feat: add access tokens and rotating refresh tokens #82

ronjalh · 2026-10-17T09:30:09Z

Summary

The session part of the login: a 15-minute access token and a 14-day refresh token that is replaced at every use. Part of #70. The Google check and login are a separate pull request (#71, draft), because Sign in with Google needs https (except on localhost) and the course server has only http.

Stacked. The base is 74-graphql-codegen (#78), which is on #77 (calculator), which is on #65 (server). Change the base to dev when the one below is merged.

What's in it

refreshSession(refreshToken): gives a new access token and a new refresh token, and the old one stops working. Using an old one again means it was copied, so the whole login (the family of tokens) is revoked. logout(refreshToken) revokes the login and is true also for an unknown token.
me: the coach for a valid access token (JWT, jose, HS256, SESSION_SECRET), null for a missing, wrong, changed, foreign or expired token. Protected operations throw UNAUTHENTICATED.
Refresh tokens are random, and only their SHA-256 hash is stored in the new sessions table (migration included). Expired rows are deleted at each refresh.
login answers NOT_IMPLEMENTED until feat: login with Google #71 is merged. Until then the tokens can only be made by the code (the tests do it).
Schema: AuthPayload has accessToken and refreshToken (the old token is renamed), and refreshSession and logout are added.
Settings: SESSION_SECRET (at least 32 characters, the server does not start with a shorter one). Without it the catalog works and me is null.
vite.config.ts sets test.fileParallelism: false, because the session tests write to the local database while other tests check that the row counts do not change.
Docs: "Identifying the user" in docs/API.md (flow, lifetimes, what the client must do, the decision to return the tokens in the body and not in a cookie), docs/DATA_MODEL.md (Session), the README, backend/.env.example, docs/AI_USAGE.md.

Decisions to check

Both tokens are returned in the response body, not in a cookie. The refresh token can then be read by scripts on the page. An httpOnly cookie is safer and works when the app and the API share an origin; it can be added later (written in docs/API.md).
Two tabs that refresh with the same token at the same moment look like a stolen token and end the login, so the client must refresh from one place at a time (documented, and done in the Apollo Client PR feat: set up Apollo Client in the frontend #80).
There is no rate limit on any of this yet.

Testing

Lint, tsc --noEmit and 152 tests pass against a database (0 skipped). 30 are new: me with no/changed/foreign/expired token, refresh and rotation, reuse ends the login, expired and unknown refresh tokens, logout, two requests with the same token (only one gets through), a hash is stored and not the token, expired rows are removed, the Authorization header over HTTP, and the settings. The time is set by the tests, and the first tokens are made directly because there is no login yet.

🤖 Generated with Claude Code

The session part of the login. refreshSession replaces the refresh token at every use, and using an old one again ends the whole login. logout revokes the login. me returns the coach for a valid 15-minute access token and null otherwise. Only a hash of the refresh token is stored, in the new sessions table. The Google check and login are a separate pull request, so login answers NOT_IMPLEMENTED until it is merged.

# Conflicts: # backend/.env.example # backend/src/schema.graphql # docs/AI_USAGE.md # docs/API.md # package-lock.json

…ion-tokens

anettkva · 2026-10-21T11:19:01Z

Nice work, the session design is solid: hashed refresh tokens, a safe rotation when two requests come at once (updateMany where revokedAt is null), HS256 pinned, no token probing, and the risk of keeping the token in the body is written down. Lint, both type checks and the build pass, and the production audit is clean.

Must fix before merging

reads me with the Authorization header fails. It signs the token with the fixed START date (17 October), but the HTTP server checks it against the real clock, so the token has been expired since then. Use signIn(new Date()) on line 315 of auth.test.ts. With that change all 12 auth tests pass.
Prettier fails on backend/src/server/server.test.ts.

Small things, not blocking

Without SESSION_SECRET, login is quietly turned off. A warning at server start, or making it required in production, would catch a missing secret on the VM.
API.md says expired refresh tokens are deleted "at each login", but the code does it in refreshSession.
An access token still works for up to 15 minutes after logout. That's normal, but worth one sentence in the docs.
fileParallelism: false makes all tests run one file at a time, the frontend ones too.

Generated with Claude Code

ronjalh requested a review from a team as a code owner October 17, 2026 09:30

ronjalh self-assigned this Oct 17, 2026

ronjalh mentioned this pull request Oct 17, 2026

feat: add the resolvers for gymnasts, their lists and routines #79

Merged

ronjalh force-pushed the 70-session-tokens branch from 4bde9f2 to a592ac3 Compare October 17, 2026 09:35

ronjalh mentioned this pull request Oct 17, 2026

feat: login with Google #71

Draft

Ronja added 2 commits October 21, 2026 12:44

Merge branch '74-graphql-codegen' into 70-session-tokens

f37d1a0

# Conflicts: # backend/.env.example # backend/src/schema.graphql # docs/AI_USAGE.md # docs/API.md # package-lock.json

Merge remote-tracking branch 'origin/74-graphql-codegen' into 70-sess…

5c20e3a

…ion-tokens

Base automatically changed from 74-graphql-codegen to dev October 21, 2026 11:14

Merge remote-tracking branch 'origin/dev' into 70-session-tokens

f732c3f

Ronja added 9 commits October 21, 2026 13:22

fix: sign the token with the real time in the Authorization header test

4bb6d2c

style: format server.test.ts with Prettier

9fc29c7

feat: warn at start when SESSION_SECRET is not set

f2cea00

docs: say where expired refresh tokens are deleted

2c9108f

docs: explain that an access token lives on after logout

332f8ca

docs: record why the test files run one at a time

d552fde

docs: remove two claims that were not verified

473b7d4

feat: stop the server in production when SESSION_SECRET is missing

d74a497

docs: set NODE_ENV=production and a real SESSION_SECRET on the VM

54eda8b

anettkva merged commit 939adbf into dev Oct 21, 2026

anettkva deleted the 70-session-tokens branch October 21, 2026 11:29

Uh oh!

feat: add access tokens and rotating refresh tokens #82

feat: add access tokens and rotating refresh tokens #82

ronjalh commented Oct 17, 2026

Uh oh!

anettkva commented Oct 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

feat: add access tokens and rotating refresh tokens #82

feat: add access tokens and rotating refresh tokens #82

Conversation

ronjalh commented Oct 17, 2026

Summary

What's in it

Decisions to check

Testing

Uh oh!

anettkva commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

anettkva commented Oct 21, 2026 •

edited

Loading