feat: back access-token revocation with Redis blacklist

Rebuilds #976 on top of the current wallet-auth architecture: wires
the app's existing RedisService (config/redis.module.ts) into a new
TokenBlacklistService, and connects it to JwtAuthGuard (fixing its
previously-unresolvable blacklistCheck constructor param) and to
AuthService.logout(), so a revoked access token's jti is rejected on
every subsequent request, across restarts and server instances.

Author: No-bodyq

backend/src/app.module.ts

@@ -6,13 +6,15 @@ import { AppController } from './app.controller.js';
 import { AppService } from './app.service.js';
 import { UsersModule } from './users/users.module.js';
 import { AuthModule } from './auth/auth.module.js';
+import { RedisModule } from './config/redis.module.js';
 import typeOrmConfig from './config/typeorm.config.js';
 
 @Module({
   imports: [
     ConfigModule.forRoot({ isGlobal: true }),
     TypeOrmModule.forRoot(typeOrmConfig),
     ThrottlerModule.forRoot([{ ttl: 60000, limit: 100 }]),
+    RedisModule.forRoot(),
     UsersModule,
     AuthModule,
   ],

backend/src/auth/auth.controller.ts

@@ -133,8 +133,8 @@ export class AuthController {
   @ApiOperation({ summary: 'Logout and invalidate current session', description: 'Revokes the current access token and optional refresh token.' })
   @ApiResponse({ status: 200, description: 'Logged out successfully' })
   @ApiResponse({ status: 401, description: 'Authentication required' })
-  logout(@Request() req: { user?: { jti?: string } }) {
-    this.authService.logout(req.user?.jti || '');
+  async logout(@Request() req: { user?: { jti?: string; exp?: number } }) {
+    await this.authService.logout(req.user?.jti || '', req.user?.exp);
     return { message: 'Logged out successfully' };
   }
 

backend/src/auth/auth.module.ts

@@ -8,6 +8,7 @@ import { JwtStrategy } from './strategies/jwt.strategy';
 import { WalletStrategy } from './strategies/wallet.strategy';
 import { JwtAuthGuard } from './guards/jwt-auth.guard';
 import { RolesGuard } from './guards/roles.guard';
+import { TokenBlacklistService } from './services/token-blacklist.service';
 
 /**
  * #971: Self-contained Auth module.
@@ -30,7 +31,7 @@ import { RolesGuard } from './guards/roles.guard';
     }),
   ],
   controllers: [AuthController],
-  providers: [AuthService, JwtStrategy, WalletStrategy, JwtAuthGuard, RolesGuard],
-  exports: [AuthService, JwtAuthGuard, RolesGuard, JwtModule],
+  providers: [AuthService, JwtStrategy, WalletStrategy, JwtAuthGuard, RolesGuard, TokenBlacklistService],
+  exports: [AuthService, JwtAuthGuard, RolesGuard, JwtModule, TokenBlacklistService],
 })
 export class AuthModule {}

backend/src/auth/auth.service.ts

@@ -4,6 +4,7 @@ import { ConfigService } from '@nestjs/config';
 import { v4 as uuidv4 } from 'uuid';
 import { JwtAccessTokenPayload } from '../interfaces/jwt-payload.interface';
 import { WalletStrategy } from '../strategies/wallet.strategy';
+import { TokenBlacklistService } from './services/token-blacklist.service';
 
 /**
  * #971-978: Auth service handling wallet login, JWT lifecycle, and session management.
@@ -41,6 +42,7 @@ export class AuthService {
     private readonly jwtService: JwtService,
     private readonly configService: ConfigService,
     private readonly walletStrategy: WalletStrategy,
+    private readonly tokenBlacklistService: TokenBlacklistService,
   ) {}
 
   /**
@@ -170,10 +172,18 @@ export class AuthService {
 
   /**
    * #976: Logout — revoke both access and refresh tokens.
+   *
+   * The access token jti is blacklisted in Redis (rather than only the
+   * in-process Set) so revocation survives restarts and applies across
+   * every server instance.
    */
-  logout(accessTokenJti: string, refreshJti?: string): void {
+  async logout(accessTokenJti: string, accessTokenExp?: number, refreshJti?: string): Promise<void> {
     if (accessTokenJti) {
       this.revokedAccessTokens.add(accessTokenJti);
+      const ttlSeconds = accessTokenExp
+        ? accessTokenExp - Math.floor(Date.now() / 1000)
+        : parseInt(this.configService.get('JWT_ACCESS_TTL', '900'), 10);
+      await this.tokenBlacklistService.blacklist(accessTokenJti, ttlSeconds);
     }
     if (refreshJti) {
       const record = this.refreshTokens.get(refreshJti);

backend/src/auth/guards/jwt-auth.guard.ts

@@ -8,6 +8,7 @@ import { ConfigService } from '@nestjs/config';
 import { JwtService } from '@nestjs/jwt';
 import { Request } from 'express';
 import { JwtAccessTokenPayload } from '../interfaces/jwt-payload.interface';
+import { TokenBlacklistService } from '../services/token-blacklist.service';
 
