Optimizations

server/src/constants/auth.constants.ts

@@ -1 +1,2 @@
-export const MAX_REFRESH_TOKENS = 5;
+export const MAX_REFRESH_TOKENS = 5;
+export const REFRESH_TOKEN_TTL = 7 * 24 * 60 * 60 * 1000;

server/src/controllers/auth.controllers.ts

@@ -1,35 +1,21 @@
 import { Request, Response } from "express";
-
-import {
-  registerUser,
-  loginUser,
-} from "../services/auth.services";
-
-import {
-  RegisterUserInput,
-  LoginUserInput,
-} from "../validators/auth.validator";
-
+import {registerUser,loginUser,deleteAndCreateRefreshToken, signoutUser, signoutAllService,} from "../services/auth.services";
+import {RegisterUserInput,LoginUserInput} from "../validators/auth.validator";
 import { refreshCookieOptions } from "../utils/cookies";
 import { asyncHandler } from "../utils/asyncHandler";
+import { verifyRefreshToken } from "../utils/jwt";
+import UserModel from "../models/user.model";
+import { hashRefreshToken, rotateRefreshToken } from "../utils/tokenUtils";
+import AppError from "../utils/AppError";
 
 export const registerController =
-  asyncHandler (async(
+  asyncHandler (
+    async(
     req: Request,
     res: Response
   ) => {
-    const result =
-      await registerUser(
-        req.validated
-          ?.body as RegisterUserInput
-      );
-
-    res.cookie(
-      "refreshToken",
-      result.refreshToken,
-      refreshCookieOptions
-    );
-
+    const result = await registerUser(req.validated?.body as RegisterUserInput);
+    res.cookie("refreshToken",result.refreshToken,refreshCookieOptions);
     res.status(201).json({
       success: true,
       data: {
@@ -38,19 +24,15 @@ export const registerController =
           result.accessToken,
       },
     });
-  });
+  }
+);
 
 export const loginController = asyncHandler(
   async (
     req: Request,
     res: Response
   ) => {
-    const result =
-      await loginUser(
-        req.validated
-          ?.body as LoginUserInput
-      );
-
+    const result = await loginUser(req.validated?.body as LoginUserInput);
     res.cookie(
       "refreshToken",
       result.refreshToken,
@@ -65,4 +47,74 @@ export const loginController = asyncHandler(
           result.accessToken,
       },
     });
-  });
+  });
+
+  export const meController = asyncHandler(async(req:Request,res:Response)=>{
+    res.set("Cache-Control", "no-store");
+    res.json(req.auth)
+  })
+
+export const refreshAuthController = asyncHandler(
+  async (req: Request, res: Response) => {
+    const oldRefreshToken = req.cookies["refreshToken"];
+    if (!oldRefreshToken) {
+      throw new AppError("No refresh token", 401);
+    }
+    // 1) Verify the refresh token signature & payload
+    const payload = verifyRefreshToken(oldRefreshToken);
+    // 2) Hash the presented token
+    const oldHash = hashRefreshToken(oldRefreshToken);
+    // 3) Make sure this user exists and still has this non‑expired token
+    const user = await UserModel.findOne({
+      _id: payload.userId,
+      refreshTokens: {
+        $elemMatch: {
+          tokenHash: oldHash,
+          expiresAt: { $gt: new Date() },
+        },
+      },
+    });
+    if (!user) {
+      throw new AppError("Invalid or expired refresh token", 401);
+    }
+    // 4) Atomically rotate the refresh token in DB and issue new tokens
+    const { accessToken, refreshToken } = await rotateRefreshToken(
+      oldHash,
+      user._id
+    );
+    // 5) Update cookie with the new refresh token
+    res.cookie("refreshToken", refreshToken, refreshCookieOptions);
+    // 6) Return new access token + user
+    res.status(200).json({
+      message: "Refresh completed",
+      data: {
+        accessToken,
+      },
+    });
+  }
+);
+
+export const signoutController = asyncHandler(
+  async (req: Request, res: Response) => {
+    const userId = req.auth.userId;
+    const refreshToken = req.cookies["refreshToken"];
+    if (refreshToken) {
+      await signoutUser(userId, refreshToken);
+    }
+    res.cookie("refreshToken", "", {
+      ...refreshCookieOptions,
+      maxAge: 0,
+    });
+    res.status(204).send(); 
+  }
+);
+
+export const signoutAllController = asyncHandler(async(req:Request,res:Response)=>{
+  const userId = req.auth!.userId;
+  await signoutAllService(userId);
+  res.cookie("refreshToken", "", {
+      ...refreshCookieOptions,
+      maxAge: 0,
+  });
+  res.status(204).send()
+})

server/src/routes/auth.routes.ts

@@ -4,7 +4,8 @@ import validate from "../middleware/validate.middleware";
 
 import {registerUserSchema,loginUserSchema} from "../validators/auth.validator";
 
