Trent/vigilcare-clinical
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: No token refresh or revocation mechanism~

Browse Source
This commit is contained in:
voltsrage
2026-06-25 14:14:20 +08:00
parent a8964381a2
commit fdcc646fae
26 changed files with 3453 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/clinical-platform-gap-analysis.md
+3 -20
View File
@@ -565,26 +565,9 @@ Any compromised container on the Docker network can read/write/delete clinical d
---
## P3 — No token refresh or revocation mechanism
## ~~P3 — No token refresh or revocation mechanism~~ DONE
### Problem
JWT tokens are issued with a configurable expiration but there is no refresh token flow and no token revocation/blacklist. A compromised token remains valid until natural expiration. There is no `POST /auth/refresh` or `POST /auth/revoke` endpoint.
### Why fix
Clinical sessions may last entire shifts (8-12 hours). Short token lifetimes require frequent re-authentication, disrupting clinical workflows. Long lifetimes without revocation mean a stolen token grants extended access. Compromised accounts cannot be locked out until the token expires.
### How to fix
1. Add refresh token support: issue a long-lived opaque refresh token stored in the database alongside the access token.
2. Add `POST /api/v1/auth/refresh` — validate refresh token, issue new access token.
3. Add `POST /api/v1/auth/revoke` — invalidate refresh token and optionally blacklist the access token (via Redis TTL set matching remaining token lifetime).
4. Add `LastLoginAt` update on token refresh (already exists on `ClinicalUser`).
**Files:** `AuthController.cs`, `AuthService.cs`, `ClinicalUser.cs` (add `RefreshToken`, `RefreshTokenExpiresAt`), migration.
**Dependency:** None.
Implemented: `RefreshToken` entity with DB-backed storage, `POST /api/v1/auth/refresh` (rotate refresh token + issue new access token), `POST /api/v1/auth/logout` (revoke refresh token server-side). Access token reduced to 15 min, refresh token 7 days. Frontend auto-refreshes before expiry, retries on 401, and redirects to login on refresh failure. Logout button in header, sidebar, and mobile nav. Audit logged as `USER_LOGOUT` and `TOKEN_REFRESHED`.
---
@@ -743,7 +726,7 @@ Different hospitals and clinical settings have different protocols. CMS Sepsis S
| 19 | JWT key not validated on startup | P3 | D | Open |
| 20 | No authorization failure audit | P3 | D | Open |
| 21 | Elasticsearch security disabled | P3 | D | Open |
| 22 | No token refresh/revocation | P3 | D | Open |
| 22 | ~~No token refresh/revocation~~ | P3 | D | **Done** |
| 23 | No request timing metrics | P5 | E | Open |
| 24 | Background service error metrics | P5 | E | Open |
| 25 | Thin concurrent/resilience tests | P5 | E | Open |