);
-      expect(extractedId).toBe(unicodeUserId);
-    });
-
-    it("should reject JWT with future issued-at time", async () => {
-      const secret = new TextEncoder().encode(env.JWT_SECRET_KEY);
-      const futureToken = await new SignJWT({ id: "test-user-123" })
-        .setProtectedHeader({ alg: "HS256" })
-        .setIssuedAt(Math.floor(Date.now() / 1000) + 3600) // 1 hour in future
-        .setExpirationTime("2h")
-        .sign(secret);
-
-      const event = createMockEvent({
-        cookies: { userIDToken: futureToken }
-      });
-
-      // Some JWT libraries reject future iat, some don't
-      // This test documents the behavior
-      const extractedId = await getUserID(event);
-      // Behavior may vary - just ensure no crash
-      expect(extractedId === null || extractedId === "test-user-123").toBe(
-        true
-      );
-    });
-  });
-
-  describe("Performance", () => {
-    it("should validate tokens efficiently", async () => {
-      const userId = "test-user-123";
-      const token = await createTestJWT(userId);
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const start = performance.now();
-      for (let i = 0; i < 1000; i++) {
-        await getUserID(event);
-      }
-      const duration = performance.now() - start;
-
-      // Should validate 1000 tokens in less than 100ms
-      expect(duration).toBeLessThan(100);
-    });
-
-    it("should check privilege levels efficiently", async () => {
-      const userId = "test-user-123";
-      const token = await createTestJWT(userId);
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const start = performance.now();
-      for (let i = 0; i < 1000; i++) {
-        await getPrivilegeLevel(event);
-      }
-      const duration = performance.now() - start;
-
-      // Should check 1000 privileges in less than 100ms
-      expect(duration).toBeLessThan(100);
-    });
-  });
-});
diff --git a/src/server/security/authorization.test.ts b/src/server/security/authorization.test.ts
deleted file mode 100644
index 56ead6c..0000000
--- a/src/server/security/authorization.test.ts
+++ /dev/null
@@ -1,417 +0,0 @@
-/**
- * Authorization Tests
- * Tests for access control, privilege escalation prevention, and admin access
- */
-
-import { describe, it, expect } from "bun:test";
-import { getUserID, getPrivilegeLevel } from "~/server/auth";
-import { createMockEvent, createTestJWT } from "./test-utils";
-import { env } from "~/env/server";
-
-describe("Authorization", () => {
-  describe("Admin Access Control", () => {
-    it("should grant admin access to configured admin user", async () => {
-      const adminToken = await createTestJWT(env.ADMIN_ID);
-      const event = createMockEvent({
-        cookies: { userIDToken: adminToken }
-      });
-
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("admin");
-    });
-
-    it("should deny admin access to regular users", async () => {
-      const userToken = await createTestJWT("regular-user-123");
-      const event = createMockEvent({
-        cookies: { userIDToken: userToken }
-      });
-
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("user");
-      expect(privilege).not.toBe("admin");
-    });
-
-    it("should deny admin access to anonymous users", async () => {
-      const event = createMockEvent({});
-      const privilege = await getPrivilegeLevel(event);
-
-      expect(privilege).toBe("anonymous");
-      expect(privilege).not.toBe("admin");
-    });
-
-    it("should not allow privilege escalation through token tampering", async () => {
-      // Create a regular user token
-      const regularToken = await createTestJWT("regular-user-123");
-
-      // Attacker tries to modify token to include admin ID
-      // This should fail signature verification
-      const parts = regularToken.split(".");
-      const fakeAdminPayload = Buffer.from(
-        JSON.stringify({ id: env.ADMIN_ID })
-      ).toString("base64url");
-      const tamperedToken = `${parts[0]}.${fakeAdminPayload}.${parts[2]}`;
-
-      const event = createMockEvent({
-        cookies: { userIDToken: tamperedToken }
-      });
-
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("anonymous"); // Invalid token = anonymous
-    });
-
-    it("should handle malformed admin ID gracefully", async () => {
-      const invalidIds = ["", null, undefined, "   ", "admin'--"];
-
-      for (const invalidId of invalidIds) {
-        const token = await createTestJWT(invalidId as string);
-        const event = createMockEvent({
-          cookies: { userIDToken: token }
-        });
-
-        const privilege = await getPrivilegeLevel(event);
-        // Should not grant admin access for invalid IDs
-        expect(privilege).not.toBe("admin");
-      }
-    });
-  });
-
-  describe("User Access Control", () => {
-    it("should grant user access to authenticated users", async () => {
-      const userToken = await createTestJWT("user-123");
-      const event = createMockEvent({
-        cookies: { userIDToken: userToken }
-      });
-
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("user");
-    });
-
-    it("should deny user access to anonymous requests", async () => {
-      const event = createMockEvent({});
-      const privilege = await getPrivilegeLevel(event);
-
-      expect(privilege).toBe("anonymous");
-      expect(privilege).not.toBe("user");
-    });
-
-    it("should maintain user access with valid token", async () => {
-      const userToken = await createTestJWT("user-456");
-      const event = createMockEvent({
-        cookies: { userIDToken: userToken }
-      });
-
-      const userId = await getUserID(event);
-      expect(userId).toBe("user-456");
-
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("user");
-    });
-  });
-
-  describe("Privilege Escalation Prevention", () => {
-    it("should prevent horizontal privilege escalation", async () => {
-      const user1Token = await createTestJWT("user-1");
-      const user2Token = await createTestJWT("user-2");
-
-      const event1 = createMockEvent({
-        cookies: { userIDToken: user1Token }
-      });
-      const event2 = createMockEvent({
-        cookies: { userIDToken: user2Token }
-      });
-
-      const user1Id = await getUserID(event1);
-      const user2Id = await getUserID(event2);
-
-      expect(user1Id).toBe("user-1");
-      expect(user2Id).toBe("user-2");
-      expect(user1Id).not.toBe(user2Id);
-    });
-
-    it("should prevent vertical privilege escalation", async () => {
-      // Regular user should not be able to become admin
-      const userToken = await createTestJWT("regular-user");
-      const event = createMockEvent({
-        cookies: { userIDToken: userToken }
-      });
-
-      const privilege = await getPrivilegeLevel(event);
-      expect(privilege).toBe("user");
-
-      // Even with multiple checks, privilege should remain the same
-      const privilege2 = await getPrivilegeLevel(event);
-      expect(privilege2).toBe("user");
-    });
-
-    it("should not allow session hijacking through token reuse", async () => {
-      const user1Token = await createTestJWT("user-1");
-
-      // User 1's token should always return user 1's ID
-      const event1 = createMockEvent({
-        cookies: { userIDToken: user1Token }
-      });
-      const id1 = await getUserID(event1);
-
-      // Even if attacker captures token, it still identifies as user 1
-      const event2 = createMockEvent({
-        cookies: { userIDToken: user1Token }
-      });
-      const id2 = await getUserID(event2);
-
-      expect(id1).toBe("user-1");
-      expect(id2).toBe("user-1");
-    });
-
-    it("should prevent privilege escalation via race conditions", async () => {
-      const userToken = await createTestJWT("concurrent-user");
-      const event = createMockEvent({
-        cookies: { userIDToken: userToken }
-      });
-
-      // Simulate concurrent privilege checks
-      const results = await Promise.all([
-        getPrivilegeLevel(event),
-        getPrivilegeLevel(event),
-        getPrivilegeLevel(event),
-        getPrivilegeLevel(event),
-        getPrivilegeLevel(event)
-      ]);
-
