Add Admin Account Enable/Disable Controls with Refresh Token Authentication

[mohab-elshamy]

Summary

This PR adds admin support for enabling and disabling user accounts and introduces refresh-token-based authentication to handle account-status changes securely.

Authentication Design

To support features such as account disabling/enabling and password changes, I considered three approaches:

1. Keep the existing JWT-only approach. However, long-lived access tokens would allow a disabled account to remain authenticated until the token expires.
2. Validate the user’s account status against the database on every authenticated request. This would provide immediate revocation but would add unnecessary database and performance overhead.
3. Use short-lived access tokens together with rotating refresh tokens.

I selected the third approach as a balance between security and performance. Access tokens expire after 10 minutes, while refresh tokens are validated against the current account status.

When an account is disabled, its refresh tokens are revoked immediately. Any existing access token remains valid only until its short expiration period ends.

Security Improvements

Authentication tokens were moved from localStorage to secure HttpOnly cookies, reducing the risk of token theft through XSS.

The implementation also includes CSRF protection, hashed refresh-token storage, token rotation, revocation, and revoked-token reuse detection.

Main Changes

• Added refresh-token storage, rotation, revocation, and EF migration.
• Moved tokens from localStorage to secure HttpOnly cookies.
• Added automatic token refresh and session-based authentication.
• Added CSRF protection for authenticated state-changing requests.
• Added Enable/Disable controls to the admin Users panel.
• Prevented disabled users from logging in or refreshing sessions.
• Revoked refresh tokens on logout, password changes, account disabling, and account deletion.
• Updated the README.

Note: The latest EF migration must be applied before running the updated application:

dotnet ef database update

[cengique]

Tested, works. I agree with the decision to change to shorter life tokens.