feat:refreshtoken

Author: fiqrikm18

.env.example

@@ -5,4 +5,5 @@ DATABASE_URL=postgresql+asyncpg://postgres:postgres@db:5432/todo_db
 SECRET_KEY=your-super-secret-production-key-here
 
 ALGORITHM=HS256
-ACCESS_TOKEN_EXPIRE_MINUTES=30
+ACCESS_TOKEN_EXPIRE_MINUTES=30
+REFRESH_TOKEN_EXPIRE_MINUTES=10080

alembic/env.py

@@ -9,6 +9,9 @@
 from alembic import context
 from src.core.config.setting import settings
 from src.modules.todo.infrastructure.models.todo_model import TodoModel  # noqa: F401
+from src.modules.user.infrastructure.models.refresh_token_model import (
+    RefreshTokenModel,  # noqa: F401
+)
 from src.modules.user.infrastructure.models.user_model import UserModel  # noqa: F401
 from src.shared.database.model import Base
 

alembic/versions/ab661f0b6986_add_refresh_tokens_table.py

@@ -0,0 +1,47 @@
+"""add refresh_tokens table
+
+Revision ID: ab661f0b6986
+Revises: 579bfc3a008b
+Create Date: 2026-06-17 05:25:07.910091
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'ab661f0b6986'
+down_revision: Union[str, Sequence[str], None] = '579bfc3a008b'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('refresh_tokens',
+    sa.Column('id', sa.Uuid(), nullable=False),
+    sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+    sa.Column('deleted_at', sa.DateTime(), nullable=True),
+    sa.Column('user_id', sa.Uuid(), nullable=False),
+    sa.Column('token_hash', sa.String(length=255), nullable=False),
+    sa.Column('expires_at', sa.DateTime(timezone=True), nullable=False),
+    sa.Column('is_revoked', sa.Boolean(), nullable=False),
+    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
+    sa.PrimaryKeyConstraint('id')
+    )
+    op.create_index(op.f('ix_refresh_tokens_token_hash'), 'refresh_tokens', ['token_hash'], unique=True)
+    op.create_index(op.f('ix_refresh_tokens_user_id'), 'refresh_tokens', ['user_id'], unique=False)
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_index(op.f('ix_refresh_tokens_user_id'), table_name='refresh_tokens')
+    op.drop_index(op.f('ix_refresh_tokens_token_hash'), table_name='refresh_tokens')
+    op.drop_table('refresh_tokens')
+    # ### end Alembic commands ###

src/core/config/setting.py

@@ -7,7 +7,7 @@ class Settings(BaseSettings):
     SECRET_KEY: str = "super-secret-key-change-in-production"
     ALGORITHM: str = "HS256"
     ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
-    REFRESH_TOKEN_EXPIRE_MINUTES: int = 60 * 60 * 24 * 7
+    REFRESH_TOKEN_EXPIRE_MINUTES: int = 10080
 
     class Config:
         env_file = ".env"

src/core/di.py

@@ -9,7 +9,10 @@
     SQLAlchemyUserRepository,
 )
 
-oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/v1/auth/login")
+oauth2_scheme = OAuth2PasswordBearer(
+    tokenUrl="/api/v1/auth/login",
+    refreshUrl="/api/v1/auth/refresh",
+)
 
 
 def get_db_session(db: AsyncSession = Depends(get_db)) -> AsyncSession:

src/core/middleware/auth.py

@@ -16,6 +16,7 @@
         "/openapi.json",
         "/api/v1/auth/login",
         "/api/v1/auth/register",
+        "/api/v1/auth/refresh",
     }
 )
 

src/core/security/jwt.py

@@ -16,6 +16,15 @@ def create_access_token(data: dict) -> str:
         to_encode.update({"exp": expire})
         return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
 
+    @staticmethod
+    def create_refresh_token(data: dict) -> str:
+        to_encode = data.copy()
+        expire = datetime.now(timezone.utc) + timedelta(
+            minutes=settings.REFRESH_TOKEN_EXPIRE_MINUTES,
+        )
+        to_encode.update({"exp": expire})
+        return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
+
     @staticmethod
     def decode_token(token: str) -> dict:
         try:

src/modules/user/application/login_user/handler.py

@@ -1,14 +1,27 @@
+import hashlib
+from datetime import datetime, timedelta, timezone
+
+from src.core.config.setting import settings
 from src.core.security.jwt import JWTService
 from src.core.security.password import PasswordSerrvice
 from src.modules.user.application.login_user.command import LoginUserCommand
+from src.modules.user.domain.entities.refresh_token import RefreshToken
 from src.modules.user.domain.exceptions.user_exception import UserNotFoundError
+from src.modules.user.domain.repositories.refresh_token_repository import (
+    RefreshTokenRepository,
+)
 from src.modules.user.domain.repositories.user_repository import UserRepository
 from src.shared.exceptions.credential_exception import InvalidCredentialsError
 