-      // All results should be the same
-      expect(results.every((r) => r === "user")).toBe(true);
-    });
-  });
-
-  describe("Anonymous Access", () => {
-    it("should handle missing authentication token", async () => {
-      const event = createMockEvent({});
-      const privilege = await getPrivilegeLevel(event);
-
-      expect(privilege).toBe("anonymous");
-    });
-
-    it("should handle empty authentication token", async () => {
-      const event = createMockEvent({
-        cookies: { userIDToken: "" }
-      });
-      const privilege = await getPrivilegeLevel(event);
-
-      expect(privilege).toBe("anonymous");
-    });
-
-    it("should handle invalid token format", async () => {
-      const event = createMockEvent({
-        cookies: { userIDToken: "not-a-jwt-token" }
-      });
-      const privilege = await getPrivilegeLevel(event);
-
-      expect(privilege).toBe("anonymous");
-    });
-
-    it("should return null user ID for anonymous users", async () => {
-      const event = createMockEvent({});
-      const userId = await getUserID(event);
-
-      expect(userId).toBeNull();
-    });
-  });
-
-  describe("Access Control Edge Cases", () => {
-    it("should handle user ID with special characters", async () => {
-      const specialUserId = "user-with-special-!@#$%";
-      const token = await createTestJWT(specialUserId);
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const userId = await getUserID(event);
-      expect(userId).toBe(specialUserId);
-    });
-
-    it("should handle very long user IDs", async () => {
-      const longUserId = "user-" + "x".repeat(1000);
-      const token = await createTestJWT(longUserId);
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const userId = await getUserID(event);
-      expect(userId).toBe(longUserId);
-    });
-
-    it("should handle user ID with unicode characters", async () => {
-      const unicodeUserId = "user-with-unicode-🔐";
-      const token = await createTestJWT(unicodeUserId);
-      const event = createMockEvent({
-        cookies: { userIDToken: token }
-      });
-
-      const userId = await getUserID(event);
-      expect(userId).toBe(unicodeUserId);
-    });
-
-    it("should handle admin ID case sensitivity", async () => {
-      const adminId = env.ADMIN_ID;
-      const wrongCaseId = adminId.toUpperCase();
-
-      // Exact match required
-      const correctToken = await createTestJWT(adminId);
-      const wrongCaseToken = await createTestJWT(wrongCaseId);
-
-      const correctEvent = createMockEvent({
-        cookies: { userIDToken: correctToken }
-      });
-      const wrongCaseEvent = createMockEvent({
-        cookies: { userIDToken: wrongCaseToken }
-      });
-
-      const correctPrivilege = await getPrivilegeLevel(correctEvent);
-      const wrongCasePrivilege = await getPrivilegeLevel(wrongCaseEvent);
-
-      expect(correctPrivilege).toBe("admin");
-      // Wrong case should not get admin access (unless IDs match)
-      if (adminId !== wrongCaseId) {
-        expect(wrongCasePrivilege).toBe("user");
-      }
-    });
-  });
-
-  describe("Authorization Attack Scenarios", () => {
-    it("should prevent session fixation attacks", async () => {
-      // Attacker cannot predict or fix session tokens
-      const token1 = await createTestJWT("user-1");
-      const token2 = await createTestJWT("user-1");
-
-      // Tokens should be different even for same user
-      // (Due to different timestamps, though payload is same)
-      expect(token1).toBeDefined();
-      expect(token2).toBeDefined();
-    });
-
-    it("should prevent parameter pollution attacks", async () => {
-      // Multiple cookie values should not cause confusion
-      const token1 = await createTestJWT("user-1");
-      const token2 = await createTestJWT("user-2");
-
-      // Only first cookie should be used
-      const event = createMockEvent({
-        cookies: {
-          userIDToken: token1
-          // In practice, duplicate cookies are handled by the framework
-        }
-      });
-
-      const userId = await getUserID(event);
