JWT Authentication in Production: Access Tokens, Refresh Token Rotation & Revocation

+----------------------------------------------------------------------+
|                     JWT Security Token Architecture                  |
|                                                                      |
|  [ Access Token ]  --> Short TTL (5-15 mins) --> Memory / HTTP-Only  |
|  [ Refresh Token ] --> Long TTL (7-30 days)  --> Secure Cookie + DB  |
+----------------------------------------------------------------------+

1. Client sends Refresh Token #1 -> Server validates.
2. Server invalidates Refresh Token #1 and issues [ Access Token #2, Refresh Token #2 ].
3. If an attacker attempts to replay Refresh Token #1:
   💥 Server detects token reuse, immediately REVOKES the entire token family,
      and forces all sessions to re-authenticate!

@Injectable()
export class AuthService {
  async rotateRefreshToken(userId: string, oldToken: string) {
    const tokenRecord = await this.prisma.refreshToken.findUnique({ where: { token: oldToken } });

    if (!tokenRecord) {
      // Possible compromise! Revoke all tokens for this user family
      await this.prisma.refreshToken.deleteMany({ where: { userId } });
      throw new UnauthorizedException('Security alert: Token reuse detected. Please log in again.');
    }

    if (tokenRecord.expiresAt < new Date()) {
      await this.prisma.refreshToken.delete({ where: { id: tokenRecord.id } });
      throw new UnauthorizedException('Session expired');
    }

    // Invalidate old token and issue new pair
    await this.prisma.refreshToken.delete({ where: { id: tokenRecord.id } });

    const newAccessToken = this.jwtService.sign({ sub: userId }, { expiresIn: '15m' });
    const newRefreshToken = crypto.randomBytes(40).toString('hex');

    await this.prisma.refreshToken.create({
      data: {
        token: newRefreshToken,
        userId,
        expiresAt: new Date(Date.now() + 7 * 24 * 3600 * 1000),
      },
    });

    return { accessToken: newAccessToken, refreshToken: newRefreshToken };
  }
}