Make session refresh retries idempotent

Preserve the successor session for legitimate refresh retries so transient failures no longer revoke the user's session family.
2026-08-25 13:13:41 +08:00
parent 36a926f12f
commit 4c9e5feec0
14 changed files with 409 additions and 65 deletions
@@ -24,6 +24,7 @@ app:
    secret: "$JWT_SECRET"
    accessMinutes: "$ACCESS_TOKEN_MINUTES:15"
    refreshDays: "$REFRESH_TOKEN_DAYS:30"
+    legacyRefreshReplaySeconds: "$LEGACY_REFRESH_REPLAY_SECONDS:30"
    gatewayGrantDays: "$GATEWAY_GRANT_DAYS:30"
  encryption:
    keyBase64: "$FIELD_ENCRYPTION_KEY"