Package com.nicholasalfonso.lato.service

Class RefreshTokenService

java.lang.Object
com.nicholasalfonso.lato.service.RefreshTokenService
@Service public class RefreshTokenService extends Object
Service for creating and validating persisted refresh tokens.

  • Constructor Details

    • RefreshTokenService

      public RefreshTokenService(@Value("${lato.jwt.refresh-expiration-ms}") long refreshExpirationMs, RefreshTokenRepository refreshTokenRepository)
      Creates the refresh token service with configured expiration settings.
      Parameters:
      refreshExpirationMs - refresh token lifetime in milliseconds
      refreshTokenRepository - repository for refresh token persistence

  • Method Details

    • createRefreshToken

      @Transactional public RefreshToken createRefreshToken(User user)
      Creates and persists a new refresh token for the given user.
      Parameters:
      user - the user to associate with the refresh token
      Returns:
      the saved refresh token entity

    • verifyRefreshToken

      @Transactional public RefreshToken verifyRefreshToken(String token)
      Validates a refresh token and returns the persisted entity.
      Parameters:
      token - refresh token string from the client
      Returns:
      the valid refresh token entity
      Throws:
      org.springframework.web.server.ResponseStatusException - if the token is invalid or expired

    • rotateRefreshToken

      @Transactional public RefreshToken rotateRefreshToken(RefreshToken token)
      Replaces an existing refresh token with a newly generated one for the same user.
      Parameters:
      token - the refresh token to rotate
      Returns:
      the newly created refresh token entity

    • revokeRefreshToken

      @Transactional public void revokeRefreshToken(String token)
      Deletes a refresh token by its token string, if present.
      Parameters:
      token - refresh token string to revoke

    • revokeRefreshToken

      @Transactional public void revokeRefreshToken(User user)
      Deletes all refresh tokens associated with a user.
      Parameters:
      user - the user whose refresh tokens should be revoked