Refactor authentication middleware to support JWT rotation

Refactor the existing auth middleware to support automatic JWT token rotation with configurable expiry windows. Must handle concurrent requests during rotation gracefully. Include refresh token flow and invalidation on logout.

Requirements

Acceptance Criteria

[
  "JWT rotation implemented with configurable expiry window",
  "Concurrent request handling during rotation (no 401 race conditions)",
  "Refresh token endpoint with proper invalidation",
  "Unit tests covering rotation, concurrency, and logout invalidation",
  "No breaking changes to existing auth flow"
]

Claims (1)

Feedback

No feedback yet.