ASP.NET Core Refresh Token Rotationでトークンの再利用を検知する

public sealed class RefreshToken
{
    public Guid RefreshTokenId { get; init; }
    public byte[] TokenHash { get; init; } = [];
    public Guid UserId { get; init; }
    public DateTimeOffset ExpiresAt { get; init; }
    public DateTimeOffset? RevokedAt { get; set; }
    public Guid? ReplacedByTokenId { get; set; }
    public Guid TokenFamilyId { get; init; }

    public bool IsRevoked => RevokedAt is not null;

    public bool IsValid(DateTimeOffset now)
        => ExpiresAt >= now && !IsRevoked;
}

var plainToken = WebEncoders.Base64UrlEncode(
    RandomNumberGenerator.GetBytes(32)
);

var tokenHash = SHA256.HashData(
    Encoding.UTF8.GetBytes(plainToken)
);

SELECT
    refresh_token_id,
    user_id,
    expires_at,
    revoked_at,
    replaced_by_token_id,
    token_family_id
FROM refresh_tokens
WHERE token_hash = @TokenHash
FOR UPDATE;

var now = DateTimeOffset.UtcNow;

if (!oldToken.IsValid(now))
{
    throw new UnauthorizedAccessException();
}

oldToken.RevokedAt = now;

var newToken = CreateRefreshToken(
    oldToken.UserId,
    oldToken.TokenFamilyId,
    now
);

oldToken.ReplacedByTokenId = newToken.RefreshTokenId;

await repository.InsertAsync(newToken, cancellationToken);
await repository.UpdateAsync(oldToken, cancellationToken);

if (oldToken.IsRevoked)
{
    var familyTokens = await repository.FindByFamilyIdForUpdateAsync(
        oldToken.TokenFamilyId,
        cancellationToken
    );

    foreach (var token in familyTokens.Where(x => !x.IsRevoked))
    {
        token.RevokedAt = DateTimeOffset.UtcNow;
        await repository.UpdateAsync(token, cancellationToken);
    }

    throw new UnauthorizedAccessException();
}

let refreshPromise: Promise<void> | undefined;

export const refreshToken = async () => {
  if (!refreshPromise) {
    refreshPromise = requestRefreshToken().finally(() => {
      refreshPromise = undefined;
    });
  }

  return refreshPromise;
};