update auth for refresh tokens and token invalidation

VigilCareRecordsAPI/Services/AuthService.cs

@@ -1,5 +1,6 @@
 using System.IdentityModel.Tokens.Jwt;
 using System.Security.Claims;
+using System.Security.Cryptography;
 using System.Text;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Options;
@@ -25,8 +26,37 @@ public class AuthService : IAuthService
         if (!user.IsActive)
             throw new ConflictException("Account is disabled.", "ACCOUNT_DISABLED");
 
-        var token = GenerateJwt(user);
-        return new LoginResponse(token, user.Id, user.Username, user.FullName, user.Role.ToDbString());
+        var (accessToken, refreshToken) = await IssueTokenPairAsync(user);
+        return new LoginResponse(
+            accessToken,
+            refreshToken,
+            user.Id,
+            user.Username,
+            user.FullName,
+            user.Role.ToDbString());
+    }
+
+    public async Task<TokenResponse> RefreshAsync(RefreshRequest req)
+    {
+        var storedToken = await FindValidRefreshTokenAsync(req.RefreshToken);
+        var user = await _db.Users.FindAsync(storedToken.UserId);
+        if (user is null || !user.IsActive)
+            throw new ValidationException("Invalid refresh token.", "INVALID_REFRESH_TOKEN");
+
+        storedToken.RevokedAt = DateTimeOffset.UtcNow;
+
+        var (accessToken, refreshToken) = await IssueTokenPairAsync(user, storedToken);
+        await WriteAuthAuditEventAsync(user.Id, AuthAuditEventType.TokenRefreshed);
+
+        return new TokenResponse(accessToken, refreshToken);
+    }
+
+    public async Task LogoutAsync(LogoutRequest req)
+    {
+        var storedToken = await FindValidRefreshTokenAsync(req.RefreshToken);
+        storedToken.RevokedAt = DateTimeOffset.UtcNow;
+        await WriteAuthAuditEventAsync(storedToken.UserId, AuthAuditEventType.UserLogout);
+        await _db.SaveChangesAsync();
     }
 
     public async Task<User> GetCurrentUserAsync(Guid userId)
@@ -37,6 +67,60 @@ public class AuthService : IAuthService
         return user;
     }
 
+    private async Task<(string AccessToken, string RefreshToken)> IssueTokenPairAsync(
+        User user,
+        RefreshToken? replacedToken = null)
+    {
+        var accessToken = GenerateJwt(user);
+        var refreshTokenValue = GenerateRefreshToken();
+        var refreshTokenEntity = new RefreshToken
+        {
+            Id = Guid.NewGuid(),
+            UserId = user.Id,
+            TokenHash = HashToken(refreshTokenValue),
+            ExpiresAt = DateTimeOffset.UtcNow.AddDays(_jwtOptions.RefreshTokenExpiryDays),
+            CreatedAt = DateTimeOffset.UtcNow
+        };
+
+        if (replacedToken is not null)
+        {
+            replacedToken.ReplacedByTokenId = refreshTokenEntity.Id;
+        }
+
+        _db.RefreshTokens.Add(refreshTokenEntity);
+        await _db.SaveChangesAsync();
+
+        return (accessToken, refreshTokenValue);
+    }
+
+    private async Task<RefreshToken> FindValidRefreshTokenAsync(string refreshToken)
+    {
+        var tokenHash = HashToken(refreshToken);
+        var storedToken = await _db.RefreshTokens
+            .FirstOrDefaultAsync(t => t.TokenHash == tokenHash);
+
+        if (storedToken is null
+            || storedToken.RevokedAt is not null
+            || storedToken.ExpiresAt <= DateTimeOffset.UtcNow)
+        {
+            throw new ValidationException("Invalid refresh token.", "INVALID_REFRESH_TOKEN");
+        }
+
+        return storedToken;
+    }
+
+    private async Task WriteAuthAuditEventAsync(Guid userId, AuthAuditEventType eventType)
+    {
+        _db.AuthAuditEvents.Add(new AuthAuditEvent
+        {
+            Id = Guid.NewGuid(),
+            UserId = userId,
+            EventType = eventType,
+            OccurredAt = DateTimeOffset.UtcNow
+        });
+        await _db.SaveChangesAsync();
+    }
+
     private string GenerateJwt(User user)
     {
         var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtOptions.Secret));
@@ -59,4 +143,16 @@ public class AuthService : IAuthService
 
         return new JwtSecurityTokenHandler().WriteToken(token);
     }
-}
+
+    private static string GenerateRefreshToken()
+    {
+        var bytes = RandomNumberGenerator.GetBytes(64);
+        return Convert.ToBase64String(bytes);
+    }
+
+    private static string HashToken(string token)
+    {
+        var bytes = SHA256.HashData(Encoding.UTF8.GetBytes(token));
+        return Convert.ToHexString(bytes).ToLowerInvariant();
+    }
+}

VigilCareRecordsAPI/Services/Interfaces/IAuthService.cs

@@ -1,5 +1,7 @@
 public interface IAuthService
 {
     Task<LoginResponse> LoginAsync(LoginRequest req);
+    Task<TokenResponse> RefreshAsync(RefreshRequest req);
+    Task LogoutAsync(LogoutRequest req);
     Task<User> GetCurrentUserAsync(Guid userId);
-}
+}