-      expect(userId).toBe("user-1");
-    });
-
-    it("should prevent token substitution attacks", async () => {
-      const legitimateToken = await createTestJWT("victim-user");
-      const attackerToken = await createTestJWT("attacker-user");
-
-      // Each token should only authenticate its respective user
-      const legitimateEvent = createMockEvent({
-        cookies: { userIDToken: legitimateToken }
-      });
-      const attackerEvent = createMockEvent({
-        cookies: { userIDToken: attackerToken }
-      });
-
-      const legitimateId = await getUserID(legitimateEvent);
-      const attackerId = await getUserID(attackerEvent);
-
-      expect(legitimateId).toBe("victim-user");
-      expect(attackerId).toBe("attacker-user");
-      expect(legitimateId).not.toBe(attackerId);
-    });
-
-    it("should prevent authorization bypass through empty checks", async () => {
-      const emptyChecks = [null, undefined, "", " ", "null", "undefined"];
-
-      for (const check of emptyChecks) {
-        const event = createMockEvent({
-          cookies: { userIDToken: check as string }
-        });
-
-        const privilege = await getPrivilegeLevel(event);
-        expect(privilege).toBe("anonymous");
-      }
-    });
-  });
-
-  describe("Multi-User Scenarios", () => {
-    it("should handle multiple concurrent user sessions", async () => {
-      const users = ["user-1", "user-2", "user-3", "user-4", "user-5"];
-      const tokens = await Promise.all(users.map((u) => createTestJWT(u)));
-
-      const events = tokens.map((token) =>
-        createMockEvent({ cookies: { userIDToken: token } })
-      );
-
-      const userIds = await Promise.all(events.map(getUserID));
-
-      // All users should be correctly identified
-      expect(userIds).toEqual(users);
-    });
-
-    it("should maintain separate privileges for different users", async () => {
-      const adminToken = await createTestJWT(env.ADMIN_ID);
-      const user1Token = await createTestJWT("user-1");
-      const user2Token = await createTestJWT("user-2");
-
-      const adminEvent = createMockEvent({
-        cookies: { userIDToken: adminToken }
-      });
-      const user1Event = createMockEvent({
-        cookies: { userIDToken: user1Token }
-      });
-      const user2Event = createMockEvent({
-        cookies: { userIDToken: user2Token }
-      });
-
-      const [adminPriv, user1Priv, user2Priv] = await Promise.all([
-        getPrivilegeLevel(adminEvent),
-        getPrivilegeLevel(user1Event),
-        getPrivilegeLevel(user2Event)
-      ]);
-
-      expect(adminPriv).toBe("admin");
-      expect(user1Priv).toBe("user");
-      expect(user2Priv).toBe("user");
-    });
-  });
-
-  describe("Performance", () => {
-    it("should check privileges efficiently", async () => {
-      const userToken = await createTestJWT("perf-test-user");
-      const event = createMockEvent({
-        cookies: { userIDToken: userToken }
-      });
-
-      const start = performance.now();
-      for (let i = 0; i < 1000; i++) {
-        await getPrivilegeLevel(event);
-      }
-      const duration = performance.now() - start;
-
-      // Should complete 1000 checks in less than 100ms
-      expect(duration).toBeLessThan(100);
-    });
-
-    it("should extract user IDs efficiently", async () => {
-      const userToken = await createTestJWT("perf-test-user");
-      const event = createMockEvent({
-        cookies: { userIDToken: userToken }
-      });
-
-      const start = performance.now();
-      for (let i = 0; i < 1000; i++) {
-        await getUserID(event);
-      }
-      const duration = performance.now() - start;
-
-      // Should complete 1000 extractions in less than 100ms
-      expect(duration).toBeLessThan(100);
-    });
-  });
-});
diff --git a/src/server/session-config.ts b/src/server/session-config.ts
new file mode 100644
index 0000000..2799b04
--- /dev/null
+++ b/src/server/session-config.ts
@@ -0,0 +1,51 @@
+import type { SessionConfig } from "vinxi/http";
+import { env } from "~/env/server";
