Access va refresh token — JWT rotation va xavfsiz saqlash (5.16-bob)

  Uzoq muddatli token (masalan 30 kun):
    ✓ Qulay (kam login)
    ✗ O'g'irlansa — 30 kun hacker kirib turadi (bekor qila olmaymiz! — 14)

  Qisqa muddatli token (masalan 15 daqiqa):
    ✓ Xavfsiz (o'g'irlansa, tez tugaydi)
    ✗ Har 15 daqiqada qayta login (dahshatli UX)

  ACCESS TOKEN — qisqa muddatli (15-60 daqiqa)
    → HAR so'rovda ishlatiladi (himoyalangan endpoint)
    → o'g'irlansa, tez yaroqsiz (xavf kam)
    → stateless JWT (server eslamaydi — tez tekshiriladi)

  REFRESH TOKEN — uzoq muddatli (7-90 kun)
    → FAQAT yangi access token olish uchun (/refresh endpoint)
    → DB'da saqlanadi (bekor qilinishi mumkin — stateful!)
    → kamdan-kam ishlatiladi (har 15 daqiqada bir marta)

  LOGIN:
  email+parol → server: access (15min) + refresh (7kun) beradi
    access  → xotirada/cookie
    refresh → httpOnly cookie + DB'ga saqlanadi 2.7-bob

  HAR SO'ROV:
  access token bilan → himoyalangan endpoint → ✓

  ACCESS MUDDATI TUGADI (15min o'tdi):
  so'rov → 401 (access eskirgan) →
  client /refresh ga refresh token yuboradi →
  server refresh'ni DB'da tekshiradi → YANGI access (+ yangi refresh — 2.4) →
  client yangi access bilan davom etadi (foydalanuvchi sezmaydi!)

  LOGOUT:
  refresh token'ni DB'dan o'chir (bekor — 2.6)

  ┌──────┐  login   ┌────────┐
  │Client│─────────▶│ Server │  access(15m) + refresh(7d)
  │      │◀─────────│        │
  └──────┘          └────────┘
     │ access bilan so'rovlar (15 daqiqa)
     │ ...access tugadi → 401...
     │ refresh bilan /refresh
     ▼
  yangi access (+ yangi refresh) → davom

  Refresh R1 ishlatildi → yangi access + yangi refresh R2
    → R1 BEKOR qilinadi (endi ishlamaydi)
  Keyingi safar R2 ishlatiladi → R3, R2 bekor
  ...

  Normal: R1 → R2 → R3 (har biri bir marta)

  O'G'IRLIK stsenariysi:
  Hacker R1'ni o'g'irladi. Lekin haqiqiy foydalanuvchi ham R1'ni ishlatdi → R2 oldi (R1 bekor)
  Hacker R1'ni ishlatmoqchi → R1 ALLAQACHON BEKOR → REUSE DETECTED!
  → butun token oilasini (R1,R2,R3...) BEKOR QILISH → ikkalasi ham qayta login qilsin (14)

  Logout            → o'sha refresh'ni DB'dan o'chirish
  "Barcha qurilmadan chiq" → foydalanuvchining BARCHA refresh'larini o'chirish
  Parol o'zgardi    → barcha refresh'ni bekor qilish (xavfsizlik — 14)
  O'g'irlik aniqlandi → token oilasini bekor qilish (2.5)

  Access token   → XOTIRADA (JS o'zgaruvchi/React state — 11)
                   yoki httpOnly cookie
                   → qisqa muddatli, sahifa yangilashda yo'qoladi (refresh bilan tiklanadi)

  Refresh token  → httpOnly + Secure + SameSite cookie (14, 5.15)
                   → JS o'qiy olmaydi (XSS himoyasi); DB'da nusxasi (bekor uchun)

  refresh_tokens jadvali:
  | id | userId | tokenHash        | family | expiresAt | revoked |
  | 1  | 7      | hash(token)      | fam-1  | +7kun     | false   |

  → tokenning O'ZI emas, HASH'i (DB sizsa, ishlatib bo'lmaydi — 14)
  → family: reuse detection uchun 2.5-bob; revoked: bekor belgisi (2.6)

  Access token:  15 daqiqa – 1 soat (qisqa — xavfsizlik)
  Refresh token: 7 – 30 kun (web); 30-90 kun (mobil app)
  Sezgir (bank): qisqaroq (access 5-15min)

  So'rov → 401 (access tugagan) →
  frontend interceptor (Axios — 2.18-JS) ushlaydi →
  /refresh ga so'rov (refresh cookie avtomatik) →
  yangi access olinadi →
  asl so'rov YANGI access bilan QAYTA yuboriladi →
  foydalanuvchi hech narsa sezmaydi (uzluksiz)

