Refresh-token rotation replaces a token every time it is used. If an older token from the same family appears again, the server has evidence that the token was copied, so it revokes the complete family.
Design a RefreshTokenFamily class:
RefreshTokenFamily(String initialToken) creates a family with one current token.String rotate(String presentedToken, String newToken) attempts a rotation.boolean isRevoked() reports whether reuse revoked the family.
rotate returns:
"ROTATED" when presentedToken is current and newToken has never belonged to the family. Move the old current token to the used set and install newToken."INVALID_NEW_TOKEN" when the current token is presented but newToken is the current token or any used family token. Do not change state."REUSE_DETECTED" when presentedToken is a used family token. Permanently revoke the family."INVALID" when presentedToken has never belonged to the family. Do not revoke it."REVOKED" for every rotation attempted after revocation.
Tokens are non-empty and case-sensitive. Tokens do not expire during a test.
Example 1:
Input:
Output:
Explanation: After two rotations, r1 is known to be used. Its replay revokes the family, including the otherwise-current r3.
Example 2:
Input:
Output:
Explanation: An unknown token is not a previously issued family token, so it does not trigger reuse detection or prevent the valid rotation.
Constraints
1 <= initialToken.length, presentedToken.length, newToken.length <= 100- Tokens contain printable ASCII characters and are case-sensitive.
- At most
10^5 total method calls are made. - A family is revoked only by presenting a token that it previously used.
- Revocation is permanent.
Detect Refresh Token Reusehard