Make session refresh retries idempotent

Preserve the successor session for legitimate refresh retries so transient failures no longer revoke the user's session family.
2026-08-25 13:13:41 +08:00
parent 36a926f12f
commit 4c9e5feec0
14 changed files with 409 additions and 65 deletions
@@ -26,6 +26,7 @@ services:
      JWT_SECRET: ${JWT_SECRET:?set a random JWT secret}
      ACCESS_TOKEN_MINUTES: ${ACCESS_TOKEN_MINUTES:-15}
      REFRESH_TOKEN_DAYS: ${REFRESH_TOKEN_DAYS:-30}
+      LEGACY_REFRESH_REPLAY_SECONDS: ${LEGACY_REFRESH_REPLAY_SECONDS:-30}
      GATEWAY_GRANT_DAYS: ${GATEWAY_GRANT_DAYS:-30}
      FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY:?set a 32-byte Base64 key}
      IDENTITY_HMAC_KEY: ${IDENTITY_HMAC_KEY:?set a distinct Base64 key}