saksham
1a4c80958f
FastAPI + Celery + Next.js + Postgres/Redis app with company monitoring, source collection, LLM-based change analysis, enrichment, and account security (Turnstile, escalating lockout, email verification).
33 lines
1.2 KiB
Python
33 lines
1.2 KiB
Python
"""Refresh token records.
|
|
|
|
Only a hash of the token's `jti` is stored - never the JWT itself - so a
|
|
database read can't be replayed as a valid refresh token. Rotation on use
|
|
(one row per issuance, `revoked_at` set when superseded) limits the blast
|
|
radius of a leaked refresh token to its remaining lifetime.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import uuid
|
|
from datetime import datetime
|
|
from typing import TYPE_CHECKING
|
|
|
|
from sqlalchemy import DateTime, ForeignKey, String
|
|
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
|
|
|
from app.db.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
|
|
|
|
if TYPE_CHECKING:
|
|
from app.models.user import User
|
|
|
|
|
|
class RefreshToken(Base, UUIDPrimaryKeyMixin, TimestampMixin):
|
|
__tablename__ = "refresh_tokens"
|
|
|
|
user_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("users.id", ondelete="CASCADE"))
|
|
token_hash: Mapped[str] = mapped_column(String(64), unique=True, index=True)
|
|
expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True))
|
|
revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
|
|
|
|
user: Mapped[User] = relationship(back_populates="refresh_tokens")
|