@solidxai/core 0.1.15 → 0.1.16-beta.1

package/dist/seeders/seed-data/solid-core-metadata.json

@@ -4,7 +4,7 @@
         "displayName": "Solid Core",
         "description": "Solid Core Module",
         "defaultDataSource": "default",
-        "menuIconUrl": null,
+        "menuIconUrl": "media-files-storage/solid-core-menu-icon.png",
         "menuSequenceNumber": 1,
         "isSystem": true,
         "models": [
@@ -14958,6 +14958,7 @@
                     "enableGlobalSearch": true,
                     "create": false,
                     "edit": false,
+                    "delete": false,
                     "import": false,
                     "export": false,
                     "allowedViews": [
@@ -15089,7 +15090,8 @@
                     "label": "User Activity History",
                     "className": "grid",
                     "showAddFormButton": false,
-                    "showEditFormButton": false
+                    "showEditFormButton": false,
+                    "showDeleteFormButton": false
                 },
                 "children": [
                     {

package/dist/services/access-token-denylist.service.d.ts

@@ -0,0 +1,16 @@
+import { Cache } from "cache-manager";
+import { SettingService } from "./setting.service";
+export declare class AccessTokenDenylistService {
+    private readonly cacheManager;
+    private readonly settingService;
+    constructor(cacheManager: Cache, settingService: SettingService);
+    isEnabled(): boolean;
+    revokeSession(userId: number, sessionKey?: string): Promise<void>;
+    revokeAllForUser(userId: number): Promise<void>;
+    isRevoked(userId: number, sessionKey: string, issuedAtSeconds?: number): Promise<boolean>;
+    private revokedAt;
+    private getSessionKey;
+    private getUserKey;
+    private getEntryTtlMs;
+}
+//# sourceMappingURL=access-token-denylist.service.d.ts.map

package/dist/services/access-token-denylist.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-denylist.service.d.ts","sourceRoot":"","sources":["../../src/services/access-token-denylist.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA6BnD,qBACa,0BAA0B;IAEZ,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADS,YAAY,EAAE,KAAK,EAC1C,cAAc,EAAE,cAAc;IAGjD,SAAS,IAAI,OAAO;IAad,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBjE,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB/C,SAAS,CACb,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,OAAO,CAAC;IA8BnB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,aAAa;CAMtB"}

package/dist/services/access-token-denylist.service.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenDenylistService = void 0;
+const cache_manager_1 = require("@nestjs/cache-manager");
+const common_1 = require("@nestjs/common");
+const setting_service_1 = require("./setting.service");
+const ENTRY_TTL_BUFFER_SECONDS = 60;
+let AccessTokenDenylistService = class AccessTokenDenylistService {
+    constructor(cacheManager, settingService) {
+        this.cacheManager = cacheManager;
+        this.settingService = settingService;
+    }
+    isEnabled() {
+        return (this.settingService.getConfigValue("invalidateAccessTokenOnLogout") === true);
+    }
+    async revokeSession(userId, sessionKey) {
+        if (!this.isEnabled() || !sessionKey) {
+            return;
+        }
+        await this.cacheManager.set(this.getSessionKey(userId, sessionKey), this.revokedAt(), this.getEntryTtlMs());
+    }
+    async revokeAllForUser(userId) {
+        if (!this.isEnabled()) {
+            return;
+        }
+        await this.cacheManager.set(this.getUserKey(userId), this.revokedAt(), this.getEntryTtlMs());
+    }
+    async isRevoked(userId, sessionKey, issuedAtSeconds) {
+        if (!this.isEnabled()) {
+            return false;
+        }
+        if (typeof issuedAtSeconds !== "number") {
+            return true;
+        }
+        const [sessionRevokedAt, userRevokedAt] = await Promise.all([
+            this.cacheManager.get(this.getSessionKey(userId, sessionKey)),
+            this.cacheManager.get(this.getUserKey(userId)),
+        ]);
+        const revokedAt = Math.max(sessionRevokedAt ?? 0, userRevokedAt ?? 0);
+        return issuedAtSeconds * 1000 < revokedAt;
+    }
+    revokedAt() {
+        return (Math.floor(Date.now() / 1000) + 1) * 1000;
+    }
+    getSessionKey(userId, sessionKey) {
+        return `revoked-session-${userId}-${sessionKey}`;
+    }
+    getUserKey(userId) {
+        return `revoked-user-${userId}`;
+    }
+    getEntryTtlMs() {
+        const accessTokenTtlSeconds = Number(this.settingService.getConfigValue("accessTokenTtl"));
+        return (accessTokenTtlSeconds + ENTRY_TTL_BUFFER_SECONDS) * 1000;
+    }
+};
+exports.AccessTokenDenylistService = AccessTokenDenylistService;
+exports.AccessTokenDenylistService = AccessTokenDenylistService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(cache_manager_1.CACHE_MANAGER)),
+    __metadata("design:paramtypes", [Object, setting_service_1.SettingService])
+], AccessTokenDenylistService);
+//# sourceMappingURL=access-token-denylist.service.js.map

