update refresh token backend

JosephHieu · JosephHieu · commit db281d124252 · 2026-04-14T11:06:07.000+07:00
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/common/config/SecurityConfig.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/common/config/SecurityConfig.java
@@ -46,7 +46,7 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
                         .authenticationEntryPoint(jwtAuthenticationEntryPoint))
 
                 .authorizeHttpRequests(auth -> auth
-                        .requestMatchers("/api/v1/auth/**").permitAll()
+                        .requestMatchers("/api/v1/auth/login", "/api/v1/auth/refresh").permitAll()
                         .requestMatchers("/api-docs/**", "/swagger-ui/**", "/swagger-ui.html").permitAll()
 
                         .requestMatchers("/api/v1/templates/**").authenticated()
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/common/exception/ErrorCode.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/common/exception/ErrorCode.java
@@ -26,6 +26,10 @@ public enum ErrorCode {
     CONFIRM_PASSWORD_NOT_MATCH(1013, "Xác nhận mật khẩu mới không khớp", HttpStatus.BAD_REQUEST),
     RESET_PASSWORD_INVALID(1014, "Mật khẩu xác nhận xóa hệ thống không chính xác", HttpStatus.BAD_REQUEST),
 
+    // REFRESH TOKEN ERRORS
+    REFRESH_TOKEN_NOT_FOUND(1101, "Refresh Token không tồn tại trong hệ thống", HttpStatus.NOT_FOUND),
+    REFRESH_TOKEN_EXPIRED(1102, "Refresh Token đã hết hạn, vui lòng đăng nhập lại", HttpStatus.UNAUTHORIZED),
+
     // TEMPLATE ERRORS
     TEMPLATE_NOT_EXISTED(2001, "Mẫu feedback không tồn tại", HttpStatus.NOT_FOUND),
     TEMPLATE_EXISTED(2002, "Tên mẫu feedback đã tồn tại", HttpStatus.BAD_REQUEST),
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/common/security/JwtTokenProvider.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/common/security/JwtTokenProvider.java
@@ -24,30 +24,48 @@ public class JwtTokenProvider {
     @Value("${application.security.jwt.expiration}")
     private long jwtExpiration;
 
+    @Value("${application.security.jwt.refresh-token-expiration}")
+    private long refreshTokenExpiration;
+
     private SecretKey getSigningKey() {
         return Keys.hmacShaKeyFor(secretKey.getBytes(StandardCharsets.UTF_8));
     }
 
     public String generateToken(Authentication authentication) {
         CustomUserDetails userPrincipal = (CustomUserDetails) authentication.getPrincipal();
-
-        Date now = new Date();
-        Date expiryDate = new Date(now.getTime() + jwtExpiration);
-
-        // Lấy quyền (ROLE_ADMIN)
         String authorities = authentication.getAuthorities().stream()
                 .map(GrantedAuthority::getAuthority)
                 .collect(Collectors.joining(" "));
 
+        return buildToken(userPrincipal.getUsername(), authorities, jwtExpiration);
+    }
+
+    public String generateTokenFromUsername(String username, String role) {
+        return buildToken(username, role, jwtExpiration);
+    }
+
+    private String buildToken(String subject, String scope, long expirationTime) {
+        Date now = new Date();
+        Date expiryDate = new Date(now.getTime() + expirationTime);
+
         return Jwts.builder()
-                .subject(userPrincipal.getUsername()) // 0.12.x dùng .subject()
+                .subject(subject)
                 .issuedAt(now)
                 .expiration(expiryDate)
-                .claim("scope", authorities)
+                .claim("scope", scope) // Lưu role vào claim "scope"
                 .signWith(getSigningKey())
                 .compact();
     }
 
+    public String getRoleFromJWT(String token) {
+        return Jwts.parser()
+                .verifyWith(getSigningKey())
+                .build()
+                .parseSignedClaims(token)
+                .getPayload()
+                .get("scope", String.class);
+    }
+
     public String getUsernameFromJWT(String token) {
         return Jwts.parser()
                 .verifyWith(getSigningKey()) // 0.12.x dùng .verifyWith()
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/controller/AuthController.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/controller/AuthController.java
@@ -25,7 +25,6 @@ public class AuthController {
     public ResponseEntity<ApiResponse<AuthResponse>> login(@RequestBody @Valid LoginRequest request) {
 
         AuthResponse result = authService.login(request);
-
         ApiResponse<AuthResponse> response = ApiResponse.<AuthResponse>builder()
                 .result(result)
                 .message("Đăng nhập thành công")
@@ -34,6 +33,17 @@ public ResponseEntity<ApiResponse<AuthResponse>> login(@RequestBody @Valid Login
         return ResponseEntity.ok(response);
     }
 
