5.16-bob: Access/Refresh tokens, token strategiyasi

  Uzoq muddatli token (masalan 30 kun):
     Qulay (kam login)
     O'g'irlansa — 30 kun hacker kirib turadi (bekor qilolmaymiz! — 14)

  Qisqa muddatli token (masalan 15 daqiqa):
     Xavfsiz (o'g'irlansa, tez tugaydi)
     Har 15 daqiqada qayta login (dahshatli UX)

  ACCESS TOKEN — qisqa muddatli (15-60 daqiqa)
     HAR so'rovda ishlatiladi (himoyalangan endpoint)
     o'g'irlansa, tez yaroqsiz (xavf kam)
     stateless JWT (server eslamaydi — tez tekshiriladi)

  REFRESH TOKEN — uzoq muddatli (7-90 kun)
     FAQAT yangi access token olish uchun (/refresh endpoint)
     DB'da saqlanadi (bekor qilinishi mumkin — stateful!)
     kamdan-kam ishlatiladi (har 15 daqiqada bir marta)

  LOGIN:
  email+parol  server: access (15min) + refresh (7kun) beradi
    access   xotirada/cookie
    refresh  httpOnly cookie + DB'ga saqlanadi 2.7-bob

  HAR SO'ROV:
  access token bilan  himoyalangan endpoint  

  ACCESS MUDDATI TUGADI (15min o'tdi):
  so'rov  401 (access eskirgan) 
  client /refresh ga refresh token yuboradi 
  server refresh'ni DB'da tekshiradi  YANGI access (+ yangi refresh — 2.4) 
  client yangi access bilan davom etadi (foydalanuvchi sezmaydi!)

  LOGOUT:
  refresh token'ni DB'dan o'chir (bekor — 2.6)

  ┌──────┐  login   ┌────────┐
  │Client│─────────▶│ Server │  access(15m) + refresh(7d)
  │      │◀─────────│        │
  └──────┘          └────────┘
     │ access bilan so'rovlar (15 daqiqa)
     │ ...access tugadi  401...
     │ refresh bilan /refresh
     ▼
  yangi access (+ yangi refresh)  davom

  Refresh R1 ishlatildi  yangi access + yangi refresh R2
     R1 BEKOR qilinadi (endi ishlamaydi)
  Keyingi safar R2 ishlatiladi  R3, R2 bekor
  ...

  Normal: R1  R2  R3 (har biri bir marta)

  O'G'IRLIK stsenariysi:
  Hacker R1'ni o'g'irladi. Lekin haqiqiy foydalanuvchi ham R1'ni ishlatdi  R2 oldi (R1 bekor)
  Hacker R1'ni ishlatmoqchi  R1 ALLAQACHON BEKOR  REUSE DETECTED!
   butun token oilasini (R1,R2,R3...) BEKOR QIL  ikkalasi ham qayta login qilsin (14)

  Logout             o'sha refresh'ni DB'dan o'chir
  "Barcha qurilmadan chiq"  foydalanuvchining BARCHA refresh'larini o'chir
  Parol o'zgardi     barcha refresh'ni bekor qil (xavfsizlik — 14)
  O'g'irlik aniqlandi  token oilasini bekor (2.5)

  Access token    XOTIRADA (JS o'zgaruvchi/React state — 11)
                   yoki httpOnly cookie
                    qisqa muddatli, sahifa yangilashda yo'qoladi (refresh bilan tiklanadi)

  Refresh token   httpOnly + Secure + SameSite cookie (14, 5.15)
                    JS o'qiy olmaydi (XSS himoyasi); DB'da nusxasi (bekor uchun)

  refresh_tokens jadvali:
  | id | userId | tokenHash        | family | expiresAt | revoked |
  | 1  | 7      | hash(token)      | fam-1  | +7kun     | false   |

   tokenning O'ZI emas, HASH'i (DB sizsa, ishlatib bo'lmaydi — 14)
   family: reuse detection uchun 2.5-bob; revoked: bekor belgisi (2.6)

  Access token:  15 daqiqa – 1 soat (qisqa — xavfsizlik)
  Refresh token: 7 – 30 kun (web); 30-90 kun (mobil app)
  Sezgir (bank): qisqaroq (access 5-15min)

  So'rov  401 (access tugagan) 
  frontend interceptor (Axios — 2.18-JS) ushlaydi 
  /refresh ga so'rov (refresh cookie avtomatik) 
  yangi access olinadi 
  asl so'rov YANGI access bilan QAYTA yuboriladi 
  foydalanuvchi hech narsa sezmaydi (uzluksiz)

   Access qisqa (15-60min), refresh uzoq (7-30kun) — 2.9
   Refresh rotatsiya (har ishlatishda yangi — 2.4); reuse detection 2.5-bob
   Refresh httpOnly cookie + DB'da hash (2.7, 2.8)
   Logout/parol o'zgarishida refresh bekor 2.6-bob
   Access va refresh uchun ALOHIDA secret 5.8-bob
   Refresh endpoint'iga rate limiting 5.20-bob
   HTTPS (14); refresh oilasini kuzat (o'g'irlik — 2.5)

import jwt from "jsonwebtoken";

// Ikki token yasash (2.2)
const access = jwt.sign({ sub: id, rol }, ACCESS_SECRET, { expiresIn: "15m" });
const refresh = jwt.sign({ sub: id }, REFRESH_SECRET, { expiresIn: "7d" });

// Refresh oqimi (2.3)
// 1. refresh'ni verify   2. DB'da tekshir (bekor emasmi)   3. rotatsiya (yangi refresh)
// 4. yangi access ber

// Saqlash (2.7)
res.cookie("refreshToken", refresh, { httpOnly: true, secure: true, sameSite: "lax", path: "/api/auth/refresh" });

import jwt from "jsonwebtoken";
import { config } from "../config/index.js";          // (5.8)

// Access — qisqa, asosiy ma'lumot bilan (2.2)
export const accessYasash = (user) =>
  jwt.sign(
    { sub: user.id, rol: user.rol },                   // payload (5.15)
    config.jwt.accessSecret,                           // ALOHIDA secret (2.11)
    { expiresIn: "15m" }                               // qisqa (2.9)
  );

// Refresh — uzoq, minimal ma'lumot (2.2)
export const refreshYasash = (user) =>
  jwt.sign(
    { sub: user.id },                                  // faqat ID
    config.jwt.refreshSecret,                          // boshqa secret (2.11)
    { expiresIn: "7d" }                                // uzoq (2.9)
  );

import bcrypt from "bcrypt";

export const login = async (req, res, next) => {
  try {
    const { email, parol } = req.body;
    const user = await User.findOne({ email }).select("+parol");   // (5.15)
    if (!user || !(await bcrypt.compare(parol, user.parol))) {
      return res.status(401).json({ error: "Email yoki parol noto'g'ri" });   // (5.15)
    }
    // Ikki token (2.2)
    const accessToken = accessYasash(user);
    const refreshToken = refreshYasash(user);
    // Refresh'ni DB'da hash qilib sakla (2.8)
    await RefreshToken.create({
      userId: user.id,
      tokenHash: await bcrypt.hash(refreshToken, 10),  // hash (DB sizsa — 14)
      family: crypto.randomUUID(),                     // oila (2.5)
      expiresAt: new Date(Date.now() + 7 * 24 * 3600 * 1000),
    });
    // Refresh — httpOnly cookie (2.7)
    res.cookie("refreshToken", refreshToken, {
      httpOnly: true, secure: config.isProd, sameSite: "lax",
      path: "/api/auth",                               // faqat auth route'larida (2.7)
      maxAge: 7 * 24 * 3600 * 1000,
    });
    // Access — javobda (frontend xotirada saqlaydi — 2.7)
    res.json({ accessToken, user: { id: user.id, email: user.email, rol: user.rol } });
  } catch (err) { next(err); }
};

import jwt from "jsonwebtoken";
import bcrypt from "bcrypt";

export const refresh = async (req, res, next) => {
  try {
    const token = req.cookies.refreshToken;            // cookie'dan (2.7)
    if (!token) return res.status(401).json({ error: "Refresh token yo'q" });

    // 1. Imzoni tekshir (2.2)
    let payload;
    try {
      payload = jwt.verify(token, config.jwt.refreshSecret);
    } catch {
      return res.status(401).json({ error: "Refresh noto'g'ri/tugagan" });
    }

    // 2. DB'da topish va tekshirish (bekor emasmi — 2.6)
    const saqlangan = await RefreshToken.findOne({ userId: payload.sub, revoked: false });
    if (!saqlangan || !(await bcrypt.compare(token, saqlangan.tokenHash))) {
      // REUSE DETECTION: bekor qilingan token qayta ishlatildi  o'g'irlik 2.5-bob!
      await RefreshToken.updateMany({ userId: payload.sub }, { revoked: true });   // butun oila (2.5)
      return res.status(401).json({ error: "Xavfsizlik buzilishi — qayta kiring" });
    }

    // 3. ROTATSIYA: eskini bekor qil, yangi refresh ber (2.4)
    saqlangan.revoked = true;
    await saqlangan.save();
    const user = await User.findById(payload.sub);
    const yangiRefresh = refreshYasash(user);
    await RefreshToken.create({
      userId: user.id, tokenHash: await bcrypt.hash(yangiRefresh, 10),
      family: saqlangan.family, expiresAt: new Date(Date.now() + 7 * 24 * 3600 * 1000),
    });
    res.cookie("refreshToken", yangiRefresh, {
      httpOnly: true, secure: config.isProd, sameSite: "lax", path: "/api/auth",
      maxAge: 7 * 24 * 3600 * 1000,
    });

