refreshAccessToken method

@unauthenticatedClientCall Future<AuthSuccess> refreshAccessToken(Session session, { String? refreshToken, })

Creates a new token pair for the given refreshToken.

If refreshToken is omitted, cookie-mode web clients fall back to the configured HttpOnly refresh cookie. When neither source is present this throws RefreshTokenNotFoundException, the same public "no usable refresh credential" exception used for unknown refresh tokens.

Can throw the following exceptions: -RefreshTokenMalformedException: refresh token is malformed and could not be parsed. Not expected to happen for tokens issued by the server. -RefreshTokenNotFoundException: refresh token is unknown to the server. Either the token was deleted or generated by a different server. -RefreshTokenExpiredException: refresh token has expired. Will happen only if it has not been used within configured refreshTokenLifetime. -RefreshTokenInvalidSecretException: refresh token is incorrect, meaning it does not refer to the current secret refresh token. This indicates either a malfunctioning client or a malicious attempt by someone who has obtained the refresh token. In this case the underlying refresh token will be deleted, and access to it will expire fully when the last access token is elapsed.

This endpoint is unauthenticated, meaning the client won't include any authentication information with the call.

Implementation

@unauthenticatedClientCall
Future<AuthSuccess> refreshAccessToken(
  final Session session, {
  final String? refreshToken,
}) async {
  final resolvedRefreshToken =
      refreshToken ?? session.readWebAuthRefreshCookie();
  if (resolvedRefreshToken == null) {
    throw RefreshTokenNotFoundException();
  }

  final authSuccess = await jwt.refreshAccessToken(
    session,
    refreshToken: resolvedRefreshToken,
  );

  if (!session.isWebAuthCookieRequest) return authSuccess;

  final rotatedRefreshToken = authSuccess.refreshToken;
  if (rotatedRefreshToken == null) return authSuccess;

  final maxAgeSeconds = jwt.config.refreshTokenLifetime.inSeconds;
  session.writeWebAuthRefreshCookie(
    rotatedRefreshToken,
    maxAgeSeconds: maxAgeSeconds > 0 ? maxAgeSeconds : null,
    path: jwtRefreshCookiePath(session),
  );
  return authSuccess.copyWith(refreshToken: null);
}