security(identity-service): revoked JWT access tokens not invalidated on incoming requests

[Jashk120]

Description

While exploring the codebase I noticed this comment in heka-identity-service/src/common/auth/jwt.strategy.ts:

// This method doesn't validate anything right now,
// but in the future we can validate token revocation list here

The validate method in JwtStrategy currently only verifies the token signature and expiry. It does not check whether the token has been explicitly revoked — meaning a user who logs out can continue using their access token until it naturally expires.

What Already Exists

heka-auth-service already has a complete revocation system. OAuthService stores every issued access token in TokenRepository and calls tokenRepository.revoke on logout and token refresh. The infrastructure is there it just isn't being checked on incoming requests to heka-identity-service.

The Problem

The two services run separate databases, so heka-identity-service cannot query the token table directly. Any revocation check needs to cross the service boundary.

Proposed Approach

Add a token validation endpoint to heka-auth-service something like POST /auth/token/validate that checks whether a given token exists and has not been revoked. heka-identity-service would then call this endpoint inside validateTokenPayload before processing the request.

I'd be happy to work on this if the approach looks good to the maintainers.