rotateRefreshToken method

Future<TokenPair> rotateRefreshToken(Session session, { required String refreshToken, Transaction? transaction, })

Returns a new refresh / access token pair.

This invalidates the previous refresh token. Previously created access tokens for this refresh token will continue to work until they expire.

Implementation

Future<TokenPair> rotateRefreshToken(
  final Session session, {
  required final String refreshToken,
  final Transaction? transaction,
}) async {
  final RefreshTokenStringData refreshTokenData;

  try {
    refreshTokenData = RefreshTokenString.parseRefreshTokenString(
      refreshToken,
    );
  } catch (e, stackTrace) {
    session.log(
      'Received malformed refresh token',
      exception: e,
      stackTrace: stackTrace,
      level: LogLevel.debug,
    );

    throw RefreshTokenMalformedServerException();
  }

  if (transaction != null) {
    return _rotateLockedRefreshToken(session, refreshTokenData, transaction);
  }

  // The reuse-revocation delete must survive the rotation failure, so
  // failures are returned from the transaction (committing the delete) and
  // thrown afterwards.
  final Object outcome = await session.db.transaction((final tx) async {
    try {
      return await _rotateLockedRefreshToken(session, refreshTokenData, tx);
    } on RefreshTokenServerException catch (e) {
      return e;
    }
  });
  if (outcome is TokenPair) return outcome;
  throw outcome as RefreshTokenServerException;
}