Method refresh

apps/api/src/auth/auth.service.ts:91–108

(refreshToken: unknown)

  }

  refresh(refreshToken: unknown): AuthTokens {
    if (typeof refreshToken !== "string" || !refreshToken) {
      throw new UnauthorizedException({ error: "missing refresh token" });
    }
    const row = this.store.refreshTokens.findByHash(hashRefreshToken(refreshToken));
    if (!row || row.expiresAt < Date.now()) {
      throw new UnauthorizedException({ error: "invalid refresh token" });
    }
    // Reuse of an already-rotated token (or losing the atomic claim) signals a
    // possible theft → revoke every session for that user and reject.
    if (row.revoked || !this.store.refreshTokens.revokeIfActive(row.tokenHash)) {
      this.store.refreshTokens.revokeAllForUser(row.userId);
      throw new UnauthorizedException({ error: "invalid refresh token" });
    }
    const u = this.store.users.findById(row.userId);
    if (!u) throw new UnauthorizedException({ error: "invalid refresh token" });
    return this.issue(u);
  }

  logout(refreshToken: unknown): void {
    if (typeof refreshToken === "string" && refreshToken) {