From 41379e821eb0a78cf1cadc1cdcc52175be785fe8 Mon Sep 17 00:00:00 2001
From: Jonathan Bourdon <lowrad000@gmail.com>
Date: Thu, 8 May 2025 02:15:56 -0400
Subject: [PATCH] fix(auth): handles refresh token flow correctly

---
 backend/src/Web/DependencyInjection.cs            |  6 +-----
 .../src/Web/Features/Users/DependencyInjection.cs |  1 -
 .../Features/Users/Handlers/LoginWithFacebook.cs  |  3 ---
 .../Features/Users/Handlers/LoginWithGoogle.cs    | 15 ++++-----------
 4 files changed, 5 insertions(+), 20 deletions(-)

diff --git a/backend/src/Web/DependencyInjection.cs b/backend/src/Web/DependencyInjection.cs
index 5038cee..78dfcd3 100644
--- a/backend/src/Web/DependencyInjection.cs
+++ b/backend/src/Web/DependencyInjection.cs
@@ -39,11 +39,7 @@ public static class DependencyInjection
             .AddAuthentication(options =>
             {
                 options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
-                options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
-            })
-            .AddCookie("Identity.Application", options =>
-            {
-                options.LoginPath = "/api/Users/login";
+                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
             });
 
         var authJwt = configuration.GetSection("Authentication:Jwt");
diff --git a/backend/src/Web/Features/Users/DependencyInjection.cs b/backend/src/Web/Features/Users/DependencyInjection.cs
index 977eef9..d1948af 100644
--- a/backend/src/Web/Features/Users/DependencyInjection.cs
+++ b/backend/src/Web/Features/Users/DependencyInjection.cs
@@ -30,7 +30,6 @@ public static class DependencyInjection
             .AddRoles<IdentityRole>()
             .AddEntityFrameworkStores<ApplicationDbContext>()
             .AddApiEndpoints()
-            .AddSignInManager<SignInManager<IdentityUser>>()
             .AddDefaultTokenProviders();
 
         // Singleton services
diff --git a/backend/src/Web/Features/Users/Handlers/LoginWithFacebook.cs b/backend/src/Web/Features/Users/Handlers/LoginWithFacebook.cs
index 212f0b8..f518f7c 100644
--- a/backend/src/Web/Features/Users/Handlers/LoginWithFacebook.cs
+++ b/backend/src/Web/Features/Users/Handlers/LoginWithFacebook.cs
@@ -42,7 +42,6 @@ public record LoginWithFacebookResponse(
 public class LoginWithFacebookHandler(
     IHttpClientFactory httpClientFactory,
     IdentityUserManager userManager,
-    SignInManager<IdentityUser> signInManager,
     IOptionsSnapshot<JwtOptions> jwtOptions)
     : Endpoint<LoginWithFacebookRequest, LoginWithFacebookResponse>
 {
@@ -116,8 +115,6 @@ public class LoginWithFacebookHandler(
             user = generatedUser;
         }
 
-        await signInManager.SignInAsync(user, isPersistent: false);
-
         // Generate refresh token
         var refreshToken = RefreshTokenGenerator.Next();
 
diff --git a/backend/src/Web/Features/Users/Handlers/LoginWithGoogle.cs b/backend/src/Web/Features/Users/Handlers/LoginWithGoogle.cs
index 1ba8f6d..8680b57 100644
--- a/backend/src/Web/Features/Users/Handlers/LoginWithGoogle.cs
+++ b/backend/src/Web/Features/Users/Handlers/LoginWithGoogle.cs
@@ -42,7 +42,6 @@ public record LoginWithGoogleResponse(
 public class LoginWithGoogleHandler(
     IHttpClientFactory httpClientFactory,
     IdentityUserManager userManager,
-    SignInManager<IdentityUser> signInManager,
     IOptionsSnapshot<JwtOptions> jwtOptions)
     : Endpoint<LoginWithGoogleRequest, LoginWithGoogleResponse>
 {
@@ -123,16 +122,10 @@ public class LoginWithGoogleHandler(
             user = generatedUser;
         }
 
-        await signInManager.SignInAsync(user, isPersistent: false);
-
-        // Generate refresh token for existing users
-        if (user.RefreshToken == null)
-        {
-            var refreshToken = RefreshTokenGenerator.Next();
-            user.RefreshToken = refreshToken;
-            user.RefreshTokenExpiryTime = DateTime.UtcNow.Add(jwtOptions.Value.RefreshTokenLifetime);
-            await userManager.UpdateAsync(user);
-        }
+        // Generate new refresh token
+        user.RefreshToken = RefreshTokenGenerator.Next();
+        user.RefreshTokenExpiryTime = DateTime.UtcNow.Add(jwtOptions.Value.RefreshTokenLifetime);
+        await userManager.UpdateAsync(user);
 
         var accessToken = JwtTokenHelper.GenerateJwtToken(
             expiresIn: jwtOptions.Value.Lifetime,