Bugfix/issue 153 token revalidation

.env.example

@@ -15,3 +15,4 @@ SMTP_PASSWORD=your_smtp_password
 LINKEDIN_CLIENT_ID=your_linkedin_client_id
 LINKEDIN_CLIENT_SECRET=your_linkedin_client_secret
 LINKEDIN_REDIRECT_URL=http://localhost:${SERVER_PORT}/api/auth/linkedin/callback
+REFRESH_JWT_SECRET=your_refresh_jwt_secret_key

src/configs/envConfig.ts

@@ -19,3 +19,4 @@ export const SMTP_PASS = process.env.SMTP_PASS ?? ''
 export const LINKEDIN_CLIENT_ID = process.env.LINKEDIN_CLIENT_ID ?? ''
 export const LINKEDIN_CLIENT_SECRET = process.env.LINKEDIN_CLIENT_SECRET ?? ''
 export const LINKEDIN_REDIRECT_URL = process.env.LINKEDIN_REDIRECT_URL ?? ''
+export const REFRESH_JWT_SECRET = process.env.REFRESH_JWT_SECRET ?? ''

src/configs/google-passport.ts

@@ -67,7 +67,7 @@ passport.deserializeUser(async (primary_email: string, done) => {
 const cookieExtractor = (req: Request): string => {
   let token = null
   if (req?.cookies) {
-    token = req.cookies.jwt
+    token = req.cookies.accessToken
   }
   return token
 }

src/configs/linkedin-passport.ts

@@ -68,7 +68,7 @@ passport.deserializeUser(async (primary_email: string, done) => {
 const cookieExtractor = (req: Request): string => {
   let token = null
   if (req?.cookies) {
-    token = req.cookies.jwt
+    token = req.cookies.accessToken
   }
   return token
 }

src/controllers/auth.controller.ts

@@ -1,16 +1,16 @@
-import type { Request, Response, NextFunction } from 'express'
+import type { NextFunction, Request, Response } from 'express'
+import jwt from 'jsonwebtoken'
+import passport from 'passport'
+import { JWT_SECRET, REFRESH_JWT_SECRET } from '../configs/envConfig'
+import type Profile from '../entities/profile.entity'
 import {
-  registerUser,
+  generateResetToken,
   loginUser,
-  resetPassword,
-  generateResetToken
+  registerUser,
+  resetPassword
 } from '../services/auth.service'
-import passport from 'passport'
-import type Profile from '../entities/profile.entity'
-import jwt from 'jsonwebtoken'
-import { JWT_SECRET } from '../configs/envConfig'
 import type { ApiResponse } from '../types'
-import { signAndSetCookie } from '../utils'
+import { setAccessToken, signAndSetCookie } from '../utils'
 
 export const googleRedirect = async (
   req: Request,
@@ -135,7 +135,8 @@ export const logout = async (
   res: Response
 ): Promise<ApiResponse<Profile>> => {
   try {
-    res.clearCookie('jwt', { httpOnly: true })
+    res.clearCookie('accessToken', { httpOnly: true })
+    res.clearCookie('refreshToken', { httpOnly: true })
     return res.status(200).json({ message: 'Logged out successfully' })
   } catch (err) {
     if (err instanceof Error) {
@@ -163,18 +164,27 @@ export const requireAuth = (
         return
       }
 
-      const token = req.cookies.jwt
+      const token = req.cookies.accessToken
+      const refreshToken = req.cookies.refreshToken
 
-      if (!token) {
-        return res.status(401).json({ error: 'User is not authenticated' })
+      if (!token && !refreshToken) {
+        return res.status(403).json({ error: 'Forbidden. No token provided.' })
       }
 
       try {
         jwt.verify(token, JWT_SECRET)
       } catch (err) {
-        return res
-          .status(401)
-          .json({ error: 'Invalid token, please log in again' })
+        try {
+          const decoded = jwt.verify(refreshToken, REFRESH_JWT_SECRET) as {
+            userId: string
+          }
+
+          setAccessToken(res, decoded.userId)
+        } catch (error) {
+          return res
+            .status(401)
+            .json({ error: 'Invalid token, please log in again' })
+        }
       }
 
