feat(auth): harden authentication with argon2 passwords and rotating hashed refresh tokens

ts_interfaces/data/loint-reception.jwt.ts

@@ -10,6 +10,11 @@ export interface IJwt {
      */
     userId: string;
 
+    /**
+     * the login session backing this jwt
+     */
+    sessionId?: string;
+
     /**
      * the latest point of
      */
@@ -24,9 +29,9 @@ export interface IJwt {
     refreshEvery: number;
 
     /**
-     * the refresh token to obtain a new jwt for a session
+     * legacy field kept for compatibility with already-issued jwt documents
      */
-    refreshToken: string;
+    refreshToken?: string;
 
     /**
      * just for looks/debugging

ts_interfaces/data/loint-reception.loginsession.ts

@@ -1,15 +1,22 @@
 export interface ILoginSession {
   id: string;
   data: {
-    userId: string;
+    userId: string | null;
     validUntil: number;
     invalidated: boolean;
-    refreshToken: string;
+    /**
+     * legacy plaintext refresh token field kept so existing sessions can migrate on first use
+     */
+    refreshToken?: string | null;
+    refreshTokenHash?: string | null;
+    rotatedRefreshTokenHashes?: string[];
+    transferTokenHash?: string | null;
+    transferTokenExpiresAt?: number | null;
     /**
      * a device id that can be used to share the login session
      * in different contexts on the same device
      */
-    deviceId: string;
+    deviceId?: string | null;
     /**
      * Device metadata for session display
      */
@@ -18,7 +25,7 @@ export interface ILoginSession {
       browser: string;
       os: string;
       ip: string;
-    };
+    } | null;
     /**
      * When this session was created
      */

ts_interfaces/request/loint-reception.login.ts

@@ -87,7 +87,8 @@ export interface IReq_RefreshJwt
   };
   response: {
     status: data.TLoginStatus;
-    jwt: string;
+    jwt?: string;
+    refreshToken?: string;
   };
 }