token usage tightened with revocation

backend/tests/test_api.py

@@ -68,6 +68,37 @@ def test_login_rate_limit_locks_out_after_five_failures_and_resets_on_success():
     assert valid.status_code == 200
 
 
+def test_refresh_token_rotates_and_reuse_revokes_family():
+    device_id = f'device-{uuid4().hex}'
+    login = client.post('/api/auth/login', json={
+        'email': 'alice@example.com',
+        'password': 'secret123',
+        'device_id': device_id,
+    })
+    assert login.status_code == 200
+    first = login.json()
+
+    rotated = client.post('/api/auth/refresh', json={
+        'refresh_token': first['refresh_token'],
+        'device_id': device_id,
+    })
+    assert rotated.status_code == 200
+    second = rotated.json()
+    assert second['refresh_token'] != first['refresh_token']
+    assert client.get('/api/auth/me', headers={'Authorization': f"Bearer {second['access_token']}"}).status_code == 200
+
+    reused = client.post('/api/auth/refresh', json={
+        'refresh_token': first['refresh_token'],
+        'device_id': device_id,
+    })
+    assert reused.status_code == 401
+    family_revoked = client.post('/api/auth/refresh', json={
+        'refresh_token': second['refresh_token'],
+        'device_id': device_id,
+    })
+    assert family_revoked.status_code == 401
+
+
 def test_password_hashes_are_salted_and_legacy_hashes_upgrade_on_login():
     from hashlib import sha256
     from backend.app.database import hash_password

backend/tests/test_database.py

@@ -10,7 +10,7 @@ def test_database_migrations_are_versioned_and_idempotent():
     connection = sqlite3.connect(':memory:')
 
     apply_migrations(connection)
-    assert get_schema_version(connection) == 14
+    assert get_schema_version(connection) == 15
     tables = {
         row[0]
         for row in connection.execute(
@@ -27,6 +27,6 @@ def test_database_migrations_are_versioned_and_idempotent():
     assert set(DEFAULT_TAGS) <= seeded_tags
 
     apply_migrations(connection)
-    assert get_schema_version(connection) == 14
+    assert get_schema_version(connection) == 15
 
     connection.close()