Token refresh

2026-08-26 17:16:06 +02:00
parent 27f26e615a
commit 54d2e4e864
7 changed files with 167 additions and 26 deletions
@@ -1014,5 +1014,11 @@ Use the VIBE directory to log interactions
 ### Assistant outcome
 Appended this visible interaction to the project VIBE chat and prompt logs in the repo’s append-only format.

+### User
+First implement a proper refresh-token rotation flow with hashing, revocation, and device binding
+
+### Assistant outcome
+Added a refresh-token rotation flow with hashed token storage, per-device binding, token-family revocation, and a dedicated /api/auth/refresh endpoint. The new flow was validated with a focused regression test covering replay rejection and device mismatch rejection.
+
 ### Assistant outcome
 Made popup state transitions defensive by synchronizing both `hidden` attributes and CSS classes. Non-authentication tag-loading errors no longer switch the popup to signed-out state; only a rejected session does. Added `display: none !important` guards for both authentication blocks.
@@ -181,6 +181,7 @@
 161. The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out.
 162. The authenticated session text and sign-in block are still shown together.
 163. Use the VIBE directory to log interactions.
+164. First implement a proper refresh-token rotation flow with hashing, revocation, and device binding.

 ## Future entries