package/dist/services/access-token-denylist.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-denylist.service.js","sourceRoot":"","sources":["../../src/services/access-token-denylist.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,yDAAsD;AACtD,2CAAoD;AAGpD,uDAAmD;AAOnD,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAuB7B,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YAC0C,YAAmB,EAC1C,cAA8B;QADP,iBAAY,GAAZ,YAAY,CAAO;QAC1C,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ,SAAS;QACP,OAAO,CACL,IAAI,CAAC,cAAc,CAAC,cAAc,CAChC,+BAA+B,CAChC,KAAK,IAAI,CACX,CAAC;IACJ,CAAC;IAOD,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,UAAmB;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,EACtC,IAAI,CAAC,SAAS,EAAE,EAChB,IAAI,CAAC,aAAa,EAAE,CACrB,CAAC;IACJ,CAAC;IASD,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EACvB,IAAI,CAAC,SAAS,EAAE,EAChB,IAAI,CAAC,aAAa,EAAE,CACrB,CAAC;IACJ,CAAC;IASD,KAAK,CAAC,SAAS,CACb,MAAc,EACd,UAAkB,EAClB,eAAwB;QAExB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAKD,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,gBAAgB,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACrE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACvD,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC;QACtE,OAAO,eAAe,GAAG,IAAI,GAAG,SAAS,CAAC;IAC5C,CAAC;IAWO,SAAS;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IACpD,CAAC;IAEO,aAAa,CAAC,MAAc,EAAE,UAAkB;QACtD,OAAO,mBAAmB,MAAM,IAAI,UAAU,EAAE,CAAC;IACnD,CAAC;IAEO,UAAU,CAAC,MAAc;QAC/B,OAAO,gBAAgB,MAAM,EAAE,CAAC;IAClC,CAAC;IAKO,aAAa;QACnB,MAAM,qBAAqB,GAAG,MAAM,CAClC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,gBAAgB,CAAC,CACvE,CAAC;QACF,OAAO,CAAC,qBAAqB,GAAG,wBAAwB,CAAC,GAAG,IAAI,CAAC;IACnE,CAAC;CACF,CAAA;AA9GY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,6BAAa,CAAC,CAAA;6CACW,gCAAc;GAHtC,0BAA0B,CA8GtC","sourcesContent":["import { CACHE_MANAGER } from \"@nestjs/cache-manager\";\nimport { Inject, Injectable } from \"@nestjs/common\";\nimport { Cache } from \"cache-manager\";\nimport type { SolidCoreSetting } from \"src/services/settings/default-settings-provider.service\";\nimport { SettingService } from \"./setting.service\";\n\n// The denylist entry must outlive the longest-lived access token it could\n// match. Any token an entry rejects was issued before the revocation, so it\n// dies by revokedAt + accessTokenTtl at the latest; after that `exp` rejects it\n// and the entry is dead weight. Mirrors STATE_TTL_BUFFER_SECONDS in\n// refresh-token-ids-storage.service.ts.\nconst ENTRY_TTL_BUFFER_SECONDS = 60;\n\n/**\n * Immediate access-token revocation, opt-in via `invalidateAccessTokenOnLogout`.\n *\n * Entries record WHEN a session was revoked rather than merely that it was, and\n * the guard compares that instant against the token's own `iat`. The timestamp\n * is what makes a session-scoped key safe: some keys are reused across logins -\n * API-key auth passes a stable `apikey-<id>` deviceKey, and the per-user key\n * below is shared by every login that user will ever make - so a boolean entry\n * would have to either reject the newly minted token too, or be cleared on\n * re-issue and thereby revive the still-unexpired token the logout killed.\n * Comparing against `iat` needs neither: tokens minted after the revocation\n * pass, tokens minted before it fail, and nothing is ever cleared.\n *\n * This service owns the setting check - callers never branch on it. One source\n * of truth instead of three call sites that can drift, no `if (enabled)` nesting\n * in logout(), and a consuming project using the public seam cannot write\n * entries that nothing will ever read. `getConfigValue` is a synchronous\n * in-memory lookup, so a deployment that has not opted in pays nothing and\n * issues no I/O.