Refresh token family not invalidated on suspected theft (no token rotation chain revocation)

[anshul23102]

Summary

persistRefreshSession issues a new refresh token on each use but does not invalidate the entire token family when a previously-used (revoked) token is presented. This means:

1. Attacker steals refresh token T1.
2. Legitimate user refreshes: T1 is revoked, T2 is issued.
3. Attacker uses T1 again - this should be a theft signal.
4. Instead of revoking the entire family (T2, T3, ...), the server returns a generic 401.
5. Attacker's session via T1 is blocked but no alert fires and the legitimate user's session remains valid even though the token was definitely stolen.

Impact

Silent session token compromise. The legitimate user is never notified and the attacker can retain access via any token in the family that has not yet been rotated.

Suggested Fix

When a token from a known-revoked family is reused, immediately invalidate all active tokens in that refresh chain and force the user to re-authenticate.

[anshul23102]

@geturbackend Could you please assign this issue to me? I'd like to work on it under GSSoC '26.
/assign
/claim