Function decode_refresh_token

apps/api/src/security/auth.py:254–275

Decode and validate a refresh JWT token. SECURITY: Always requires expiration claim for refresh tokens. Dev mode does not affect refresh token validation.

(token: str)

def decode_refresh_token(token: str) -> Optional[dict]:
    """
    Decode and validate a refresh JWT token.

    SECURITY: Always requires expiration claim for refresh tokens.
    Dev mode does not affect refresh token validation.
    """
    try:
        # SECURITY: Always verify expiration for refresh tokens
        decode_options = {"require": ["exp", "sub"]}

        payload = jwt.decode(
            token,
            JWT_SECRET_KEY,
            algorithms=[ALGORITHM],
            options=decode_options
        )
        if payload.get("type") != "refresh":
            return None
        return payload
    except PyJWTError:
        return None


def _mark_refresh_jti_used(user_id: int, jti: str) -> bool: