hash refresh token

src/modules/auth/entities/refresh-token.entity.ts

@@ -10,7 +10,7 @@ export enum RefreshTokenType {
 @Entity({ tableName: 'refreshtokens' })
 export class RefreshToken extends BaseEntity {
   @Property({ type: 'varchar', length: 255 })
-  token!: string;
+  hashedToken!: string;
 
   @Property()
   ownerId!: string;

src/modules/auth/services/tokens.service.ts

@@ -1,4 +1,4 @@
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { EntityManager } from '@mikro-orm/postgresql';
 import { Injectable, Logger, UnauthorizedException } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
@@ -49,8 +49,10 @@ export class TokensService {
     const refreshExpire = this.configService.getOrThrow<number>('REFRESH_TOKEN_EXPIRE');
     const expiresAt = dayjs().add(refreshExpire, 'day').toDate();
 
+    const hashedToken = this.hashToken(refreshToken);
+
     const token = this.em.create(RefreshToken, {
-      token: refreshToken,
+      hashedToken,
       ownerId,
       restId,
       type,
@@ -61,7 +63,8 @@ export class TokensService {
   }
 
   async refreshToken(oldRefreshToken: string) {
-    const token = await this.em.findOne(RefreshToken, { token: oldRefreshToken });
+    const hashedToken = this.hashToken(oldRefreshToken);
+    const token = await this.em.findOne(RefreshToken, { hashedToken });
 
     if (!token) throw new UnauthorizedException(AuthMessage.INVALID_REFRESH_TOKEN);
 
@@ -97,4 +100,8 @@ export class TokensService {
   private generateRefreshToken() {
     return randomBytes(32).toString('hex');
   }
+
+  private hashToken(token: string): string {
+    return createHash('sha256').update(token).digest('hex');
+  }
 }