all working

app/models/__init__.py

@@ -8,6 +8,7 @@ from .files import File
 from .ledger import Ledger
 from .qdro import QDRO
 from .audit import AuditLog, LoginAttempt
+from .auth import RefreshToken
 from .additional import Deposit, Payment, FileNote, FormVariable, ReportVariable, Document
 from .support import SupportTicket, TicketResponse, TicketStatus, TicketPriority, TicketCategory
 from .pensions import (
@@ -22,7 +23,7 @@ from .lookups import (
 
 __all__ = [
     "BaseModel", "User", "Rolodex", "Phone", "File", "Ledger", "QDRO",
-    "AuditLog", "LoginAttempt",
+    "AuditLog", "LoginAttempt", "RefreshToken",
     "Deposit", "Payment", "FileNote", "FormVariable", "ReportVariable", "Document",
     "SupportTicket", "TicketResponse", "TicketStatus", "TicketPriority", "TicketCategory",
     "Pension", "PensionSchedule", "MarriageHistory", "DeathBenefit", 

app/models/auth.py

@@ -0,0 +1,34 @@
+"""
+Authentication-related persistence models
+"""
+from datetime import datetime
+from typing import Optional
+
+from sqlalchemy import Column, Integer, String, DateTime, Boolean, ForeignKey, UniqueConstraint
+from sqlalchemy.orm import relationship
+
+from app.models.base import BaseModel
+
+
+class RefreshToken(BaseModel):
+    """Persisted refresh tokens for revocation and auditing."""
+    __tablename__ = "refresh_tokens"
+
+    id = Column(Integer, primary_key=True, autoincrement=True, index=True)
+    user_id = Column(Integer, ForeignKey("users.id"), nullable=False, index=True)
+    jti = Column(String(64), nullable=False, unique=True, index=True)
+    user_agent = Column(String(255), nullable=True)
+    ip_address = Column(String(45), nullable=True)
+    issued_at = Column(DateTime, default=datetime.utcnow, nullable=False)
+    expires_at = Column(DateTime, nullable=False, index=True)
+    revoked = Column(Boolean, default=False, nullable=False)
+    revoked_at = Column(DateTime, nullable=True)
+
+    # relationships
+    user = relationship("User")
+
+    __table_args__ = (
+        UniqueConstraint("jti", name="uq_refresh_tokens_jti"),
+    )
+
+