\n */\n@Injectable()\nexport class AccessTokenDenylistService {\n  constructor(\n    @Inject(CACHE_MANAGER) private readonly cacheManager: Cache,\n    private readonly settingService: SettingService,\n  ) {}\n\n  isEnabled(): boolean {\n    return (\n      this.settingService.getConfigValue<SolidCoreSetting>(\n        \"invalidateAccessTokenOnLogout\",\n      ) === true\n    );\n  }\n\n  /**\n   * Revoke every access token belonging to one session. A no-op when the\n   * feature is off, and when no session key could be resolved - which spares\n   * the caller a null check.\n   */\n  async revokeSession(userId: number, sessionKey?: string): Promise<void> {\n    if (!this.isEnabled() || !sessionKey) {\n      return;\n    }\n    await this.cacheManager.set(\n      this.getSessionKey(userId, sessionKey),\n      this.revokedAt(),\n      this.getEntryTtlMs(),\n    );\n  }\n\n  /**\n   * Revoke every access token for a user, across all sessions - `allDevices`.\n   *\n   * Needs no claim on the token and no enumeration of buckets: every\n   * outstanding token was necessarily issued before the logout that writes\n   * this, so one entry sweeps them all.\n   */\n  async revokeAllForUser(userId: number): Promise<void> {\n    if (!this.isEnabled()) {\n      return;\n    }\n    await this.cacheManager.set(\n      this.getUserKey(userId),\n      this.revokedAt(),\n      this.getEntryTtlMs(),\n    );\n  }\n\n  /**\n   * True when the token was issued before either revocation instant that could\n   * apply to it - its own session's, or its user's.\n   *\n   * Returns false without touching the cache when the feature is off, which is\n   * why the guard needs no setting check of its own.\n   */\n  async isRevoked(\n    userId: number,\n    sessionKey: string,\n    issuedAtSeconds?: number,\n  ): Promise<boolean> {\n    if (!this.isEnabled()) {\n      return false;\n    }\n\n    // A token with no `iat` cannot be placed relative to a revocation. Tokens\n    // signed by @nestjs/jwt always carry one, so this is a malformed-payload\n    // guard rather than a real case; refuse rather than fail open.\n    if (typeof issuedAtSeconds !== \"number\") {\n      return true;\n    }\n\n    const [sessionRevokedAt, userRevokedAt] = await Promise.all([\n      this.cacheManager.get<number>(this.getSessionKey(userId, sessionKey)),\n      this.cacheManager.get<number>(this.getUserKey(userId)),\n    ]);\n\n    const revokedAt = Math.max(sessionRevokedAt ?? 0, userRevokedAt ?? 0);\n    return issuedAtSeconds * 1000 < revokedAt;\n  }\n\n  /**\n   * `iat` has whole-second resolution, so a token minted in the same second as\n   * the revocation is indistinguishable from one minted just before it.\n   * Rounding up resolves that ambiguity toward revoking: an automated client\n   * re-authenticating inside the window gets one 401 and succeeds on retry,\n   * whereas rounding down would leave a genuinely revoked token valid for up to\n   * a second. No human path can reach the window at all - logout invalidates\n   * the refresh token, so the next access token only exists after a fresh login.\n   */\n  private revokedAt(): number {\n    return (Math.floor(Date.now() / 1000) + 1) * 1000;\n  }\n\n  private getSessionKey(userId: number, sessionKey: string): string {\n    return `revoked-session-${userId}-${sessionKey}`;\n  }\n\n  private getUserKey(userId: number): string {\n    return `revoked-user-${userId}`;\n  }\n\n  // cache-manager v5 expects milliseconds; accessTokenTtl is configured in\n  // seconds. Read from the setting rather than hardcoded so that raising\n  // accessTokenTtl keeps entries long enough to outlive the tokens they match.\n  private getEntryTtlMs(): number {\n    const accessTokenTtlSeconds = Number(\n      this.settingService.getConfigValue<SolidCoreSetting>(\"accessTokenTtl\"),\n    );\n    return (accessTokenTtlSeconds + ENTRY_TTL_BUFFER_SECONDS) * 1000;\n  }\n}\n"]}

