Skip to content

[codex] Fix multi-device refresh token sessions#321

Merged
jjoonleo merged 17 commits into
mainfrom
dev
Jun 26, 2026
Merged

[codex] Fix multi-device refresh token sessions#321
jjoonleo merged 17 commits into
mainfrom
dev

Conversation

@jjoonleo

Copy link
Copy Markdown
Contributor

Summary

  • Add a per-login refresh token session table and repository.
  • Route Apple, Google, Kakao, normal login, and sign-up token issuance through AuthTokenService.
  • Rotate only the matched refresh-token session on refresh instead of overwriting a single User.refreshToken slot.
  • Validate access tokens by JWT signature and existing userId, removing dependence on the single stored User.accessToken slot.

Why

Logging in on device B previously overwrote user.refreshToken, so device A could no longer refresh after its access token expired. The same single-slot pattern also made old access tokens invalid immediately after a later login.

Validation

  • ./gradlew test

@jjoonleo jjoonleo marked this pull request as ready for review June 26, 2026 15:47
@jjoonleo jjoonleo merged commit f79ef87 into main Jun 26, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant