Auth hardening: refresh token persistence, rotation, and revocation

[AlexKitipov]

Motivation

• Implement server-side refresh token/session persistence so refresh tokens can be meaningfully rotated and revoked.
• Detect and handle refresh-token reuse (compromised/duplicated tokens) to protect user sessions and revoke token families.
• Ensure logout revokes refresh tokens on the server so clients cannot re-use them after logout.

Description

• Add a new RefreshToken SQLAlchemy model with hashed token_id_hash, family_id, parent/replacement links, expiry, revocation, and reuse-detection timestamps (app/models/refresh_token.py).
• Persist refresh tokens on register/login, issue JWT refresh tokens with a random jti, store a SHA-256 hash of the jti, and return the JWT to the client (app/api/v1/auth.py).
• Rotate refresh tokens on /refresh by issuing a new persisted token, marking the previous token as revoked and recording the replacement, and revoke the whole family on reuse detection (app/api/v1/auth.py).
• Revoke the supplied refresh token on /logout by marking the persisted record as revoked (app/api/v1/auth.py).
• Add LogoutRequest schema and update imports/relationships so SQLAlchemy metadata includes the new model (app/schemas/user.py, app/models/user.py, app/models/__init__.py, migrations/env.py).
• Add Alembic migration 0002_refresh_tokens to create the refresh_tokens table (migrations/versions/0002_refresh_tokens.py).
• Add tests covering hashed persistence, rotation, family revocation on reuse, and logout revocation (tests/test_auth_refresh_tokens.py) and update schema tests (tests/test_schemas.py).

Testing

• Ran linting with python -m flake8 --max-line-length=88 ... which completed successfully.
• Ran the full test suite with pytest -q and all tests passed (including the new refresh-token tests).
• Verified migrations apply by running DATABASE_URL=sqlite:///$tmpdb alembic upgrade head against a temporary SQLite DB and the migration ran successfully.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a7b05a05e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".