Implement refresh token flow and refactor session handling

Added refresh token endpoint and controller, introduced IUserSessionRefresher and UserSessionRefresher for token renewal, and updated session handling to return both access and refresh tokens. Refactored AuthController, tests, and related interfaces to support new token flow. Fixed JwtAccessOption property typo, updated configuration, and extended UserSessionsRepository to support lookup by refresh token.
2026-07-21 19:54:55 +00:00 · 2025-07-19 17:51:06 +07:00
parent ab643c16a4
commit ff873ae179
25 changed files with 485 additions and 124 deletions
@@ -0,0 +1,74 @@
+using Govor.Application.Interfaces.Authentication;
+using Govor.Application.Interfaces.UserSession;
+using Govor.Application.Services.Authentication;
+using Govor.Core.Models;
+using Govor.Core.Repositories.Users;
+using Govor.Core.Repositories.UserSessionsRepository;
+using Govor.Data.Repositories.Exceptions;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace Govor.Application.Services.UserSessions;
+
+public class UserSessionRefresher : IUserSessionRefresher
+{
+    private readonly IUserSessionsRepository _sessionsRepository;
+    private readonly ILogger<UserSessionRefresher> _logger;
+    private readonly IUsersRepository _usersRepository;
+    private readonly JwtRefreshOption _options;
+    private readonly IJwtService _jwtService;
+
+    public UserSessionRefresher(
+        IUserSessionsRepository sessionsRepository,
+        ILogger<UserSessionRefresher> logger,
+        IUsersRepository usersRepository,
+        IOptions<JwtRefreshOption> options,
+        IJwtService jwtService)
+    {
+        _sessionsRepository = sessionsRepository;
+        _logger = logger;
+        _usersRepository = usersRepository;
+        _options = options.Value;
+        _jwtService = jwtService;
+    }
+
+    public async Task<RefreshResult> RefreshTokenAsync(string refreshToken)
+    {
+        try
+        {
+            var session = await _sessionsRepository.GetByRefreshTokenAsync(refreshToken);
+
+            if (session.IsRevoked || session.ExpiresAt <= DateTime.UtcNow)
+                throw new UnauthorizedAccessException("Refresh token is invalid or expired");
+            
+            session.IsRevoked = true;
+            await _sessionsRepository.UpdateAsync(session);
+
+            // Find user 
+            var user = await _usersRepository.FindByIdAsync(session.UserId);
+
+            // New tokens 
+            var newAccessToken = await _jwtService.GenerateAccessTokenAsync(user);
+            var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
+
+            // Opening new session 
+            var newSession = new UserSession
+            {
+                UserId = user.Id,
+                RefreshToken = newRefreshToken,
+                DeviceInfo = session.DeviceInfo,
+                CreatedAt = DateTime.UtcNow,
+                ExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays)
+            };
+
+            await _sessionsRepository.AddAsync(newSession);
+
+            return new RefreshResult(newRefreshToken, newAccessToken);
+        }
+        catch (NotFoundByKeyException<string> ex)
+        {
+            _logger.LogWarning(ex, ex.Message);
+            throw new UnauthorizedAccessException("Invalid refresh token", ex);
+        }
+    }
+}