-import {registerController,loginController} from "../controllers/auth.controllers";
+import {registerController,loginController, meController, refreshAuthController, signoutController, signoutAllController} from "../controllers/auth.controllers";
+import authMiddleware from "../middleware/auth.middleware";
 
 const router = Router();
 
@@ -13,4 +14,11 @@ router.post(
 
 router.post("/login",validate(loginUserSchema,"body"),loginController);
 
+router.get("/me",authMiddleware,meController)
+
+router.post("/refresh",refreshAuthController)
+
+router.post("/signout",authMiddleware,signoutController);
+router.post("/signout-all",authMiddleware,signoutAllController);
+
 export default router;

server/src/services/auth.services.ts

@@ -1,58 +1,25 @@
 import UserModel from "../models/user.model";
-
 import AppError from "../utils/AppError";
-
 import {
   hashPassword,
   comparePassword,
 } from "../utils/password";
-
-import { issueTokens } from "../utils/issueTokens";
-
+import { issueTokens, revokeAllRefreshTokens, storeRefreshToken } from "../utils/tokenUtils";
 import { buildAuthResponse } from "../utils/authResponse";
-
-import type {
-  RegisterUserInput,
-  LoginUserInput,
-} from "../validators/auth.validator";
-
-export const registerUser = async (
-  input: RegisterUserInput
-) => {
-  const existingUser =
-    await UserModel.findOne({
-      email: input.email,
-    });
-
-  if (existingUser) {
-    throw new AppError(
-      "User already exists",
-      409
-    );
-  }
-
-  const passwordHash =
-    await hashPassword(
-      input.password
-    );
-
+import type {RegisterUserInput,LoginUserInput,JwtPayload} from "../validators/auth.validator";
+import { ObjectId } from "mongoose";
+import { generateRefreshToken } from "../utils/jwt";
+import { hashRefreshToken } from "../utils/tokenUtils";
+
+export const registerUser = async (input: RegisterUserInput) => {
+  const existingUser = await UserModel.findOne({ email: input.email});
+  if (existingUser) {throw new AppError("User already exists",409)}
+  const passwordHash = await hashPassword(input.password);
   try {
-    const user =
-      await UserModel.create({
-        email: input.email,
-        passwordHash,
-      });
-
-    const {
-      accessToken,
-      refreshToken,
-    } = await issueTokens(user);
-
-    return buildAuthResponse(
-      user,
-      accessToken,
-      refreshToken
-    );
+    const user = await UserModel.create({email: input.email,passwordHash});
+    const {accessToken,refreshToken} = await issueTokens(user);
+    await storeRefreshToken(user._id.toString(),refreshToken);
+    return buildAuthResponse(user,accessToken,refreshToken);
   } catch (error) {
     if (
       typeof error === "object" &&
@@ -65,47 +32,70 @@ export const registerUser = async (
         409
       );
     }
-
     throw error;
   }
 };
 
 export const loginUser = async (
   input: LoginUserInput
 ) => {
-  const user =
-    await UserModel.findOne({
-      email: input.email,
-    });
-
+  const user = await UserModel.findOne({email: input.email});
   if (!user) {
     throw new AppError(
       "Invalid credentials",
       401
     );
   }
-
-  const passwordValid =
-    await comparePassword(
-      input.password,
-      user.passwordHash
-    );
-
+  const passwordValid = await comparePassword(input.password,user.passwordHash);
   if (!passwordValid) {
     throw new AppError(
       "Invalid credentials",
       401
     );
   }
-
   const {
     accessToken,
     refreshToken,
   } = await issueTokens(user);
-
+  await storeRefreshToken(user._id.toString(),refreshToken);
   return buildAuthResponse(
     user,
     accessToken,
     refreshToken
   );
-};
+};
+
+export const deleteAndCreateRefreshToken = async (oldRefreshTokenHash:string,user:InstanceType<typeof UserModel>)=>{
+  const {accessToken,refreshToken,} = await issueTokens(user)
+  let result = await UserModel.findByIdAndUpdate(
+  {
+    _id: user._id,
+    refreshTokens:
+      oldRefreshTokenHash,
+  },
+  {
+    $pull: {
+      refreshTokens:
+        oldRefreshTokenHash,
+    }
+  }
+);
+return {accessToken,refreshToken};
+}
+
+export const signoutUser = async (userId: string, refreshToken: string) => {
+  if (!refreshToken) return;
+  const tokenHash = hashRefreshToken(refreshToken);
+  await UserModel.updateOne(
+    { _id: userId },
+    {
+      $pull: {
+        refreshTokens: { tokenHash },
+      },
+    }
+  );
+};
+
+export const signoutAllService = async(userId:string)=>{
+  return await revokeAllRefreshTokens(userId);
+}

server/src/services/task.services.ts

@@ -114,4 +114,5 @@ export const getTasks = async (
       [sortField]: sortOrder,
     })
     .lean();
-};
+};
+