Description: The current auth module issues access tokens but has no refresh token mechanism. Long-lived sessions are not possible without re-authentication. Implement a secure refresh token flow.
Tasks:
- Generate a refresh token (long-lived JWT or opaque token) on login
- Store refresh tokens in the database with expiry and revocation support
- Create a
POST /auth/refresh endpoint to issue new access tokens
- Implement
POST /auth/logout to revoke refresh tokens
- Add guards to protect the refresh endpoint
Acceptance Criteria:
- Users can obtain a new access token using a valid refresh token
- Expired or revoked refresh tokens are rejected with 401
- Logout invalidates the refresh token immediately
ETA: 1 day
Description: The current auth module issues access tokens but has no refresh token mechanism. Long-lived sessions are not possible without re-authentication. Implement a secure refresh token flow.
Tasks:
POST /auth/refreshendpoint to issue new access tokensPOST /auth/logoutto revoke refresh tokensAcceptance Criteria:
ETA: 1 day