JWT Access and Refresh Token Rotation — Complete Token Lifecycle Management

import jwt, secrets, datetime, hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)
SECRET = "rotation-secret"

# token_families[family_id] = { active_token_hash, user, revoked }
token_families = {}

def create_token_family(user):
    family_id = secrets.token_urlsafe(16)
    refresh_token = secrets.token_urlsafe(32)
    token_hash = hashlib.sha256(refresh_token.encode()).hexdigest()

    token_families[family_id] = {
        "user": user,
        "active_hash": token_hash,
        "revoked": False,
        "created": datetime.datetime.utcnow().isoformat()
    }
    return family_id, refresh_token

def issue_access_token(user):
    return jwt.encode({
        "sub": user,
        "iat": datetime.datetime.utcnow(),
        "exp": datetime.datetime.utcnow() + datetime.timedelta(minutes=15)
    }, SECRET, algorithm="HS256")

@app.route("/api/auth/login", methods=["POST"])
def login():
    username = request.json.get("username", "user")
    family_id, refresh_token = create_token_family(username)
    access_token = issue_access_token(username)

    return jsonify({
        "access_token": access_token,
        "refresh_token": refresh_token,
        "token_family": family_id,
        "expires_in": 900
    })

@app.route("/api/auth/refresh", methods=["POST"])
def refresh():
    old_refresh = request.json.get("refresh_token")
    if not old_refresh:
        return jsonify({"error": "Refresh token required"}), 401

    old_hash = hashlib.sha256(old_refresh.encode()).hexdigest()

    # Find token family
    for fam_id, fam in token_families.items():
        if fam["active_hash"] == old_hash:
            if fam["revoked"]:
                return jsonify({
                    "error": "Token family revoked — possible theft"
                }), 401

            # Issue new tokens, invalidate old
            new_refresh = secrets.token_urlsafe(32)
            new_hash = hashlib.sha256(new_refresh.encode()).hexdigest()
            fam["active_hash"] = new_hash

            access_token = issue_access_token(fam["user"])

            return jsonify({
                "access_token": access_token,
                "refresh_token": new_refresh,
                "expires_in": 900
            })

    return jsonify({"error": "Invalid refresh token"}), 401

@app.route("/api/auth/refresh", methods=["POST"])
def refresh_with_theft_detection():
    """Enhanced refresh with automatic theft detection."""
    old_refresh = request.json.get("refresh_token")
    old_hash = hashlib.sha256(old_refresh.encode()).hexdigest()

    for fam_id, fam in token_families.items():
        if fam["active_hash"] == old_hash:
            # Normal rotation — issue new tokens
            new_refresh = secrets.token_urlsafe(32)
            new_hash = hashlib.sha256(new_refresh.encode()).hexdigest()
            fam["active_hash"] = new_hash

            return jsonify({
                "access_token": issue_access_token(fam["user"]),
                "refresh_token": new_refresh
            })

        # Check if old_hash matches a PREVIOUS hash in this family
        if fam.get("previous_hashes") and old_hash in fam["previous_hashes"]:
            # Theft detected! This refresh was already rotated
            fam["revoked"] = True
            fam["theft_detected_at"] = datetime.datetime.utcnow().isoformat()

            # Alert security team (in production)
            alert_theft_detected(fam_id, fam["user"])

            return jsonify({
                "error": "Possible token theft — all tokens revoked",
                "contact": "security@dodatech.com"
            }), 401

    return jsonify({"error": "Invalid refresh token"}), 401


def alert_theft_detected(family_id, user):
    """Log security event for token theft."""
    import logging
    logging.warning(
        f"TOKEN THEFT DETECTED: family={family_id}, user={user}, "
        f"time={datetime.datetime.utcnow().isoformat()}"
    )

class AuthenticatedClient {
  constructor(baseURL) {
    this.baseURL = baseURL;
    this.accessToken = null;
    this.refreshToken = null;
    this.refreshPromise = null;
  }

  async request(path, options = {}) {
    const headers = { ...options.headers };
    if (this.accessToken) {
      headers['Authorization'] = `Bearer ${this.accessToken}`;
    }

    const resp = await fetch(`${this.baseURL}${path}`, {
      ...options, headers
    });

    if (resp.status === 401 && this.refreshToken) {
      await this.attemptRefresh();
      return this.request(path, options); // Retry
    }

    return resp;
  }

  async attemptRefresh() {
    // Prevent concurrent refresh storms
    if (this.refreshPromise) return this.refreshPromise;

    this.refreshPromise = (async () => {
      const resp = await fetch(`${this.baseURL}/api/auth/refresh`, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ refresh_token: this.refreshToken })
      });

      if (resp.ok) {
        const data = await resp.json();
        this.accessToken = data.access_token;
        this.refreshToken = data.refresh_token;
      } else {
        this.accessToken = null;
        this.refreshToken = null;
        throw new Error('Session expired');
      }
    })();

    try {
      return await this.refreshPromise;
    } finally {
      this.refreshPromise = null;
    }
  }
}