fix

src/handlers.rs

@@ -22,6 +22,7 @@ pub fn routes() -> Router<AppState> {
         .route("/", get(index))
         .route("/auth/login", get(auth_login))
         .route("/auth/callback", get(auth_callback))
+        .route("/auth/refresh", post(auth_refresh))
         .route("/auth/logout", post(auth_logout))
         .route("/me", get(me))
         .route("/dms", get(list_dm_conversations))
@@ -213,8 +214,9 @@ async fn auth_callback(
     .await
     .map_err(|e| ApiError::internal(&format!("failed to persist user: {e}")))?;
 
-    let jwt_token = auth::new_jwt_token(user.id, &state.settings.session_secret)
-        .map_err(|e| ApiError::internal(&e.to_string()))?;
+    let (access_token, refresh_token) =
+        auth::new_jwt_tokens(user.id, &state.settings.session_secret)
+            .map_err(|e| ApiError::internal(&e.to_string()))?;
 
     let mut headers = HeaderMap::new();
     headers.append(
@@ -224,7 +226,53 @@ async fn auth_callback(
             .map_err(|_| ApiError::internal("failed to clear oauth state cookie"))?,
     );
 
-    Ok((headers, Redirect::to(&format!("/?token={}", jwt_token))))
+    Ok((
+        headers,
+        Redirect::to(&format!(
+            "/?token={}&refresh_token={}",
+            access_token, refresh_token
+        )),
+    ))
+}
+
+#[derive(Deserialize)]
+struct AuthRefreshBody {
+    refresh_token: String,
+}
+
+#[derive(Serialize)]
+struct AuthRefreshResponse {
+    access_token: String,
+    refresh_token: String,
+}
+
+async fn auth_refresh(
+    State(state): State<AppState>,
+    Json(body): Json<AuthRefreshBody>,
+) -> Result<impl IntoResponse, ApiError> {
+    let user_id = auth::verify_session(
+        &body.refresh_token,
+        &state.settings.session_secret,
+        "refresh",
+    )
+    .map_err(|_| ApiError::unauthorized("invalid or expired refresh token"))?;
+
+    let exists = db::user_exists(&state.db, user_id)
+        .await
+        .map_err(|_| ApiError::internal("user verification failed"))?;
+
+    if !exists {
+        return Err(ApiError::unauthorized("user not found"));
+    }
+
+    let (access_token, refresh_token) =
+        auth::new_jwt_tokens(user_id, &state.settings.session_secret)
+            .map_err(|e| ApiError::internal(&e.to_string()))?;
+
+    Ok(Json(AuthRefreshResponse {
+        access_token,
+        refresh_token,
+    }))
 }
 
 async fn auth_logout() -> Result<impl IntoResponse, ApiError> {