Make session refresh retries idempotent

Preserve the successor session for legitimate refresh retries so transient failures no longer revoke the user's session family.
2026-08-25 13:13:41 +08:00
parent 36a926f12f
commit 4c9e5feec0
14 changed files with 409 additions and 65 deletions
@@ -60,6 +60,13 @@ paths:
              required: [refreshToken]
              properties:
                refreshToken: { type: string, minLength: 32 }
+                refreshOperationId:
+                  type: string
+                  format: uuid
+                  description: |
+                    Stable ID for one logical refresh attempt. Retrying with the same
+                    ID returns the same successor while that session remains current
+                    and unexpired.
      responses:
        "200":
          description: Rotated session