Make session refresh retries idempotent

Preserve the successor session for legitimate refresh retries so transient failures no longer revoke the user's session family.
2026-08-25 13:13:41 +08:00
parent 36a926f12f
commit 4c9e5feec0
14 changed files with 409 additions and 65 deletions
@@ -23,6 +23,7 @@ JWT_AUDIENCE=osgkeyboard-ios
 JWT_SECRET=replace-with-at-least-32-random-bytes
 ACCESS_TOKEN_MINUTES=15
 REFRESH_TOKEN_DAYS=30
+LEGACY_REFRESH_REPLAY_SECONDS=30
 GATEWAY_GRANT_DAYS=30
 FIELD_ENCRYPTION_KEY=replace-with-exactly-32-random-bytes-as-base64
 IDENTITY_HMAC_KEY=replace-with-a-distinct-32-random-bytes-as-base64