+    @PostMapping("/refresh")
+    public ResponseEntity<ApiResponse<AuthResponse>> refresh(@RequestBody String refreshToken) {
+
+        AuthResponse result = authService.refreshToken(refreshToken);
+
+        return ResponseEntity.ok(ApiResponse.<AuthResponse>builder()
+                .result(result)
+                .message("Làm mới phiên làm việc thành công")
+                .build());
+    }
+
     @PostMapping("/change-password")
     public ResponseEntity<ApiResponse<Void>> changePassword(
             @RequestBody @Valid PasswordChangeRequest request,
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/dto/response/AuthResponse.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/dto/response/AuthResponse.java
@@ -11,6 +11,7 @@
 public class AuthResponse {
 
     String token;
+    String refreshToken;
     String username;
     String role;
 }
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/entity/RefreshToken.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/entity/RefreshToken.java
@@ -0,0 +1,33 @@
+package com.josephhieu.feedbackonline.entity;
+
+import jakarta.persistence.*;
+import lombok.*;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Entity
+@Table(name = "refresh_tokens")
+@Getter @Setter
+@NoArgsConstructor
+@AllArgsConstructor
+@Builder
+public class RefreshToken {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.UUID)
+    @Column(name = "id")
+    private UUID id;
+
+    @Column(name = "token", nullable = false, unique = true)
+    private String token;
+
+    @Column(name = "expiry_date", nullable = false)
+    private Instant expiryDate;
+
+    @Column(name = "username", nullable = false)
+    private String username;
+
+    @Column(name = "role", nullable = false)
+    private String role;
+}
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/repository/RefreshTokenRepository.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/repository/RefreshTokenRepository.java
@@ -0,0 +1,17 @@
+package com.josephhieu.feedbackonline.repository;
+
+import com.josephhieu.feedbackonline.entity.RefreshToken;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Modifying;
+import org.springframework.stereotype.Repository;
+
+import java.util.Optional;
+import java.util.UUID;
+
+@Repository
+public interface RefreshTokenRepository extends JpaRepository<RefreshToken, UUID> {
+    Optional<RefreshToken> findByToken(String token);
+
+    @Modifying
+    void deleteByUsername(String username);
+}
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/service/AuthService.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/service/AuthService.java
@@ -8,5 +8,7 @@ public interface AuthService {
 
     AuthResponse login(LoginRequest request);
 
+    AuthResponse refreshToken(String refreshToken);
+
     void changePassword(PasswordChangeRequest request);
 }
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/service/RefreshTokenService.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/service/RefreshTokenService.java
@@ -0,0 +1,16 @@
+package com.josephhieu.feedbackonline.service;
+
+import com.josephhieu.feedbackonline.entity.RefreshToken;
+
+import java.util.Optional;
+
+public interface RefreshTokenService {
+
+    RefreshToken createRefreshToken(String username, String role);
+
+    Optional<RefreshToken> findByToken(String token);
+
+    RefreshToken verifyExpiration(RefreshToken token);
+
+    void deleteByUsername(String username);
+}
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/service/impl/AuthServiceImpl.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/service/impl/AuthServiceImpl.java
@@ -12,6 +12,7 @@
 import com.josephhieu.feedbackonline.repository.AdminRepository;
 import com.josephhieu.feedbackonline.repository.HocVienRepository;
 import com.josephhieu.feedbackonline.service.AuthService;
+import com.josephhieu.feedbackonline.service.RefreshTokenService;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.security.authentication.AuthenticationManager;
@@ -35,28 +36,35 @@ public class AuthServiceImpl implements AuthService {
     private final HocVienRepository hocVienRepository;
     private final PasswordEncoder passwordEncoder;
 
+    private final RefreshTokenService refreshTokenService;
+
     @Override
+    @Transactional
     public AuthResponse login(LoginRequest request) {
-
         try {
             Authentication authentication = authenticationManager.authenticate(
                     new UsernamePasswordAuthenticationToken(request.getUsername(), request.getPassword())
             );
 
             SecurityContextHolder.getContext().setAuthentication(authentication);
 
-            String token = tokenProvider.generateToken(authentication);
+            // 2. Tạo Access Token
+            String accessToken = tokenProvider.generateToken(authentication);
 
             CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();
             String role = userDetails.getAuthorities().stream()
                     .map(GrantedAuthority::getAuthority)
                     .findFirst()
                     .orElse("ROLE_USER");
 
+            // 3. Tạo và lưu Refresh Token vào Database
+            var refreshToken = refreshTokenService.createRefreshToken(userDetails.getUsername(), role);
+
             log.info("Login successful for user: {}", userDetails.getUsername());
 
             return AuthResponse.builder()
-                    .token(token)
+                    .token(accessToken)
+                    .refreshToken(refreshToken.getToken())
                     .username(userDetails.getUsername())
                     .role(role)
                     .build();
@@ -66,6 +74,31 @@ public AuthResponse login(LoginRequest request) {
         }
     }
 
