alan.brault/KotlinApiDemo
1
0
Fork 0
Code Activity

chore(auth): refresh token and initial logout (broken) support

Browse Source 
Signed-off-by: Alan Brault <alan.brault@visus.io>
This commit is contained in:
Alan Brault
2026-03-21 08:46:54 -04:00
parent 240964ea1d
commit 435298c013
9 changed files with 279 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/kotlin/io/visus/demos/kotlinapi/controller/AuthController.kt
+65 -6
View File
@@ -5,14 +5,19 @@ import io.swagger.v3.oas.annotations.media.Content
import io.swagger.v3.oas.annotations.media.Schema
import io.swagger.v3.oas.annotations.responses.ApiResponse
import io.swagger.v3.oas.annotations.responses.ApiResponses
import io.swagger.v3.oas.annotations.security.SecurityRequirement
import io.swagger.v3.oas.annotations.tags.Tag
import io.visus.demos.kotlinapi.api.ApiVersion
import io.visus.demos.kotlinapi.api.dto.AuthResponse
import io.visus.demos.kotlinapi.api.dto.ErrorResponse
import io.visus.demos.kotlinapi.api.dto.LoginRequest
import io.visus.demos.kotlinapi.api.dto.RefreshTokenRequest
import io.visus.demos.kotlinapi.domain.model.User
import io.visus.demos.kotlinapi.domain.service.AuthService
import jakarta.validation.Valid
import org.springframework.http.MediaType
import org.springframework.http.ResponseEntity
import org.springframework.security.core.annotation.AuthenticationPrincipal
import org.springframework.web.bind.annotation.PostMapping
import org.springframework.web.bind.annotation.RequestBody
import org.springframework.web.bind.annotation.RestController
@@ -39,16 +44,12 @@ class AuthController(
ApiResponse(
responseCode = "400",
description = "Invalid request payload",
content = [Content(schema = Schema(implementation = AuthResponse::class))],
content = [Content(schema = Schema(implementation = ErrorResponse::class))],
),
ApiResponse(
responseCode = "401",
description = "Unauthorized, invalid email or password",
content = [Content(schema = Schema(implementation = AuthResponse::class))],
),
ApiResponse(
responseCode = "403",
description = "Forbidden",
content = [Content(schema = Schema(implementation = ErrorResponse::class))],
),
],
)
@@ -58,4 +59,62 @@ class AuthController(
authService.login(request.email, request.password).let {
ResponseEntity.ok(it)
}
@PostMapping("/auth/logout", produces = [MediaType.APPLICATION_JSON_VALUE])
@Operation(
summary = "Logout",
description = "Revokes all refresh tokens for the authenticated user",
security = [SecurityRequirement(name = "bearerAuth")],
)
@ApiResponses(
value = [
ApiResponse(
responseCode = "204",
description = "Successfully logged out",
),
ApiResponse(
responseCode = "401",
description = "Not authenticated",
content = [Content(schema = Schema(implementation = ErrorResponse::class))],
),
],
)
suspend fun logout(
@AuthenticationPrincipal user: User,
): ResponseEntity<Unit> {
authService.logout(user.id!!)
return ResponseEntity.noContent().build()
}
@PostMapping("/auth/refresh", produces = [MediaType.APPLICATION_JSON_VALUE])
@Operation(
summary = "Refresh access token",
description = "Get a new access token using a valid refresh token",
security = [],
)
@ApiResponses(
value = [
ApiResponse(
responseCode = "200",
description = "Successfully refreshed token",
content = [Content(schema = Schema(implementation = AuthResponse::class))],
),
ApiResponse(
responseCode = "400",
description = "Invalid request payload",
content = [Content(schema = Schema(implementation = ErrorResponse::class))],
),
ApiResponse(
responseCode = "401",
description = "Invalid or expired refresh token",
content = [Content(schema = Schema(implementation = ErrorResponse::class))],
),
],
)
suspend fun refreshToken(
@Valid @RequestBody request: RefreshTokenRequest,
): ResponseEntity<AuthResponse> {
val response = authService.refreshToken(request.refreshToken)
return ResponseEntity.ok(response)
}
}