  ✓ Access qisqa (15-60min), refresh uzoq (7-30kun) — 2.9
  ✓ Refresh rotatsiya (har ishlatishda yangi — 2.4); reuse detection 2.5-bob
  ✓ Refresh httpOnly cookie + DB'da hash (2.7, 2.8)
  ✓ Logout/parol o'zgarishida refresh bekor 2.6-bob
  ✓ Access va refresh uchun ALOHIDA secret 5.8-bob
  ✓ Refresh endpoint'iga rate limiting 5.20-bob
  ✓ HTTPS (14); refresh oilasini kuzat (o'g'irlik — 2.5)

import jwt from "jsonwebtoken";

// Ikki token yasash (2.2)
const access = jwt.sign({ sub: id, rol }, ACCESS_SECRET, { expiresIn: "15m" });
const refresh = jwt.sign({ sub: id }, REFRESH_SECRET, { expiresIn: "7d" });

// Refresh oqimi (2.3)
// 1. refresh'ni verify   2. DB'da tekshir (bekor emasmi)   3. rotatsiya (yangi refresh)
// 4. yangi access ber

// Saqlash (2.7)
res.cookie("refreshToken", refresh, { httpOnly: true, secure: true, sameSite: "lax", path: "/api/auth/refresh" });

import jwt from "jsonwebtoken";
import { config } from "../config/index.js";          // (5.8)

// Access — qisqa, asosiy ma'lumot bilan (2.2)
export const accessYasash = (user) =>
  jwt.sign(
    { sub: user.id, rol: user.rol },                   // payload (5.15)
    config.jwt.accessSecret,                           // ALOHIDA secret (2.11)
    { expiresIn: "15m" }                               // qisqa (2.9)
  );

// Refresh — uzoq, minimal ma'lumot (2.2)
export const refreshYasash = (user) =>
  jwt.sign(
    { sub: user.id },                                  // faqat ID
    config.jwt.refreshSecret,                          // boshqa secret (2.11)
    { expiresIn: "7d" }                                // uzoq (2.9)
  );

import bcrypt from "bcrypt";

export const login = async (req, res, next) => {
  try {
    const { email, parol } = req.body;
    const user = await User.findOne({ email }).select("+parol");   // (5.15)
    if (!user || !(await bcrypt.compare(parol, user.parol))) {
      return res.status(401).json({ error: "Email yoki parol noto'g'ri" });   // (5.15)
    }
    // Ikki token (2.2)
    const accessToken = accessYasash(user);
    const refreshToken = refreshYasash(user);
    // Refresh'ni DB'da hash qilib saqlash (2.8)
    await RefreshToken.create({
      userId: user.id,
      tokenHash: await bcrypt.hash(refreshToken, 10),  // hash (DB sizsa — 14)
      family: crypto.randomUUID(),                     // oila (2.5)
      expiresAt: new Date(Date.now() + 7 * 24 * 3600 * 1000),
    });
    // Refresh — httpOnly cookie (2.7)
    res.cookie("refreshToken", refreshToken, {
      httpOnly: true, secure: config.isProd, sameSite: "lax",
      path: "/api/auth",                               // faqat auth route'larida (2.7)
      maxAge: 7 * 24 * 3600 * 1000,
    });
    // Access — javobda (frontend xotirada saqlaydi — 2.7)
    res.json({ accessToken, user: { id: user.id, email: user.email, rol: user.rol } });
  } catch (err) { next(err); }
};

import jwt from "jsonwebtoken";
import bcrypt from "bcrypt";

export const refresh = async (req, res, next) => {
  try {
    const token = req.cookies.refreshToken;            // cookie'dan (2.7)
    if (!token) return res.status(401).json({ error: "Refresh token yo'q" });

    // 1. Imzoni tekshirish (2.2)
    let payload;
    try {
      payload = jwt.verify(token, config.jwt.refreshSecret);
    } catch {
      return res.status(401).json({ error: "Refresh noto'g'ri/tugagan" });
    }

    // 2. DB'da topish va tekshirish (bekor emasmi — 2.6)
    const saqlangan = await RefreshToken.findOne({ userId: payload.sub, revoked: false });
    if (!saqlangan || !(await bcrypt.compare(token, saqlangan.tokenHash))) {
      // REUSE DETECTION: bekor qilingan token qayta ishlatildi → o'g'irlik 2.5-bob!
      await RefreshToken.updateMany({ userId: payload.sub }, { revoked: true });   // butun oila (2.5)
      return res.status(401).json({ error: "Xavfsizlik buzilishi — qayta kiring" });
    }

    // 3. ROTATSIYA: eskini bekor qilish, yangi refresh berish (2.4)
    saqlangan.revoked = true;
    await saqlangan.save();
    const user = await User.findById(payload.sub);
    const yangiRefresh = refreshYasash(user);
    await RefreshToken.create({
      userId: user.id, tokenHash: await bcrypt.hash(yangiRefresh, 10),
      family: saqlangan.family, expiresAt: new Date(Date.now() + 7 * 24 * 3600 * 1000),
    });
    res.cookie("refreshToken", yangiRefresh, {
      httpOnly: true, secure: config.isProd, sameSite: "lax", path: "/api/auth",
      maxAge: 7 * 24 * 3600 * 1000,
    });

