30 lines
1.1 KiB
Python
30 lines
1.1 KiB
Python
from datetime import datetime
|
|
|
|
from sqlalchemy import Boolean, DateTime, ForeignKey, String, func
|
|
from sqlalchemy.orm import Mapped, mapped_column
|
|
|
|
from app.core.database import Base
|
|
|
|
|
|
class RefreshToken(Base):
|
|
"""Server-side record of an issued refresh token, enabling revocation.
|
|
|
|
The raw token is never stored — only its jti (for lookup) and a SHA-256
|
|
hash (for verification). Rotation marks the old row revoked and inserts a
|
|
new one; logout revokes the row(s) for a user.
|
|
"""
|
|
|
|
__tablename__ = "refresh_tokens"
|
|
|
|
id: Mapped[int] = mapped_column(primary_key=True)
|
|
jti: Mapped[str] = mapped_column(String(64), unique=True, index=True)
|
|
token_hash: Mapped[str] = mapped_column(String(64))
|
|
user_id: Mapped[int] = mapped_column(
|
|
ForeignKey("users.id", ondelete="CASCADE"), index=True
|
|
)
|
|
expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True))
|
|
revoked: Mapped[bool] = mapped_column(Boolean, default=False)
|
|
created_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), server_default=func.now()
|
|
)
|