Description: Sep10Service.rotateRefreshToken handles refresh token rotation with family revocation. This is a critical security feature preventing token reuse attacks. There are no unit tests for this flow.
Acceptance Criteria:
- Write unit test for successful refresh token rotation
- Write unit test for reused refresh token → revoke family and throw
- Write unit test for expired refresh token → UnauthorizedException
- Write unit test for invalid refresh token hash → UnauthorizedException
- Write unit test for revokeTokenFamily revokes all user tokens
Description: Sep10Service.rotateRefreshToken handles refresh token rotation with family revocation. This is a critical security feature preventing token reuse attacks. There are no unit tests for this flow.
Acceptance Criteria: