chore: configure auth schemes and add refresh token revocation migration

src/FiscalOS.API/Http/HttpContextExtensions.cs

@@ -0,0 +1,34 @@
+using FiscalOS.Core.Identity;
+
+namespace FiscalOS.API.Http;
+
+internal static class HttpContextExtensions
+{
+  private const string RefreshTokenCookieName = "fiscalos_refresh_cookie";
+
+  public static Guid GetUserId(this HttpContext context)
+  {
+    var id = context.User.FindFirstValue(ClaimTypes.NameIdentifier) ?? string.Empty;
+    return Guid.TryParse(id, out var userId) ? userId : Guid.Empty;
+  }
+
+  public static void SetRefreshTokenCookie(this HttpContext context, RefreshToken token)
+  {
+    context.Response.Cookies.Append(
+      RefreshTokenCookieName,
+      token.Token,
+      new CookieOptions
+      {
+        HttpOnly = true,
+        Expires = token.ExpiresAt,
+        SameSite = SameSiteMode.Strict,
+        Secure = true
+      }
+    );
+  }
+
+  public static string GetRefreshTokenFromCookie(this HttpContext context)
+  {
+    return context.Request.Cookies[RefreshTokenCookieName] ?? string.Empty;
+  }
+}

src/FiscalOS.API/Refresh/Endpoint.cs

@@ -0,0 +1,60 @@
+namespace FiscalOS.API.Refresh;
+
+internal static class Endpoint
+{
+  private const string Route = "/refresh";
+
+  public static RouteHandlerBuilder MapRefreshEndpoint(this WebApplication app)
+  {
+    return app.MapPost(Route, HandleAsync);
+  }
+
+  private static async Task<IResult> HandleAsync(
+    HttpContext httpContext,
+    [FromServices] AppDbContext appDbContext,
+    [FromServices] TimeProvider timeProvider,
+    [FromServices] ITokenGenerator tokenGenerator
+  )
+  {
+    var requestUserId = httpContext.GetUserId();
+    var token = httpContext.GetRefreshTokenFromCookie();
+
+    var refreshToken = await appDbContext.RefreshTokens
+      .Include(t => t.User)
+      .SingleOrDefaultAsync(t => t.Token == token);
+
+    if (refreshToken is null || refreshToken.User is null)
+    {
+      return Results.BadRequest();
+    }
+
+    if (refreshToken.UserId != requestUserId)
+    {
+      await appDbContext.RefreshTokens
+        .Where(t => t.UserId == refreshToken.UserId)
+        .ExecuteUpdateAsync(t => t.SetProperty(t => t.Revoked, true));
+
+      await appDbContext.SaveChangesAsync();
+
+      return Results.Forbid();
+    }
+
+    var now = timeProvider.GetUtcNow();
+
+    if (refreshToken.Revoked || refreshToken.IsExpired(now))
+    {
+      return Results.BadRequest();
+    }
+
+    var accessToken = tokenGenerator.GenerateAccessToken(refreshToken.User);
+    var newRefreshToken = tokenGenerator.GenerateRefreshToken(refreshToken.User);
+
+    refreshToken.Revoke();
+    await appDbContext.RefreshTokens.AddAsync(newRefreshToken);
+    await appDbContext.SaveChangesAsync();
+
+    httpContext.SetRefreshTokenCookie(newRefreshToken);
+
+    return Results.Ok(Response.From(accessToken));
+  }
+}

src/FiscalOS.API/Refresh/Response.cs

@@ -0,0 +1,22 @@
+namespace FiscalOS.API.Refresh;
+
+internal sealed record Response
+{
+  public string AccessToken { get; init; }
+
+  [JsonConstructor]
+  private Response()
+  {
+    AccessToken = string.Empty;
+  }
+
+  private Response(string accessToken)
+  {
+    AccessToken = accessToken;
+  }
+
+  public static Response From(string accessToken)
+  {
+    return new(accessToken);
+  }
+}

src/FiscalOS.Infra/Authentication/Schemes.cs

@@ -0,0 +1,9 @@
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+
+namespace FiscalOS.Infra.Authentication;
+
+public static class Schemes
+{
+  public const string Default = JwtBearerDefaults.AuthenticationScheme;
+  public const string AllowExpiredTokens = "AllowExpiredTokens";
+}

src/FiscalOS.Infra/Migrations/20260203164938_AddRevokedPropertyToRefreshToken.Designer.cs

@@ -0,0 +1,104 @@
+// <auto-generated />
+using System;
+using FiscalOS.Infra.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260203164938_AddRevokedPropertyToRefreshToken")]
+    partial class AddRevokedPropertyToRefreshToken
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("Revoked")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Token")
+                        .IsUnique();
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("HashedPassword")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/FiscalOS.Infra/Migrations/20260203164938_AddRevokedPropertyToRefreshToken.cs

@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddRevokedPropertyToRefreshToken : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<bool>(
+                name: "Revoked",
+                table: "RefreshTokens",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "Revoked",
+                table: "RefreshTokens");
+        }
+    }
+}