File Manager

✏️ Edit File: /home/u625410797/domains/monothailand.com/public_html/ecotect_air/api/v1/auth/refresh_token.php

<?php
/**
 * Refresh Token Endpoint
 *
 * POST /api/v1/auth/refresh_token.php
 * Refreshes access token using refresh token
 *
 * @package Ecotech\API\Auth
 * @version 1.0.0
 */
header("Content-Type: application/json; charset=UTF-8");
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Api-Key');
require_once '../../../config.php';
require_once '../../../core/JWTHandler.php';

// Only accept POST requests
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    Response::error(405, "Method Not Allowed", "Only POST requests are accepted");
}

// Get JSON input
$input = json_decode(file_get_contents('php://input'), true);

// Validate required fields
$refreshToken = $input['refresh_token'] ?? '';

if (empty($refreshToken)) {
    Response::error(400, "Bad Request", "Refresh token is required");
}

try {
    // Validate refresh token
    $jwt = new JWTHandler();
    $decoded = $jwt->validateToken($refreshToken);

if (!$decoded || ($decoded['type'] ?? '') !== 'refresh') {
        Response::error(401, "Unauthorized", "Invalid refresh token");
    }

$userId = $decoded['user_id'] ?? null;

if (!$userId) {
        Response::error(401, "Unauthorized", "Invalid token payload");
    }

// Verify refresh token exists in database
    $stmt = $pdo->prepare("
        SELECT id, email, display_name, role, access_level,
               refresh_token, token_expires_at
        FROM users
        WHERE id = ?
    ");

$stmt->execute([$userId]);
    $user = $stmt->fetch();

if (!$user) {
        Response::error(401, "Unauthorized", "User not found");
    }

// Check if token matches database
    if ($user['refresh_token'] !== $refreshToken) {
        Response::error(401, "Unauthorized", "Token has been revoked");
    }

// Check if token is expired in database
    if ($user['token_expires_at'] && strtotime($user['token_expires_at']) < time()) {
        Response::error(401, "Unauthorized", "Refresh token expired. Please login again.");
    }

// Generate new access token
    $payload = [
        'user_id' => $user['id'],
        'id' => $user['id'],
        'email' => $user['email'],
        'role' => $user['role']
    ];

$newAccessToken = $jwt->generateAccessToken($payload);

// Optionally generate new refresh token (token rotation)
    $rotateRefreshToken = ($input['rotate'] ?? false) === true;
    $newRefreshToken = $refreshToken; // Default: keep same refresh token

if ($rotateRefreshToken) {
        $newRefreshToken = $jwt->generateRefreshToken($userId);
        $refreshTokenExpiry = date('Y-m-d H:i:s', time() + $jwt->getTokenExpiry('refresh'));

// Update refresh token in database
        $stmt = $pdo->prepare("
            UPDATE users
            SET refresh_token = ?,
                token_expires_at = ?
            WHERE id = ?
        ");

$stmt->execute([$newRefreshToken, $refreshTokenExpiry, $userId]);

// Update session record
        $stmt = $pdo->prepare("
            UPDATE user_sessions
            SET refresh_token = ?,
                expires_at = ?
            WHERE user_id = ? AND refresh_token = ?
            LIMIT 1
        ");

$stmt->execute([
            $newRefreshToken,
            $refreshTokenExpiry,
            $userId,
            $refreshToken
        ]);
    }

// Return new access token
    Response::success([
        'access_token' => $newAccessToken,
        'refresh_token' => $newRefreshToken,
        'expires_in' => $jwt->getTokenExpiry('access'),
        'token_type' => 'Bearer'
    ], "Token refreshed successfully");

} catch (PDOException $e) {
    error_log("Token Refresh Error: " . $e->getMessage());
    Response::error(500, "Internal Server Error", "Token refresh failed. Please try again.");
}

Batal

⬅ Naik ke v1 6 item

Nama	Tipe	Ukuran	Diubah	Aksi
🐘forgot_password.php	php	3.4 KB	2026-02-21 07:17	✏️ Edit 👁️ View
🐘login.php	php	5.5 KB	2026-02-21 07:17	✏️ Edit 👁️ View
🐘logout.php	php	1.9 KB	2026-02-21 07:17	✏️ Edit 👁️ View
🐘refresh_token.php	php	3.8 KB	2026-02-21 07:17	✏️ Edit 👁️ View
🐘register.php	php	4.2 KB	2026-06-26 11:07	✏️ Edit 👁️ View
🐘reset_password.php	php	2.6 KB	2026-02-21 07:17	✏️ Edit 👁️ View