This lesson's interactive features are locked, please to keep using them

Refresh and Revoke

Our access tokens now expire after an hour, but we don't want users to get logged out every hour. That's where the refresh tokens we just added come in. When an access token expires, the client should be able to use its refresh token to get a new access token.

Refresh tokens are long-lived, so we need a way to kill them early when a user logs out or if a token gets stolen. Once a refresh token is revoked, it can't be used to get new access tokens, so the user will have to log in again when their current access token expires.

Assignment

Create a POST /api/refresh endpoint. This new endpoint does not accept a request body, but does require a refresh token to be present in the headers, in the same Authorization: Bearer <refresh-token> format.

Look up the refresh token in the database. If it doesn't exist, or if it's expired or revoked, respond with a 401 status code. Otherwise, respond with a 200 code and this shape:
```
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}
```
The token field should be a newly created access token for the given user that expires in 1 hour. I wrote a userForRefreshToken query.
Create a new POST /api/revoke endpoint. This new endpoint does not accept a request body, but does require a refresh token to be present in the headers, in the same Authorization: Bearer <refresh-token> format.

Revoke the refresh token record in the database that matches the refresh token passed in the request header by setting the revoked_at to the current timestamp. Remember that any time you update a record, you should also be updating the updated_at timestamp.

Respond with a 204 status code. A 204 status means the request was successful, but no response body is returned.

Run and submit the CLI tests.