Token refresh

backend/tests/test_api.py

@@ -68,6 +68,40 @@ def test_login_rate_limit_locks_out_after_five_failures_and_resets_on_success():
     assert valid.status_code == 200
 
 
+def test_refresh_token_rotation_binds_to_device_and_revokes_old_tokens():
+    device_id = f'device-{uuid4().hex}'
+    login = client.post('/api/auth/login', json={
+        'email': 'alice@example.com',
+        'password': 'secret123',
+        'device_id': device_id,
+    })
+    assert login.status_code == 200
+    refresh_token = login.json()['refresh_token']
+    first_access = login.json()['access_token']
+
+    rotated = client.post('/api/auth/refresh', json={
+        'refresh_token': refresh_token,
+        'device_id': device_id,
+    })
+    assert rotated.status_code == 200
+    rotated_payload = rotated.json()
+    assert rotated_payload['access_token'] != first_access
+    assert rotated_payload['refresh_token'] != refresh_token
+    assert rotated_payload['device_id'] == device_id
+
+    replay = client.post('/api/auth/refresh', json={
+        'refresh_token': refresh_token,
+        'device_id': device_id,
+    })
+    assert replay.status_code == 401
+
+    wrong_device = client.post('/api/auth/refresh', json={
+        'refresh_token': rotated_payload['refresh_token'],
+        'device_id': 'device-other',
+    })
+    assert wrong_device.status_code == 401
+
+
 def test_password_hashes_are_salted_and_legacy_hashes_upgrade_on_login():
     from hashlib import sha256
     from backend.app.database import hash_password