From 266233a473ff7f59f3d9702276446c8070cebb80 Mon Sep 17 00:00:00 2001
From: jjbrunton <jamie@jbrunton.co.uk>
Date: Sat, 29 Aug 2026 23:45:39 +0100
Subject: [PATCH] fix(api): keep auth sync timestamps monotonic

Use PostgreSQL's clock for both the initial auth sync timestamp and later identity refreshes so host clock skew cannot move the marker backwards.
---
 apps/api/src/db/repository.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/apps/api/src/db/repository.ts b/apps/api/src/db/repository.ts
index 477bf2e..670dcf4 100644
--- a/apps/api/src/db/repository.ts
+++ b/apps/api/src/db/repository.ts
@@ -83,7 +83,10 @@ export class PostgresRepository implements ApiRepository {
       target: profiles.id,
       set: {
         email: sql`coalesce(excluded.email, ${profiles.email})`,
-        authSyncedAt: new Date(),
+        // Keep the write on the same clock as the column default. API and
+        // PostgreSQL hosts can differ slightly, which must not move this
+        // monotonic sync marker backwards.
+        authSyncedAt: sql`now()`,
       },
     }).returning();