+import { AUTH_CONFIG } from "~/config";
+
+/**
+ * Session data stored in encrypted cookie
+ * This is synced with database Session table for serverless persistence
+ */
+export interface SessionData {
+  /** User ID */
+  userId: string;
+  /** Session ID for database lookup and revocation */
+  sessionId: string;
+  /** Token family for rotation chain tracking */
+  tokenFamily: string;
+  /** Whether user is admin (cached from DB) */
+  isAdmin: boolean;
+  /** Refresh token for rotation (opaque, hashed in DB) */
+  refreshToken: string;
+  /** Remember me preference for session duration */
+  rememberMe: boolean;
+}
+
+/**
+ * Vinxi session configuration
+ * Uses iron-session style password-based encryption
+ */
+export const sessionConfig: SessionConfig = {
+  password: env.JWT_SECRET_KEY,
+  cookieName: "session",
+  cookieOptions: {
+    httpOnly: true,
+    secure: env.NODE_ENV === "production",
+    sameSite: "strict",
+    path: "/"
+    // maxAge is set dynamically based on rememberMe
+  }
+};
+
+/**
+ * Get session cookie options with appropriate maxAge
+ * @param rememberMe - Whether to use extended session duration
+ */
+export function getSessionCookieOptions(rememberMe: boolean) {
+  return {
+    ...sessionConfig.cookieOptions,
+    maxAge: rememberMe
+      ? 90 * 24 * 60 * 60 // 90 days
+      : undefined // Session cookie (expires on browser close)
+  };
+}
diff --git a/src/server/session-helpers.ts b/src/server/session-helpers.ts
new file mode 100644
index 0000000..20dc80a
--- /dev/null
+++ b/src/server/session-helpers.ts
@@ -0,0 +1,499 @@
+import { v4 as uuidV4 } from "uuid";
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import type { H3Event } from "vinxi/http";
+import {
+  useSession,
+  updateSession,
+  clearSession,
+  getSession
+} from "vinxi/http";
+import { ConnectionFactory } from "./database";
+import { env } from "~/env/server";
+import { AUTH_CONFIG, expiryToSeconds } from "~/config";
+import { logAuditEvent } from "./audit";
+import type { SessionData } from "./session-config";
+import { sessionConfig } from "./session-config";
+
+/**
+ * Generate a cryptographically secure refresh token
+ * @returns Base64URL-encoded random token (32 bytes = 256 bits)
+ */
+export function generateRefreshToken(): string {
+  return randomBytes(32).toString("base64url");
+}
+
+/**
+ * Hash refresh token for storage (one-way hash)
+ * Using SHA-256 since refresh tokens are high-entropy random values
+ * @param token - Plaintext refresh token
+ * @returns Hex-encoded hash
+ */
+export function hashRefreshToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+/**
+ * Create a new session in database and Vinxi session
+ * @param event - H3Event
+ * @param userId - User ID
+ * @param isAdmin - Whether user is admin
+ * @param rememberMe - Whether to use extended session duration
+ * @param ipAddress - Client IP address
+ * @param userAgent - Client user agent string
+ * @param parentSessionId - ID of parent session if this is a rotation (null for new sessions)
+ * @param tokenFamily - Token family UUID for rotation chain (generated if null)
+ * @returns Session data
+ */
+export async function createAuthSession(
+  event: H3Event,
+  userId: string,
+  isAdmin: boolean,
+  rememberMe: boolean,
+  ipAddress: string,
+  userAgent: string,
+  parentSessionId: string | null = null,
+  tokenFamily: string | null = null
+): Promise<SessionData> {
+  const conn = ConnectionFactory();
+  const sessionId = uuidV4();
+  const family = tokenFamily || uuidV4();
+  const refreshToken = generateRefreshToken();
+  const tokenHash = hashRefreshToken(refreshToken);
+
+  // Calculate refresh token expiration
+  const refreshExpiry = rememberMe
+    ? AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_LONG
+    : AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_SHORT;
+
+  const expiresAt = new Date();
+  if (refreshExpiry.endsWith("d")) {
+    const days = parseInt(refreshExpiry);
+    expiresAt.setDate(expiresAt.getDate() + days);
+  } else if (refreshExpiry.endsWith("h")) {
+    const hours = parseInt(refreshExpiry);
