feat(auth): add logout-all endpoint to revoke all sessions (#74) - #105
Merged
Conversation
Adds POST /api/v1/auth/logout-all so a candidate can invalidate every access/refresh token issued to them at once, not just the current one (as /logout already does). Design differs from the issue's tokenVersion-on-Candidate-model proposal: instead of adding a Mongo field + an extra DB lookup per authenticated request, this reuses the exact Redis-with-in-memory- fallback shape already used by tokenBlacklist.ts. A per-candidate 'invalidated before' timestamp is stored in Redis/mem (sessionRevocation.ts) and compared against each JWT's standard iat claim in verifyToken.middleware.ts and authRefreshToken — one more Redis/mem lookup alongside the blacklist check that already runs on every request, no schema change, no new DB round trip. - src/utils/sessionRevocation.ts: invalidateAllSessions / getSessionsInvalidatedAt / isSessionRevoked - verifyToken.middleware.ts: reject tokens issued before the last logout-all - auth.controller.ts: authLogoutAll controller + same check in authRefreshToken - auth.route.ts: POST /logout-all (authenticated via verifyToken) - locales: logoutAllSuccess (en/vi) - tests updated/added for verifyToken middleware, authRefreshToken, authLogoutAll Closes #74
This was referenced Sep 5, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
POST /api/v1/auth/logout-allso a candidate can invalidate every access/refresh token issued to them at once, not just the current one (as/logoutalready does).Design note (diverges from the issue's proposal)
The issue proposed a
tokenVersionfield on theCandidatemodel, checked via an extra Mongo lookup on every authenticated request — but it also flagged that cost as worth measuring/avoiding before committing to it.Instead, this reuses the exact Redis-with-in-memory-fallback shape already used by
tokenBlacklist.ts:sessionRevocation.ts).iatclaim inverifyToken.middleware.tsandauthRefreshToken.Result: no schema change, no new DB round trip — just one more Redis/mem lookup alongside the blacklist check that already runs on every request.
Changes
src/utils/sessionRevocation.ts(new) —invalidateAllSessions,getSessionsInvalidatedAt,isSessionRevokedverifyToken.middleware.ts— reject tokens issued before the candidate's last logout-allauth.controller.ts— newauthLogoutAllcontroller + same revocation check added toauthRefreshTokenauth.route.ts—POST /api/v1/auth/logout-all(authenticated viaverifyToken), with Swagger docsauth.logoutAllSuccessverifyToken.test.ts,refreshToken.test.ts,auth.controller.test.tsTesting
npm test— 60/60 passingnpm run build— clean, no tsc errorsCloses #74
🤖 Generated with Claude Code
https://claude.ai/code/session_01ACpXY4MGdQHFTmu3SZTPLG