[Backend] Secure Refresh Token Rotation Mechanisms

backend/prisma/schema.prisma

@@ -284,6 +284,23 @@ model Notification {
   metadata  Json?
 }
 
+/// Refresh tokens for secure session management
+/// Opaque random byte strings (not JWTs) mapped to users
+model RefreshToken {
+  id          String   @id @default(cuid())
+  token       String   @unique /// Opaque hashed token stored
+  userId      String
+  user        User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  expiresAt   DateTime
+  createdAt   DateTime @default(now())
+  replacedBy  String?  /// Points to the new token after rotation (for replay detection)
+  revokedAt   DateTime?
+
+  @@index([userId])
+  @@index([token])
+  @@map("refresh_tokens")
+}
+
 model PrivacySettings {
   id                            String  @id @default(cuid())
   user                          User    @relation(fields: [userId], references: [id], onDelete: Cascade)

backend/src/auth/auth.module.ts

@@ -8,6 +8,7 @@ import { JwtStrategy } from './strategies/jwt.strategy';
 import { JwtAuthGuard } from './guards/jwt-auth.guard';
 import { RoleGuard } from './guards/role.guard';
 import { PrismaModule } from '../prisma/prisma.module';
+import { RefreshTokenService } from './refresh-token.service';
 
 @Module({
   imports: [
@@ -19,14 +20,23 @@ import { PrismaModule } from '../prisma/prisma.module';
       useFactory: async (configService: ConfigService) => ({
         secret: configService.get<string>('JWT_SECRET') || 'your-secret-key',
         signOptions: {
-          expiresIn: 900, // 15 minutes in seconds (default)
+          expiresIn: '15m', // 15 minutes — short-lived access token
         },
       }),
       inject: [ConfigService],
     }),
   ],
   controllers: [AuthController],
-  providers: [AuthService, JwtStrategy, JwtAuthGuard, RoleGuard],
-  exports: [AuthService, JwtStrategy, JwtAuthGuard, RoleGuard, PassportModule],
+  providers: [
+    AuthService,
+    JwtStrategy,
+    JwtAuthGuard,
+    RoleGuard,
+    RefreshTokenService,
+  ],
+  exports: [
+    AuthService, JwtStrategy, JwtAuthGuard, RoleGuard,
+    PassportModule, RefreshTokenService,
+  ],
 })
 export class AuthModule {}