Function refresh

apps/api/src/routers/auth.py:194–295

Validates the refresh token and issues a new access token + rotated refresh token. The refresh token is read from cookies. Applies the same ``password_changed_at`` and logout-revocation checks as ``get_current_user`` — a refresh must not outlive either. Rotates the refresh cook

(
    request: Request,
    response: Response,
    db_session: AsyncSession = Depends(get_db_session),
)

    },
)
async def refresh(
    request: Request,
    response: Response,
    db_session: AsyncSession = Depends(get_db_session),
):
    """
    Validates the refresh token and issues a new access token + rotated refresh
    token. The refresh token is read from cookies.

    Applies the same ``password_changed_at`` and logout-revocation checks as
    ``get_current_user`` — a refresh must not outlive either. Rotates the
    refresh cookie on every call; the old token's ``jti`` is marked consumed
    in Redis, and replay is treated as theft (all sessions revoked).
    """
    # Rate limit refresh endpoint to prevent brute force attacks
    is_allowed, retry_after = check_refresh_rate_limit(request)
    if not is_allowed:
        raise HTTPException(
            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
            detail={
                "code": "RATE_LIMITED",
                "message": "Too many refresh attempts. Please try again later.",
                "retry_after": retry_after,
            },
        )

    credentials_exception = HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="Invalid credentials",
        headers={"WWW-Authenticate": "Bearer"},
    )

    refresh_token = request.cookies.get(JWT_REFRESH_COOKIE_NAME)
    if not refresh_token:
        raise credentials_exception

    payload = decode_refresh_token(refresh_token)
    if not payload:
        raise credentials_exception

    email = payload.get("sub")
    if not email:
        raise credentials_exception

    user = await security_get_user(request, db_session, email=email)
    if user is None or user.id is None:
        raise credentials_exception

    # Enforce password-change cutover: tokens minted before the user's last
    # password change are stale.
    iat_raw = payload.get("iat")
    issued_at = None
    if iat_raw:
        try:
            issued_at = datetime.fromtimestamp(iat_raw, tz=timezone.utc)
        except (TypeError, ValueError, OSError):
            issued_at = None