Connect Flutter phone auth and Android platform

public/api/v1/auth/refresh.php

@@ -19,6 +19,7 @@ try {
     $db = Database::getInstance();
     $connection = $db->getConnection();
     $connection->begin_transaction();
+    $transactionOpen = true;
     $digest = hash('sha256', $refreshToken);
     $query = $db->prepare('SELECT s.session_uuid, s.family_uuid, s.user_id, s.device_uuid, s.replaced_by, s.revoked_at, s.expires_at, u.uuid, u.phone_e164, u.account_role, u.is_active FROM auth_sessions s JOIN users u ON u.id = s.user_id WHERE s.refresh_token_digest = ? FOR UPDATE');
     $query->bind_param('s', $digest);
@@ -27,6 +28,7 @@ try {
     $query->close();
     if (!$session) {
         $connection->rollback();
+        $transactionOpen = false;
         api_json(['error' => 'invalid_refresh_token'], 401);
     }
     if ($session['replaced_by'] !== null) {
@@ -35,10 +37,12 @@ try {
         $revoke->execute();
         $revoke->close();
         $connection->commit();
+        $transactionOpen = false;
         api_json(['error' => 'refresh_token_reuse_detected'], 401);
     }
     if ($session['revoked_at'] !== null || $session['expires_at'] <= gmdate('Y-m-d H:i:s') || !(bool) $session['is_active']) {
         $connection->rollback();
+        $transactionOpen = false;
         api_json(['error' => 'session_expired'], 401);
     }
 
@@ -54,19 +58,21 @@ try {
     $replace->bind_param('ss', $newSessionId, $session['session_uuid']);
     $replace->execute();
     $replace->close();
-    $connection->commit();
-
     $ttl = max(60, min(3600, AppConfig::integer('JWT_ACCESS_TTL_SECONDS', 900)));
+    $accessToken = JwtToken::issue((int) $session['user_id'], $newSessionId, $ttl);
+    $connection->commit();
+    $transactionOpen = false;
+
     api_json([
         'user' => ['id' => (int) $session['user_id'], 'uuid' => $session['uuid'], 'phone_e164' => $session['phone_e164'], 'account_role' => $session['account_role']],
-        'access_token' => JwtToken::issue((int) $session['user_id'], $newSessionId, $ttl),
+        'access_token' => $accessToken,
         'token_type' => 'Bearer',
         'expires_in_seconds' => $ttl,
         'refresh_token' => $newRefresh,
         'refresh_expires_in_days' => $refreshDays,
     ]);
 } catch (Throwable $exception) {
-    if (isset($connection) && $connection instanceof mysqli) {
+    if (!empty($transactionOpen) && isset($connection) && $connection instanceof mysqli) {
         try { $connection->rollback(); } catch (Throwable $ignored) {}
     }
     error_log('Session refresh failed: ' . $exception->getMessage());