From 8166c62bb1b2071da6ebc5a3a5301cad3820367a Mon Sep 17 00:00:00 2001
From: Dylan De Faoite <dylanseandefaoite@gmail.com>
Date: Wed, 7 Oct 2026 18:45:27 +0100
Subject: [PATCH] fix reused token within grace still throwing

---
 .../ddf/vodsystem/security/TokenService.java    | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/src/main/java/com/ddf/vodsystem/security/TokenService.java b/src/main/java/com/ddf/vodsystem/security/TokenService.java
index 96721e3..b79eeb6 100644
--- a/src/main/java/com/ddf/vodsystem/security/TokenService.java
+++ b/src/main/java/com/ddf/vodsystem/security/TokenService.java
@@ -89,12 +89,9 @@ public class TokenService {
         }
 
         // Reuse Check
-        if (refreshToken.getUsedAt() != null) {
-            if (now.isAfter(refreshToken.getUsedAt().plus(refreshGracePeriod))) {
-                tokenFamily.setRevokedAt(Instant.now());
-                tokenFamilyRepository.save(tokenFamily);
-            }
-
+        if (refreshToken.getUsedAt() != null && now.isAfter(refreshToken.getUsedAt().plus(refreshGracePeriod))) {
+            tokenFamily.setRevokedAt(now);
+            tokenFamilyRepository.save(tokenFamily);
             throw new NotAuthenticated("Refresh token already being used");
         }
 
@@ -106,9 +103,11 @@ public class TokenService {
             throw new NotAuthenticated("Refresh token or family expired");
         }
 
-        // Rotate
-        refreshToken.setUsedAt(now);
-        refreshTokenRepository.save(refreshToken);
+        // Invalidate old token, unless we're within the grace period, otherwise the grace gets extended
+        if (refreshToken.getUsedAt() == null) {
+            refreshToken.setUsedAt(now);
+            refreshTokenRepository.save(refreshToken);
+        }
 
         byte[] newRawToken = generateRandomBytes(32);
         createRefreshToken(