| 1 |
|
defmodule WalletAuth.Token.RefreshToken do |
| 2 |
|
@moduledoc """ |
| 3 |
|
Opaque refresh token generation. |
| 4 |
|
|
| 5 |
|
Refresh tokens are: |
| 6 |
|
- Opaque (not JWTs) — random bytes encoded as URL-safe base64. |
| 7 |
|
- One-time-use: invalidated immediately on use; new token issued on each refresh. |
| 8 |
|
- Revocable: subject to explicit revocation via TokenStore. |
| 9 |
|
- Bound to a session_id and subject (user_id). |
| 10 |
|
|
| 11 |
|
Per ADR 0006: refresh token rotation is mandatory to limit replay window. |
| 12 |
|
""" |
| 13 |
|
|
| 14 |
|
@token_bytes 32 |
| 15 |
|
|
| 16 |
|
@type t :: String.t() |
| 17 |
|
|
| 18 |
|
@doc "Generates a new cryptographically random opaque refresh token." |
| 19 |
|
@spec generate() :: t() |
| 20 |
|
def generate do |
| 21 |
|
:crypto.strong_rand_bytes(@token_bytes) |
| 22 |
32 |
|> Base.url_encode64(padding: false) |
| 23 |
|
end |
| 24 |
|
end |