2ebff5f4d7
## Summary - **Apollo factory** (`apollo.factory.ts`): Bail early with `EMPTY` when no token pair exists so no request is forwarded without credentials. Propagate renewal success/failure as a boolean so failed renewals stop the operation chain instead of forwarding with stale tokens. - **Refresh token service** (`refresh-token.service.ts`): When a revoked refresh token is reused past the grace period, reject only that token instead of mass-revoking all user tokens. The most common cause is a lost renewal response (e.g. navigation during refresh), not actual token theft. This eliminates the "Suspicious activity detected" errors users were seeing. Also switches to `findOneBy` since the `appTokens` relation is no longer needed. ## Test plan - [x] `refresh-token.service.spec.ts` — all 7 tests pass - [ ] Verify login flow: sign in from `app.localhost`, get redirected to workspace subdomain without "Suspicious activity" errors - [ ] Verify token renewal: let access token expire, confirm silent renewal works and operations resume - [ ] Verify concurrent tabs: open multiple tabs, let tokens expire, confirm no mass revocation cascade Made with [Cursor](https://cursor.com) --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>