@solidxai/core 0.1.15 → 0.1.16-beta.0

package/postman/instant-logout.postman_collection.json

@@ -0,0 +1,1493 @@
+{
+  "info": {
+    "name": "SolidX — Instant Logout (access-token revocation)",
+    "description": "Verifies `invalidateAccessTokenOnLogout`.\n\n## Before you run\n\n1. Point `baseUrl` at a running app that depends on this build of @solidxai/core (include the global prefix if the app sets one, e.g. http://localhost:3000/api).\n2. Set `email` / `username` / `password` to a user that can edit settings (the settings requests need a bearer token).\n3. **Set `IAM_JWT_ACCESS_TOKEN_TTL` high (e.g. 3600) and restart the app.** Otherwise a token expiring mid-run looks exactly like a revoked one and the results are meaningless.\n4. Run folders in order with the Collection Runner. Folder A must run before B — it establishes that the default (setting off) behaviour is unchanged.\n\n## Notes\n\n- `SettingService` caches per process, so run this against a single replica. With more than one, a setting toggle only reaches the instance that served the write.\n- Without REDIS_HOST/REDIS_PORT the cache is per-process in-memory. That is fine for a single-instance test run.\n- Folder D flips `preventConcurrentLogins` on and folder E turns everything back off. If a run aborts midway, run folder E before doing anything else.",
+    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
+  },
+  "variable": [
+    {
+      "key": "baseUrl",
+      "value": "http://localhost:3000",
+      "type": "string"
+    },
+    {
+      "key": "email",
+      "value": "sa@solidxai.com",
+      "type": "string"
+    },
+    {
+      "key": "username",
+      "value": "sa",
+      "type": "string"
+    },
+    {
+      "key": "password",
+      "value": "",
+      "type": "string"
+    },
+    {
+      "key": "adminToken",
+      "value": "",
+      "type": "string"
+    },
+    {
+      "key": "accessToken",
+      "value": "",
+      "type": "string"
+    },
+    {
+      "key": "refreshToken",
+      "value": "",
+      "type": "string"
+    },
+    {
+      "key": "accessToken2",
+      "value": "",
+      "type": "string"
+    },
+    {
+      "key": "refreshToken2",
+      "value": "",
+      "type": "string"
+    },
+    {
+      "key": "staleAccessToken",
+      "value": "",
+      "type": "string"
+    },
+    {
+      "key": "staleRefreshToken",
+      "value": "",
+      "type": "string"
+    }
+  ],
+  "item": [
+    {
+      "name": "00 — Setup",
+      "item": [
+        {
+          "name": "Login as admin (for settings)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('login succeeds', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('adminToken', b.accessToken);",
+                  "pm.test('got an access token', () => pm.expect(b.accessToken).to.be.a('string').and.not.empty);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"email\": \"{{email}}\",\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/authenticate",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "authenticate"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    {
+      "name": "A — Setting OFF (default): behaviour unchanged",
+      "description": "Proves opting out costs nothing. The access token must survive logout exactly as it does today.",
+      "item": [
+        {
+          "name": "A1. invalidateAccessTokenOnLogout = false",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('setting updated', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "PUT",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              },
+              {
+                "key": "Authorization",
+                "value": "Bearer {{adminToken}}"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"settings\": [\n    { \"key\": \"invalidateAccessTokenOnLogout\", \"value\": \"false\", \"type\": \"system\" }\n  ]\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/setting/bulk",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "setting",
+                "bulk"
+              ]
+            }
+          }
+        },
+        {
+          "name": "A2. Login",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('login succeeds', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('accessToken', b.accessToken);",
+                  "pm.collectionVariables.set('refreshToken', b.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"email\": \"{{email}}\",\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/authenticate",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "authenticate"
+              ]
+            }
+          }
+        },
+        {
+          "name": "A3. GET /iam/me → 200",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('token works before logout', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        },
+        {
+          "name": "A4. Logout",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('logout returns 200', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"refreshToken\": \"{{refreshToken}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/logout",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "logout"
+              ]
+            }
+          }
+        },
+        {
+          "name": "A5. GET /iam/me with the SAME token → still 200",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// With the feature off, logout must NOT invalidate the access token.",
+                  "// A 401 here means the setting is being ignored and opted-out",
+                  "// deployments would see a behaviour change.",
+                  "pm.test('access token survives logout when feature is off', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    {
+      "name": "B — Setting ON: instant logout",
+      "description": "The feature itself. Step B5 is the fix.",
+      "item": [
+        {
+          "name": "B1. invalidateAccessTokenOnLogout = true",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('setting updated', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "PUT",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              },
+              {
+                "key": "Authorization",
+                "value": "Bearer {{adminToken}}"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"settings\": [\n    { \"key\": \"invalidateAccessTokenOnLogout\", \"value\": \"true\", \"type\": \"system\" }\n  ]\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/setting/bulk",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "setting",
+                "bulk"
+              ]
+            }
+          }
+        },
+        {
+          "name": "B2. Login",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('login succeeds', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('accessToken', b.accessToken);",
+                  "pm.collectionVariables.set('refreshToken', b.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"email\": \"{{email}}\",\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/authenticate",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "authenticate"
+              ]
+            }
+          }
+        },
+        {
+          "name": "B3. GET /iam/me → 200",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('token works before logout', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        },
+        {
+          "name": "B4. Logout",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('logout returns 200', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"refreshToken\": \"{{refreshToken}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/logout",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "logout"
