Add refresh token

[cherylli]

Description

1. Refresh token functionality is added.

• refresh route
• refresh token in user table

2. Global guard to protect all the routes

• can be bypassed by @Public decorator

Refresh token will have 7 day expiry, while access token will expire in 15mins (I think access tokens can probably have a longer expiry)

Please add 2 new environment Variables
AT_SECRET
RT_SECRET

JWT_SECRET can be removed

Issue link

Fixes # (issue)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Tested locally

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[cherylli]

Refresh token - hashing

[cherylli]

Refresh token - Reuse detection

[jenny-alexander]

LGTM. I did various tests like:

• Access token and refresh token were granted after successful login.
• Access token was removed from cookies after 15 minutes.
• Refresh token was successfully granted after access token expires.
• I tampered with refresh token and when 'refresh' endpoint was invoked, it failed (as expected).
• Access token and refresh token were removed from cookies after successful logout & refreshToken set to null in database.

[cherylli]

LGTM. I did various tests like:

• Access token and refresh token were granted after successful login.
• Access token was removed from cookies after 15 minutes.
• Refresh token was successfully granted after access token expires.
• I tampered with refresh token and when 'refresh' endpoint was invoked, it failed (as expected).
• Access token and refresh token were removed from cookies after successful logout & refreshToken set to null in database.

https://github.com/chingu-x/chingu-dashboard-be/pull/78/files#r1460185576

[curtwl]

LGTM