    // 4. Yangi access ber (2.3)
    res.json({ accessToken: accessYasash(user) });
  } catch (err) { next(err); }
};

export const logout = async (req, res, next) => {
  try {
    const token = req.cookies.refreshToken;
    if (token) {
      const payload = jwt.decode(token);               // (5.15)
      // DB'dan o'chir/bekor qil (2.6)
      await RefreshToken.updateMany({ userId: payload?.sub }, { revoked: true });
    }
    res.clearCookie("refreshToken", { path: "/api/auth" });   // cookie tozalash (5.15)
    res.json({ message: "Tizimdan chiqdingiz" });
  } catch (err) { next(err); }
};

import jwt from "jsonwebtoken";

export const auth = (req, res, next) => {
  const token = req.headers.authorization?.startsWith("Bearer ")
    ? req.headers.authorization.slice(7)               // header'dan (access — 2.7)
    : null;
  if (!token) return res.status(401).json({ error: "Avtorizatsiya kerak" });
  try {
    const payload = jwt.verify(token, config.jwt.accessSecret);   // access secret (2.11)
    req.user = { id: payload.sub, rol: payload.rol };
    next();
  } catch (err) {
    // Muddat tugagan bo'lsa — maxsus kod (frontend refresh qilsin — 2.10)
    if (err.name === "TokenExpiredError") {
      return res.status(401).json({ error: "Access tugagan", code: "TOKEN_EXPIRED" });
    }
    return res.status(401).json({ error: "Token noto'g'ri" });
  }
};

export const hammadanChiq = async (req, res, next) => {
  try {
    // Foydalanuvchining BARCHA refresh tokenlarini bekor qil (2.6)
    await RefreshToken.updateMany({ userId: req.user.id }, { revoked: true });
    res.clearCookie("refreshToken", { path: "/api/auth" });
    res.json({ message: "Barcha qurilmalardan chiqildi" });
    // Endi hech bir qurilmada refresh ishlamaydi (access'lar 15min ichida tugaydi)
  } catch (err) { next(err); }
};

// frontend (11, 2.18-JS) — backend uchun kontekst
import axios from "axios";
const api = axios.create({ baseURL: "/api", withCredentials: true });   // cookie uchun

// Har so'rovga access token qo'sh (xotiradan)
api.interceptors.request.use((cfg) => {
  if (accessToken) cfg.headers.Authorization = `Bearer ${accessToken}`;
  return cfg;
});

// 401 (access tugagan) bo'lsa — avtomatik refresh + qayta urinish (2.10)
api.interceptors.response.use(null, async (error) => {
  if (error.response?.status === 401 && error.response.data.code === "TOKEN_EXPIRED") {
    const { data } = await api.post("/auth/refresh");   // refresh cookie avtomatik
    accessToken = data.accessToken;                      // yangi access (xotirada)
    error.config.headers.Authorization = `Bearer ${accessToken}`;
    return api(error.config);                            // asl so'rovni qayta yubor
  }
  return Promise.reject(error);
});

export const parolOzgartir = async (req, res, next) => {
  try {
    const user = await User.findById(req.user.id).select("+parol");
    if (!(await bcrypt.compare(req.body.eskiParol, user.parol))) {
      return res.status(401).json({ error: "Eski parol noto'g'ri" });
    }
    user.parol = await bcrypt.hash(req.body.yangiParol, 12);   // (5.15)
    await user.save();
    // Xavfsizlik: barcha refresh'ni bekor (boshqa qurilmalar chiqsin — 2.6, 14)
    await RefreshToken.updateMany({ userId: user.id }, { revoked: true });
    res.clearCookie("refreshToken", { path: "/api/auth" });
    res.json({ message: "Parol o'zgartirildi. Qaytadan kiring." });
  } catch (err) { next(err); }
};

 bitta 30 kunlik token  o'g'irlansa bekor qilolmaysiz (2.1, 14)
 qisqa access + uzoq refresh (DB'da, bekor qilinadi)

 localStorage  XSS o'g'irlaydi (refresh — eng qimmat! — 2.7, 14)
 httpOnly cookie + DB'da hash

 bir refresh qayta-qayta ishlatiladi  reuse detection imkonsiz (2.4)
 har refresh'da yangi (rotatsiya) + eski bekor

//  DB sizsa — tokenlar ochiq (14, 2.8)
await RefreshToken.create({ token: refreshToken });

//  hash
await RefreshToken.create({ tokenHash: await bcrypt.hash(refreshToken, 10) });

//  bitta secret (2.11)
jwt.sign(p, SECRET); // ikkalasi ham

//  alohida (access secret sizsa, refresh xavfsiz)
jwt.sign(p, ACCESS_SECRET); jwt.sign(p, REFRESH_SECRET);