+              ]
+            }
+          }
+        },
+        {
+          "name": "B5. GET /iam/me with the SAME token → 401  ← THE FIX",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// The whole point. Before this change the token stayed valid for the",
+                  "// remainder of accessTokenTtl (20 min in prod).",
+                  "pm.test('access token is revoked immediately', () => pm.response.to.have.status(401));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        },
+        {
+          "name": "B6. Refresh with the old refresh token → 401",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('refresh token also invalidated (unchanged behaviour)', () => pm.response.to.have.status(401));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"refreshToken\": \"{{refreshToken}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/refresh-tokens",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "refresh-tokens"
+              ]
+            }
+          }
+        },
+        {
+          "name": "B7. Log in again → new token works",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('login still works after logout', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('accessToken', b.accessToken);",
+                  "pm.collectionVariables.set('refreshToken', b.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"email\": \"{{email}}\",\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/authenticate",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "authenticate"
+              ]
+            }
+          }
+        },
+        {
+          "name": "B8. GET /iam/me with the NEW token → 200 (user not poisoned)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// Guards against a revocation entry outliving its session and killing",
+                  "// freshly minted tokens - the failure a boolean denylist would have.",
+                  "pm.test('new token is not born revoked', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    {
+      "name": "C — Scope: one session vs allDevices",
+      "description": "Requires preventConcurrentLogins = false (the default) so two sessions can coexist.",
+      "item": [
+        {
+          "name": "C1. Login as client 1",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('client 1 logged in', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('accessToken', b.accessToken);",
+                  "pm.collectionVariables.set('refreshToken', b.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"email\": \"{{email}}\",\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/authenticate",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "authenticate"
+              ]
+            }
+          }
+        },
+        {
+          "name": "C2. Login as client 2",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('client 2 logged in', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('accessToken2', b.accessToken);",
+                  "pm.collectionVariables.set('refreshToken2', b.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"email\": \"{{email}}\",\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/authenticate",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "authenticate"
+              ]
+            }
+          }
+        },
+        {
+          "name": "C3. Logout client 1 (scoped)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('logout returns 200', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"refreshToken\": \"{{refreshToken}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/logout",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "logout"
+              ]
+            }
+          }
+        },
+        {
+          "name": "C4. Client 1 token → 401",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('client 1 is revoked', () => pm.response.to.have.status(401));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        },
+        {
+          "name": "C5. Client 2 token → 200 (scoping works)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// A scoped logout must not touch other devices. A 401 here means the",
+                  "// per-session key is wrong and logout is acting user-wide.",
+                  "pm.test('client 2 is untouched', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken2}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        },
+        {
+          "name": "C6. Login client 1 again",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('client 1 logged back in', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('accessToken', b.accessToken);",
+                  "pm.collectionVariables.set('refreshToken', b.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"email\": \"{{email}}\",\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/authenticate",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "authenticate"
+              ]
+            }
+          }
+        },
+        {
+          "name": "C7. Logout with allDevices: true",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('logout returns 200', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"refreshToken\": \"{{refreshToken}}\",\n  \"allDevices\": true\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/logout",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "logout"
+              ]
+            }
+          }
+        },
+        {
+          "name": "C8. Client 1 token → 401",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('client 1 revoked', () => pm.response.to.have.status(401));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        },
+        {
+          "name": "C9. Client 2 token → 401 (allDevices swept it)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// The per-user revocation key. Client 2 never presented a token to",
+                  "// this logout, yet must still be revoked.",
+                  "pm.test('allDevices revokes other sessions too', () => pm.response.to.have.status(401));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken2}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        },
+        {
+          "name": "C10. Login again → works (per-user entry is a timestamp, not a flag)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('login after allDevices logout succeeds', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('accessToken', b.accessToken);",
+                  "pm.collectionVariables.set('refreshToken', b.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"email\": \"{{email}}\",\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/authenticate",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "authenticate"
+              ]
+            }
+          }
+        },
+        {
+          "name": "C11. New token → 200  ← boolean flag would fail here",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// revoked-user-<id> is shared by every login this user will ever make.",
+                  "// A boolean entry would lock the account out until the entry expired;",
+                  "// the timestamp lets a newer token through.",
+                  "pm.test('user is not locked out by allDevices logout', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    {
+      "name": "D — Stale logout must not kill the live session",
+      "description": "The ownership check. Needs preventConcurrentLogins = true, where all sessions share the bare `user-<id>` bucket. Folder E turns it back off.",
+      "item": [
+        {
+          "name": "D1. preventConcurrentLogins = true",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('setting updated', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "PUT",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              },
