Method refreshAccessToken

backend/api/src/auth/auth.service.ts:114–162

(
    refreshToken: string,
    ipAddress?: string,
    userAgent?: string,
  )

  }

  async refreshAccessToken(
    refreshToken: string,
    ipAddress?: string,
    userAgent?: string,
  ) {
    // First validate the OLD refresh token to get the user
    const oldTokenEntity =
      await this.refreshTokenService.validateRefreshToken(refreshToken);

    if (!oldTokenEntity || !oldTokenEntity.userId) {
      throw new UnauthorizedException('Invalid refresh token');
    }

    // Load the user explicitly by ID
    const user = await this.usersService.findOne(oldTokenEntity.userId);
    if (!user) {
      throw new UnauthorizedException('User not found');
    }

    // Now rotate to get new refresh token
    const newRefreshToken = await this.refreshTokenService.rotateRefreshToken(
      refreshToken,
      ipAddress,
      userAgent,
    );

    if (!newRefreshToken) {
      throw new UnauthorizedException('Failed to rotate refresh token');
    }

    const payload = {
      email: user.email,
      sub: user.id,
      type: 'access',
    };

    // Generate new short-lived access token
    const accessToken = this.jwtService.sign(payload, {
      secret:
        this.configService.get('JWT_ACCESS_SECRET') ||
        this.configService.get('JWT_SECRET'),
      expiresIn: '15m',
    });

    return {
      access_token: accessToken,
      refresh_token: newRefreshToken,
    };
  }

  async logout(refreshToken: string) {
    await this.refreshTokenService.revokeToken(refreshToken);