## Summary
Restores refresh token functionality that was lost during a previous refactor.
This enables seamless session renewal without forcing users to re-login when
their access token expires.
## Server changes
- Add refresh token configuration to settingsService (7d TTL by default)
- Add issueRefreshToken method to userService
- Update login/register/resetPassword to return refreshToken
- Add refreshAuthToken method to userService for token refresh
- Add refreshAuthToken controller method
- Add POST /auth/refresh route
- Update verifyJWT middleware to return 403 for expired tokens (triggers refresh)
and 401 for invalid tokens (triggers logout)
## Client changes
- Store refreshToken in Redux auth state
- Clear refreshToken on logout
- Add setAuthToken action for updating token after refresh
- Update NetworkService to handle 403 responses:
- Call /auth/refresh endpoint to get new token
- Retry failed request with new token
- Queue concurrent requests during refresh
- Redirect to login if refresh fails
- Remove settingsModule caching that caused inconsistent state
- Restore direct AppSettings query in statusPageModule
- Keep immediate Redux dispatch for UI feedback
- All functionality verified working"
Summary of what we fixed based on AI review feedback:
Formatting - Ran Prettier to fix code formatting
Redux state rollback - Moved Redux dispatch to after successful save in settingsHooks.js
Performance - Added caching layer in settingsModule (1-minute TTL) to prevent DB query on every status page request
Architecture - Inject settingsModule instead of raw AppSettings model for better encapsulation
gorkem-bwl
Alexander Holliday
Craig Lawson