Implement refresh token flow and refactor session handling

Added refresh token endpoint and controller, introduced IUserSessionRefresher and UserSessionRefresher for token renewal, and updated session handling to return both access and refresh tokens. Refactored AuthController, tests, and related interfaces to support new token flow. Fixed JwtAccessOption property typo, updated configuration, and extended UserSessionsRepository to support lookup by refresh token.
2026-07-21 11:44:56 +00:00 · 2025-07-19 17:51:06 +07:00
parent ab643c16a4
commit ff873ae179
25 changed files with 485 additions and 124 deletions
@@ -0,0 +1,58 @@
+using Govor.Application.Interfaces.UserSession;
+using Govor.Contracts.Requests;
+using Govor.Contracts.Responses;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Govor.API.Controllers.Authentication;
+
+[Route("api/auth/token")]
+public class RefreshController : Controller
+{
+    private readonly ILogger<RefreshController> _logger;
+    private readonly IUserSessionRefresher _userSession;
+    
+    public RefreshController(ILogger<RefreshController> logger, IUserSessionRefresher userSession)
+    {
+        _logger = logger;
+        _userSession = userSession;
+    }
+    
+    [RequireHttps] 
+    [AllowAnonymous]
+    [HttpPost("refresh")]
+    public async Task<IActionResult> Refresh([FromBody] RefreshTokenRequest refreshRequest)
+    {
+        try
+        {
+            if (!ModelState.IsValid)
+                return BadRequest(ModelState);
+            
+            if (string.IsNullOrEmpty(refreshRequest.RefreshToken))
+                throw new InvalidOperationException("Refresh token cant be empty.");
+            
+            var result = await _userSession.RefreshTokenAsync(refreshRequest.RefreshToken);
+
+            return Ok(new RefreshTokenResponse()
+                {
+                    AccessToken = result.accessToken,
+                    RefreshToken = result.refreshToken
+                });
+        }
+        catch (InvalidOperationException ex)
+        {
+            _logger.LogWarning(ex, "Invalid refresh token");
+            return BadRequest(ex.Message);
+        }
+        catch (UnauthorizedAccessException ex)
+        {
+            _logger.LogWarning(ex, "Refresh token failed");
+            return Unauthorized("Invalid refresh token");
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, ex.Message);
+            return StatusCode(500, "An unexpected error occurred.");
+        }
+    }
+}