The JwtService now includes sessionId in access tokens, and all usages have been updated to pass sessionId when generating tokens. UserSession now supports public encryption and signing keys. Tests and session management logic have been updated to reflect these changes, ensuring session-specific claims in JWTs and improved session tracking.
Introduced IAccesserToDownloadMedia and its implementation to enforce access checks when downloading media files. Updated MediaController to use the new accesser service and improved error handling and validation in upload/download actions. Refactored and moved MediaService to the Medias namespace, registered new services in DI, and added comprehensive tests for access logic. Also fixed GroupMembershipConfiguration to make InvitationId optional and performed minor test and namespace cleanups.
Added refresh token endpoint and controller, introduced IUserSessionRefresher and UserSessionRefresher for token renewal, and updated session handling to return both access and refresh tokens. Refactored AuthController, tests, and related interfaces to support new token flow. Fixed JwtAccessOption property typo, updated configuration, and extended UserSessionsRepository to support lookup by refresh token.
Added user session models, interfaces, repository, and service for managing user sessions and refresh tokens. Refactored authentication flow to return user objects and open sessions with device info, supporting refresh token generation and validation. Updated JWT configuration to separate access and refresh options, and refactored related tests and API contracts. Improved media upload handling and error logging. Migrated dependency references and DI registrations accordingly.
Artemy