Add Refresh token

internal/app/app.go

@@ -365,8 +365,7 @@ type services struct {
 
 func (a *App) initServices(processors *processors, repos *repositories, cfg *config.Config) *services {
 	authConfig := cfg.Auth()
-	jwtSecret := authConfig.AccessTokenSecret()
-	authService := service.NewAuthService(processors.userProcessor, jwtSecret)
+	authService := service.NewAuthService(processors.userProcessor, authConfig)
 	organizationService := service.NewOrganizationService(processors.organizationProcessor)
 	outletService := service.NewOutletService(processors.outletProcessor)
 	outletSettingService := service.NewOutletSettingService(processors.outletSettingProcessor)

internal/contract/user_contract.go

@@ -40,9 +40,11 @@ type LoginRequest struct {
 }
 
 type LoginResponse struct {
-	Token     string       `json:"token"`
-	ExpiresAt time.Time    `json:"expires_at"`
-	User      UserResponse `json:"user"`
+	Token              string       `json:"token"`
+	RefreshToken       string       `json:"refresh_token"`
+	ExpiresAt          time.Time    `json:"expires_at"`
+	RefreshExpiresAt   time.Time    `json:"refresh_expires_at"`
+	User               UserResponse `json:"user"`
 }
 
 type UserResponse struct {

internal/service/auth_service.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"time"
 
+	"apskel-pos-be/config"
 	"apskel-pos-be/internal/contract"
 	"apskel-pos-be/internal/models"
 	"apskel-pos-be/internal/transformer"
@@ -23,9 +24,11 @@ type AuthService interface {
 }
 
 type AuthServiceImpl struct {
-	userProcessor UserProcessor
-	jwtSecret     string
-	tokenTTL      time.Duration
+	userProcessor     UserProcessor
+	jwtSecret         string
+	refreshSecret     string
+	tokenTTL          time.Duration
+	refreshTokenTTL   time.Duration
 }
 
 type Claims struct {
@@ -36,11 +39,13 @@ type Claims struct {
 	jwt.RegisteredClaims
 }
 
-func NewAuthService(userProcessor UserProcessor, jwtSecret string) AuthService {
+func NewAuthService(userProcessor UserProcessor, authConfig *config.AuthConfig) AuthService {
 	return &AuthServiceImpl{
-		userProcessor: userProcessor,
-		jwtSecret:     jwtSecret,
-		tokenTTL:      24 * time.Hour,
+		userProcessor:   userProcessor,
+		jwtSecret:       authConfig.AccessTokenSecret(),
+		refreshSecret:   authConfig.RefreshTokenSecret(),
+		tokenTTL:        authConfig.AccessTokenTTL(),
+		refreshTokenTTL: authConfig.RefreshTokenTTL(),
 	}
 }
 
@@ -71,10 +76,17 @@ func (s *AuthServiceImpl) Login(ctx context.Context, req *contract.LoginRequest)
 		return nil, fmt.Errorf("failed to generate token: %w", err)
 	}
 
+	refreshToken, refreshExpiresAt, err := s.generateRefreshToken(userResponse)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate refresh token: %w", err)
+	}
+
 	return &contract.LoginResponse{
-		Token:     token,
-		ExpiresAt: expiresAt,
-		User:      *contractUserResponse,
+		Token:            token,
+		RefreshToken:     refreshToken,
+		ExpiresAt:        expiresAt,
+		RefreshExpiresAt: refreshExpiresAt,
+		User:             *contractUserResponse,
 	}, nil
 }
 
@@ -119,10 +131,17 @@ func (s *AuthServiceImpl) RefreshToken(ctx context.Context, tokenString string)
 		return nil, fmt.Errorf("failed to generate token: %w", err)
 	}
 
+	refreshToken, refreshExpiresAt, err := s.generateRefreshToken(userResponse)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate refresh token: %w", err)
+	}
+
 	return &contract.LoginResponse{
-		Token:     newToken,
-		ExpiresAt: expiresAt,
-		User:      *contractUserResponse,
+		Token:            newToken,
+		RefreshToken:     refreshToken,
+		ExpiresAt:        expiresAt,
+		RefreshExpiresAt: refreshExpiresAt,
+		User:             *contractUserResponse,
 	}, nil
 }
 
@@ -164,6 +183,32 @@ func (s *AuthServiceImpl) generateToken(user *models.UserResponse) (string, time
 	return tokenString, expiresAt, nil
 }
 
+func (s *AuthServiceImpl) generateRefreshToken(user *models.UserResponse) (string, time.Time, error) {
+	expiresAt := time.Now().Add(s.refreshTokenTTL)
+
+	claims := &Claims{
+		UserID:         user.ID,
+		Email:          user.Email,
+		Role:           string(user.Role),
+		OrganizationID: user.OrganizationID,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(expiresAt),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			NotBefore: jwt.NewNumericDate(time.Now()),
+			Issuer:    "apskel-pos-refresh",
+			Subject:   user.ID.String(),
+		},
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenString, err := token.SignedString([]byte(s.refreshSecret))
+	if err != nil {
+		return "", time.Time{}, err
+	}
+
+	return tokenString, expiresAt, nil
+}
+
 func (s *AuthServiceImpl) parseToken(tokenString string) (*Claims, error) {
 	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
 		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {