Skip to content

Invalidate refresh tokens after password reset#518

Merged
KishParikh13 merged 1 commit into
v2from
codex/v2-refresh-token-tv-check
Jun 17, 2026
Merged

Invalidate refresh tokens after password reset#518
KishParikh13 merged 1 commit into
v2from
codex/v2-refresh-token-tv-check

Conversation

@KishParikh13

Copy link
Copy Markdown
Collaborator

Summary

  • Reject refresh tokens whose tv claim no longer matches the current user password fingerprint.
  • Keep legacy refresh tokens without tv valid, matching the existing access-token middleware rollout behavior.
  • Add regression coverage for refresh after password rotation plus legacy no-tv refresh compatibility.

Validation

  • npm --workspace=@janata/backend exec -- vitest run src/__tests__/app.test.ts -t "POST /api/auth/refresh"
  • npm --workspace=@janata/backend run typecheck

Notes

  • This branch intentionally contains only the auth refresh route/test changes.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying chinmaya-janata with  Cloudflare Pages  Cloudflare Pages

Latest commit: 2340bd9
Status: ✅  Deploy successful!
Preview URL: https://6c1f9153.project-janatha.pages.dev
Branch Preview URL: https://codex-v2-refresh-token-tv-ch.project-janatha.pages.dev

View logs

@KishParikh13 KishParikh13 marked this pull request as ready for review June 17, 2026 15:03
@KishParikh13 KishParikh13 merged commit 4725eb5 into v2 Jun 17, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant