Program.cs

// README: JWT + Refresh Token Minimal API sample (ASP.NET Core)
// Run: dotnet new web -n JwtRefreshDemo
// Replace Program.cs with the contents below. This sample uses an in-memory user store and refresh-token store for demo purposes.
// For production: store users and refresh tokens in a secure DB, hash refresh tokens, use HTTPS, strong keys and rotate keys.

// ----------------------------
// Program.cs
// ----------------------------
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Security.Cryptography;
using System.Text;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;

var builder = WebApplication.CreateBuilder(args);

// ----- CONFIG -----
var jwtSettings = new JwtSettings
{
    Issuer = "JwtRefreshDemo",
    Audience = "JwtRefreshDemoClient",
    Secret = "VeryStrongSecretKey_For_Demo_PleaseChange_!1234567890",
    AccessTokenExpiryMinutes = 15,
    RefreshTokenExpiryDays = 7
};

//registering 
builder.Services.AddSingleton(jwtSettings);
builder.Services.AddSingleton<IUserRepository, InMemoryUserRepository>();
builder.Services.AddSingleton<IRefreshTokenStore, InMemoryRefreshTokenStore>();
builder.Services.AddSingleton<ITokenService, TokenService>();

// JWT authentication
var key = Encoding.UTF8.GetBytes(jwtSettings.Secret);
builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = jwtSettings.Issuer,
        ValidAudience = jwtSettings.Audience,
        IssuerSigningKey = new SymmetricSecurityKey(key),
        ClockSkew = TimeSpan.Zero // strict expiry check
    };

    // Optional: if you want to read expired access token in refresh endpoint, set this:
    options.Events = new JwtBearerEvents
    {
        OnAuthenticationFailed = ctx =>
        {
            // swallow for demo
            return Task.CompletedTask;
        }
    };
});

builder.Services.AddAuthorization();

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

// -------------------------------------------------
// Minimal API endpoints: /auth/login, /auth/refresh, /me
// -------------------------------------------------

app.MapPost("/auth/login", (LoginRequest req, IUserRepository users, ITokenService tokenService, IRefreshTokenStore rtStore) =>
{
    var user = users.ValidateCredentials(req.Username, req.Password);
    if (user == null) return Results.Unauthorized();

    var accessToken = tokenService.GenerateAccessToken(user);
    var refreshToken = tokenService.GenerateRefreshToken();

    // Save hashed refresh token with metadata in store
    rtStore.SaveRefreshToken(user.Id, refreshToken, tokenService.GetRefreshTokenExpiry());

    return Results.Ok(new TokenResponse { AccessToken = accessToken, RefreshToken = refreshToken });
});

app.MapPost("/auth/refresh", async (RefreshRequest req, IRefreshTokenStore rtStore, ITokenService tokenService, IUserRepository users) =>
{
    // Validate request
    if (string.IsNullOrWhiteSpace(req.RefreshToken)) return Results.BadRequest("Missing refresh token");

    // Validate refresh token from store
    var stored = await rtStore.GetByTokenAsync(req.RefreshToken);
    if (stored == null) return Results.Unauthorized();
    if (stored.IsExpired) return Results.Unauthorized();
    if (stored.IsRevoked) return Results.Unauthorized();

    // Optional: Check that the access token belongs to same user (if you send it). For demo, we use stored.UserId
    var user = users.GetById(stored.UserId);
    if (user == null) return Results.Unauthorized();

    // Token rotation: revoke old refresh token and create a new one
    await rtStore.RevokeAsync(stored.Token);

    var newAccessToken = tokenService.GenerateAccessToken(user);
    var newRefreshToken = tokenService.GenerateRefreshToken();
    await rtStore.SaveRefreshTokenAsync(user.Id, newRefreshToken, tokenService.GetRefreshTokenExpiry());

    return Results.Ok(new TokenResponse { AccessToken = newAccessToken, RefreshToken = newRefreshToken });
});

app.MapGet("/me", (ClaimsPrincipal userPrincipal) =>
{
    var sub = userPrincipal.FindFirstValue(ClaimTypes.NameIdentifier);
    return Results.Ok(new { Message = "Protected data", UserId = sub });
})
.RequireAuthorization();

app.Run();

// ----------------------------
// Supporting types and simple in-memory stores
// ----------------------------

public record LoginRequest(string Username, string Password);
public record RefreshRequest(string AccessToken, string RefreshToken);
public record TokenResponse { public string AccessToken { get; init; } public string RefreshToken { get; init; } }

public class JwtSettings
{
    public string Issuer { get; init; }
    public string Audience { get; init; }
    public string Secret { get; init; }
    public int AccessTokenExpiryMinutes { get; init; }
    public int RefreshTokenExpiryDays { get; init; }
}

public class User
{
    public Guid Id { get; set; }
    public string Username { get; set; }
    public string PasswordHash { get; set; } // For demo, plain text optional
}

public interface IUserRepository
{
    User ValidateCredentials(string username, string password);
    User GetById(Guid id);
}

public class InMemoryUserRepository : IUserRepository
{
    private readonly List<User> _users = new()
    {
        new User { Id = Guid.Parse("11111111-1111-1111-1111-111111111111"), Username = "reena", PasswordHash = "password123" }
    };

    public User ValidateCredentials(string username, string password)
    {
        return _users.FirstOrDefault(u => u.Username == username && u.PasswordHash == password);
    }

    public User GetById(Guid id) => _users.FirstOrDefault(u => u.Id == id);
}

public class RefreshTokenEntry
{
    public string Token { get; set; } // store as plain for demo; in production store hashed version
    public Guid UserId { get; set; }
    public DateTime ExpiresAt { get; set; }
    public bool IsRevoked { get; set; }
    public bool IsUsed { get; set; }
    public bool IsExpired => DateTime.UtcNow >= ExpiresAt;
}

public interface IRefreshTokenStore
{
    void SaveRefreshToken(Guid userId, string token, DateTime expiresAt);
    Task SaveRefreshTokenAsync(Guid userId, string token, DateTime expiresAt);
    Task<RefreshTokenEntry> GetByTokenAsync(string token);
    Task RevokeAsync(string token);
}

public class InMemoryRefreshTokenStore : IRefreshTokenStore
{
    private readonly List<RefreshTokenEntry> _store = new();

    public void SaveRefreshToken(Guid userId, string token, DateTime expiresAt)
    {
        _store.Add(new RefreshTokenEntry { Token = token, UserId = userId, ExpiresAt = expiresAt });
    }

    public Task SaveRefreshTokenAsync(Guid userId, string token, DateTime expiresAt)
    {
        SaveRefreshToken(userId, token, expiresAt);
        return Task.CompletedTask;
    }

    public Task<RefreshTokenEntry> GetByTokenAsync(string token)
    {
        var entry = _store.FirstOrDefault(x => x.Token == token);
        return Task.FromResult(entry);
    }

    public Task RevokeAsync(string token)
    {
        var entry = _store.FirstOrDefault(x => x.Token == token);
        if (entry != null)
        {
            entry.IsRevoked = true;
            entry.IsUsed = true;
        }
        return Task.CompletedTask;
    }
}

public interface ITokenService
{
    string GenerateAccessToken(User user);
    string GenerateRefreshToken();
    DateTime GetRefreshTokenExpiry();
}

public class TokenService : ITokenService
{
    private readonly JwtSettings _settings;
    private readonly byte[] _key;

    public TokenService(JwtSettings settings)
    {
        _settings = settings;
        _key = Encoding.UTF8.GetBytes(_settings.Secret);
    }

    public string GenerateAccessToken(User user)
    {
        var tokenHandler = new JwtSecurityTokenHandler();
        var claims = new List<Claim>
        {
            new Claim(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
            new Claim(JwtRegisteredClaimNames.UniqueName, user.Username)
        };

        var descriptor = new SecurityTokenDescriptor
        {
            Subject = new ClaimsIdentity(claims),
            Expires = DateTime.UtcNow.AddMinutes(_settings.AccessTokenExpiryMinutes),
            Issuer = _settings.Issuer,
            Audience = _settings.Audience,
            SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(_key), SecurityAlgorithms.HmacSha256Signature)
        };

        var token = tokenHandler.CreateToken(descriptor);
        return tokenHandler.WriteToken(token);
    }

    public string GenerateRefreshToken()
    {
        var random = new byte[64];
        using var rng = RandomNumberGenerator.Create();
        rng.GetBytes(random);
        return Convert.ToBase64String(random);
    }

    public DateTime GetRefreshTokenExpiry()
    {
        return DateTime.UtcNow.AddDays(_settings.RefreshTokenExpiryDays);
    }
}

// End of file