a06673b
use db::conn::sea_orm::EntityTrait;
use db::user::users::Entity as UserEntity;
use jwt::handlers::TokenPairResponse;
use jwt::rotation::{RotationContext, UserSnapshot, rotate_refresh};
use jwt::signer::{decode_refresh_token, extract_kid};
use crate::error::AuthError;
use crate::features::AuthService;
use super::{RefreshCmd, RefreshResp};
pub async fn refresh(cmd: RefreshCmd, svc: &AuthService) -> Result<RefreshResp, AuthError> {
let db = svc.db.writer();
let cache = svc.jwt.cache.read().await;
// VULN-007: decode the refresh token to learn user_id, then look up
// the live passwd_version so rotate_refresh can reject a token whose
// claim lags behind a password reset.
let user_id = {
let kid = extract_kid(&cmd.refresh_token)
.ok_or_else(|| AuthError::Unauthorized("invalid refresh token".into()))?;
let cached = cache
.get(&kid)
.ok_or_else(|| AuthError::Unauthorized("unknown signing key".into()))?;
let claims = decode_refresh_token(
&cmd.refresh_token,
&cached.decoding,
cached.algorithm,
&svc.jwt.settings.issuer,
&svc.jwt.settings.audience,
svc.jwt.settings.clock_skew_seconds,
)
.map_err(AuthError::Jwt)?;
claims.sub
};
let user = UserEntity::find_by_id(user_id)
.one(&db)
.await?
.ok_or_else(|| AuthError::Unauthorized("unknown user".into()))?;
// VULN-002/B4: suspended / restricted / deactivated accounts must not be
// able to keep their session alive through refresh. Mirror the login gate
// so a suspended user cannot mint fresh token pairs indefinitely.
if user.is_restricted {
return Err(AuthError::Forbidden("account restricted".into()));
}
if user.prohibit_login {
return Err(AuthError::Forbidden("login prohibited".into()));
}
if !user.is_active {
return Err(AuthError::Forbidden(
"account inactive, please verify your email".into(),
));
}
let current_pwd_version = user.passwd_version.unwrap_or(0);
let ctx = RotationContext {
db: &db,
settings: &svc.jwt.settings,
cache: &cache,
};
let snapshot = UserSnapshot {
pwd_version: current_pwd_version,
username: user.username.clone(),
is_admin: user.is_admin,
is_restricted: user.is_restricted,
};
let pair: TokenPairResponse =
rotate_refresh(&ctx, &cmd.refresh_token, &snapshot, cmd.app_id)
.await?
.into();
Ok(RefreshResp {
access_token: pair.access_token,
refresh_token: pair.refresh_token,
token_type: pair.token_type,
expires_in: pair.expires_in,
})
}