package/dist/services/authentication.service.d.ts

@@ -16,6 +16,7 @@ import { SignUpDto } from "../dtos/sign-up.dto";
 import { User } from "../entities/user.entity";
 import { ActiveUserData } from "../interfaces/active-user-data.interface";
 import { ActiveSessionStorageService } from "./active-session-storage.service";
+import { AccessTokenDenylistService } from "./access-token-denylist.service";
 import { HashingService } from "./hashing.service";
 import { RefreshTokenIdsStorageService } from "./refresh-token-ids-storage.service";
 import { SsoCodeStorageService } from "./sso-code-storage.service";
@@ -33,6 +34,7 @@ export declare class AuthenticationService {
     private readonly hashingService;
     private readonly jwtService;
     private readonly activeSessionStorage;
+    private readonly accessTokenDenylist;
     private readonly refreshTokenIdsStorage;
     private readonly httpService;
     private readonly mailServiceFactory;
@@ -47,7 +49,7 @@ export declare class AuthenticationService {
     private readonly dataSource;
     private readonly solidRegistry;
     private readonly logger;
-    constructor(userService: UserService, userRepository: UserRepository, hashingService: HashingService, jwtService: JwtService, activeSessionStorage: ActiveSessionStorageService, refreshTokenIdsStorage: RefreshTokenIdsStorageService, httpService: HttpService, mailServiceFactory: MailFactory, smsFactory: SmsFactory, whatsAppFactory: WhatsAppFactory, eventEmitter: EventEmitter2, settingService: SettingService, roleMetadataService: RoleMetadataService, userActivityHistoryService: UserActivityHistoryService, ssoCodeStorage: SsoCodeStorageService, metadataValidationService: MetadataValidationService, dataSource: DataSource, solidRegistry: SolidRegistry);
+    constructor(userService: UserService, userRepository: UserRepository, hashingService: HashingService, jwtService: JwtService, activeSessionStorage: ActiveSessionStorageService, accessTokenDenylist: AccessTokenDenylistService, refreshTokenIdsStorage: RefreshTokenIdsStorageService, httpService: HttpService, mailServiceFactory: MailFactory, smsFactory: SmsFactory, whatsAppFactory: WhatsAppFactory, eventEmitter: EventEmitter2, settingService: SettingService, roleMetadataService: RoleMetadataService, userActivityHistoryService: UserActivityHistoryService, ssoCodeStorage: SsoCodeStorageService, metadataValidationService: MetadataValidationService, dataSource: DataSource, solidRegistry: SolidRegistry);
     private getCompanyLogo;
     resolveUser(username: string, email: string): Promise<User>;
     private resolveUserForPasswordSignIn;
@@ -238,6 +240,12 @@ export declare class AuthenticationService {
     logout(refreshToken: string, allDevices?: boolean): Promise<{
         message: string;
     }>;
+    private ownsLiveSession;
+    private resolveRevocationKey;
+    resolveSessionRevocationKey(refreshToken: string): Promise<{
+        userId: number;
+        revocationKey?: string;
+    } | null>;
     private verifyRefreshTokenForLogout;
     activateUser(userId: number): Promise<void>;
     me(activeUser: ActiveUserData): Promise<{

