JWT refresh tokens

[jaspermayone]

// Token issuance endpoint
app.post('/login', (req, res) => {
  // Authenticate user
  const user = authenticateUser(req.body);
  if (user) {
    const accessToken = generateAccessToken(user);
    const refreshToken = generateRefreshToken(user);
    saveRefreshToken(user, refreshToken);
    res.json({ accessToken, refreshToken });
  } else {
    res.status(401).send('Unauthorized');
  }
});

// Token refresh endpoint
app.post('/token/refresh', (req, res) => {
  const { refreshToken } = req.body;
  if (!refreshToken || !isValidRefreshToken(refreshToken)) {
    return res.status(403).send('Forbidden');
  }
  const user = getUserFromRefreshToken(refreshToken);
  const newAccessToken = generateAccessToken(user);
  res.json({ accessToken: newAccessToken });
});