Adrian Flores Cortes 54ea125d82 docs(auth): Document BLOCKER-001 Token Refresh improvements (Phases 1-2) ... FASE 1 ✅: Rate limiting específico para /auth/refresh - Nuevo refreshTokenRateLimiter (15 refreshes/15min por token) - Key generator: IP + hash(refreshToken) - Previene abuse de tokens individuales FASE 2 ✅: Token rotation mechanism - Backend code implementado (backward-compatible) - Detección de token reuse → revoca todas las sesiones - Nuevo refresh token en cada refresh - Migration SQL creada: apps/database/migrations/2026-01-27_add_token_rotation.sql Archivos de código modificados (en .gitignore): - apps/backend/src/core/middleware/rate-limiter.ts - apps/backend/src/modules/auth/auth.routes.ts - apps/backend/src/modules/auth/services/token.service.ts - apps/backend/src/modules/auth/types/auth.types.ts - apps/database/ddl/schemas/auth/tables/04-sessions.sql - apps/database/migrations/2026-01-27_add_token_rotation.sql Pendiente: FASE 3 (Session Validation) y FASE 4 (Proactive Refresh) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>		2026-01-27 00:46:19 -06:00
..
01-CONTEXTO.md	docs(auth): Document BLOCKER-001 Token Refresh improvements (Phases 1-2)	2026-01-27 00:46:19 -06:00
05-EJECUCION.md	docs(auth): Document BLOCKER-001 Token Refresh improvements (Phases 1-2)	2026-01-27 00:46:19 -06:00
METADATA.yml	docs(auth): Document BLOCKER-001 Token Refresh improvements (Phases 1-2)	2026-01-27 00:46:19 -06:00