Merge pull request #1040 from No-bodyq/feat/issue-976-logout-token-invalidation

Add logout and token invalidation with Redis blacklist

Author: nafiuishaaq

backend/src/auth/auth.controller.spec.ts

@@ -28,6 +28,9 @@ describe('AuthController', () => {
 
   const mockRequest = (ip?: string) => ({ ip }) as unknown as Request;
 
+  const validWallet =
+    'GABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUVW';
+
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
       controllers: [AuthController],
@@ -81,11 +84,7 @@ describe('AuthController', () => {
 
       await expect(
         controller.login(
-          {
-            walletAddress:
-              'GABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUVW',
-            nonce: 'sig',
-          },
+          { walletAddress: validWallet, nonce: 'sig' },
           mockRequest('127.0.0.1'),
         ),
       ).rejects.toThrow(
@@ -106,24 +105,14 @@ describe('AuthController', () => {
       });
 
       const result = await controller.login(
-        {
-          walletAddress:
-            'GABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUVW',
-          nonce: 'sig',
-        },
+        { walletAddress: validWallet, nonce: 'sig' },
         mockRequest('127.0.0.1'),
       );
 
-      expect(mockAuthService.login).toHaveBeenCalledWith(
-        'GABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUVW',
-        'sig',
-      );
+      expect(mockAuthService.login).toHaveBeenCalledWith(validWallet, 'sig');
       expect(
         mockSuspiciousLoginService.recordSuccessfulLogin,
-      ).toHaveBeenCalledWith(
-        'GABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUVW',
-        '127.0.0.1',
-      );
+      ).toHaveBeenCalledWith(validWallet, '127.0.0.1');
       expect(result).toEqual({
         accessToken: 'access',
         refreshToken: 'refresh',
@@ -133,10 +122,14 @@ describe('AuthController', () => {
   });
 
   describe('logout', () => {
-    it('should revoke the current access token and confirm', () => {
-      const result = controller.logout({ user: { jti: 'jti-1' } });
+    it('should revoke the current access token and confirm', async () => {
+      mockAuthService.logout.mockResolvedValue(undefined);
+
+      const result = await controller.logout({
+        user: { jti: 'jti-1', exp: 1234 },
+      });
 
-      expect(mockAuthService.logout).toHaveBeenCalledWith('jti-1');
+      expect(mockAuthService.logout).toHaveBeenCalledWith('jti-1', 1234);
       expect(result).toEqual({ message: 'Logged out successfully' });
     });
   });

backend/src/auth/auth.controller.ts

@@ -153,8 +153,8 @@ export class AuthController {
   })
   @ApiResponse({ status: 200, description: 'Logged out successfully' })
   @ApiResponse({ status: 401, description: 'Authentication required' })
-  logout(@Request() req: { user?: { jti?: string } }) {
-    this.authService.logout(req.user?.jti || '');
+  async logout(@Request() req: { user?: { jti?: string; exp?: number } }) {
+    await this.authService.logout(req.user?.jti || '', req.user?.exp);
     return { message: 'Logged out successfully' };
   }
 

backend/src/auth/auth.module.ts

@@ -7,6 +7,7 @@ import { JwtStrategy } from './strategies/jwt.strategy.js';
 import { WalletStrategy } from './strategies/wallet.strategy.js';
 import { JwtAuthGuard } from './guards/jwt-auth.guard.js';
 import { RolesGuard } from './guards/roles.guard.js';
+import { TokenBlacklistService } from './services/token-blacklist.service.js';
 import { jwtModuleConfig } from '../config/jwt.config.js';
 import { UsersModule } from '../users/users.module.js';
 
@@ -29,7 +30,14 @@ import { UsersModule } from '../users/users.module.js';
     WalletStrategy,
     JwtAuthGuard,
     RolesGuard,
+    TokenBlacklistService,
+  ],
+  exports: [
+    AuthService,
+    JwtAuthGuard,
+    RolesGuard,
+    JwtModule,
+    TokenBlacklistService,
   ],
-  exports: [AuthService, JwtAuthGuard, RolesGuard, JwtModule],
 })
 export class AuthModule {}

backend/src/auth/auth.service.spec.ts

@@ -4,6 +4,7 @@ import { ConfigService } from '@nestjs/config';
 import { UnauthorizedException } from '@nestjs/common';
 import { AuthService } from './auth.service.js';
 import { WalletStrategy } from './strategies/wallet.strategy.js';
+import { TokenBlacklistService } from './services/token-blacklist.service.js';
 import { v4 as uuidv4 } from 'uuid';
 
 jest.mock('uuid', () => {
@@ -28,13 +29,19 @@ describe('AuthService', () => {
     verifyAsync: jest.fn(),
   };
 
+  const mockTokenBlacklistService = {
+    blacklist: jest.fn(),
+    isBlacklisted: jest.fn(),
+  };
+
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
       providers: [
         AuthService,
         { provide: WalletStrategy, useValue: mockWalletStrategy },
         { provide: ConfigService, useValue: mockConfigService },
         { provide: JwtService, useValue: mockJwtService },
+        { provide: TokenBlacklistService, useValue: mockTokenBlacklistService },
       ],
     }).compile();
 
@@ -58,17 +65,6 @@ describe('AuthService', () => {
     });
   });
 
-  describe('logout', () => {
-    it('should not throw when called with a jti', () => {
-      expect(() => service.logout('some-jti')).not.toThrow();
-    });
-
-    it('isTokenRevoked should return true after logout', () => {
-      service.logout('jti-abc');
-      expect(service.isTokenRevoked('jti-abc')).toBe(true);
-    });
-  });
-
   describe('login', () => {
     it('should issue an access and refresh token pair for a valid signature', async () => {
       mockWalletStrategy.generateNonce.mockReturnValue({
@@ -157,4 +153,63 @@ describe('AuthService', () => {
       );
     });
   });
+
+  describe('logout', () => {
+    it('should blacklist the access token jti for its remaining lifetime', async () => {
+      const nowSeconds = Math.floor(Date.now() / 1000);
+
+      await service.logout('access-jti', nowSeconds + 120);
+
+      expect(mockTokenBlacklistService.blacklist).toHaveBeenCalledWith(
+        'access-jti',
+        expect.any(Number),
+      );
+      const [, ttl] = mockTokenBlacklistService.blacklist.mock.calls[0] as [
+        string,
+        number,
+      ];
+      expect(ttl).toBeGreaterThan(0);
+      expect(ttl).toBeLessThanOrEqual(120);
+    });
+
+    it('should fall back to the configured access TTL when no expiry is given', async () => {
+      await service.logout('access-jti');
+
+      expect(mockTokenBlacklistService.blacklist).toHaveBeenCalledWith(
+        'access-jti',
+        900,
+      );
+    });
+
+    it('isTokenRevoked should return true after logout', async () => {
+      await service.logout('jti-abc');
+      expect(service.isTokenRevoked('jti-abc')).toBe(true);
+    });
+
+    it('should mark a stored refresh token as revoked', async () => {
+      mockWalletStrategy.generateNonce.mockReturnValue({
+        nonce: 'nonce-1',
+        expiresAt: Date.now() + 60_000,
+      });
+      service.requestNonce('test-wallet');
+      mockWalletStrategy.verify.mockReturnValue(true);
+      mockJwtService.signAsync
+        .mockResolvedValueOnce('access-token')
+        .mockResolvedValueOnce('refresh-token');
+      await service.login('test-wallet', 'nonce-1');
+      const issuedRefreshJti = (uuidv4 as jest.Mock).mock.results.at(-1)
+        ?.value as string;
+
+      await service.logout('access-jti', undefined, issuedRefreshJti);
+
+      mockJwtService.verifyAsync.mockResolvedValue({
+        sub: 'test-wallet',
+        jti: issuedRefreshJti,
+        type: 'refresh',
+      });
+      await expect(service.refresh('refresh-token')).rejects.toThrow(
+        'Refresh token has been revoked',
+      );
+    });
+  });
 });

backend/src/auth/auth.service.ts

@@ -4,6 +4,7 @@ import { ConfigService } from '@nestjs/config';
 import { v4 as uuidv4 } from 'uuid';
 import { JwtAccessTokenPayload } from './interfaces/jwt-payload.interface.js';
 import { WalletStrategy } from './strategies/wallet.strategy.js';
+import { TokenBlacklistService } from './services/token-blacklist.service.js';
 import { UsersService } from '../users/users.service.js';
 import { AuthRole } from '../common/enums/auth-role.enum.js';
 import { ROLE_PERMISSIONS } from '../common/constants/role-permissions.constant.js';
@@ -44,6 +45,7 @@ export class AuthService {
     private readonly jwtService: JwtService,
     private readonly configService: ConfigService,
     private readonly walletStrategy: WalletStrategy,
+    private readonly tokenBlacklistService: TokenBlacklistService,
     private readonly usersService: UsersService,
   ) {}
 
@@ -196,10 +198,18 @@ export class AuthService {
 
   /**
    * #976: Logout — revoke both access and refresh tokens.
+   *
+   * The access token jti is blacklisted in Redis (rather than only the
+   * in-process Set) so revocation survives restarts and applies across
+   * every server instance.
    */
-  logout(accessTokenJti: string, refreshJti?: string): void {
+  async logout(accessTokenJti: string, accessTokenExp?: number, refreshJti?: string): Promise<void> {
     if (accessTokenJti) {
       this.revokedAccessTokens.add(accessTokenJti);
+      const ttlSeconds = accessTokenExp
+        ? accessTokenExp - Math.floor(Date.now() / 1000)
+        : parseInt(this.configService.get('JWT_ACCESS_TTL', '900'), 10);
+      await this.tokenBlacklistService.blacklist(accessTokenJti, ttlSeconds);
     }
     if (refreshJti) {
       const record = this.refreshTokens.get(refreshJti);

backend/src/auth/guards/jwt-auth.guard.ts

@@ -8,6 +8,7 @@ import { ConfigService } from '@nestjs/config';
 import { JwtService } from '@nestjs/jwt';
 import { Request } from 'express';
 import { JwtAccessTokenPayload } from '../interfaces/jwt-payload.interface.js';
+import { TokenBlacklistService } from '../services/token-blacklist.service.js';
 import { UserStatus } from '../../users/enums/user-status.enum.js';
 
 /**
@@ -27,6 +28,7 @@ export class JwtAuthGuard implements CanActivate {
   constructor(
     private readonly jwtService: JwtService,
     private readonly configService: ConfigService,
+    private readonly tokenBlacklistService: TokenBlacklistService,
   ) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
@@ -48,6 +50,19 @@ export class JwtAuthGuard implements CanActivate {
         },
       );
 
+      // #981: Check Redis blacklist for revoked tokens
+      if (payload.jti) {
+        const isRevoked = await this.tokenBlacklistService.isBlacklisted(
+          payload.jti,
+        );
+        if (isRevoked) {
+          throw new UnauthorizedException({
+            message: 'Token has been revoked',
+            code: 'token_revoked',
+          });
+        }
+      }
+
       if (payload.status && payload.status !== UserStatus.ACTIVE) {
         throw new UnauthorizedException({
           message: 'Account is not active',

backend/src/auth/services/token-blacklist.service.spec.ts

@@ -0,0 +1,65 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { TokenBlacklistService } from './token-blacklist.service.js';
+import { RedisService } from '../../config/redis.module.js';
+
+describe('TokenBlacklistService', () => {
+  let service: TokenBlacklistService;
+
+  const mockRedisService = {
+    set: jest.fn(),
+    exists: jest.fn(),
+  };
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        TokenBlacklistService,
+        { provide: RedisService, useValue: mockRedisService },
+      ],
+    }).compile();
+
+    service = module.get<TokenBlacklistService>(TokenBlacklistService);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('blacklist', () => {
+    it('should store the jti with the given TTL', async () => {
+      await service.blacklist('jti-1', 900);
+      expect(mockRedisService.set).toHaveBeenCalledWith('blacklist:jti-1', '1', 900);
+    });
+
+    it('should not store anything for a non-positive TTL', async () => {
+      await service.blacklist('jti-1', 0);
+      expect(mockRedisService.set).not.toHaveBeenCalled();
+    });
+
+    it('should not store anything for an empty jti', async () => {
+      await service.blacklist('', 900);
+      expect(mockRedisService.set).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('isBlacklisted', () => {
+    it('should return true when the key exists', async () => {
+      mockRedisService.exists.mockResolvedValue(true);
+      const result = await service.isBlacklisted('jti-1');
+      expect(result).toBe(true);
+      expect(mockRedisService.exists).toHaveBeenCalledWith('blacklist:jti-1');
+    });
+
+    it('should return false when the key does not exist', async () => {
+      mockRedisService.exists.mockResolvedValue(false);
+      const result = await service.isBlacklisted('jti-1');
+      expect(result).toBe(false);
+    });
+
+    it('should return false for an empty jti without querying Redis', async () => {
+      const result = await service.isBlacklisted('');
+      expect(result).toBe(false);
+      expect(mockRedisService.exists).not.toHaveBeenCalled();
+    });
+  });
+});

backend/src/auth/services/token-blacklist.service.ts

@@ -0,0 +1,23 @@
+import { Injectable } from '@nestjs/common';
+import { RedisService } from '../../config/redis.module.js';
+
+/**
+ * #976: Redis-backed access token blacklist.
+ *
+ * Persists revoked jti's beyond process memory so logout invalidation
+ * survives restarts and works across multiple server instances.
+ */
+@Injectable()
+export class TokenBlacklistService {
+  constructor(private readonly redisService: RedisService) {}
+
+  async blacklist(jti: string, ttlSeconds: number): Promise<void> {
+    if (!jti || ttlSeconds <= 0) return;
+    await this.redisService.set(`blacklist:${jti}`, '1', ttlSeconds);
+  }
+
+  async isBlacklisted(jti: string): Promise<boolean> {
+    if (!jti) return false;
+    return this.redisService.exists(`blacklist:${jti}`);
+  }
+}

backend/src/users/users.module.ts

@@ -15,6 +15,7 @@ import { MenteeProfile } from './entities/mentee-profile.entity.js';
 import { PortfolioLink } from './entities/portfolio-link.entity.js';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard.js';
 import { RolesGuard } from '../auth/guards/roles.guard.js';
+import { TokenBlacklistService } from '../auth/services/token-blacklist.service.js';
 import { jwtModuleConfig } from '../config/jwt.config.js';
 import { StorageModule } from '../storage/storage.module.js';
 import { AvailabilityModule } from '../availability/availability.module.js';
@@ -44,6 +45,7 @@ import { ProfileCompletenessService } from './profile-completeness.service.js';
     UsersService,
     JwtAuthGuard,
     RolesGuard,
+    TokenBlacklistService,
     AvatarService,
     ProfileCompletenessService,
   ],

contract/target/.rustc_info.json

@@ -1 +1 @@
-{"rustc_fingerprint":678832330695229064,"outputs":{"7971740275564407648":{"success":true,"status":"","code":0,"stdout":"___.exe\nlib___.rlib\n___.dll\n___.dll\n___.lib\n___.dll\nC:\\Users\\thefo\\.rustup\\toolchains\\stable-x86_64-pc-windows-msvc\npacked\n___\ndebug_assertions\npanic=\"unwind\"\nproc_macro\ntarget_abi=\"\"\ntarget_arch=\"x86_64\"\ntarget_endian=\"little\"\ntarget_env=\"msvc\"\ntarget_family=\"windows\"\ntarget_feature=\"cmpxchg16b\"\ntarget_feature=\"fxsr\"\ntarget_feature=\"sse\"\ntarget_feature=\"sse2\"\ntarget_feature=\"sse3\"\ntarget_has_atomic=\"128\"\ntarget_has_atomic=\"16\"\ntarget_has_atomic=\"32\"\ntarget_has_atomic=\"64\"\ntarget_has_atomic=\"8\"\ntarget_has_atomic=\"ptr\"\ntarget_has_atomic_primitive_alignment=\"128\"\ntarget_has_atomic_primitive_alignment=\"16\"\ntarget_has_atomic_primitive_alignment=\"32\"\ntarget_has_atomic_primitive_alignment=\"64\"\ntarget_has_atomic_primitive_alignment=\"8\"\ntarget_has_atomic_primitive_alignment=\"ptr\"\ntarget_os=\"windows\"\ntarget_pointer_width=\"64\"\ntarget_vendor=\"pc\"\nwindows\n","stderr":""},"12004014463585500860":{"success":true,"status":"","code":0,"stdout":"___.exe\nlib___.rlib\n___.dll\n___.dll\n___.lib\n___.dll\nC:\\Users\\thefo\\.rustup\\toolchains\\stable-x86_64-pc-windows-msvc\npacked\n___\ndebug_assertions\npanic=\"unwind\"\nproc_macro\ntarget_abi=\"\"\ntarget_arch=\"x86_64\"\ntarget_endian=\"little\"\ntarget_env=\"msvc\"\ntarget_family=\"windows\"\ntarget_feature=\"cmpxchg16b\"\ntarget_feature=\"fxsr\"\ntarget_feature=\"sse\"\ntarget_feature=\"sse2\"\ntarget_feature=\"sse3\"\ntarget_has_atomic=\"128\"\ntarget_has_atomic=\"16\"\ntarget_has_atomic=\"32\"\ntarget_has_atomic=\"64\"\ntarget_has_atomic=\"8\"\ntarget_has_atomic=\"ptr\"\ntarget_has_atomic_primitive_alignment=\"128\"\ntarget_has_atomic_primitive_alignment=\"16\"\ntarget_has_atomic_primitive_alignment=\"32\"\ntarget_has_atomic_primitive_alignment=\"64\"\ntarget_has_atomic_primitive_alignment=\"8\"\ntarget_has_atomic_primitive_alignment=\"ptr\"\ntarget_os=\"windows\"\ntarget_pointer_width=\"64\"\ntarget_vendor=\"pc\"\nwindows\n","stderr":""},"12522964844413219576":{"success":true,"status":"","code":0,"stdout":"rustc 1.97.1 (8bab26f4f 2026-07-14)\nbinary: rustc\ncommit-hash: 8bab26f4f68e0e26f0bb7960be334d5b520ea452\ncommit-date: 2026-07-14\nhost: x86_64-pc-windows-msvc\nrelease: 1.97.1\nLLVM version: 22.1.6\n","stderr":""}},"successes":{}}
+{"rustc_fingerprint":678832330695229064,"outputs":{"12522964844413219576":{"success":true,"status":"","code":0,"stdout":"rustc 1.97.1 (8bab26f4f 2026-07-14)\nbinary: rustc\ncommit-hash: 8bab26f4f68e0e26f0bb7960be334d5b520ea452\ncommit-date: 2026-07-14\nhost: x86_64-pc-windows-msvc\nrelease: 1.97.1\nLLVM version: 22.1.6\n","stderr":""},"7971740275564407648":{"success":true,"status":"","code":0,"stdout":"___.exe\nlib___.rlib\n___.dll\n___.dll\n___.lib\n___.dll\nC:\\Users\\thefo\\.rustup\\toolchains\\stable-x86_64-pc-windows-msvc\npacked\n___\ndebug_assertions\npanic=\"unwind\"\nproc_macro\ntarget_abi=\"\"\ntarget_arch=\"x86_64\"\ntarget_endian=\"little\"\ntarget_env=\"msvc\"\ntarget_family=\"windows\"\ntarget_feature=\"cmpxchg16b\"\ntarget_feature=\"fxsr\"\ntarget_feature=\"sse\"\ntarget_feature=\"sse2\"\ntarget_feature=\"sse3\"\ntarget_has_atomic=\"128\"\ntarget_has_atomic=\"16\"\ntarget_has_atomic=\"32\"\ntarget_has_atomic=\"64\"\ntarget_has_atomic=\"8\"\ntarget_has_atomic=\"ptr\"\ntarget_has_atomic_primitive_alignment=\"128\"\ntarget_has_atomic_primitive_alignment=\"16\"\ntarget_has_atomic_primitive_alignment=\"32\"\ntarget_has_atomic_primitive_alignment=\"64\"\ntarget_has_atomic_primitive_alignment=\"8\"\ntarget_has_atomic_primitive_alignment=\"ptr\"\ntarget_os=\"windows\"\ntarget_pointer_width=\"64\"\ntarget_vendor=\"pc\"\nwindows\n","stderr":""},"12004014463585500860":{"success":true,"status":"","code":0,"stdout":"___.exe\nlib___.rlib\n___.dll\n___.dll\n___.lib\n___.dll\nC:\\Users\\thefo\\.rustup\\toolchains\\stable-x86_64-pc-windows-msvc\npacked\n___\ndebug_assertions\npanic=\"unwind\"\nproc_macro\ntarget_abi=\"\"\ntarget_arch=\"x86_64\"\ntarget_endian=\"little\"\ntarget_env=\"msvc\"\ntarget_family=\"windows\"\ntarget_feature=\"cmpxchg16b\"\ntarget_feature=\"fxsr\"\ntarget_feature=\"sse\"\ntarget_feature=\"sse2\"\ntarget_feature=\"sse3\"\ntarget_has_atomic=\"128\"\ntarget_has_atomic=\"16\"\ntarget_has_atomic=\"32\"\ntarget_has_atomic=\"64\"\ntarget_has_atomic=\"8\"\ntarget_has_atomic=\"ptr\"\ntarget_has_atomic_primitive_alignment=\"128\"\ntarget_has_atomic_primitive_alignment=\"16\"\ntarget_has_atomic_primitive_alignment=\"32\"\ntarget_has_atomic_primitive_alignment=\"64\"\ntarget_has_atomic_primitive_alignment=\"8\"\ntarget_has_atomic_primitive_alignment=\"ptr\"\ntarget_os=\"windows\"\ntarget_pointer_width=\"64\"\ntarget_vendor=\"pc\"\nwindows\n","stderr":""}},"successes":{}}