YueGuobin 0e8d0cb87b
Add stateless JWT refresh token mechanism
- New config: Controller.jwt_refresh_token_expire_minutes (default 30 days)
- New endpoint: POST /v3/access/users/refresh (public, unauthenticated)
- Login/authenticate responses now include refresh_token
- AuthService: _create_token helper, create_refresh_token, get_token_data
  now parses type claim (token_use) for token classification
- Security: refresh tokens rejected on HTTP + WebSocket access paths;
  /refresh strictly requires type=='refresh'
- Logout works for free via existing token_version mechanism
- Tests: 9 new TestRefreshToken cases, all passing; 34 existing tests
  still pass (no regressions)
2026-06-23 22:39:11 +08:00
..
2026-06-06 22:53:12 +02:00
2026-06-16 23:04:05 +08:00
2026-04-04 19:55:13 +08:00
2026-06-06 23:19:24 +02:00
2024-04-22 18:51:29 +07:00
2026-06-06 23:19:24 +02:00
2022-01-19 22:28:36 +10:30
2026-06-07 00:13:59 +02:00