[Backend] — Auth Refresh Token Rotation and Reuse Detection

[Olowodarey]

Problem
auth refresh tokens may be long-lived without rotation, so a leaked token stays valid and reuse goes undetected.

Requirements

• Rotate refresh tokens on use; invalidate the prior token.
• Detect reuse of a rotated token and revoke the session family.
• Tests: rotation issues a new token; reuse triggers family revocation.

Acceptance Criteria

• Refresh tokens rotate and reuse is detected and blocked. Covered by tests.

Files

• backend/src/auth/auth.service.ts
• backend/src/migrations/1777000000000-CreateRefreshTokens.ts
• backend/src/auth/auth.module.ts

[trust13]

@trust13 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

This is a valuable authentication hardening task, and I can implement refresh-token rotation with reuse detection while ensuring the session family is revoked appropriately. I’ll also cover both rotation and reuse scenarios with tests.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @trust13 to this issue.

[kiel997]

@kiel997 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello maintanier,

I can implement secure refresh token rotation and reuse detection for the authentication system. I will ensure refresh tokens are rotated after use, detect attempts to reuse previously consumed tokens, and invalidate compromised token sessions when reuse is identified. I will also handle token expiration, revocation, and relevant edge cases while keeping the existing authentication flow stable. Appropriate tests will be added to verify successful rotation, expired tokens, token reuse, and invalid refresh attempts.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @kiel997 to this issue.

[rudeus112266]

@rudeus112266 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Kindly assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @rudeus112266 to this issue.

[drips-wave]

Congratulations, @rudeus112266! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @rudeus112266: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