class RefreshTokenService

Refresh token service implementing token rotation and revocation.

This is NOT an IAuthStrategy and NOT an IAuthService method — it is an app-instantiated service reached directly by the app's login/refresh/logout route handlers.

Constructors

RefreshTokenService(options: RefreshTokenOptions)

Methods

issue(principal: IPrincipal): Promise<TokenPair>

Issue a new access + refresh token pair for the given principal.

refresh(refreshToken: string): Promise<TokenPair | null>

Refresh a token pair: verify the refresh token, revoke its jti, and issue a new pair (rotation). Returns null if the token is invalid, expired, tampered with, not a refresh token, or already revoked (replay).

revoke(refreshToken: string): Promise<boolean>

Revoke a refresh token (logout). Returns true if a live record was found and revoked; false when the token does not verify or no live record exists (missing, expired, or already revoked).

Usage

import { RefreshTokenService } from "auth-plugin/src/index.ts";