AUTH-142

I'll implement OAuth refresh token rotation. Let me first explore the current auth setup to understand the existing token handling.

Glob: {
  "pattern": "src/auth/**/*.ts"
}

Read: {
  "file_path": "src/auth/token-service.ts"
}

I can see the current implementation issues a refresh token but never rotates it. Here's my plan:

1. Add a `refreshTokenFamily` column to track token lineage
2. On refresh: invalidate old token, issue new one in the same family
3. If a revoked token is reused, invalidate the entire family (theft detection)
4. Add tests for all scenarios

Let me start with the database migration.

Adding the refresh token family tracking and rotation logic to the token service.

Edit: {
  "file_path": "src/auth/token-service.ts"
}

Edit: {
  "file_path": "prisma/schema.prisma"
}

Adding security event logging for token reuse detection. I'll integrate with the existing audit log system.

Read: {
  "file_path": "src/logging/audit.ts"
}

Edit: {
  "file_path": "src/auth/token-service.ts"
}

Now writing tests for the refresh token rotation — covering normal rotation, reuse detection, and family invalidation.

Write: {
  "file_path": "src/auth/__tests__/token-rotation.test.ts"
}

Bash: {
  "command": "pnpm test -- token-rotation"
}

All 12 tests passing. Here's a summary of what was implemented:

- **Token rotation**: Each refresh creates a new token, old one is invalidated
- **Family tracking**: All tokens in a refresh chain share a `familyId`
- **Theft detection**: Reusing a revoked token invalidates the entire family
- **Audit logging**: Suspicious reuse attempts logged to the security audit trail
- **Edge case**: Expired refresh tokens return a clear `token_expired` error

3 commits pushed to `feat/oauth-refresh-tokens`.