Implement refresh token flow and refactor session handling

Added refresh token endpoint and controller, introduced IUserSessionRefresher and UserSessionRefresher for token renewal, and updated session handling to return both access and refresh tokens. Refactored AuthController, tests, and related interfaces to support new token flow. Fixed JwtAccessOption property typo, updated configuration, and extended UserSessionsRepository to support lookup by refresh token.
2026-07-21 11:44:56 +00:00 · 2025-07-19 17:51:06 +07:00
parent ab643c16a4
commit ff873ae179
25 changed files with 485 additions and 124 deletions
@@ -5,6 +5,6 @@ namespace Govor.Application.Interfaces.UserSession;

 public interface IUserSessionOpener
 {
-    Task<string> OpenSessionAsync(User user, string deviceInfo);
+    Task<RefreshResult> OpenSessionAsync(User user, string deviceInfo);
 }

@@ -0,0 +1,8 @@
+namespace Govor.Application.Interfaces.UserSession;
+
+public interface IUserSessionRefresher
+{
+     Task<RefreshResult> RefreshTokenAsync(string refreshToken);
+}
+
+public record RefreshResult(string refreshToken, string accessToken);
@@ -1,6 +1,6 @@
 namespace Govor.Application.Services.Authentication;
 public class JwtAccessOption
 {
-    public string SecretKeу {get; set;}
+    public string SecretKey {get; set;}
    public int Minutes { get; set; }
 }
@@ -3,4 +3,4 @@ namespace Govor.Application.Services.Authentication;
 public class JwtRefreshOption
 {
    public int RefreshTokenLifetimeDays { get; set; }
-}
+}
@@ -30,7 +30,7 @@ public class JwtService : IJwtService
        };
        
        var singing = new SigningCredentials(
-            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtAccessOption.SecretKeу)),
+            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtAccessOption.SecretKey)),
            SecurityAlgorithms.HmacSha256Signature);

        var token = new JwtSecurityToken(
@@ -43,7 +43,7 @@ public class JwtService : IJwtService
    
    public async Task<string> GenerateRefreshTokenAsync(User user)
    {
-        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtAccessOption.SecretKeу));
+        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtAccessOption.SecretKey));
        var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

        var claims = new[]
@@ -68,7 +68,7 @@ public class JwtService : IJwtService
            ValidateAudience = false,
            ValidateIssuer = false,
            ValidateIssuerSigningKey = true,
-            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtAccessOption.SecretKeу)),
+            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtAccessOption.SecretKey)),
            ValidateLifetime = false // << important 
        };
        
@@ -3,6 +3,7 @@ using Govor.Application.Interfaces.UserSession;
 using Govor.Application.Services.Authentication;
 using Govor.Core.Models.Users;
 using Govor.Core.Repositories.UserSessionsRepository;
+using Govor.Data.Repositories.Exceptions;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;

@@ -11,58 +12,78 @@ namespace Govor.Application.Services.UserSessions;
 public class UserSessionOpener : IUserSessionOpener
 {
    private readonly IUserSessionsRepository _repository;
-    private readonly IJwtService _jwtService;
    private readonly ILogger<UserSessionOpener> _logger;
    private readonly JwtRefreshOption _options;
+    private readonly IJwtService _jwtService;

-    public UserSessionOpener(IUserSessionsRepository repository, IJwtService jwtService, IOptions<JwtRefreshOption> options, ILogger<UserSessionOpener> logger)
+    public UserSessionOpener(
+        IUserSessionsRepository repository,
+        IJwtService jwtService,
+        IOptions<JwtRefreshOption> options,
+        ILogger<UserSessionOpener> logger)
    {
        _jwtService = jwtService;
        _repository = repository;
        _logger = logger;
        _options = options.Value;
    }
-    public async Task<string> OpenSessionAsync(User user, string deviceInfo)
+
+    public async Task<RefreshResult> OpenSessionAsync(User user, string deviceInfo)
    {
        _logger.LogInformation($"Opening session for user {user.Id} on device '{deviceInfo}'");