+    expiresAt.setHours(expiresAt.getHours() + hours);
+  }
+
+  // Calculate access token expiry
+  const accessExpiresAt = new Date();
+  const accessExpiry =
+    env.NODE_ENV === "production"
+      ? AUTH_CONFIG.ACCESS_TOKEN_EXPIRY
+      : AUTH_CONFIG.ACCESS_TOKEN_EXPIRY_DEV;
+
+  if (accessExpiry.endsWith("m")) {
+    const minutes = parseInt(accessExpiry);
+    accessExpiresAt.setMinutes(accessExpiresAt.getMinutes() + minutes);
+  } else if (accessExpiry.endsWith("h")) {
+    const hours = parseInt(accessExpiry);
+    accessExpiresAt.setHours(accessExpiresAt.getHours() + hours);
+  }
+
+  // Get rotation count from parent if exists
+  let rotationCount = 0;
+  if (parentSessionId) {
+    const parentResult = await conn.execute({
+      sql: "SELECT rotation_count FROM Session WHERE id = ?",
+      args: [parentSessionId]
+    });
+    if (parentResult.rows.length > 0) {
+      rotationCount = (parentResult.rows[0].rotation_count as number) + 1;
+    }
+  }
+
+  // Insert session into database
+  await conn.execute({
+    sql: `INSERT INTO Session 
+          (id, user_id, token_family, refresh_token_hash, parent_session_id,
+           rotation_count, expires_at, access_token_expires_at, ip_address, user_agent)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      sessionId,
+      userId,
+      family,
+      tokenHash,
+      parentSessionId,
+      rotationCount,
+      expiresAt.toISOString(),
+      accessExpiresAt.toISOString(),
+      ipAddress,
+      userAgent
+    ]
+  });
+
+  // Create session data
+  const sessionData: SessionData = {
+    userId,
+    sessionId,
+    tokenFamily: family,
+    isAdmin,
+    refreshToken,
+    rememberMe
+  };
+
+  // Update Vinxi session with dynamic maxAge based on rememberMe
+  await updateSession(
+    event,
+    {
+      ...sessionConfig,
+      maxAge: rememberMe
+        ? expiryToSeconds(AUTH_CONFIG.REFRESH_TOKEN_EXPIRY_LONG)
+        : undefined // Session cookie (expires on browser close)
+    },
+    sessionData
+  );
+
+  // Log audit event
+  await logAuditEvent({
+    userId,
+    eventType: "auth.session_created",
+    eventData: {
+      sessionId,
+      tokenFamily: family,
+      rememberMe,
+      parentSessionId
+    },
+    success: true
+  });
+
+  return sessionData;
+}
+
+/**
+ * Get current session from Vinxi and validate against database
+ * @param event - H3Event
+ * @returns Session data or null if invalid/expired
+ */
+export async function getAuthSession(
+  event: H3Event
+): Promise<SessionData | null> {
+  try {
+    const session = await getSession<SessionData>(event, sessionConfig);
+
+    if (!session.data || !session.data.userId || !session.data.sessionId) {
+      return null;
+    }
+
+    // Validate session against database
+    const isValid = await validateSessionInDB(
+      session.data.sessionId,
+      session.data.userId,
+      session.data.refreshToken
+    );
+
+    if (!isValid) {
+      // Clear invalid session
+      await clearSession(event, sessionConfig);
+      return null;
+    }
+
+    return session.data;
+  } catch (error) {
+    console.error("Error getting auth session:", error);
+    return null;
+  }
+}
+
+/**
+ * Validate session against database
+ * Checks if session exists, not revoked, not expired, and refresh token matches
+ * @param sessionId - Session ID
+ * @param userId - User ID
+ * @param refreshToken - Plaintext refresh token
+ * @returns true if valid, false otherwise
+ */
+async function validateSessionInDB(
+  sessionId: string,
+  userId: string,
+  refreshToken: string
+): Promise<boolean> {
+  try {
+    const conn = ConnectionFactory();
+    const tokenHash = hashRefreshToken(refreshToken);
+
+    const result = await conn.execute({
+      sql: `SELECT revoked, expires_at, refresh_token_hash 
+            FROM Session 
+            WHERE id = ? AND user_id = ?`,
+      args: [sessionId, userId]
+    });
+
+    if (result.rows.length === 0) {
+      return false;
+    }
+
+    const session = result.rows[0];
+
+    // Check if revoked
+    if (session.revoked === 1) {
