feat: implement JWT token blacklist and refresh token endpoint

backend/package.json

@@ -112,6 +112,9 @@
     "transform": {
       "^.+\\.(t|j)s$": "ts-jest"
     },
+    "moduleNameMapper": {
+      "^src/(.*)$": "<rootDir>/$1"
+    },
     "collectCoverageFrom": [
       "**/*.(t|j)s"
     ],

backend/src/modules/auth/auth.controller.ts

@@ -7,7 +7,9 @@ import {
   HttpCode,
   HttpStatus,
   Patch,
+  Res,
 } from '@nestjs/common';
+import { Response } from 'express';
 import { AuthService } from './auth.service';
 import { LoginDto, RegisterAdminDto, ChangePasswordDto } from './auth.dto';
 import { UpdateRegisterAdminDto } from './update-auth.dto';
@@ -20,15 +22,77 @@ export class AuthController {
   @Post('login')
   @Public()
   @HttpCode(HttpStatus.OK)
-  async login(@Body() loginDto: LoginDto) {
-    return await this.authService.login(loginDto);
+  async login(
+    @Body() loginDto: LoginDto,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const result = await this.authService.login(loginDto);
+
+    res.cookie('refreshToken', result.refreshToken, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === 'production',
+      sameSite: 'strict',
+      maxAge: 7 * 24 * 60 * 60 * 1000,
+      path: '/',
+    });
+
+    return {
+      accessToken: result.accessToken,
+      user: result.user,
+    };
   }
 
   @Post('register')
   @Public()
   @HttpCode(HttpStatus.CREATED)
-  async register(@Body() registerAdminDto: RegisterAdminDto) {
-    return await this.authService.register(registerAdminDto);
+  async register(
+    @Body() registerAdminDto: RegisterAdminDto,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const result = await this.authService.register(registerAdminDto);
+
+    res.cookie('refreshToken', result.refreshToken, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === 'production',
+      sameSite: 'strict',
+      maxAge: 7 * 24 * 60 * 60 * 1000,
+      path: '/',
+    });
+
+    return {
+      accessToken: result.accessToken,
+      user: result.user,
+    };
+  }
+
+  @Post('refresh')
+  @HttpCode(HttpStatus.OK)
+  async refresh(
+    @Body('refreshToken') refreshToken: string,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    if (!refreshToken) {
+      const cookies = res.req.cookies;
+      refreshToken = cookies?.refreshToken;
+    }
+
+    if (!refreshToken) {
+      return res.status(401).json({ message: 'Refresh token not provided' });
+    }
+
+    const result = await this.authService.refreshTokens(refreshToken);
+
+    res.cookie('refreshToken', result.refreshToken, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === 'production',
+      sameSite: 'strict',
+      maxAge: 7 * 24 * 60 * 60 * 1000,
+      path: '/',
+    });
+
+    return {
+      accessToken: result.accessToken,
+    };
   }
 
   @Post('change-password')
@@ -52,8 +116,13 @@ export class AuthController {
 
   @Post('logout')
   @HttpCode(HttpStatus.OK)
-  async logout() {
-    return { message: 'Logged out successfully' };
+  async logout(@Request() req, @Res({ passthrough: true }) res: Response) {
+    const authHeader = req.headers.authorization;
+    const accessToken = authHeader?.replace('Bearer ', '');
+
+    res.clearCookie('refreshToken', { path: '/' });
+
+    return await this.authService.logout(req.user, accessToken);
   }
 
   @Patch('profile')

backend/src/modules/auth/auth.module.ts

@@ -1,4 +1,3 @@
-// backend/src/modules/auth/auth.module.ts
 import { Module } from '@nestjs/common';
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { JwtModule } from '@nestjs/jwt';
@@ -9,6 +8,7 @@ import { AdminUser } from './admin-user.entity';
 import { JwtStrategy } from './jwt.strategy';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { Restaurant } from '../restaurant/restaurant.entity';
+import { TokenBlacklistService } from './token-blacklist.service';
 
