Devops Monk

CREATE TABLE refresh_tokens (
    id          BIGINT          NOT NULL AUTO_INCREMENT PRIMARY KEY,
    user_id     BIGINT          NOT NULL,
    token_hash  VARCHAR(64)     NOT NULL UNIQUE,  -- SHA-256 hash of the token
    expires_at  TIMESTAMP       NOT NULL,
    revoked     BOOLEAN         NOT NULL DEFAULT false,
    revoked_at  TIMESTAMP,
    created_at  TIMESTAMP       NOT NULL DEFAULT CURRENT_TIMESTAMP,
    device_info VARCHAR(255),   -- optional: browser/device for UX
    FOREIGN KEY (user_id) REFERENCES users(id)
);

CREATE INDEX idx_refresh_tokens_hash ON refresh_tokens(token_hash);
CREATE INDEX idx_refresh_tokens_user  ON refresh_tokens(user_id);

@Entity
@Table(name = "refresh_tokens")
public class RefreshToken {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @ManyToOne(fetch = FetchType.LAZY)
    @JoinColumn(name = "user_id", nullable = false)
    private User user;

    @Column(name = "token_hash", nullable = false, unique = true, length = 64)
    private String tokenHash;

    @Column(name = "expires_at", nullable = false)
    private LocalDateTime expiresAt;

    @Column(nullable = false)
    private boolean revoked = false;

    @Column(name = "revoked_at")
    private LocalDateTime revokedAt;

    @Column(name = "created_at", nullable = false)
    private LocalDateTime createdAt = LocalDateTime.now();

    @Column(name = "device_info")
    private String deviceInfo;
}

@Repository
public interface RefreshTokenRepository extends JpaRepository<RefreshToken, Long> {
    Optional<RefreshToken> findByTokenHash(String tokenHash);
    List<RefreshToken> findByUserIdAndRevokedFalse(Long userId);
    int revokeAllByUserId(Long userId); // via @Modifying query
}

@Service
@RequiredArgsConstructor
public class RefreshTokenService {

    @Value("${app.jwt.refresh-expiration-ms:604800000}") // 7 days
    private long refreshTokenDurationMs;

    private final RefreshTokenRepository refreshTokenRepository;

    public String createRefreshToken(User user, String deviceInfo) {
        // Generate a cryptographically secure random token
        String rawToken = generateSecureToken();
        String tokenHash = hashToken(rawToken);

        RefreshToken refreshToken = new RefreshToken();
        refreshToken.setUser(user);
        refreshToken.setTokenHash(tokenHash);
        refreshToken.setExpiresAt(LocalDateTime.now().plusSeconds(refreshTokenDurationMs / 1000));
        refreshToken.setDeviceInfo(deviceInfo);

        refreshTokenRepository.save(refreshToken);

        return rawToken; // return the raw token to the client — never the hash
    }

    @Transactional
    public RefreshToken verifyAndRotate(String rawToken) {
        String tokenHash = hashToken(rawToken);

        RefreshToken token = refreshTokenRepository.findByTokenHash(tokenHash)
            .orElseThrow(() -> new InvalidRefreshTokenException("Refresh token not found"));

        if (token.isRevoked()) {
            // REUSE DETECTED — invalidate all tokens for this user
            revokeAllTokensForUser(token.getUser().getId());
            throw new RefreshTokenReusedException(
                "Refresh token reuse detected. All sessions invalidated."
            );
        }

        if (token.getExpiresAt().isBefore(LocalDateTime.now())) {
            token.revoke();
            refreshTokenRepository.save(token);
            throw new RefreshTokenExpiredException("Refresh token has expired");
        }

        // Rotate: revoke old token
        token.revoke();
        refreshTokenRepository.save(token);

        // Return the revoked token — caller will create a new one
        return token;
    }

    @Transactional
    public void revokeAllTokensForUser(Long userId) {
        List<RefreshToken> activeTokens =
            refreshTokenRepository.findByUserIdAndRevokedFalse(userId);
        activeTokens.forEach(t -> {
            t.setRevoked(true);
            t.setRevokedAt(LocalDateTime.now());
        });
        refreshTokenRepository.saveAll(activeTokens);
    }

    private String generateSecureToken() {
        byte[] randomBytes = new byte[32];
        new SecureRandom().nextBytes(randomBytes);
        return Base64.getUrlEncoder().withoutPadding().encodeToString(randomBytes);
    }

    private String hashToken(String rawToken) {
        return DigestUtils.sha256Hex(rawToken);
    }
}

@Service
public class JwtService {

    @Value("${app.jwt.expiration-ms:900000}")         // 15 min
    private long jwtExpiration;