    // 4. Yangi access berish (2.3)
    res.json({ accessToken: accessYasash(user) });
  } catch (err) { next(err); }
};

export const logout = async (req, res, next) => {
  try {
    const token = req.cookies.refreshToken;
    if (token) {
      const payload = jwt.decode(token);               // (5.15)
      // DB'dan o'chir/bekor qil (2.6)
      await RefreshToken.updateMany({ userId: payload?.sub }, { revoked: true });
    }
    res.clearCookie("refreshToken", { path: "/api/auth" });   // cookie tozalash (5.15)
    res.json({ message: "Tizimdan chiqdingiz" });
  } catch (err) { next(err); }
};

import jwt from "jsonwebtoken";

export const auth = (req, res, next) => {
  const token = req.headers.authorization?.startsWith("Bearer ")
    ? req.headers.authorization.slice(7)               // header'dan (access — 2.7)
    : null;
  if (!token) return res.status(401).json({ error: "Avtorizatsiya kerak" });
  try {
    const payload = jwt.verify(token, config.jwt.accessSecret);   // access secret (2.11)
    req.user = { id: payload.sub, rol: payload.rol };
    next();
  } catch (err) {
    // Muddat tugagan bo'lsa — maxsus kod (frontend refresh qilsin — 2.10)
    if (err.name === "TokenExpiredError") {
      return res.status(401).json({ error: "Access tugagan", code: "TOKEN_EXPIRED" });
    }
    return res.status(401).json({ error: "Token noto'g'ri" });
  }
};

export const hammadanChiq = async (req, res, next) => {
  try {
    // Foydalanuvchining BARCHA refresh tokenlarini bekor qilish (2.6)
    await RefreshToken.updateMany({ userId: req.user.id }, { revoked: true });
    res.clearCookie("refreshToken", { path: "/api/auth" });
    res.json({ message: "Barcha qurilmalardan chiqildi" });
    // Endi hech bir qurilmada refresh ishlamaydi (access'lar 15min ichida tugaydi)
  } catch (err) { next(err); }
};

// frontend (11, 2.18-JS) — backend uchun kontekst
import axios from "axios";
const api = axios.create({ baseURL: "/api", withCredentials: true });   // cookie uchun

// Har so'rovga access token qo'sh (xotiradan)
api.interceptors.request.use((cfg) => {
  if (accessToken) cfg.headers.Authorization = `Bearer ${accessToken}`;
  return cfg;
});

// 401 (access tugagan) bo'lsa — avtomatik refresh + qayta urinish (2.10)
api.interceptors.response.use(null, async (error) => {
  if (error.response?.status === 401 && error.response.data.code === "TOKEN_EXPIRED") {
    const { data } = await api.post("/auth/refresh");   // refresh cookie avtomatik
    accessToken = data.accessToken;                      // yangi access (xotirada)
    error.config.headers.Authorization = `Bearer ${accessToken}`;
    return api(error.config);                            // asl so'rovni qayta yuborish
  }
  return Promise.reject(error);
});

export const parolOzgartir = async (req, res, next) => {
  try {
    const user = await User.findById(req.user.id).select("+parol");
    if (!(await bcrypt.compare(req.body.eskiParol, user.parol))) {
      return res.status(401).json({ error: "Eski parol noto'g'ri" });
    }
    user.parol = await bcrypt.hash(req.body.yangiParol, 12);   // (5.15)
    await user.save();
    // Xavfsizlik: barcha refresh'ni bekor qilish (boshqa qurilmalar chiqsin — 2.6, 14)
    await RefreshToken.updateMany({ userId: user.id }, { revoked: true });
    res.clearCookie("refreshToken", { path: "/api/auth" });
    res.json({ message: "Parol o'zgartirildi. Qaytadan kiring." });
  } catch (err) { next(err); }
};

❌ bitta 30 kunlik token → o'g'irlansa bekor qila olmaysiz (2.1, 14)
✅ qisqa access + uzoq refresh (DB'da, bekor qilinadi)

❌ localStorage → XSS o'g'irlaydi (refresh — eng qimmat! — 2.7, 14)
✅ httpOnly cookie + DB'da hash

❌ bir refresh qayta-qayta ishlatiladi → reuse detection imkonsiz 2.4-bob
✅ har refresh'da yangi (rotatsiya) + eski bekor

// ❌ DB sizsa — tokenlar ochiq (14, 2.8)
await RefreshToken.create({ token: refreshToken });

// ✅ hash
await RefreshToken.create({ tokenHash: await bcrypt.hash(refreshToken, 10) });

// ❌ bitta secret (2.11)
jwt.sign(p, SECRET); // ikkalasi ham

// ✅ alohida (access secret sizsa, refresh xavfsiz)
jwt.sign(p, ACCESS_SECRET); jwt.sign(p, REFRESH_SECRET);