private async Task <(string, DateTime)> CreateRefreshToken(User user, bool autoSave = true)
        {
            var p   = new RNGCryptoServiceProvider();
            var exp = DateTime.UtcNow.Add(configuration.GetJwtSettings().RefreshTokenLifetime);

            var token = new RefreshToken
            {
                Id = RefreshToken.GenerateId(),
                UserAgentSha256 = UserAgentHashOrNull(),
                Ip         = HttpContext.Connection.RemoteIpAddress.ToString(),
                UserId     = user.Id,
                Expiration = exp
            };

            DbContext.Add(token);

            if (autoSave)
            {
                await DbContext.SaveChangesAsync();
            }

            return(token.Id, exp);
        }