fix: fixed refresh token logic

Author: kelvink96

Controllers/AuthController.cs

@@ -172,17 +172,17 @@ public async Task<IActionResult> RefreshToken([FromBody] RefreshTokenRequestDto
         if (string.IsNullOrEmpty(request.Token))
             return BadRequest(new { message = "Token is required" });
 
-        // Extract token ID (jti claim)
+        // Extract the token ID (jti claim)
         var tokenId = _tokenService.ExtractTokenId(request.Token);
 
         if (string.IsNullOrEmpty(tokenId))
             return BadRequest(new { message = "Invalid token" });
 
-        // Check if token is blacklisted
+        // Check if the token is blacklisted
         if (await _tokenBlacklistRepository.IsTokenBlacklistedAsync(tokenId))
             return Unauthorized(new { message = "Token has been revoked" });
 
-        var principal = _tokenService.ValidateToken(request.Token);
+        var principal = _tokenService.ValidateTokenForRefresh(request.Token);
 
         if (principal == null)
             return Unauthorized(new { message = "Invalid token" });

Interfaces/ITokenService.cs

@@ -10,4 +10,5 @@ public interface ITokenService
     ClaimsPrincipal ValidateToken(string token);
     DateTime GetTokenExpirationTime(string token);
     string ExtractTokenId(string token);
+    ClaimsPrincipal ValidateTokenForRefresh(string token);
 }

Services/TokenService.cs

@@ -124,4 +124,23 @@ public string ExtractTokenId(string token)
 
         return null;
     }
+    
+    public ClaimsPrincipal ValidateTokenForRefresh(string token)
+    {
+        var tokenHandler = new JwtSecurityTokenHandler();
+        var key = Encoding.UTF8.GetBytes(_jwtSettings.SecretKey);
+
+        var validationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidateAudience = true,
+            ValidateLifetime = false, // This is the key change - don't validate lifetime for refresh
+            ValidateIssuerSigningKey = true,
+            ValidIssuer = _jwtSettings.Issuer,
+            ValidAudience = _jwtSettings.Audience,
+            IssuerSigningKey = new SymmetricSecurityKey(key),
+        };
+    
+        return tokenHandler.ValidateToken(token, validationParameters, out _);
+    }
 }