TCotton

JWT Refresh Token Strategy: Solving Password Reset Token Invalidation

Problem Statement

The Security Vulnerability

When using JWTs with long expiration times (e.g., 24 hours), a critical security gap emerges during password reset flows:

1. User authenticates and receives a JWT valid for 24 hours
2. User initiates a password reset (possibly because their account was compromised)

TCotton

import { google } from '@ai-sdk/google'
import {
  convertToModelMessages,
  createUIMessageStreamResponse,
  streamText,
  stepCountIs,
  tool,
  type ModelMessage,
  type UIMessage,
} from 'ai'

TCotton

import { promises as fs } from 'fs'
import { join } from 'path'
import type { UIMessage } from 'ai'

export namespace DB {
  // Types for our persistence layer
  export interface Chat {
    id: string
    messages: UIMessage[]
    createdAt: string

TCotton

/**
Branding in TypeScript is a technique for creating opaque, nominal, or distinct types even when they
have the same underlying structure.

It’s one of the most useful advanced type tricks in TS, because the language is otherwise structurally typed. **/

// Branding:

// Makes structurally identical types distinct

TCotton

import { DbSchema } from '@repo/database/schema'
import { type ExtractTablesWithRelations } from 'drizzle-orm'
import { drizzle, type NodePgDatabase, type NodePgQueryResultHKT } from 'drizzle-orm/node-postgres'
import { type PgTransaction } from 'drizzle-orm/pg-core'
import { Cause, Context, Data, Effect, Exit, Layer, Option, Redacted, Runtime } from 'effect'
import * as pg from 'pg'

type TransactionClient = PgTransaction<
  NodePgQueryResultHKT,
  typeof DbSchema,

TCotton

// return types from functions
type P = ReturnType<typeof dateFromUUIDv7>;
  
// return type with promise
type P = Awaited<ReturnType<typeof dateFromUUIDv7>>;
  
// see all types
type PrettifyPromise<T> = {
    [K in keyof T]: T[K] extends Promise<infer U> ? U : T[K];
} & {}

TCotton

d3
  $ every 4 ( superimpose
     (   slice 2 (fast "2" "[1 2 3 4]" ) -- re-slice give variation of slight glitch
     .  (|+| gain "0.1") -- slightly louder
     .  ( # sound "bd*4") -- different sound from the bDrums
     )) 
  $ every 2 ( superimpose
     (  (|+| gain "-0.2")       -- slightly quieter
     .  (0.25 <~)               -- delay by 1/4 cycle
     .  (slice 4 (fast "2" "[1 3 2 4]"))  -- re-slice + rearrange

TCotton

let spread1    = (spread ($) [jux rev, rev])
    spread2    = spread ($) [density 2, rev, slow 2, striate 3, (# speed "0.8")]
    juxrev     = jux rev
    revEffect  = rev
    palindrom  = palindrome
    fadeOut    = range 1 0 $ slow 16 saw
    in d4 $ stack [(
      slow 2
      $ chop 32
      $ sound "piano_c"

TCotton

cps (120/60/4)

-- drum patterns in do block

do
  let drumz1 = every 4 (|> sound "drum")
            $ sound "[drum <dr:2>] drum *2"
            # gain 0.7
            # orbit 0 -- routed to audiochannel 1-2
  let drumz2 = sound "[drum <dr:1>] drum [drum <techno:5>] drum /2"

TCotton

setcps (120/60/4)

-- drum patterns in do block

do
  let drumz1 = every 4 (|> sound "drum")
            $ sound "[drum <dr:2>] drum *2"
            # gain 0.6
            # orbit 0
  let drumz2 = sound "[drum <dr:1>] drum [drum <techno:5>] drum /2"