refresh the access token in the background

Use gesdinet/jwt-refresh-token-bundle to achieve this.
The access token lifetime was reduced to 30 mins
according to https://cloud.google.com/apigee/docs/api-platform/antipatterns/oauth-long-expiration
as a starting point.
Do not log out if the refresh in the background fails, the user might want to backup
the content he is currently editing.

One proposed pattern is to intercept 401 responses and refresh the token when the requests fail.
Because we often have multiple requests running, this did not work well.
Now we have a timeout in the background which refreshes the access token periodically.

closes #4898

Author: BacLuc

api/composer.json

@@ -15,6 +15,7 @@
         "exercise/htmlpurifier-bundle": "5.1",
         "friendsofsymfony/http-cache": "3.1.1",
         "friendsofsymfony/http-cache-bundle": "3.2.0",
+        "gesdinet/jwt-refresh-token-bundle": "1.5.0",
         "google/recaptcha": "1.3.1",
         "guzzlehttp/guzzle": "7.9.3",
         "knpuniversity/oauth2-client-bundle": "2.18.3",

api/composer.lock

@@ -6,6 +6,7 @@
 use Exercise\HTMLPurifierBundle\ExerciseHTMLPurifierBundle;
 use Fidry\AliceDataFixtures\Bridge\Symfony\FidryAliceDataFixturesBundle;
 use FOS\HttpCacheBundle\FOSHttpCacheBundle;
+use Gesdinet\JWTRefreshTokenBundle\GesdinetJWTRefreshTokenBundle;
 use Hautelook\AliceBundle\HautelookAliceBundle;
 use KnpU\OAuth2ClientBundle\KnpUOAuth2ClientBundle;
 use Lexik\Bundle\JWTAuthenticationBundle\LexikJWTAuthenticationBundle;
@@ -44,4 +45,5 @@
     SentryBundle::class => ['all' => true],
     TwigExtraBundle::class => ['all' => true],
     FOSHttpCacheBundle::class => ['all' => true],
+    GesdinetJWTRefreshTokenBundle::class => ['all' => true],
 ];

api/config/bundles.php

@@ -0,0 +1,11 @@
+gesdinet_jwt_refresh_token:
+    cookie:
+      enabled: true
+      same_site: strict
+      path: /
+      http_only: true
+      secure: '%env(bool:COOKIE_SECURE)%'
+      remove_token_from_body: true
+    refresh_token_class: App\Entity\RefreshToken
+    single_use: true
+    token_parameter_name: '%env(COOKIE_PREFIX)%refresh_token'

api/config/packages/gesdinet_jwt_refresh_token.yaml

@@ -7,9 +7,8 @@ lexik_jwt_authentication:
     public_key: '%env(resolve:JWT_PUBLIC_KEY)%'
     pass_phrase: '%env(JWT_PASSPHRASE)%'
 
-    # Tokens are valid for 12 hours, should be safe because we never expose the whole token to JavaScript.
-    # Of course it would be even better to have only short-lived tokens but renew them on every request.
-    token_ttl: 43200
+    # Tokens are valid for 30 minutes.
+    token_ttl: 1800
 
     # Read the JWT token from a split cookie: The [api-domain]_jwt_hp and [api-domain]_jwt_s cookies are combined with a period (.)
     # to form the full JWT token.

api/config/packages/lexik_jwt_authentication.yaml

@@ -28,13 +28,16 @@ security:
             lazy: true
             provider: app_user_provider
             user_checker: App\Security\UserStatusChecker
+            entry_point: jwt
             json_login:
                 check_path: /authentication_token
                 username_path: identifier
                 password_path: password
                 success_handler: lexik_jwt_authentication.handler.authentication_success
                 failure_handler: lexik_jwt_authentication.handler.authentication_failure
             jwt: ~
+            refresh_jwt:
+                check_path: /token/refresh
             custom_authenticators:
                 - App\Security\OAuth\GoogleAuthenticator
                 - App\Security\OAuth\HitobitoAuthenticator
@@ -46,6 +49,7 @@ security:
         - { path: ^/auth, roles: PUBLIC_ACCESS } # OAuth and resend password endpoints
         - { path: ^/content_types, roles: PUBLIC_ACCESS } # Content types is more or less static and the same for all camps
         - { path: ^/invitations/.*/(find|reject), roles: PUBLIC_ACCESS }
+        - { path: ^/token/refresh, roles: PUBLIC_ACCESS }
         - { path: ^/users$, methods: [POST], roles: PUBLIC_ACCESS } # register
         - { path: ^/users/.*/activate$, methods: [PATCH], roles: PUBLIC_ACCESS }
         - { path: .*, roles: [ROLE_USER] } # Protect all other routes must be at the end

api/config/packages/security.yaml

@@ -4,3 +4,5 @@
 authentication_token:
   path: /authentication_token
   methods: ['POST']
+api_refresh_token:
+  path: /token/refresh

api/config/routes.yaml

@@ -103,6 +103,12 @@ services:
     App\OpenApi\OAuthDecorator:
         decorates: 'api_platform.openapi.factory'
 
+    App\OpenApi\RefreshTokenDecorator:
+      decorates: 'api_platform.openapi.factory'
+      arguments:
+        - '@.inner'
+        - '%env(COOKIE_PREFIX)%'
+
     App\OAuth\UrlGeneratorDecorator:
         class: App\OAuth\UrlGeneratorDecorator
         arguments:

api/config/services.yaml

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20250809140557 extends AbstractMigration {
+    public function getDescription(): string {
+        return 'Add refresh tokens table';
+    }
+
+    public function up(Schema $schema): void {
+        $this->addSql('CREATE TABLE refresh_tokens (refresh_token VARCHAR(128) NOT NULL, username VARCHAR(255) NOT NULL, valid TIMESTAMP(0) WITHOUT TIME ZONE NOT NULL, id INT GENERATED BY DEFAULT AS IDENTITY NOT NULL, PRIMARY KEY (id))');
+        $this->addSql('CREATE UNIQUE INDEX UNIQ_9BACE7E1C74F2195 ON refresh_tokens (refresh_token)');
+    }
+
+    public function down(Schema $schema): void {
+        $this->addSql('DROP TABLE refresh_tokens');
+    }
+}

api/migrations/schema/Version20250809140557.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Entity;
+
+use Doctrine\ORM\Mapping as ORM;
+use Gesdinet\JWTRefreshTokenBundle\Entity\RefreshToken as BaseRefreshToken;
+
+#[ORM\Entity]
+#[ORM\Table(name: 'refresh_tokens')]
+class RefreshToken extends BaseRefreshToken {}