 
 class LoginUserCommandHandler:
-    def __init__(self, user_repository: UserRepository):
+    def __init__(
+        self,
+        user_repository: UserRepository,
+        refresh_token_repository: RefreshTokenRepository,
+    ):
         self._user_repository = user_repository
+        self._refresh_token_repository = refresh_token_repository
 
     async def execute(self, command: LoginUserCommand) -> dict[str, str]:
         user = await self._user_repository.get_by_email(command.username)
@@ -20,12 +33,20 @@ async def execute(self, command: LoginUserCommand) -> dict[str, str]:
         ):
             raise InvalidCredentialsError("Incorrect email or password")
 
-        access_token = JWTService.create_access_token(
-            data={
-                "fullname": user.fullname,
-                "email": user.email,
-                "sub": str(user.id),
-            }
+        access_token = JWTService.create_access_token(data={"sub": str(user.id)})
+
+        refresh_token_str = JWTService.create_refresh_token(data={"sub": str(user.id)})
+        token_hash = hashlib.sha256(refresh_token_str.encode()).hexdigest()
+        expires_at = datetime.now(timezone.utc) + timedelta(
+            minutes=settings.REFRESH_TOKEN_EXPIRE_MINUTES
+        )
+
+        new_rt = RefreshToken.create(
+            user_id=user.id, token_hash=token_hash, expires_at=expires_at
         )
+        await self._refresh_token_repository.save(new_rt)
 
-        return {"access_token": access_token}
+        return {
+            "access_token": access_token,
+            "refresh_token": refresh_token_str,
+        }

src/modules/user/application/refresh_token/command.py

@@ -0,0 +1,5 @@
+from pydantic import BaseModel
+
+
+class RefreshTokenCommand(BaseModel):
+    token: str

src/modules/user/application/refresh_token/handler.py

@@ -0,0 +1,61 @@
+import hashlib
+from datetime import datetime, timedelta, timezone
+
+from src.core.config.setting import settings
+from src.core.security.jwt import JWTService
+from src.modules.user.application.refresh_token.command import RefreshTokenCommand
+from src.modules.user.domain.entities.refresh_token import RefreshToken
+from src.modules.user.domain.repositories.refresh_token_repository import (
+    RefreshTokenRepository,
+)
+from src.shared.exceptions.credential_exception import InvalidRefreshTokenError
+
+
+class RefreshTokenCommandHandler:
+    def __init__(self, refresh_token_repo: RefreshTokenRepository):
+        self._refresh_token_repo = refresh_token_repo
+
+    def _hash_token(self, token: str) -> str:
+        return hashlib.sha256(token.encode()).hexdigest()
+
+    async def execute(self, command: RefreshTokenCommand) -> dict:
+        token_hash = self._hash_token(command.token)
+        stored_token = await self._refresh_token_repo.get_by_token_hash(token_hash)
+
+        if not stored_token:
+            raise InvalidRefreshTokenError("Invalid refresh token")
+        if stored_token.is_revoked:
+            raise InvalidRefreshTokenError("Refresh token has been revoked")
+        if stored_token.expires_at < datetime.now(timezone.utc):
+            raise InvalidRefreshTokenError("Refresh token has expired")
+
+        stored_token.revoke()
+        await self._refresh_token_repo.save(stored_token)
+
+        new_access_token = JWTService.create_access_token(
+            data={"sub": str(stored_token.user_id)}
+        )
+
+        new_refresh_token_str = JWTService.create_refresh_token(
+            data={"sub": str(stored_token.user_id)}
+        )
+
+        new_token_hash = self._hash_token(new_refresh_token_str)
+
+        expires_at = datetime.now(timezone.utc) + timedelta(
+            minutes=settings.REFRESH_TOKEN_EXPIRE_MINUTES,
+        )
+
+        new_refresh_token_entity = RefreshToken.create(
+            user_id=stored_token.user_id,
+            token_hash=new_token_hash,
+            expires_at=expires_at,
+        )
+
+        await self._refresh_token_repo.save(new_refresh_token_entity)
+
+        return {
+            "access_token": new_access_token,
+            "refresh_token": new_refresh_token_str,
+            "token_type": "bearer",
+        }