feat(auth): revoke refresh tokens with a per-user token version (#104)

migrations/058_user_token_version.sql

@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN token_version INTEGER NOT NULL DEFAULT 0;

src/auth/jwt.rs

@@ -16,6 +16,8 @@ pub struct Claims {
     pub is_banned: bool,
     #[serde(default)]
     pub email_verified: bool,
+    #[serde(default)]
+    pub ver: i32,
 }
 
 impl Claims {
@@ -55,6 +57,7 @@ pub fn create_access_token(
         is_admin,
         is_banned,
         email_verified,
+        ver: 0,
     };
     encode(
         &Header::default(),
@@ -63,7 +66,10 @@ pub fn create_access_token(
     )
 }
 
-pub fn create_refresh_token(user_id: Uuid) -> Result<String, jsonwebtoken::errors::Error> {
+pub fn create_refresh_token(
+    user_id: Uuid,
+    token_version: i32,
+) -> Result<String, jsonwebtoken::errors::Error> {
     let now = Utc::now();
     // Refresh tokens carry no tier — tier is re-read from DB on each refresh.
     let claims = Claims {
@@ -77,6 +83,7 @@ pub fn create_refresh_token(user_id: Uuid) -> Result<String, jsonwebtoken::error
         is_admin: false,
         is_banned: false,
         email_verified: false,
+        ver: token_version,
     };
     encode(
         &Header::default(),
@@ -103,7 +110,7 @@ pub fn validate_token(
 }
 
 #[cfg(test)]
-mod tests {
+pub(crate) mod tests {
     use super::*;
     use jsonwebtoken::{encode, EncodingKey, Header};
 
@@ -120,6 +127,26 @@ mod tests {
         is_banned: bool,
     }
 
+    pub(crate) fn legacy_token(user_id: Uuid, kind: &str, secret: &str) -> String {
+        let now = Utc::now();
+        encode(
+            &Header::default(),
+            &LegacyClaims {
+                sub: user_id,
+                iat: now.timestamp(),
+                exp: (now + Duration::hours(1)).timestamp(),
+                kind: kind.to_string(),
+                tier: "pro".to_string(),
+                trial_ends_at: None,
+                trial_used: false,
+                is_admin: false,
+                is_banned: false,
+            },
+            &EncodingKey::from_secret(secret.as_bytes()),
+        )
+        .unwrap()
+    }
+
     #[test]
     fn access_token_includes_email_verified_claim() {
         // Serialize JWT_SECRET mutation against other env-touching tests (e.g. the
@@ -136,31 +163,25 @@ mod tests {
     }
 
     #[test]
-    fn legacy_token_without_email_verified_decodes_as_unverified() {
+    fn legacy_token_decodes_with_defaults_for_later_claims() {
         let _guard = crate::test_support::env_lock();
         std::env::set_var("JWT_SECRET", "test-secret");
-        let now = Utc::now();
         let user_id = Uuid::new_v4();
-        let token = encode(
-            &Header::default(),
-            &LegacyClaims {
-                sub: user_id,
-                iat: now.timestamp(),
-                exp: (now + Duration::hours(1)).timestamp(),
-                kind: "access".to_string(),
-                tier: "pro".to_string(),
-                trial_ends_at: None,
-                trial_used: false,
-                is_admin: false,
-                is_banned: false,
-            },
-            &EncodingKey::from_secret(b"test-secret"),
-        )
-        .unwrap();
 
-        let claims = validate_token(&token, "access").unwrap();
+        let claims = validate_token(&legacy_token(user_id, "access", "test-secret"), "access").unwrap();
 
         assert!(!claims.email_verified);
+        assert_eq!(claims.ver, 0);
         assert_eq!(claims.sub, user_id);
     }
+
+    #[test]
+    fn refresh_token_carries_the_token_version() {
+        let _guard = crate::test_support::env_lock();
+        std::env::set_var("JWT_SECRET", "test-secret");
+
+        let token = create_refresh_token(Uuid::new_v4(), 7).unwrap();
+
+        assert_eq!(validate_token(&token, "refresh").unwrap().ver, 7);
+    }
 }

src/auth/mod.rs

@@ -165,6 +165,7 @@ mod authz_tests {
             is_admin: false,
             is_banned,
             email_verified: true,
+            ver: 0,
         }
     }
 

src/main.rs

@@ -286,7 +286,6 @@ async fn main() {
     let public = Router::new()
         .route("/v1/auth/challenge", get(routes::auth::challenge))
         .route("/v1/auth/login", post(routes::auth::login))
-        .route("/v1/auth/refresh", post(routes::auth::refresh))
         .route("/v1/auth/verify-email", post(routes::auth::verify_email))
         .route(
             "/v1/invitations/:token",
@@ -295,6 +294,15 @@ async fn main() {
         .layer(middleware::from_fn(rate_limit::auth_rate_limit))
         .layer(Extension(auth_limiter));
 
+    // A revoked session retries refresh every few seconds; it must not spend the sign-in budget.
+    let refresh_route = Router::new()
+        .route("/v1/auth/refresh", post(routes::auth::refresh))
+        .layer(middleware::from_fn(rate_limit::auth_rate_limit))
+        .layer(Extension(RateLimiter::<std::net::IpAddr>::new(
+            auth_per_minute * 3,
+            Duration::from_secs(60),
+        )));
+
     let waitlist = Router::new()
         .route(
             "/v1/mobile-waitlist",
@@ -360,6 +368,7 @@ async fn main() {
         .route("/v1/auth/me", get(routes::auth::get_me))
         .route("/v1/auth/email", put(routes::auth::update_email))
         .route("/v1/auth/password", put(routes::auth::update_password))
+        .route("/v1/auth/logout-all", post(routes::auth::logout_all))
         .route(
             "/v1/auth/wrapped-user-secrets",
             put(routes::auth::upload_wrapped_user_secrets),
@@ -760,6 +769,7 @@ async fn main() {
 
     let app = Router::new()
         .merge(public)
+        .merge(refresh_route)
         .merge(waitlist)
         .merge(register_route)
         .merge(webhooks)