funman300
b129664344
Adds a `refresh_tokens` table (migration 003) with one row per live refresh token, keyed by UUID jti. On every POST /api/auth/refresh the old jti row is deleted and a new token pair is issued and stored. Using a consumed token returns 401. Expired rows are pruned inline on each successful rotation. Server: Claims gains an optional `jti` field; make_refresh_token now returns (jwt, jti); register/login insert the jti row; RefreshResponse now carries both tokens. Client: stores the rotated refresh token from the response. ARCHITECTURE.md: API table + Security Model updated. Three new integration tests cover rotation, consumed-token rejection, and chained rotations. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
21 lines
376 B
JSON
21 lines
376 B
JSON
{
|
|
"db_name": "SQLite",
|
|
"query": "SELECT jti FROM refresh_tokens WHERE jti = ?",
|
|
"describe": {
|
|
"columns": [
|
|
{
|
|
"name": "jti",
|
|
"ordinal": 0,
|
|
"type_info": "Text"
|
|
}
|
|
],
|
|
"parameters": {
|
|
"Right": 1
|
|
},
|
|
"nullable": [
|
|
true
|
|
]
|
|
},
|
|
"hash": "893c45c27854ba15ea611e8254ef980ced21dc64e6ca95fde56af513f86ffa46"
|
|
}
|