malpercio.dev / ezpds
An easy-to-host PDS on the ATProtocol, iPhone and MacOS. Maintain control of your keys and data, always.
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

feat: implement refreshSession (MM-82) #33

open opened by
malpercio.dev targeting main from malpercio/mm-82-xrpc-comatprotoserverrefreshsession

Summary#

  • Implements POST /xrpc/com.atproto.server.refreshSession per the ATProto spec
  • Token rotation: old refresh token is invalidated (marked via next_jti) and a new access + refresh pair is issued atomically
  • Replay detection: presenting an already-rotated refresh token triggers full session revocation (session + all its refresh tokens deleted)
  • Refactors issue_access_jwt / issue_refresh_jwt from create_session.rs into auth/jwt.rs so both routes share them without cross-route imports
  • Promotes extract_bearer_token to pub(crate) for direct use in route handlers

Test plan#

  • valid_refresh_token_returns_new_token_pair — 200 with accessJwt, refreshJwt, did, handle
  • new_access_jwt_has_access_scope — new access JWT has correct scope claim
  • new_refresh_jwt_has_refresh_scope_and_different_jti — new refresh JWT has fresh jti
  • token_rotation_stored_in_db — old token's next_jti set, new token in DB
  • old_refresh_token_rejected_after_rotation — reusing rotated token returns error
  • replay_of_used_refresh_token_revokes_session — session and all tokens deleted on replay
  • expired_refresh_token_returns_error — expired JWT rejected before DB hit
  • invalid_token_signature_returns_error — tampered/garbage token rejected
  • access_token_rejected_as_refresh_token — scope mismatch returns error
  • missing_authorization_header_returns_error — no Bearer header returns error
Labels

None yet.

assignee

None yet.

Participants 1
AT URI
at://did:web:malpercio.dev/sh.tangled.repo.pull/3mhvqgdp2hq22
Diff #0

No differences found between the selected revisions.

History

1 round 0 comments
sign up or login to add to the discussion
malpercio.dev submitted #0
patch application failed: error: No valid patches in input (allow with "--allow-empty")
expand 0 comments