    @Value("${app.jwt.refresh-expiration-ms:604800000}") // 7 days
    private long refreshExpiration;

    public String generateToken(UserDetails userDetails) {
        return buildToken(Map.of(), userDetails.getUsername(), jwtExpiration);
    }

    public String generateRefreshToken(UserDetails userDetails) {
        // Refresh JWT — minimal claims, just subject
        return buildToken(Map.of("type", "refresh"), userDetails.getUsername(), refreshExpiration);
    }

    private String buildToken(Map<String, Object> claims, String subject, long expiration) {
        return Jwts.builder()
            .claims(claims)
            .subject(subject)
            .issuedAt(new Date())
            .expiration(new Date(System.currentTimeMillis() + expiration))
            .signWith(getSigningKey())
            .compact();
    }
    // ... extractUsername, isTokenValid, etc. from Article 8
}

@RestController
@RequestMapping("/api/auth")
@RequiredArgsConstructor
public class AuthController {

    private final AuthenticationManager authenticationManager;
    private final JwtService jwtService;
    private final RefreshTokenService refreshTokenService;
    private final UserRepository userRepository;
    private final UserDetailsService userDetailsService;

    @PostMapping("/login")
    public ResponseEntity<AuthResponse> login(
        @RequestBody @Valid LoginRequest request,
        HttpServletRequest httpRequest
    ) {
        Authentication auth = authenticationManager.authenticate(
            new UsernamePasswordAuthenticationToken(request.email(), request.password())
        );

        AppUserDetails userDetails = (AppUserDetails) auth.getPrincipal();
        User user = userRepository.findById(userDetails.getId()).orElseThrow();

        String accessToken = jwtService.generateToken(userDetails);
        String rawRefreshToken = refreshTokenService.createRefreshToken(
            user,
            httpRequest.getHeader("User-Agent") // optional device info
        );

        return ResponseEntity.ok(new AuthResponse(
            accessToken, rawRefreshToken, userDetails.getUsername()
        ));
    }

    @PostMapping("/refresh")
    public ResponseEntity<AuthResponse> refresh(
        @RequestBody @Valid RefreshRequest request,
        HttpServletRequest httpRequest
    ) {
        // Verify, detect reuse, and rotate
        RefreshToken oldToken = refreshTokenService.verifyAndRotate(request.refreshToken());

        // Load user for new token generation
        UserDetails userDetails =
            userDetailsService.loadUserByUsername(oldToken.getUser().getUsername());

        // Issue new access token and refresh token
        String newAccessToken = jwtService.generateToken(userDetails);
        String newRawRefreshToken = refreshTokenService.createRefreshToken(
            oldToken.getUser(),
            httpRequest.getHeader("User-Agent")
        );

        return ResponseEntity.ok(new AuthResponse(
            newAccessToken, newRawRefreshToken, userDetails.getUsername()
        ));
    }

    @PostMapping("/logout")
    public ResponseEntity<Void> logout(
        @AuthenticationPrincipal UserDetails currentUser,
        @RequestBody(required = false) LogoutRequest request
    ) {
        if (request != null && request.refreshToken() != null) {
            // Revoke the specific refresh token
            refreshTokenService.revokeToken(request.refreshToken());
        } else {
            // Revoke all tokens (logout from all devices)
            AppUserDetails appUser = (AppUserDetails) currentUser;
            refreshTokenService.revokeAllTokensForUser(appUser.getId());
        }
        return ResponseEntity.ok().build();
    }
}

// Set refresh token as HttpOnly cookie (inaccessible to JavaScript)
@PostMapping("/login")
public ResponseEntity<AccessTokenResponse> login(@RequestBody LoginRequest request,
                                                  HttpServletResponse response) {
    // ... authenticate and generate tokens ...

    // Refresh token in HttpOnly cookie
    ResponseCookie refreshCookie = ResponseCookie.from("refreshToken", rawRefreshToken)
        .httpOnly(true)       // not accessible via JavaScript
        .secure(true)         // HTTPS only
        .sameSite("Strict")   // CSRF protection for cookies
        .maxAge(Duration.ofDays(7))
        .path("/api/auth/refresh") // only sent to refresh endpoint
        .build();
    response.addHeader(HttpHeaders.SET_COOKIE, refreshCookie.toString());

    // Access token in response body (stored in memory by client)
    return ResponseEntity.ok(new AccessTokenResponse(accessToken));
}

// Read refresh token from cookie
@PostMapping("/refresh")
public ResponseEntity<AccessTokenResponse> refresh(
    @CookieValue("refreshToken") String refreshToken
) {
    // ... verify and rotate ...
}

@Component
@RequiredArgsConstructor
public class RefreshTokenCleanupJob {

    private final RefreshTokenRepository refreshTokenRepository;

    @Scheduled(cron = "0 0 3 * * *") // daily at 3am
    @Transactional
    public void deleteExpiredTokens() {
        int deleted = refreshTokenRepository.deleteByExpiresAtBefore(LocalDateTime.now());
        log.info("Cleaned up {} expired refresh tokens", deleted);
    }
}