 /**
  * #981: Enhanced JWT Auth Guard.
@@ -26,7 +27,7 @@ export class JwtAuthGuard implements CanActivate {
   constructor(
     private readonly jwtService: JwtService,
     private readonly configService: ConfigService,
-    private readonly blacklistCheck?: (jti: string) => Promise<boolean>,
+    private readonly tokenBlacklistService: TokenBlacklistService,
   ) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
@@ -46,8 +47,8 @@ export class JwtAuthGuard implements CanActivate {
       });
 
       // #981: Check Redis blacklist for revoked tokens
-      if (this.blacklistCheck && payload.jti) {
-        const isRevoked = await this.blacklistCheck(payload.jti);
+      if (payload.jti) {
+        const isRevoked = await this.tokenBlacklistService.isBlacklisted(payload.jti);
         if (isRevoked) {
           throw new UnauthorizedException({
             message: 'Token has been revoked',

backend/src/auth/services/token-blacklist.service.spec.ts

@@ -0,0 +1,65 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { TokenBlacklistService } from './token-blacklist.service.js';
+import { RedisService } from '../../config/redis.module.js';
+
+describe('TokenBlacklistService', () => {
+  let service: TokenBlacklistService;
+
+  const mockRedisService = {
+    set: jest.fn(),
+    exists: jest.fn(),
+  };
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        TokenBlacklistService,
+        { provide: RedisService, useValue: mockRedisService },
+      ],
+    }).compile();
+
+    service = module.get<TokenBlacklistService>(TokenBlacklistService);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('blacklist', () => {
+    it('should store the jti with the given TTL', async () => {
+      await service.blacklist('jti-1', 900);
+      expect(mockRedisService.set).toHaveBeenCalledWith('blacklist:jti-1', '1', 900);
+    });
+
+    it('should not store anything for a non-positive TTL', async () => {
+      await service.blacklist('jti-1', 0);
+      expect(mockRedisService.set).not.toHaveBeenCalled();
+    });
+
+    it('should not store anything for an empty jti', async () => {
+      await service.blacklist('', 900);
+      expect(mockRedisService.set).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('isBlacklisted', () => {
+    it('should return true when the key exists', async () => {
+      mockRedisService.exists.mockResolvedValue(true);
+      const result = await service.isBlacklisted('jti-1');
+      expect(result).toBe(true);
+      expect(mockRedisService.exists).toHaveBeenCalledWith('blacklist:jti-1');
+    });
+
+    it('should return false when the key does not exist', async () => {
+      mockRedisService.exists.mockResolvedValue(false);
+      const result = await service.isBlacklisted('jti-1');
+      expect(result).toBe(false);
+    });
+
+    it('should return false for an empty jti without querying Redis', async () => {
+      const result = await service.isBlacklisted('');
+      expect(result).toBe(false);
+      expect(mockRedisService.exists).not.toHaveBeenCalled();
+    });
+  });
+});

backend/src/auth/services/token-blacklist.service.ts

@@ -0,0 +1,23 @@
+import { Injectable } from '@nestjs/common';
+import { RedisService } from '../../config/redis.module.js';
+
+/**
+ * #976: Redis-backed access token blacklist.
+ *
+ * Persists revoked jti's beyond process memory so logout invalidation
+ * survives restarts and works across multiple server instances.
+ */
+@Injectable()
+export class TokenBlacklistService {
+  constructor(private readonly redisService: RedisService) {}
+
+  async blacklist(jti: string, ttlSeconds: number): Promise<void> {
+    if (!jti || ttlSeconds <= 0) return;
+    await this.redisService.set(`blacklist:${jti}`, '1', ttlSeconds);
+  }
+
+  async isBlacklisted(jti: string): Promise<boolean> {
+    if (!jti) return false;
+    return this.redisService.exists(`blacklist:${jti}`);
+  }
+}

backend/src/users/users.module.ts

@@ -10,6 +10,7 @@ import { MentorProfile } from './entities/mentor-profile.entity.js';
 import { MenteeProfile } from './entities/mentee-profile.entity.js';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard.js';
 import { RolesGuard } from '../auth/guards/roles.guard.js';
+import { TokenBlacklistService } from '../auth/services/token-blacklist.service.js';
 
 @Module({
   imports: [
@@ -25,7 +26,7 @@ import { RolesGuard } from '../auth/guards/roles.guard.js';
     ConfigModule,
   ],
   controllers: [UsersController],
-  providers: [UsersService, JwtAuthGuard, RolesGuard],
+  providers: [UsersService, JwtAuthGuard, RolesGuard, TokenBlacklistService],
   exports: [UsersService],
 })
 export class UsersModule {}