+      return false;
+    }
+
+    // Check if expired
+    const expiresAt = new Date(session.expires_at as string);
+    if (expiresAt < new Date()) {
+      return false;
+    }
+
+    // Validate refresh token hash (timing-safe comparison)
+    const storedHash = session.refresh_token_hash as string;
+    if (
+      !timingSafeEqual(
+        Buffer.from(tokenHash, "hex"),
+        Buffer.from(storedHash, "hex")
+      )
+    ) {
+      return false;
+    }
+
+    // Update last_used timestamp (fire and forget)
+    conn
+      .execute({
+        sql: "UPDATE Session SET last_used = datetime('now') WHERE id = ?",
+        args: [sessionId]
+      })
+      .catch((err) =>
+        console.error("Failed to update session last_used:", err)
+      );
+
+    return true;
+  } catch (error) {
+    console.error("Session validation error:", error);
+    return false;
+  }
+}
+
+/**
+ * Invalidate a specific session in database and clear Vinxi session
+ * @param event - H3Event
+ * @param sessionId - Session ID to invalidate
+ */
+export async function invalidateAuthSession(
+  event: H3Event,
+  sessionId: string
+): Promise<void> {
+  const conn = ConnectionFactory();
+  console.log(`[Session] Invalidating session ${sessionId}`);
+
+  await conn.execute({
+    sql: "UPDATE Session SET revoked = 1 WHERE id = ?",
+    args: [sessionId]
+  });
+
+  await clearSession(event, sessionConfig);
+}
+
+/**
+ * Revoke all sessions in a token family
+ * Used when breach is detected (token reuse)
+ * @param tokenFamily - Token family ID to revoke
+ * @param reason - Reason for revocation (for audit)
+ */
+export async function revokeTokenFamily(
+  tokenFamily: string,
+  reason: string = "breach_detected"
+): Promise<void> {
+  const conn = ConnectionFactory();
+
+  // Get all sessions in family for audit log
+  const sessions = await conn.execute({
+    sql: "SELECT id, user_id FROM Session WHERE token_family = ? AND revoked = 0",
+    args: [tokenFamily]
+  });
+
+  // Revoke all sessions in family
+  console.log(
+    `[Token Family] Revoking entire family ${tokenFamily} (reason: ${reason}). Sessions affected: ${sessions.rows.length}`
+  );
+  await conn.execute({
+    sql: "UPDATE Session SET revoked = 1 WHERE token_family = ?",
+    args: [tokenFamily]
+  });
+
+  // Log audit events for each affected session
+  for (const session of sessions.rows) {
+    await logAuditEvent({
+      userId: session.user_id as string,
+      eventType: "auth.token_family_revoked",
+      eventData: {
+        tokenFamily,
+        sessionId: session.id as string,
+        reason
+      },
+      success: true
+    });
+  }
+
+  console.warn(`Token family ${tokenFamily} revoked: ${reason}`);
+}
+
+/**
+ * Detect if a token is being reused after rotation
+ * Implements grace period for race conditions
+ * @param sessionId - Session ID being validated
+ * @returns true if reuse detected (and revocation occurred), false otherwise
+ */
+export async function detectTokenReuse(sessionId: string): Promise<boolean> {
+  const conn = ConnectionFactory();
+
+  // Check if this session has already been rotated (has child session)
+  const childCheck = await conn.execute({
+    sql: `SELECT id, created_at FROM Session 
+          WHERE parent_session_id = ? 
+          ORDER BY created_at DESC 
+          LIMIT 1`,
+    args: [sessionId]
+  });
+
+  if (childCheck.rows.length === 0) {
+    // No child session, this is legitimate first use
+    return false;
+  }
+
+  const childSession = childCheck.rows[0];
+  const childCreatedAt = new Date(childSession.created_at as string);
+  const now = new Date();
+  const timeSinceRotation = now.getTime() - childCreatedAt.getTime();
+
+  // Grace period for race conditions
+  if (timeSinceRotation < AUTH_CONFIG.REFRESH_TOKEN_REUSE_WINDOW_MS) {
+    console.warn(
+      `[Token Reuse] Within grace period (${timeSinceRotation}ms < ${AUTH_CONFIG.REFRESH_TOKEN_REUSE_WINDOW_MS}ms), allowing for session ${sessionId}`
+    );
+    return false;
+  }
+
+  // Reuse detected outside grace period - this is a breach!
