feat(auth): implement refresh token functionality

- Add create_refresh_token utility function with 7-day expiration
- Update TokenResponse schema to include refresh_token field
- Modify login and registration endpoints to return refresh tokens
- Add new /refresh-token endpoint for token rotation
- Include user_exists flag in OTPSendResponse for better UX

app/routers/user_router.py

@@ -9,12 +9,14 @@ from app.schemas.user_schema import (
     UserLoginRequest,
     OAuthLoginRequest,
     TokenResponse,
+    OTPSendResponse,
 )
 from app.services.user_service import UserService
-from app.utils.jwt import create_temp_token, decode_token
+from app.utils.jwt import create_temp_token, decode_token, create_refresh_token
 from app.utils.social_utils import verify_google_token, verify_apple_token, verify_facebook_token
 from app.utils.common_utils import validate_identifier
 from app.models.social_security_model import SocialSecurityModel
+from app.models.user_model import BookMyServiceUserModel
 from fastapi import Request
 import logging
 
@@ -54,55 +56,10 @@ def get_bearer_token(api_key: str = Security(api_key_scheme)) -> str:
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid Authorization header format"
         )
-
-# 📧📱 Send OTP to email or phone (legacy endpoint - supports both fields)
-@router.post("/send-otp")
-async def send_otp_handler(payload: OTPRequest):
-    logger.info(f"OTP request started - email: {payload.email}, phone: {payload.phone}")
-    
-    try:
-        # Validate input - ensure only one identifier is provided
-        identifier = payload.email or payload.phone
-        if not identifier:
-            logger.warning("OTP request failed - neither email nor phone provided")
-            raise HTTPException(status_code=400, detail="Email or phone required")
-        
-        # Validate identifier format
-        try:
-            identifier_type = validate_identifier(identifier)
-            logger.debug(f"Identifier type: {identifier_type}")
-        except ValueError as ve:
-            logger.error(f"Invalid identifier format: {str(ve)}")
-            raise HTTPException(status_code=400, detail=str(ve))
-        
-        logger.debug(f"Using identifier: {identifier}")
-        
-        # Send OTP via service
-        logger.debug(f"Calling UserService.send_otp with identifier: {identifier}")
-        await UserService.send_otp(identifier)
-        logger.info(f"OTP sent successfully to: {identifier}")
-        
-        # Create temporary token
-        logger.debug("Creating temporary token for OTP verification")
-        temp_token = create_temp_token({
-            "sub": identifier,
-            "type": "otp_verification"
-        }, expires_minutes=10)
-        
-        logger.info(f"Temporary token created for: {identifier}")
-        logger.debug(f"Temp token (first 20 chars): {temp_token[:20]}...")
-        
-        return {"message": "OTP sent", "temp_token": temp_token}
-        
-    except HTTPException as e:
-        logger.error(f"OTP request failed - HTTP {e.status_code}: {e.detail}")
-        raise e
-    except Exception as e:
-        logger.error(f"Unexpected error during OTP request: {str(e)}", exc_info=True)
-        raise HTTPException(status_code=500, detail="Internal server error during OTP request")
+ 
 
 # 📧📱 Send OTP using single login input (preferred endpoint)
-@router.post("/send-otp-login")
+@router.post("/send-otp-login", response_model=OTPSendResponse)
 async def send_otp_login_handler(payload: OTPRequestWithLogin):
     logger.info(f"OTP login request started - login_input: {payload.login_input}")
     
@@ -115,6 +72,15 @@ async def send_otp_login_handler(payload: OTPRequestWithLogin):
             logger.error(f"Invalid login input format: {str(ve)}")
             raise HTTPException(status_code=400, detail=str(ve))
         
+        # Check if user already exists
+        user_exists = False
+        if identifier_type == "email":
+            user_exists = await BookMyServiceUserModel.exists_by_email_or_phone(email=payload.login_input)
+        elif identifier_type == "phone":
+            user_exists = await BookMyServiceUserModel.exists_by_email_or_phone(phone=payload.login_input)
+        
+        logger.debug(f"User existence check result: {user_exists}")
+        
         # Send OTP via service
         logger.debug(f"Calling UserService.send_otp with identifier: {payload.login_input}")
         await UserService.send_otp(payload.login_input)
@@ -130,7 +96,11 @@ async def send_otp_login_handler(payload: OTPRequestWithLogin):
         logger.info(f"Temporary token created for: {payload.login_input}")
         logger.debug(f"Temp token (first 20 chars): {temp_token[:20]}...")
         
-        return {"message": "OTP sent", "temp_token": temp_token}
+        return {
+            "message": "OTP sent", 
+            "temp_token": temp_token,
+            "user_exists": user_exists
+        }
         
     except HTTPException as e:
         logger.error(f"OTP login request failed - HTTP {e.status_code}: {e.detail}")
@@ -282,4 +252,69 @@ async def register_user(
     
     logger.info(f"Registering user with payload: {payload}")
 
