Implement Secure Logout & Implement JWT Token Rotation

prisma/schema.prisma

@@ -134,12 +134,19 @@ model BlacklistedToken {
   jti       String    @unique
   tokenType TokenType @map("token_type")
   expiresAt DateTime  @map("expires_at")
+  tokenFamily String? @map("token_family") // Track token rotation family
+  previousJti String? @map("previous_jti") // Link to previous token in rotation
+  ipAddress  String?  @map("ip_address")
+  userAgent  String?  @map("user_agent")
+  reusedAt   DateTime? @map("reused_at") // When token reuse was detected
   createdAt DateTime  @default(now()) @map("created_at")
 
   user User? @relation(fields: [userId], references: [id], onDelete: Cascade)
 
   @@index([userId])
   @@index([expiresAt])
+  @@index([tokenFamily])
+  @@index([tokenFamily, createdAt])
   @@map("blacklisted_tokens")
 }
 

src/app.module.ts

@@ -3,6 +3,7 @@ import { ConfigModule } from '@nestjs/config';
 import { UsersModule } from './users/users.module';
 import { AuthModule } from './auth/auth.module';
 import { PropertiesModule } from './properties/properties.module';
+import { DashboardModule } from './dashboard/dashboard.module';
 import { PrismaModule } from './database/prisma.module';
 import { AppController } from './app.controller';
 

src/auth/auth.controller.ts

@@ -35,8 +35,10 @@ export class AuthController {
   }
 
   @Post('refresh')
-  refresh(@Body() refreshTokenDto: RefreshTokenDto) {
-    return this.authService.refreshToken(refreshTokenDto);
+  refresh(@Body() refreshTokenDto: RefreshTokenDto, @Req() request: Request) {
+    const ipAddress = request.ip || request.socket.remoteAddress;
+    const userAgent = request.headers['user-agent'];
+    return this.authService.refreshToken(refreshTokenDto, ipAddress, userAgent);
   }
 
   @UseGuards(JwtAuthGuard)
@@ -49,6 +51,12 @@ export class AuthController {
     return this.authService.logout(user, logoutDto.refreshToken, request.accessToken);
   }
 
+  @UseGuards(JwtAuthGuard)
+  @Post('logout-all')
+  logoutAllDevices(@CurrentUser() user: AuthUserPayload, @Req() request: { accessToken?: string }) {
+    return this.authService.logoutAllDevices(user, request.accessToken);
+  }
+
   @UseGuards(JwtAuthGuard)
   @Get('me')
   me(@CurrentUser() user: AuthUserPayload) {