+  console.error(
+    `[Token Reuse] BREACH DETECTED! Session ${sessionId} rotated ${timeSinceRotation}ms ago. Child session: ${childSession.id}`
+  );
+
+  // Get token family and revoke entire family
+  const sessionInfo = await conn.execute({
+    sql: "SELECT token_family, user_id FROM Session WHERE id = ?",
+    args: [sessionId]
+  });
+
+  if (sessionInfo.rows.length > 0) {
+    const tokenFamily = sessionInfo.rows[0].token_family as string;
+    const userId = sessionInfo.rows[0].user_id as string;
+
+    await revokeTokenFamily(tokenFamily, "token_reuse_detected");
+
+    // Log critical security event
+    await logAuditEvent({
+      userId,
+      eventType: "auth.token_reuse_detected",
+      eventData: {
+        sessionId,
+        tokenFamily,
+        timeSinceRotation
+      },
+      success: false
+    });
+
+    return true;
+  }
+
+  return false;
+}
+
+/**
+ * Rotate refresh token: invalidate old, issue new tokens
+ * Implements automatic breach detection
+ * @param event - H3Event
+ * @param oldSessionData - Current session data
+ * @param ipAddress - Client IP address for new session
+ * @param userAgent - Client user agent for new session
+ * @returns New session data or null if rotation fails
+ */
+export async function rotateAuthSession(
+  event: H3Event,
+  oldSessionData: SessionData,
+  ipAddress: string,
+  userAgent: string
+): Promise<SessionData | null> {
+  console.log(
+    `[Token Rotation] Starting rotation for session ${oldSessionData.sessionId}`
+  );
+
+  // Validate old session exists in DB
+  const isValid = await validateSessionInDB(
+    oldSessionData.sessionId,
+    oldSessionData.userId,
+    oldSessionData.refreshToken
+  );
+
+  if (!isValid) {
+    console.warn(
+      `[Token Rotation] Invalid session during rotation for ${oldSessionData.sessionId}`
+    );
+    return null;
+  }
+
+  // Detect token reuse (breach detection)
+  const reuseDetected = await detectTokenReuse(oldSessionData.sessionId);
+  if (reuseDetected) {
+    console.error(
+      `[Token Rotation] Token reuse detected for session ${oldSessionData.sessionId}`
+    );
+    return null;
+  }
+
+  // Check rotation limit
+  const conn = ConnectionFactory();
+  const sessionCheck = await conn.execute({
+    sql: "SELECT rotation_count FROM Session WHERE id = ?",
+    args: [oldSessionData.sessionId]
+  });
+
+  if (sessionCheck.rows.length === 0) {
+    return null;
+  }
+
+  const rotationCount = sessionCheck.rows[0].rotation_count as number;
+  if (rotationCount >= AUTH_CONFIG.MAX_ROTATION_COUNT) {
+    console.warn(
+      `[Token Rotation] Max rotation count reached for session ${oldSessionData.sessionId}`
+    );
+    await invalidateAuthSession(event, oldSessionData.sessionId);
+    return null;
+  }
+
+  // Create new session (linked to old via parent_session_id)
+  const newSessionData = await createAuthSession(
+    event,
+    oldSessionData.userId,
+    oldSessionData.isAdmin,
+    oldSessionData.rememberMe,
+    ipAddress,
+    userAgent,
+    oldSessionData.sessionId, // parent session
+    oldSessionData.tokenFamily // reuse family
+  );
+
+  // Invalidate old session
+  await conn.execute({
+    sql: "UPDATE Session SET revoked = 1 WHERE id = ?",
+    args: [oldSessionData.sessionId]
+  });
+
+  // Log rotation event
+  await logAuditEvent({
+    userId: oldSessionData.userId,
+    eventType: "auth.token_rotated",
+    eventData: {
+      oldSessionId: oldSessionData.sessionId,
+      newSessionId: newSessionData.sessionId,
+      tokenFamily: oldSessionData.tokenFamily,
+      rotationCount: rotationCount + 1
+    },
+    success: true
+  });
+
+  console.log(
+    `[Token Rotation] Successfully rotated session ${oldSessionData.sessionId} -> ${newSessionData.sessionId}`
+  );
+
+  return newSessionData;
+}
diff --git a/src/types/user.ts b/src/types/user.ts
index f42c96e..ccfa2de 100644
--- a/src/types/user.ts
+++ b/src/types/user.ts
@@ -36,16 +36,3 @@ export function toUserProfile(user: User): UserProfile {
     hasPassword: !!user.password_hash
   };
 }
-
-export interface SessionPayload {
-  id: string;
-  email?: string;
-}
-
-export interface EmailVerificationPayload {
-  email: string;
-}
-
-export interface PasswordResetPayload {
-  email: string;
-}