-    return await UserService.register(payload, decoded)
+    return await UserService.register(payload, decoded)
+
+# 🔄 Refresh access token using refresh token
+@router.post("/refresh-token", response_model=TokenResponse)
+async def refresh_token_handler(refresh_token: str = Depends(get_bearer_token)):
+    logger.info("Refresh token request received")
+    
+    try:
+        # Decode and validate refresh token
+        decoded = decode_token(refresh_token)
+        logger.debug(f"Decoded refresh token payload: {decoded}")
+        
+        if not decoded:
+            logger.warning("Failed to decode refresh token - token is invalid or expired")
+            raise HTTPException(status_code=401, detail="Invalid or expired refresh token")
+        
+        # Validate token type
+        token_type = decoded.get("type")
+        if token_type != "refresh":
+            logger.warning(f"Invalid token type for refresh - expected: refresh, got: {token_type}")
+            raise HTTPException(status_code=401, detail="Invalid refresh token")
+        
+        # Extract user information from refresh token
+        user_id = decoded.get("sub")
+        if not user_id:
+            logger.warning("Refresh token missing subject (user_id)")
+            raise HTTPException(status_code=401, detail="Invalid refresh token")
+        
+        logger.info(f"Refresh token validation successful for user: {user_id}")
+        
+        # Create new access token
+        access_token = create_access_token({
+            "sub": user_id,
+            "user_id": user_id,
+            "email": decoded.get("email"),
+            "phone": decoded.get("phone"),
+            "role": "user"
+        }, expires_minutes=60)  # 1 hour access token
+        
+        # Optionally create a new refresh token (refresh token rotation)
+        new_refresh_token = create_refresh_token({
+            "sub": user_id,
+            "user_id": user_id,
+            "email": decoded.get("email"),
+            "phone": decoded.get("phone"),
+            "role": "user"
+        }, expires_days=7)  # 7 days refresh token
+        
+        logger.info(f"New access token generated for user: {user_id}")
+        
+        return {
+            "access_token": access_token,
+            "token_type": "bearer",
+            "expires_in": 3600,  # 1 hour in seconds
+            "refresh_token": new_refresh_token,
+            "user_id": user_id,
+            "email": decoded.get("email"),
+            "phone": decoded.get("phone")
+        }
+        
+    except HTTPException as e:
+        logger.error(f"Refresh token failed - HTTP {e.status_code}: {e.detail}")
+        raise e
+    except Exception as e:
+        logger.error(f"Unexpected error during refresh token: {str(e)}", exc_info=True)
+        raise HTTPException(status_code=500, detail="Internal server error during token refresh")

app/schemas/user_schema.py

@@ -106,6 +106,12 @@ class OTPVerifyRequest(BaseModel):
             raise ValueError('Login input must be a valid email address or phone number')
         return v
 
+# OTP send response with user existence flag
+class OTPSendResponse(BaseModel):
+    message: str
+    temp_token: str
+    user_exists: bool = False
+
 # OAuth login using Google/Apple
 class OAuthLoginRequest(BaseModel):
     provider: Literal["google", "apple", "facebook"]
@@ -116,6 +122,7 @@ class TokenResponse(BaseModel):
     access_token: str
     token_type: str = "bearer"
     expires_in: Optional[int] = 28800  # 8 hours in seconds
+    refresh_token: Optional[str] = None
     user_id: Optional[str] = None
     name: Optional[str] = None
     email: Optional[str] = None

app/services/user_service.py

@@ -116,9 +116,25 @@ class UserService:
             logger.debug(f"Token data: {token_data}")
             
             access_token = jwt.encode(token_data, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
-            logger.info(f"JWT token created successfully for user: {user.get('user_id')}")
             
-            return {"access_token": access_token, "token_type": "bearer", "name": user.get("name")}
+            # Create refresh token
+            refresh_token_data = {
+                "sub": user.get("user_id"),
+                "user_id": user.get("user_id"),
+                "type": "refresh",
+                "exp": datetime.utcnow() + timedelta(days=7)
+            }
+            refresh_token = jwt.encode(refresh_token_data, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
+            
+            logger.info(f"JWT tokens created successfully for user: {user.get('user_id')}")
+            
+            return {
+                "access_token": access_token, 
+                "refresh_token": refresh_token,
+                "token_type": "bearer", 
+                "expires_in": 28800,
+                "name": user.get("name")
+            }
             
         except ValueError as ve:
             logger.error(f"Validation error for identifier {identifier}: {str(ve)}")
@@ -204,7 +220,22 @@ class UserService:
                         "exp": datetime.utcnow() + timedelta(hours=8)
                     }
                     access_token = jwt.encode(token_data, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
-                    return {"access_token": access_token}
+                    
+                    # Create refresh token
+                    refresh_token_data = {
+                        "sub": existing_user["user_id"],
+                        "user_id": existing_user["user_id"],
+                        "type": "refresh",
+                        "exp": datetime.utcnow() + timedelta(days=7)
+                    }
+                    refresh_token = jwt.encode(refresh_token_data, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
+                    
+                    return {
+                        "access_token": access_token,
+                        "refresh_token": refresh_token,
+                        "token_type": "bearer",
+                        "expires_in": 28800
+                    }
             
             user_id = f"{data.provider}_{provider_user_id}"
             
@@ -257,8 +288,19 @@ class UserService:
         }
 
         access_token = jwt.encode(token_data, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
+        
+        # Create refresh token
+        refresh_token_data = {
+            "sub": user_id,
+            "user_id": user_id,
+            "type": "refresh",
+            "exp": datetime.utcnow() + timedelta(days=7)
+        }
+        refresh_token = jwt.encode(refresh_token_data, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
+        
         return {
             "access_token": access_token,
+            "refresh_token": refresh_token,
             "token_type": "bearer",
             "expires_in": 28800,
             "user_id": user_id,

app/utils/jwt.py

@@ -20,6 +20,12 @@ def create_access_token(data: dict, expires_minutes: int = 60):
     to_encode.update({"exp": expire})
     return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
 
+def create_refresh_token(data: dict, expires_days: int = 7):
+    to_encode = data.copy()
+    expire = datetime.utcnow() + timedelta(days=expires_days)
+    to_encode.update({"exp": expire, "type": "refresh"})
+    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
+
 def create_temp_token(data: dict, expires_minutes: int = 10):
     return create_access_token(data, expires_minutes=expires_minutes)