-        var sessions = await _repository.GetByUserIdAsync(user.Id);
-        var session = sessions.FirstOrDefault(s => s.DeviceInfo == deviceInfo);
-
-        var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
-        var newExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays);
-
-        if (session is not null)
+        try
        {
-            if (session.IsRevoked || session.ExpiresAt <= DateTime.UtcNow)
+            var sessions = await _repository.GetByUserIdAsync(user.Id);
+            var session = sessions.FirstOrDefault(s => s.DeviceInfo == deviceInfo);
+
+            var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
+            var accessToken = await _jwtService.GenerateAccessTokenAsync(user);
+            
+            var newExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays);
+
+            if (session is not null)
            {
-                // Update Session 
+                // Всегда обновляем токен и дату
                session.RefreshToken = newRefreshToken;
                session.ExpiresAt = newExpiresAt;
                session.CreatedAt = DateTime.UtcNow;
                session.IsRevoked = false;

                await _repository.UpdateAsync(session);
-                _logger.LogInformation($"Updated expired/revoked session for user {user.Id} on device '{deviceInfo}'");
+                _logger.LogInformation($"Updated session for user {user.Id} on device '{deviceInfo}'");
+
+                return new RefreshResult(session.RefreshToken, accessToken);
            }
-
-            return session.RefreshToken;
+            
+            return await OpenNewSession();
        }
-
-        // New Session 
-        var newSession = new Core.Models.UserSession
+        catch (NotFoundByKeyException<Guid> ex)
        {
-            UserId = user.Id,
-            DeviceInfo = deviceInfo,
-            RefreshToken = newRefreshToken,
-            CreatedAt = DateTime.UtcNow,
-            ExpiresAt = newExpiresAt,
-            IsRevoked = false
-        };
+            return await OpenNewSession();
+        }
+        
+        async Task<RefreshResult> OpenNewSession()
+        {
+            var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
+            var accessToken = await _jwtService.GenerateAccessTokenAsync(user);
+            
+            var newSession = new Core.Models.UserSession
+            {
+                UserId = user.Id,
+                DeviceInfo = deviceInfo,
+                RefreshToken = newRefreshToken,
+                CreatedAt = DateTime.UtcNow,
+                ExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays),
+                IsRevoked = false
+            };

-        await _repository.AddAsync(newSession);
-        _logger.LogInformation($"Created new session for user {user.Id} on device '{deviceInfo}'");
+            await _repository.AddAsync(newSession);
+            
+            _logger.LogInformation($"Created new session for user {user.Id} on device '{deviceInfo}'");

-        return newRefreshToken;
+            return new RefreshResult(newRefreshToken, accessToken);
+        }
    }
-}
+}
+    
@@ -0,0 +1,74 @@
+using Govor.Application.Interfaces.Authentication;
+using Govor.Application.Interfaces.UserSession;
+using Govor.Application.Services.Authentication;
+using Govor.Core.Models;
+using Govor.Core.Repositories.Users;
+using Govor.Core.Repositories.UserSessionsRepository;
+using Govor.Data.Repositories.Exceptions;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace Govor.Application.Services.UserSessions;
+
+public class UserSessionRefresher : IUserSessionRefresher
+{
+    private readonly IUserSessionsRepository _sessionsRepository;
+    private readonly ILogger<UserSessionRefresher> _logger;
+    private readonly IUsersRepository _usersRepository;
+    private readonly JwtRefreshOption _options;
+    private readonly IJwtService _jwtService;
+
+    public UserSessionRefresher(
+        IUserSessionsRepository sessionsRepository,
+        ILogger<UserSessionRefresher> logger,
+        IUsersRepository usersRepository,
+        IOptions<JwtRefreshOption> options,
+        IJwtService jwtService)
+    {
+        _sessionsRepository = sessionsRepository;
+        _logger = logger;
+        _usersRepository = usersRepository;
+        _options = options.Value;
+        _jwtService = jwtService;
+    }
+
+    public async Task<RefreshResult> RefreshTokenAsync(string refreshToken)
+    {
+        try
+        {
+            var session = await _sessionsRepository.GetByRefreshTokenAsync(refreshToken);
+
+            if (session.IsRevoked || session.ExpiresAt <= DateTime.UtcNow)
+                throw new UnauthorizedAccessException("Refresh token is invalid or expired");
+            
+            session.IsRevoked = true;
+            await _sessionsRepository.UpdateAsync(session);
+
+            // Find user 
+            var user = await _usersRepository.FindByIdAsync(session.UserId);
+
+            // New tokens 
+            var newAccessToken = await _jwtService.GenerateAccessTokenAsync(user);
+            var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
+
+            // Opening new session 
+            var newSession = new UserSession
+            {
+                UserId = user.Id,
+                RefreshToken = newRefreshToken,
+                DeviceInfo = session.DeviceInfo,
+                CreatedAt = DateTime.UtcNow,
+                ExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays)
+            };
+
+            await _sessionsRepository.AddAsync(newSession);
+
+            return new RefreshResult(newRefreshToken, newAccessToken);
+        }
+        catch (NotFoundByKeyException<string> ex)
+        {
+            _logger.LogWarning(ex, ex.Message);
+            throw new UnauthorizedAccessException("Invalid refresh token", ex);
+        }
+    }
+}