Refresh Token с использованием ASPNET core Identity (Старый токен остаётся действительным, неправильно имплементировал)

 public sealed class RefreshToken 
{ 
    public Guid Id { get; private set; } 
    public string Value { get; private set; } = string.Empty; 
    public DateTime ExpiresAt { get; private set; } 
    public string UserId { get; private set; } = string.Empty; 
    public bool IsUsed { get; set; } 
    public ApplicationUser? User { get; private set; } 
 
    private RefreshToken() 
    { 
    } 
 
    public static RefreshToken CreateNew(string userId) 
    { 
        return new RefreshToken 
        { 
            Id = Guid.NewGuid(), 
            ExpiresAt = DateTime.Now.AddDays(15), 
            UserId = userId, 
            Value = GenerateNewValue() 
        }; 
    } 
 
    public void Refresh() 
    { 
        Value = GenerateNewValue(); 
    } 
 
    private static string GenerateNewValue() => Convert.ToBase64String(RandomNumberGenerator.GetBytes(32)); 
} 

     public async Task<string> RefreshTokenAsync(string token) 
    { 
        var refreshToken = await _tokenRepository.GetRefreshTokenAsync(token); 
 
        if (refreshToken is null) 
        { 
            throw new AuthenticationException("Invalid refresh token"); 
        } 
        if (refreshToken.IsUsed) 
        { 
            throw new AuthenticationException("Token Is Already Used"); 
        } 
        if (refreshToken.ExpiresAt <= DateTime.Now) 
        { 
            throw new AuthenticationException("Refresh token has expired"); 
        } 
        refreshToken.IsUsed = true; 
        refreshToken.Refresh(); 
        await _tokenRepository.UpdateAsync(refreshToken); 
 
        return refreshToken.Value; 
    }