{"record":{"id":"4ff751002e8f3c03","repo":"Tencent/WeKnora","slug":"refresh-token-is-revoked","errorCode":null,"errorMessage":"refresh token is revoked","messagePattern":"refresh token is revoked","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/user.go","lineNumber":1347,"sourceCode":"\tclaims, ok := token.Claims.(jwt.MapClaims)\n\tif !ok {\n\t\treturn \"\", \"\", errors.New(\"invalid token claims\")\n\t}\n\n\ttokenType, ok := claims[\"type\"].(string)\n\tif !ok || tokenType != \"refresh\" {\n\t\treturn \"\", \"\", errors.New(\"not a refresh token\")\n\t}\n\n\tuserID, ok := claims[\"user_id\"].(string)\n\tif !ok {\n\t\treturn \"\", \"\", errors.New(\"invalid user ID in token\")\n\t}\n\n\t// Check if token is revoked\n\ttokenRecord, err := s.tokenRepo.GetTokenByValue(ctx, refreshTokenString)\n\tif err != nil || tokenRecord == nil || tokenRecord.IsRevoked {\n\t\treturn \"\", \"\", errors.New(\"refresh token is revoked\")\n\t}\n\tif tokenRecord.TokenType != \"refresh_token\" {\n\t\treturn \"\", \"\", errors.New(\"not a refresh token\")\n\t}\n\n\t// Get user\n\tuser, err := s.userRepo.GetUserByID(ctx, userID)\n\tif err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\n\t// Revoke old refresh token\n\ttokenRecord.IsRevoked = true\n\t_ = s.tokenRepo.UpdateToken(ctx, tokenRecord)\n\n\t// Generate new tokens\n\treturn s.GenerateTokens(ctx, user)\n}","sourceCodeStart":1329,"sourceCodeEnd":1365,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/user.go#L1329-L1365","documentation":"Raised in RefreshToken when the token row exists but IsRevoked is true (or the row lookup failed) — the presented refresh token was already revoked (logout, rotation, or admin revocation) and must not be honored. Reuse-detection guard against replayed tokens.","triggerScenarios":"Thrown at internal/application/service/user.go:1347 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject with 401 and require re-authentication","If rotation is in use, treat repeated use of the revoked token as a possible replay and revoke the family"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}