 @Module({
   imports: [
@@ -26,7 +26,7 @@ import { Restaurant } from '../restaurant/restaurant.entity';
     }),
   ],
   controllers: [AuthController],
-  providers: [AuthService, JwtStrategy],
-  exports: [AuthService, JwtModule],
+  providers: [AuthService, JwtStrategy, TokenBlacklistService],
+  exports: [AuthService],
 })
 export class AuthModule {}

backend/src/modules/auth/auth.service.spec.ts

@@ -0,0 +1,135 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { AuthService } from './auth.service';
+import { TokenBlacklistService } from './token-blacklist.service';
+
+jest.mock('uuid', () => ({
+  v4: jest.fn().mockReturnValue('mock-uuid-123'),
+}));
+
+describe('AuthService', () => {
+  let service: AuthService;
+  let jwtService: JwtService;
+  let tokenBlacklistService: any;
+
+  const mockAdminRepository = {
+    findOne: jest.fn(),
+    save: jest.fn(),
+    create: jest.fn(),
+    preload: jest.fn(),
+  };
+
+  const mockRestaurantRepository = {
+    findOne: jest.fn(),
+    save: jest.fn(),
+    create: jest.fn(),
+  };
+
+  beforeEach(() => {
+    jwtService = {
+      sign: jest.fn().mockReturnValue('mock-token'),
+      verify: jest.fn(),
+      decode: jest.fn(),
+    } as any;
+
+    tokenBlacklistService = {
+      blacklistToken: jest.fn(),
+      isBlacklisted: jest.fn().mockResolvedValue(false),
+      blacklistRefreshToken: jest.fn(),
+      isRefreshTokenValid: jest.fn().mockResolvedValue(true),
+      revokeRefreshToken: jest.fn(),
+    } as any;
+
+    service = new AuthService(
+      mockAdminRepository as any,
+      jwtService,
+      mockRestaurantRepository as any,
+      tokenBlacklistService,
+    );
+  });
+
+  describe('logout', () => {
+    it('should blacklist the access token on logout', async () => {
+      const mockUser = { id: '123', role: 'admin' };
+      const mockToken = 'valid.jwt.token';
+
+      jest.spyOn(jwtService, 'decode').mockReturnValue({
+        jti: 'token-jti-123',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      });
+
+      const result = await service.logout(mockUser, mockToken);
+
+      expect(tokenBlacklistService.blacklistToken).toHaveBeenCalledWith(
+        'token-jti-123',
+        expect.any(Number),
+      );
+      expect(result).toEqual({ message: 'Logged out successfully' });
+    });
+
+    it('should handle logout without access token', async () => {
+      const mockUser = { id: '123', role: 'admin' };
+
+      const result = await service.logout(mockUser);
+
+      expect(tokenBlacklistService.blacklistToken).not.toHaveBeenCalled();
+      expect(result).toEqual({ message: 'Logged out successfully' });
+    });
+  });
+
+  describe('refreshTokens', () => {
+    it('should issue new tokens with valid refresh token', async () => {
+      const mockAdmin = {
+        id: '123',
+        username: 'testuser',
+        role: 'admin',
+        restaurantId: 'rest-1',
+        isActive: true,
+        restaurant: { isActive: true, name: 'Test', slug: 'test' },
+      };
+
+      jest.spyOn(jwtService, 'verify').mockReturnValue({
+        sub: '123',
+        type: 'refresh',
+        jti: 'refresh-jti-123',
+      });
+
+      mockAdminRepository.findOne.mockResolvedValue(mockAdmin);
+
+      const result = await service.refreshTokens('valid-refresh-token');
+
+      expect(tokenBlacklistService.isRefreshTokenValid).toHaveBeenCalledWith(
+        'refresh-jti-123',
+      );
+      expect(tokenBlacklistService.revokeRefreshToken).toHaveBeenCalledWith(
+        'refresh-jti-123',
+      );
+      expect(result).toHaveProperty('accessToken');
+      expect(result).toHaveProperty('refreshToken');
+    });
+
+    it('should reject invalid refresh token', async () => {
+      jest.spyOn(jwtService, 'verify').mockImplementation(() => {
+        throw new Error('Invalid token');
+      });
+
+      await expect(service.refreshTokens('invalid-token')).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+
+    it('should reject revoked refresh token', async () => {
+      jest.spyOn(jwtService, 'verify').mockReturnValue({
+        sub: '123',
+        type: 'refresh',
+        jti: 'revoked-jti',
+      });
+
+      tokenBlacklistService.isRefreshTokenValid.mockResolvedValue(false);
+
+      await expect(service.refreshTokens('revoked-token')).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+  });
+});