Refresh Endpoint and Rotation

@Entity
@Table(name = "refresh_tokens")
public class RefreshToken {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(nullable = false, unique = true, length = 64)
    private String tokenHash;            // SHA-256 hex of the raw token

    @ManyToOne(fetch = FetchType.LAZY, optional = false)
    private User user;

    @Column(nullable = false)
    private String family;               // all rotations of one login share a family id

    private Instant expiresAt;
    private boolean used;
    private boolean revoked;
    // constructors, getters, setters...
}

@Service
public class RefreshTokenService {

    private static final Duration TTL = Duration.ofDays(7);
    private final RefreshTokenRepository repo;
    private final SecureRandom random = new SecureRandom();

    public RefreshTokenService(RefreshTokenRepository repo) { this.repo = repo; }

    public record Issued(String rawToken, User user) {}

    @Transactional
    public Issued issue(User user, String family) {
        byte[] bytes = new byte[32];
        random.nextBytes(bytes);
        String raw = Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
        repo.save(new RefreshToken(sha256(raw), user, family, Instant.now().plus(TTL)));
        return new Issued(raw, user);
    }

    /** Uses up the old token and returns a new one (rotation). */
    @Transactional
    public Issued rotate(String raw) {
        RefreshToken old = repo.findByTokenHash(sha256(raw))
                .orElseThrow(() -> new BadCredentialsException("Unknown refresh token"));
        if (old.isUsed() || old.isRevoked()) {
            // reuse of an old token = probably stolen: kill the whole family
            repo.revokeFamily(old.getFamily());
            throw new BadCredentialsException("Refresh token reuse detected");
        }
        if (old.getExpiresAt().isBefore(Instant.now())) {
            throw new BadCredentialsException("Refresh token expired");
        }
        old.setUsed(true);
        return issue(old.getUser(), old.getFamily());
    }

    @Transactional
    public void revoke(String raw) {
        repo.findByTokenHash(sha256(raw)).ifPresent(t -> repo.revokeFamily(t.getFamily()));
    }

    static String sha256(String s) {
        try {
            return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256")
                    .digest(s.getBytes(StandardCharsets.UTF_8)));
        } catch (NoSuchAlgorithmException e) {
            throw new IllegalStateException(e);
        }
    }
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private static final String COOKIE = "shopease_rt";
    // ... constructor with authenticationManager, jwtService, refreshTokens, users, userDetailsService

    @PostMapping("/login")
    public ResponseEntity<LoginResponse> login(@Valid @RequestBody LoginRequest req) {
        Authentication auth = authenticationManager.authenticate(
                UsernamePasswordAuthenticationToken.unauthenticated(req.email(), req.password()));
        User user = users.findByEmail(auth.getName()).orElseThrow();
        var issued = refreshTokens.issue(user, UUID.randomUUID().toString());
        return withCookie(issued.rawToken(), body((UserDetails) auth.getPrincipal()));
    }

    @PostMapping("/refresh")
    public ResponseEntity<LoginResponse> refresh(@CookieValue(name = COOKIE, required = false) String raw) {
        if (raw == null) throw new BadCredentialsException("No refresh token");
        var issued = refreshTokens.rotate(raw);
        UserDetails details = userDetailsService.loadUserByUsername(issued.user().getEmail());
        return withCookie(issued.rawToken(), body(details));     // fresh roles every refresh
    }

    @PostMapping("/logout")
    public ResponseEntity<Void> logout(@CookieValue(name = COOKIE, required = false) String raw) {
        if (raw != null) refreshTokens.revoke(raw);
        return ResponseEntity.noContent()
                .header(HttpHeaders.SET_COOKIE, cookie("", Duration.ZERO).toString()).build();
    }

    private ResponseEntity<LoginResponse> withCookie(String raw, LoginResponse body) {
        return ResponseEntity.ok()
                .header(HttpHeaders.SET_COOKIE, cookie(raw, Duration.ofDays(7)).toString())
                .body(body);
    }

    private ResponseCookie cookie(String value, Duration maxAge) {
        return ResponseCookie.from(COOKIE, value)
                .httpOnly(true)          // JavaScript cannot read it
                .secure(true)            // HTTPS only
                .sameSite("Strict")      // not sent on cross-site requests
                .path("/api/auth")       // only sent to the auth endpoints
                .maxAge(maxAge)
                .build();
    }
}