Skip to content

urBackend v0.5.0 — Public Auth Refresh Token Flow

Choose a tag to compare

View all tags
@yash-pouranik yash-pouranik released this 29 Mar 12:00
· 1066 commits to main since this release
v0.5.0
e17ed70
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

This release adds a secure refresh-token lifecycle for public-api user authentication, with rotation, replay protection, and logout session revocation.

What’s New

  • ✅ Added POST /api/userAuth/refresh-token
  • ✅ Added POST /api/userAuth/logout
  • ✅ Added Redis-backed refresh session store with:
    • tokenId, projectId, userId, tokenHash
    • rotatedFrom, rotatedTo
    • isUsed, revokedAt, expiresAt, lastUsedAt
  • ✅ Refresh token rotation on each successful refresh
  • ✅ Replay detection and session-chain revocation on token reuse
  • ✅ Multi-tenant secret handling via projectId-based project lookup
  • ✅ Rate checks for refresh attempts (IP, token, user)
  • ✅ Mobile/non-browser support using x-refresh-token

Developer Experience

  • Extracted refresh/session logic into:
    • apps/public-api/src/utils/refreshToken.js
  • Kept controller flow cleaner and easier to maintain.

Docs Updated

  • docs/authentication.md
  • docs/api-reference.md
  • Added note: token is a backward-compat alias; use accessToken.

Environment Variables (new optional)

  • PUBLIC_AUTH_ACCESS_TOKEN_TTL (default: 15m)
  • PUBLIC_AUTH_REFRESH_TOKEN_TTL_SECONDS (default: 604800)

Validation

  • npm run test --workspace=public-api ✅
  • npm run build ✅
Assets 2
Loading