david
bbe0757ab6
Implement complete refresh token flow for improved security: - Short-lived access tokens (configurable, default 1h) - Long-lived refresh tokens (configurable, default 7d) - Automatic token rotation on refresh - Token revocation for proper logout Domain layer: - Add RefreshToken entity with validation and revocation - Add RefreshTokenRepository interface Application layer: - Add RefreshTokenHandler for token refresh operations - Add RevokeTokenHandler for single token revocation - Add RevokeAllTokensHandler for user-wide revocation Infrastructure layer: - Implement SQLite RefreshTokenRepository - Add refresh_tokens table migration with indexes - Add parseDuration helper for flexible time configuration HTTP layer: - Add POST /api/v1/auth/refresh endpoint - Add POST /api/v1/auth/logout endpoint - Update login/register to return refresh tokens - Improve Swagger documentation with clear descriptions Configuration: - Update .env.example with secure token expiry defaults - Add support for minute/hour/day duration formats Tests: - Fix test suite to work with new signatures - All existing tests passing
17 lines
517 B
Go
17 lines
517 B
Go
package repositories
|
|
|
|
import (
|
|
"context"
|
|
|
|
"apocapoc-api/internal/domain/entities"
|
|
)
|
|
|
|
type RefreshTokenRepository interface {
|
|
Create(ctx context.Context, token *entities.RefreshToken) error
|
|
FindByToken(ctx context.Context, token string) (*entities.RefreshToken, error)
|
|
FindByUserID(ctx context.Context, userID string) ([]*entities.RefreshToken, error)
|
|
RevokeByToken(ctx context.Context, token string) error
|
|
RevokeAllByUserID(ctx context.Context, userID string) error
|
|
DeleteExpired(ctx context.Context) error
|
|
}
|