fix(auth): require type=access in /me

services/auth/src/routers/auth.py

@@ -109,6 +109,9 @@ async def me(token: str = Depends(_get_token), db: AsyncSession = Depends(get_db
         payload = decode_token(token)
     except ValueError:
         raise HTTPException(401, "invalid token")
+    if payload.get("type") != "access":
+        # issue #76: refresh-токен — не identity, как в Go-мидлварях (#53)
+        raise HTTPException(401, "not an access token")
     user_id = payload["sub"]
     # user_id is str from JWT; compare as UUID
     import uuid

services/auth/tests/test_auth.py

@@ -199,6 +199,18 @@ def test_me_oversized_token_rejected():
     assert r.status_code == 401
 
 
+def test_me_with_refresh_token_rejected():
+    # issue #76: refresh-токен — не identity для /me
+    mock_db = AsyncMock()
+    mock_db.execute = AsyncMock(return_value=FakeResult(None))
+    token = create_refresh_token(str(uuid.uuid4()))
+    c = client_with_mock(mock_db)
+    r = c.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {token}"})
+    clear_overrides()
+    assert r.status_code == 401
+    mock_db.execute.assert_not_awaited()
+
+
 def test_refresh_token_without_exp_rejected():
     # issue #53: token without exp must not validate
     import jwt as pyjwt