+    // 4. Implement phương thức refreshToken
+    @Override
+    @Transactional
+    public AuthResponse refreshToken(String requestToken) {
+        return refreshTokenService.findByToken(requestToken)
+                .map(refreshTokenService::verifyExpiration)
+                .map(refreshToken -> {
+                    // Cấp Access Token mới dựa trên thông tin trong Refresh Token
+                    String newAccessToken = tokenProvider.generateTokenFromUsername(
+                            refreshToken.getUsername(),
+                            refreshToken.getRole()
+                    );
+
+                    log.info("Access Token refreshed for user: {}", refreshToken.getUsername());
+
+                    return AuthResponse.builder()
+                            .token(newAccessToken)
+                            .refreshToken(refreshToken.getToken())
+                            .username(refreshToken.getUsername())
+                            .role(refreshToken.getRole())
+                            .build();
+                })
+                .orElseThrow(() -> new AppException(ErrorCode.REFRESH_TOKEN_NOT_FOUND));
+    }
+
     @Transactional
     public void changePassword(PasswordChangeRequest request) {
         // 1. Lấy thông tin từ SecurityContext
diff --git a/01-backend/src/main/java/com/josephhieu/feedbackonline/service/impl/RefreshTokenServiceImpl.java b/01-backend/src/main/java/com/josephhieu/feedbackonline/service/impl/RefreshTokenServiceImpl.java
@@ -0,0 +1,65 @@
+package com.josephhieu.feedbackonline.service.impl;
+
+import com.josephhieu.feedbackonline.common.exception.AppException;
+import com.josephhieu.feedbackonline.common.exception.ErrorCode;
+import com.josephhieu.feedbackonline.common.security.JwtTokenProvider;
+import com.josephhieu.feedbackonline.entity.RefreshToken;
+import com.josephhieu.feedbackonline.repository.RefreshTokenRepository;
+import com.josephhieu.feedbackonline.service.RefreshTokenService;
+import lombok.RequiredArgsConstructor;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.time.Instant;
+import java.util.Optional;
+import java.util.UUID;
+
+@Service
+@RequiredArgsConstructor
+public class RefreshTokenServiceImpl implements RefreshTokenService {
+
+    @Value("${application.security.jwt.refresh-token-expiration}")
+    private long refreshTokenDurationMs;
+
+    private final RefreshTokenRepository refreshTokenRepository;
+    private final JwtTokenProvider tokenProvider;
+
+    @Override
+    @Transactional
+    public RefreshToken createRefreshToken(String username, String role) {
+        // 1. Xóa các token cũ
+        refreshTokenRepository.deleteByUsername(username);
+
+        // 2. Tạo token mới
+        RefreshToken refreshToken = RefreshToken.builder()
+                .username(username)
+                .role(role)
+                .token(UUID.randomUUID().toString())
+                .expiryDate(Instant.now().plusMillis(refreshTokenDurationMs))
+                .build();
+
+        return refreshTokenRepository.save(refreshToken);
+    }
+
+    @Override
+    public Optional<RefreshToken> findByToken(String token) {
+        return refreshTokenRepository.findByToken(token);
+    }
+
+    @Override
+    @Transactional
+    public RefreshToken verifyExpiration(RefreshToken token) {
+        if (token.getExpiryDate().isBefore(Instant.now())) {
+            refreshTokenRepository.delete(token);
+            throw new AppException(ErrorCode.REFRESH_TOKEN_EXPIRED);
+        }
+        return token;
+    }
+
+    @Override
+    @Transactional
+    public void deleteByUsername(String username) {
+        refreshTokenRepository.deleteByUsername(username);
+    }
+}
diff --git a/01-backend/src/main/resources/application-pro.yml b/01-backend/src/main/resources/application-pro.yml
@@ -50,6 +50,7 @@ application:
     jwt:
       secret-key: ${JWT_SECRET_KEY}
       expiration: 86400000 # 1 ngày
+      refresh-token-expiration: 604800000 # 7 ngày
 
 # 5. Tối ưu Log cho Production (Chỉ hiện INFO/ERROR để tiết kiệm RAM)
 logging:
diff --git a/01-backend/src/main/resources/application.yml b/01-backend/src/main/resources/application.yml
@@ -60,4 +60,5 @@ application:
   security:
     jwt:
       secret-key: 404E635266556A586E3272357538782F413F4428472B4B6250645367566B5970
-      expiration: 86400000
+      expiration: 360000
+      refresh-token-expiration: 604800000

Original file line number	Diff line number	Diff line change
`@@ -11,6 +11,7 @@`
`11`	`11`	`public class AuthResponse {`
`12`	`12`
`13`	`13`	`String token;`
	`14`	`+ String refreshToken;`
`14`	`15`	`String username;`
`15`	`16`	`String role;`
`16`	`17`	`}`
Original file line number	Diff line number	Diff line change
`@@ -8,5 +8,7 @@ public interface AuthService {`
`8`	`8`
`9`	`9`	`AuthResponse login(LoginRequest request);`
`10`	`10`
	`11`	`+ AuthResponse refreshToken(String refreshToken);`
	`12`	`+`
`11`	`13`	`void changePassword(PasswordChangeRequest request);`
`12`	`14`	`}`