feat(api): Implement Secure Session and Token Management

backend/package.json

@@ -87,6 +87,7 @@
     "ts-node": "^10.9.2",
     "tsconfig-paths": "^4.2.0",
     "typescript": "^5.7.3",
-    "typescript-eslint": "^8.20.0"
+    "typescript-eslint": "^8.20.0",
+    "yn": "^3.1.1"
   }
 }

backend/src/auth/auth.module.ts

@@ -23,14 +23,16 @@ import { ForgotPasswordProvider } from './providers/forgot-password.provider';
 import { ResetPasswordProvider } from './providers/reset-password.provider';
 import { MailService } from './providers/mail.service';
 import { NonceService } from './providers/nonce.service';
-
+import { Session } from './entities/session.entity';
+import { SessionsProvider } from './providers/sessions.provider';
 import { GuestSessionProvider } from './providers/guest-session.provider';
 
 @Module({
   imports: [
     forwardRef(() => UsersModule),
     TypeOrmModule.forFeature([User]),
     ConfigModule.forFeature(jwtConfig),
+    TypeOrmModule.forFeature([Session]),
     JwtModule.registerAsync(jwtConfig.asProvider()),
     ThrottlerModule.forRoot([
       {
@@ -54,6 +56,7 @@ import { GuestSessionProvider } from './providers/guest-session.provider';
     ResetPasswordProvider,
     MailService,
     NonceService,
+    SessionsProvider,
     {
       provide: HashingProvider, // Use the abstract class as a token
       useClass: BcryptProvider, // Bind it to the concrete implementation

backend/src/auth/authConfig/jwt.config.ts

@@ -7,6 +7,7 @@ export default registerAs('jwt', () => {
     googleClient_id: process.env.GOOGLE_CLIENT_ID,
     googleClient_secret: process.env.GOOGLE_CLIENT_SECRET,
     issuer: process.env.JWT_TOKEN_ISSUER ?? 'localhost',
-    ttl: parseInt(process.env.JWT_ACCESS_TOKEN_TTL ?? '3600'),
+    accessTokenTtl: parseInt(process.env.JWT_ACCESS_TOKEN_TTL ?? '3600'), // 1 hour default
+    refreshTokenTtl: parseInt(process.env.JWT_REFRESH_TOKEN_TTL ?? '604800'), // 7 days default
   };
-});
+});

backend/src/auth/controllers/auth.controller.ts

@@ -7,17 +7,22 @@ import {
   Get,
   Query,
   Param,
+  Req,
+  UseGuards,
 } from '@nestjs/common';
 import { Throttle } from '@nestjs/throttler';
 import { LoginDto } from '../dtos/login.dto';
 import { RegisterDto } from '../dtos/register.dto';
 import { AuthService } from '../providers/auth.service';
 import { RefreshTokenDto } from '../dtos/refreshTokenDto';
-import { ApiOperation, ApiResponse } from '@nestjs/swagger';
+import { ApiOperation, ApiResponse, ApiBearerAuth } from '@nestjs/swagger';
 import { NonceResponseDto } from '../dtos/nonceResponse.dto';
 import { StellarWalletLoginDto } from '../dtos/walletLogin.dto';
 import { ResetPasswordDto } from '../dtos/reset-password.dto';
 import { ForgotPasswordDto } from '../dtos/forgot-password.dto';
+import { AuthGuard } from '@nestjs/passport';
+import { ActiveUser } from '../decorators/activeUser.decorator';
+import { ActiveUserData } from '../interfaces/activeInterface';
 
 import { GuestSessionProvider } from '../providers/guest-session.provider';
 import { ConvertGuestDto } from '../dtos/convert-guest.dto';
@@ -210,32 +215,40 @@ export class AuthController {
   }
 
   @Post('/reset-password/:token')
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({
-    summary: 'Reset password with token',
-    description: 'Resets user password using the token from email',
-  })
-  @ApiResponse({
-    status: 200,
-    description: 'Password reset successfully',
-    schema: {
-      type: 'object',
-      properties: {
-        message: {
-          type: 'string',
-          example: 'Password has been reset successfully',
-        },
-      },
-    },
-  })
-  @ApiResponse({
-    status: 400,
-    description: 'Invalid or expired token',
-  })
   public async resetPassword(
     @Param('token') token: string,
     @Body() resetPasswordDto: ResetPasswordDto,
   ) {
     return await this.authservice.resetPassword(token, resetPasswordDto);
   }
+
+  @Post('/logout')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Logout current user and invalidate session' })
+  @ApiResponse({ status: 200, description: 'Successfully logged out' })
+  @ApiResponse({ status: 401, description: 'Invalid or missing refresh token' })
+  public async logout(@Body() refreshTokenDto: RefreshTokenDto) {
+    return await this.authservice.logout(refreshTokenDto);
+  }
+
+  @Post('/logout-all')
+  @UseGuards(AuthGuard('jwt'))
+  @ApiBearerAuth()
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Logout from all devices' })
+  @ApiResponse({ status: 200, description: 'All sessions invalidated' })
+  public async logoutAll(@ActiveUser() user: ActiveUserData) {
+    return await this.authservice.logoutAll(user.sub);
+  }
+
+  @Get('/me')
+  @UseGuards(AuthGuard('jwt'))
+  @ApiBearerAuth()
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Get current authenticated user' })
+  @ApiResponse({ status: 200, description: 'Current user data retrieved' })
+  @ApiResponse({ status: 401, description: 'Unauthorized - invalid or missing token' })
+  public async getCurrentUser(@ActiveUser() user: ActiveUserData) {
+    return await this.authservice.getCurrentUser(user.sub);
+  }
 }

backend/src/auth/entities/session.entity.ts

@@ -0,0 +1,42 @@
+import {
+  Column,
+  Entity,
+  PrimaryGeneratedColumn,
+  ManyToOne,
+  CreateDateColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+import { User } from '../../users/user.entity';
+
+@Entity()
+export class Session {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @ManyToOne(() => User, { onDelete: 'CASCADE' })
+  user: User;
+
+  @Column()
+  userId: string;
+
+  @Column({ unique: true })
+  refreshTokenHash: string;
+
+  @Column({ nullable: true })
+  deviceInfo?: string;
+
+  @Column({ nullable: true })
+  ipAddress?: string;
+
+  @Column({ type: 'timestamp' })
+  expiresAt: Date;
+
+  @Column({ default: true })
+  isActive: boolean;
+
+  @CreateDateColumn()
+  createdAt: Date;
+
+  @UpdateDateColumn()
+  updatedAt: Date;
+}

backend/src/auth/providers/auth.service.ts

@@ -1,4 +1,4 @@
-import { BadRequestException, Injectable } from '@nestjs/common';
+import { BadRequestException, Injectable, UnauthorizedException } from '@nestjs/common';
 import { LoginDto } from '../dtos/login.dto';
 import { RegisterDto } from '../dtos/register.dto';
 import { SignInProvider } from './sign-in.provider';
@@ -14,6 +14,8 @@ import { ResetPasswordProvider } from './reset-password.provider';
 import { ForgotPasswordDto } from '../dtos/forgot-password.dto';
 import { ResetPasswordDto } from '../dtos/reset-password.dto';
 import { NonceService } from './nonce.service';
+import { SessionsProvider } from './sessions.provider';
+import { UsersService } from '../../users/providers/users.service';
 
 @Injectable()
 export class AuthService {
@@ -52,6 +54,16 @@ export class AuthService {
      * inject nonceService
      */
     private readonly nonceService: NonceService,
+
+    /**
+     * Inject SessionsProvider for secure session management
+     */
+    private readonly sessionsProvider: SessionsProvider,
+
+    /**
+     * Inject UsersService to retrieve user data
+     */
+    private readonly usersService: UsersService,
   ) {}
 
   public async register(registerDto: RegisterDto) {
@@ -150,4 +162,33 @@ export class AuthService {
       resetPasswordDto,
     );
   }
+
+  /**
+   * Logout current user by invalidating their refresh token
+   */
+  public async logout(refreshTokenDto: RefreshTokenDto) {
+    await this.sessionsProvider.invalidateSession(refreshTokenDto.refreshToken);
+    return { message: 'Successfully logged out' };
+  }
+
+  /**
+   * Invalidate all sessions for a user (logout from all devices)
+   */
+  public async logoutAll(userId: string) {
+    await this.sessionsProvider.invalidateAllUserSessions(userId);
+    return { message: 'All sessions invalidated successfully' };
+  }
+
+  /**
+   * Get current authenticated user data
+   */
+  public async getCurrentUser(userId: string) {
+    const user = await this.usersService.findOneById(userId);
+    if (!user) {
+      throw new UnauthorizedException('User not found');
+    }
+    // Return user without sensitive data
+    const { password, passwordResetToken, passwordResetExpires, ...userWithoutSensitiveData } = user;
+    return userWithoutSensitiveData;
+  }
 }

backend/src/auth/providers/generate-tokens.provider.ts

@@ -72,12 +72,12 @@ export class GenerateTokensProvider {
     }
 
     const [accessToken, refreshToken] = await Promise.all([
-      this.signToken(user.id, user.username, this.jwtConfiguration.ttl, {
+      this.signToken(user.id, user.username, this.jwtConfiguration.accessTokenTtl, {
         email: user.email,
       }),
-      this.signToken(user.id, user.username, this.jwtConfiguration.ttl),
+      this.signToken(user.id, user.username, this.jwtConfiguration.refreshTokenTtl),
     ]);
 
     return { accessToken, refreshToken, user };
   }
-}
+}

backend/src/auth/providers/refreshTokensProvider.ts

@@ -1,16 +1,7 @@
-import {
-  forwardRef,
-  Inject,
-  Injectable,
-  UnauthorizedException,
-} from '@nestjs/common';
+import { Injectable } from '@nestjs/common';
 import { RefreshTokenDto } from '../dtos/refreshTokenDto';
-import { JwtService } from '@nestjs/jwt';
-import { ConfigType } from '@nestjs/config';
-import jwtConfig from '../authConfig/jwt.config';
-import { GenerateTokensProvider } from './generate-tokens.provider';
 import { ApiTags, ApiOperation, ApiBody } from '@nestjs/swagger';
-import { UsersService } from '../../users/providers/users.service';
+import { SessionsProvider } from './sessions.provider';
 
 /**
  * Refresh token provider class
@@ -20,26 +11,9 @@ import { UsersService } from '../../users/providers/users.service';
 export class RefreshTokensProvider {
   constructor(
     /**
-     * Injecting UserService repository
+     * Injecting SessionsProvider for secure session management
      */
-    @Inject(forwardRef(() => UsersService))
-    private readonly userService: UsersService,
-
-    /**
-     * Injecting JwtService
-     */
-    private readonly jwtService: JwtService,
-
-    /**
-     * Injecting JWT Configuration
-     */
-    @Inject(jwtConfig.KEY)
-    private readonly jwtConfiguration: ConfigType<typeof jwtConfig>,
-
-    /**
-     * Injecting GenerateTokensProvider
-     */
-    private readonly generateTokenProvider: GenerateTokensProvider,
+    private readonly sessionsProvider: SessionsProvider,
   ) {}
 
   /**
@@ -49,28 +23,16 @@ export class RefreshTokensProvider {
    */
   @ApiOperation({ summary: 'Refresh authentication tokens' })
   @ApiBody({ type: RefreshTokenDto })
-  public async refreshTokens(refreshTokenDto: RefreshTokenDto) {
-    // Validate the refresh token using JWT
-    const payload = await this.jwtService.verifyAsync<{ sub: string }>(
+  public async refreshTokens(
+    refreshTokenDto: RefreshTokenDto,
+    deviceInfo?: string,
+    ipAddress?: string,
+  ) {
+    // Use sessions provider to validate and rotate the refresh token
+    return await this.sessionsProvider.refreshSession(
       refreshTokenDto.refreshToken,
-      {
-        secret: this.jwtConfiguration.secret,
-        audience: this.jwtConfiguration.audience,
-        issuer: this.jwtConfiguration.issuer,
-      },
+      deviceInfo,
+      ipAddress,
     );
-
-    const sub = payload.sub;
-
-    // Retrieve the user from the database
-    const user = await this.userService.findOneByGoogleId(sub);
-
-    // inside refreshTokens
-    if (!user) {
-      throw new UnauthorizedException('Invalid refresh token');
-    }
-
-    // Generate new tokens
-    return await this.generateTokenProvider.generateTokens(user);
   }
-}
+}