fix: No token refresh or revocation mechanism~

VigilCareClinicalAPI/Controllers/AuthController.cs

@@ -2,7 +2,7 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 /// <summary>
-/// JWT authentication: login and current-user profile.
+/// JWT authentication: login, token refresh, logout, and current-user profile.
 /// </summary>
 [ApiController]
 [Route("api/v1/auth")]
@@ -24,6 +24,29 @@ public class AuthController : ControllerBase
         return Ok(ApiResponse<LoginResponse>.Ok(result));
     }
 
+    /// <summary>Exchange a refresh token for a new access + refresh token pair.</summary>
+    [HttpPost("refresh")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(ApiResponse<RefreshResponse>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiResponse<object>), StatusCodes.Status422UnprocessableEntity)]
+    public async Task<IActionResult> Refresh([FromBody] RefreshRequest req)
+    {
+        var result = await _auth.RefreshAsync(req.RefreshToken);
+        return Ok(ApiResponse<RefreshResponse>.Ok(result));
+    }
+
+    /// <summary>Revoke the refresh token and end the session.</summary>
+    [HttpPost("logout")]
+    [Authorize]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> Logout(
+        [FromBody] LogoutRequest req,
+        [FromServices] ICurrentUserService currentUser)
+    {
+        await _auth.LogoutAsync(req.RefreshToken, currentUser.UserId!.Value);
+        return NoContent();
+    }
+
     /// <summary>Returns the authenticated user's profile.</summary>
     [HttpGet("me")]
     [Authorize]