       if (!user) {
@@ -230,3 +240,22 @@ export const passwordReset = async (
     })
   }
 }
+
+export const refresh = async (req: Request, res: Response): Promise<void> => {
+  const refreshToken = req.cookies.refreshToken
+
+  if (!refreshToken) {
+    res.status(401).json({ error: 'Access Denied. No token provided.' })
+    return
+  }
+
+  try {
+    const decoded = jwt.verify(refreshToken, REFRESH_JWT_SECRET) as {
+      userId: string
+    }
+
+    setAccessToken(res, decoded.userId)
+  } catch (error) {
+    res.status(401).json({ error: 'Invalid token, please log in again' })
+  }
+}

src/routes/auth/auth.route.ts

@@ -7,6 +7,7 @@ import {
   logout,
   passwordReset,
   passwordResetRequest,
+  refresh,
   register
 } from '../../controllers/auth.controller'
 import { requestBodyValidator } from '../../middlewares/requestValidator'
@@ -15,6 +16,7 @@ import { loginSchema, registerSchema } from '../../schemas/auth-routes.schems'
 const authRouter = express.Router()
 
 authRouter.post('/register', requestBodyValidator(registerSchema), register)
+authRouter.post('/refresh', refresh)
 authRouter.post('/login', requestBodyValidator(loginSchema), login)
 authRouter.get('/logout', logout)
 

src/utils.ts

@@ -1,21 +1,48 @@
-import { JWT_SECRET, CLIENT_URL } from './configs/envConfig'
-import jwt from 'jsonwebtoken'
+import { randomUUID } from 'crypto'
+import ejs from 'ejs'
 import type { Response } from 'express'
-import type Mentor from './entities/mentor.entity'
-import path from 'path'
+import jwt from 'jsonwebtoken'
 import multer from 'multer'
-import ejs from 'ejs'
-import { MenteeApplicationStatus, MentorApplicationStatus } from './enums'
-import { generateCertificate } from './services/admin/generateCertificate'
-import { randomUUID } from 'crypto'
+import path from 'path'
 import { certificatesDir } from './app'
+import { CLIENT_URL, JWT_SECRET, REFRESH_JWT_SECRET } from './configs/envConfig'
 import type Mentee from './entities/mentee.entity'
+import type Mentor from './entities/mentor.entity'
+import { MenteeApplicationStatus, MentorApplicationStatus } from './enums'
+import { generateCertificate } from './services/admin/generateCertificate'
 import { type ZodError } from 'zod'
 
+const generateAccessToken = (uuid: string): string => {
+  return jwt.sign({ userId: uuid }, JWT_SECRET ?? '')
+}
+
+const generateRefreshToken = (uuid: string): string => {
+  return jwt.sign({ userId: uuid }, REFRESH_JWT_SECRET ?? '', {
+    expiresIn: '10d'
+  })
+}
+
 export const signAndSetCookie = (res: Response, uuid: string): void => {
-  const token = jwt.sign({ userId: uuid }, JWT_SECRET ?? '')
+  const accessToken = generateAccessToken(uuid)
+  const refreshToken = generateRefreshToken(uuid)
+
+  res.cookie('accessToken', accessToken, {
+    httpOnly: true,
+    maxAge: 5 * 24 * 60 * 60 * 1000,
+    secure: false // TODO: Set to true when using HTTPS
+  })
+
+  res.cookie('refreshToken', refreshToken, {
+    httpOnly: true,
+    maxAge: 10 * 24 * 60 * 60 * 1000,
+    secure: false // TODO: Set to true when using HTTPS
+  })
+}
+
+export const setAccessToken = (res: Response, uuid: string): void => {
+  const accessToken = generateAccessToken(uuid)
 
-  res.cookie('jwt', token, {
+  res.cookie('accessToken', accessToken, {
     httpOnly: true,
     maxAge: 5 * 24 * 60 * 60 * 1000,
     secure: false // TODO: Set to true when using HTTPS
@@ -101,7 +128,7 @@
     subject: string
     message: string
   }
 ): any => {
   const templatePath = path.join(__dirname, 'templates', `${templateName}.ejs`)
 
   return new Promise<string>((resolve, reject) => {