+              {
+                "key": "Authorization",
+                "value": "Bearer {{adminToken}}"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"settings\": [\n    { \"key\": \"preventConcurrentLogins\", \"value\": \"true\", \"type\": \"system\" },\n    { \"key\": \"invalidateAccessTokenOnLogout\", \"value\": \"true\", \"type\": \"system\" }\n  ]\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/setting/bulk",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "setting",
+                "bulk"
+              ]
+            }
+          }
+        },
+        {
+          "name": "D2. Login as client 1 (will be superseded)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('client 1 logged in', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('staleAccessToken', b.accessToken);",
+                  "pm.collectionVariables.set('staleRefreshToken', b.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"email\": \"{{email}}\",\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/authenticate",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "authenticate"
+              ]
+            }
+          }
+        },
+        {
+          "name": "D3. Login as client 2 (supersedes client 1)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('client 2 logged in', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('accessToken2', b.accessToken);",
+                  "pm.collectionVariables.set('refreshToken2', b.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"email\": \"{{email}}\",\n  \"username\": \"{{username}}\",\n  \"password\": \"{{password}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/authenticate",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "authenticate"
+              ]
+            }
+          }
+        },
+        {
+          "name": "D4. Client 1 token → 401 (concurrent-login check working)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('superseded session is rejected', () => pm.response.to.have.status(401));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{staleAccessToken}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        },
+        {
+          "name": "D5. Client 2 token → 200",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('live session works', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken2}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        },
+        {
+          "name": "D6. Logout with the STALE refresh token",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// Client 1 tidying up after its 401. Still reports success (RFC 7009).",
+                  "pm.test('stale logout returns 200', () => pm.response.to.have.status(200));",
+                  "// The server logs: 'refresh token does not match the live session'"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"refreshToken\": \"{{staleRefreshToken}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/logout",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "logout"
+              ]
+            }
+          }
+        },
+        {
+          "name": "D7. Client 2 access token → still 200  ← THE OWNERSHIP FIX",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// Without ownsLiveSession this is 401: the stale logout resolves the",
+                  "// revocation key via getActiveSession, which now holds client 2's",
+                  "// session. The laptop's cleanup would log out the phone.",
+                  "pm.test('stale logout did not revoke the live session', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken2}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        },
+        {
+          "name": "D8. Client 2 refresh token → still works",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// The pre-existing half: invalidate() would otherwise have deleted the",
+                  "// bare user-<id> bucket, which by now holds client 2's refresh token.",
+                  "pm.test('stale logout did not delete the live refresh token', () => pm.response.to.have.status(200));",
+                  "// WrapResponseInterceptor wraps every payload as",
+                  "// { statusCode, message, error, data }. Fall back to the raw body so this",
+                  "// also works against an app that does not register that interceptor.",
+                  "const body = pm.response.json();",
+                  "const b = body.data ?? body;",
+                  "pm.collectionVariables.set('accessToken2', b.accessToken);",
+                  "pm.collectionVariables.set('refreshToken2', b.refreshToken);"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"refreshToken\": \"{{refreshToken2}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/refresh-tokens",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "refresh-tokens"
+              ]
+            }
+          }
+        },
+        {
+          "name": "D9. Client 2 logs out properly → 401",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('genuine logout returns 200', () => pm.response.to.have.status(200));",
+                  "// Confirms the ownership check does not block legitimate logouts:",
+                  "// verified by the follow-up request D10."
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"refreshToken\": \"{{refreshToken2}}\"\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/iam/logout",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "logout"
+              ]
+            }
+          }
+        },
+        {
+          "name": "D10. Client 2 token → 401 (genuine logout still revokes)",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "// The ownership check must not be so strict that real logouts no-op.",
+                  "pm.test('legitimate logout still revokes', () => pm.response.to.have.status(401));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "GET",
+            "header": [
+              {
+                "key": "Authorization",
+                "value": "Bearer {{accessToken2}}"
+              }
+            ],
+            "url": {
+              "raw": "{{baseUrl}}/iam/me",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "iam",
+                "me"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    {
+      "name": "E — Teardown (always run this)",
+      "item": [
+        {
+          "name": "E1. Reset both settings to false",
+          "event": [
+            {
+              "listen": "test",
+              "script": {
+                "type": "text/javascript",
+                "exec": [
+                  "pm.test('settings reset', () => pm.response.to.have.status(200));"
+                ]
+              }
+            }
+          ],
+          "request": {
+            "method": "PUT",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json"
+              },
+              {
+                "key": "Authorization",
+                "value": "Bearer {{adminToken}}"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n  \"settings\": [\n    { \"key\": \"preventConcurrentLogins\", \"value\": \"false\", \"type\": \"system\" },\n    { \"key\": \"invalidateAccessTokenOnLogout\", \"value\": \"false\", \"type\": \"system\" }\n  ]\n}"
+            },
+            "url": {
+              "raw": "{{baseUrl}}/setting/bulk",
+              "host": [
+                "{{baseUrl}}"
+              ],
+              "path": [
+                "setting",
+                "bulk"
+              ]
+            }
+          }
+        }
+      ]
+    }
+  ]
+}