Storing IP of users in sessions table

apps/api/src/modules/auth/handlers/oauth-callback.logic.ts

@@ -113,8 +113,14 @@ export async function processOauthCallback(
   }
 
   try {
+    const ipAddress =
+      c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip");
+
     const result = await OAuthService.handleCallback(provider, code, {
       callbackData: { user, idToken: id_token },
+      metadata: {
+        ...(ipAddress && { ipAddress }),
+      },
     });
 
     const { user: authUser, session } = result;

apps/api/src/modules/auth/handlers/post-refresh-token.handler.ts

@@ -65,9 +65,15 @@ export type PostRefreshTokenRoute = typeof postRefreshTokenRoute;
 export const postRefreshTokenHandler: AppRouteHandler<PostRefreshTokenRoute> = async (c) => {
   try {
     const { sessionId } = c.req.valid("json");
+    const ipAddress =
+      c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip");
 
     // Refresh access token
-    const result = await TokenService.refreshAccessToken(sessionId);
+    const result = await TokenService.refreshAccessToken(sessionId, {
+      metadata: {
+        ...(ipAddress && { ipAddress }),
+      },
+    });
 
     logger.audit("Access token refreshed", {
       module: "auth",

apps/api/src/modules/auth/services/oauth.service.ts

@@ -5,6 +5,7 @@ import {
   type DBTransaction,
   type SessionProvider,
   SessionStatus,
+  type SessionMetadata,
 } from "@repo/db";
 import { encrypt, logger, type OAuthProvider } from "@repo/shared";
 import { oauthProviderFactory } from "../providers";
@@ -118,6 +119,7 @@ async function executeOAuthCallbackTransaction(
   userInfo: OAuthUserInfoPayload,
   oauthProvider: OAuthProvider,
   tx: DBTransaction,
+  metadata?: SessionMetadata,
 ): Promise<OAuthCallbackResult> {
   const existingUser = await UsersService.findByProviderAccountId(userInfo.id, { tx });
   const { firstName, lastName } = resolveOAuthNameFields(userInfo, existingUser);
@@ -172,7 +174,7 @@ async function executeOAuthCallbackTransaction(
       providerAccountId: user.providerAccountId,
       expiresAt: sessionExpiresAt,
       lastAccessedAt: new Date(),
-      metadata: {},
+      metadata: metadata ?? {},
     },
     { tx },
   );
@@ -195,6 +197,7 @@ export namespace OAuthService {
       tx?: DBTransaction;
       /** Provider-specific callback payload (e.g. Apple form_post body fields) */
       callbackData?: { user?: string; idToken?: string };
+      metadata?: SessionMetadata;
     },
   ): Promise<OAuthCallbackResult> {
     const oauthProvider = oauthProviderFactory.getProvider(provider);
@@ -252,6 +255,7 @@ export namespace OAuthService {
           userInfo,
           oauthProvider,
           tx,
+          options?.metadata,
         );
       };
 

apps/api/src/modules/auth/services/token.service.ts

@@ -1,4 +1,4 @@
-import { SessionService, type DBTransaction, SessionStatus } from "@repo/db";
+import { SessionService, type DBTransaction, SessionStatus, type SessionMetadata } from "@repo/db";
 import { encrypt, decrypt, logger } from "@repo/shared";
 import { oauthProviderFactory } from "../providers";
 import { env } from "@/env";
@@ -46,6 +46,7 @@ export namespace TokenService {
     sessionId: string,
     options?: {
       tx?: DBTransaction;
+      metadata?: SessionMetadata;
     },
   ): Promise<TokenRefreshResult> {
     const session = await SessionService.findById(sessionId, options);
@@ -111,6 +112,12 @@ export namespace TokenService {
         lastAccessedAt: new Date(),
         // Update scope if provided
         ...(tokenResponse.scope && { providerScope: tokenResponse.scope }),
+        ...(options?.metadata && {
+          metadata: {
+            ...(session.metadata ?? {}),
+            ...options.metadata,
+          },
+        }),
       };
 
       // Update refresh token if provider returned a new one