Skip to main content

Interface: OAuthRefreshToken

Defined in: auth/src/models/types.ts:385

Defines a single OAuth 2.0 refresh token (RFC 6749 §1.5), issued alongside an access token whenever the client's grantTypes includes refresh_token, and redeemed by BaseOAuthTokenRoute's refresh_token grant to obtain a new access token without the resource owner re-authenticating.

Extends​

  • BaseEntity

Properties​

clientId​

clientId: string

Defined in: auth/src/models/types.ts:390

The uid of the Client this token was issued to.

dateCreated​

dateCreated: Date

Defined in: auth/node_modules/@rapidrest/service-core/dist/types/models/BaseEntity.d.ts:18

The date and time that the entity was created.

Inherited from​

BaseEntity.dateCreated

dateModified​

dateModified: Date

Defined in: auth/node_modules/@rapidrest/service-core/dist/types/models/BaseEntity.d.ts:22

The date and time that the entity was last modified.

Inherited from​

BaseEntity.dateModified

expiresAt​

expiresAt: Date

Defined in: auth/src/models/types.ts:408

When this token expires.

familyId​

familyId: string

Defined in: auth/src/models/types.ts:405

Groups every token produced by rotating a single original refresh token into one lineage. A brand new grant starts a fresh familyId; each rotation carries the same familyId forward. Presenting a token whose revoked is already true — a replayed, already-rotated-out token — revokes every token sharing its familyId, per RFC 9700 §4.14.2.

replacedByHash?​

optional replacedByHash?: string

Defined in: auth/src/models/types.ts:418

The tokenHash of the token that replaced this one via rotation, for audit — distinguishes a routine rotation from an explicit revocation.

revoked​

revoked: boolean

Defined in: auth/src/models/types.ts:411

Set to true once this token has either been rotated (see replacedByHash) or explicitly revoked.

revokedAt?​

optional revokedAt?: Date

Defined in: auth/src/models/types.ts:414

When this token was revoked, if it has been.

scope​

scope: string

Defined in: auth/src/models/types.ts:397

The space-delimited set of scopes this token (and any it rotates into) is authorized for.

tokenHash​

tokenHash: string

Defined in: auth/src/models/types.ts:387

The SHA-256 hex digest of the opaque token. The raw token itself is never persisted.

uid​

uid: string

Defined in: auth/node_modules/@rapidrest/service-core/dist/types/models/BaseEntity.d.ts:14

The universally unique identifier of the entity.

Inherited from​

BaseEntity.uid

userUid?​

optional userUid?: string

Defined in: auth/src/models/types.ts:394

The uid of the User (resource owner) this token acts on behalf of. Absent for a token issued via the client_credentials grant, which has no resource owner.

version​

version: number

Defined in: auth/node_modules/@rapidrest/service-core/dist/types/models/BaseEntity.d.ts:26

The optimistic lock version.

Inherited from​

BaseEntity.version