Add sessionId to JWT and update session handling

The JwtService now includes sessionId in access tokens, and all usages have been updated to pass sessionId when generating tokens. UserSession now supports public encryption and signing keys. Tests and session management logic have been updated to reflect these changes, ensuring session-specific claims in JWTs and improved session tracking.

Govor.Application/Interfaces/Authentication/IJwtService.cs

@@ -5,7 +5,7 @@ namespace Govor.Application.Interfaces.Authentication;
 
 public interface IJwtService
 {
-    Task<string> GenerateAccessTokenAsync(User user);
+    Task<string> GenerateAccessTokenAsync(User user, Guid sessionId);
     Task<string> GenerateRefreshTokenAsync(User user);
     ClaimsPrincipal GetPrincipalFromExpiredToken(string token);
 }

Govor.Application/Services/Authentication/JwtService.cs

@@ -21,11 +21,12 @@ public class JwtService : IJwtService
         _invitesService = invitesService;
     }
     
-    public async Task<string> GenerateAccessTokenAsync(User user)
+    public async Task<string> GenerateAccessTokenAsync(User user, Guid sessionId)
     {
         var claims = new[]
         {
             new Claim("userId", user.Id.ToString()),
+            new Claim("sid", sessionId.ToString()),
             new Claim(ClaimTypes.Role, await _invitesService.GetRoleAsync(user), ClaimValueTypes.String)
         };
         

Govor.Application/Services/UserSessions/UserSessionOpener.cs

@@ -36,15 +36,13 @@ namespace Govor.Application.Services.UserSessions
             {
                 var sessions = await _repository.GetByUserIdAsync(user.Id);
                 var session = sessions.FirstOrDefault(s => s.DeviceInfo == deviceInfo);
-
-                var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
-                var accessToken = await _jwtService.GenerateAccessTokenAsync(user);
-            
-                var newExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays);
-
+                
                 if (session is not null)
                 {
-                    // Всегда обновляем токен и дату
+                    var newExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays);
+                    var accessToken = await _jwtService.GenerateAccessTokenAsync(user, session.Id);
+                    var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
+                    
                     session.RefreshToken = newRefreshToken;
                     session.ExpiresAt = newExpiresAt;
                     session.CreatedAt = DateTime.UtcNow;
@@ -52,7 +50,7 @@ namespace Govor.Application.Services.UserSessions
 
                     await _repository.UpdateAsync(session);
                     _logger.LogInformation($"Updated session for user {user.Id} on device '{deviceInfo}'");
-
+                    
                     return new RefreshResult(session.RefreshToken, accessToken);
                 }
             
@@ -65,25 +63,29 @@ namespace Govor.Application.Services.UserSessions
         
             async Task<RefreshResult> OpenNewSession()
             {
-                var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
-                var accessToken = await _jwtService.GenerateAccessTokenAsync(user);
-            
+                var sessionId = Guid.NewGuid(); 
+
+                var accessToken = await _jwtService.GenerateAccessTokenAsync(user, sessionId);
+                var refreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
+
                 var newSession = new UserSession
                 {
+                    Id = sessionId,
                     UserId = user.Id,
                     DeviceInfo = deviceInfo,
-                    RefreshToken = newRefreshToken,
+                    RefreshToken = refreshToken,
                     CreatedAt = DateTime.UtcNow,
                     ExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays),
                     IsRevoked = false
                 };
 
                 await _repository.AddAsync(newSession);
-            
-                _logger.LogInformation($"Created new session for user {user.Id} on device '{deviceInfo}'");
 
-                return new RefreshResult(newRefreshToken, accessToken);
+                _logger.LogInformation($"Created new session {sessionId} for user {user.Id} on device '{deviceInfo}'");
+
+                return new RefreshResult(refreshToken, accessToken);
             }
+
         }
     }
 }

Govor.Application/Services/UserSessions/UserSessionRefresher.cs

@@ -48,7 +48,7 @@ public class UserSessionRefresher : IUserSessionRefresher
             var user = await _usersRepository.FindByIdAsync(session.UserId);
 
             // New tokens 
-            var newAccessToken = await _jwtService.GenerateAccessTokenAsync(user);
+            var newAccessToken = await _jwtService.GenerateAccessTokenAsync(user, session.Id);
             var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
 
             // Opening new session