package/dist/services/authentication.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.service.d.ts","sourceRoot":"","sources":["../../src/services/authentication.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAY5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AAOhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAEL,6BAA6B,EAC9B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAa3D,qBACa,qBAAqB;IAI9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAG1C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAzBhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAG9C,WAAW,EAAE,WAAW,EAExB,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,oBAAoB,EAAE,2BAA2B,EACjD,sBAAsB,EAAE,6BAA6B,EACrD,WAAW,EAAE,WAAW,EAExB,kBAAkB,EAAE,WAAW,EAE/B,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,YAAY,EAAE,aAAa,EAC3B,cAAc,EAAE,cAAc,EAC9B,mBAAmB,EAAE,mBAAmB,EACxC,0BAA0B,EAAE,0BAA0B,EACtD,cAAc,EAAE,qBAAqB,EACrC,yBAAyB,EAAE,yBAAyB,EAGpD,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa;YAKjC,cAAc;IAItB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;YASnC,4BAA4B;IAoBpC,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM;IAcrD,8BAA8B,CAAC,KAAK,EAAE,MAAM;YAOpC,4BAA4B;YAmB5B,wBAAwB;IAWtC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAUpC;IAEG,MAAM,CACV,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1C,UAAU,GAAE,cAAqB,GAChC,OAAO,CAAC,IAAI,CAAC;YAuBF,aAAa;YA6Db,6BAA6B;YAqD7B,2BAA2B;IAqCnC,sBAAsB,CAAC,CAAC,SAAS,IAAI,EACzC,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,EAChC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC;YAKC,iBAAiB;YAmEjB,gBAAgB;IA8B9B,gBAAgB,CAAC,MAAM,GAAE,MAAU,GAAG,MAAM;YAiB9B,+BAA+B;YAkC/B,qBAAqB;YAQrB,mBAAmB;YAQnB,kBAAkB;IAwD1B,uBAAuB,CAAC,SAAS,EAAE,YAAY;;;IAkCrD,OAAO,CAAC,4BAA4B;YAsBtB,4BAA4B;IAa1C,OAAO,CAAC,mCAAmC;YAM7B,4CAA4C;IAuB1D,OAAO,CAAC,UAAU;YAWJ,qBAAqB;YAqCrB,mCAAmC;IA+HjD,OAAO,CAAC,4BAA4B;YAkCtB,yBAAyB;IAajC,sBAAsB,CAAC,gBAAgB,EAAE,gBAAgB;;;;YAoCjD,gCAAgC;IAe9C,OAAO,CAAC,uBAAuB;IAqB/B,OAAO,CAAC,oBAAoB;IAe5B,OAAO,CAAC,wBAAwB;YAMlB,uDAAuD;YAwBvD,GAAG;IAWjB,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,gBAAgB;IAclB,MAAM,CAAC,SAAS,EAAE,SAAS;;;;;;;;;;;;IA6BjC,OAAO,CAAC,SAAS;IAajB,OAAO,CAAC,UAAU;IAWZ,gBAAgB,CAAC,SAAS,EAAE,YAAY;;;;;;;;;;IAmB9C,OAAO,CAAC,gBAAgB;YA2BV,4BAA4B;YAkB5B,gBAAgB;YAqBhB,cAAc;IAsB5B,OAAO,CAAC,qBAAqB;YAcf,6BAA6B;IAwHrC,eAAe,CAAC,gBAAgB,EAAE,gBAAgB;;;;;;;;;;;;IA2CxD,OAAO,CAAC,gBAAgB;YAqBV,aAAa;IA2B3B,OAAO,CAAC,gBAAgB;YAMV,uBAAuB;IAK/B,cAAc,CAClB,iBAAiB,EAAE,iBAAiB,EACpC,UAAU,EAAE,cAAc;YA0Dd,2BAA2B;IAiBnC,sBAAsB,CAC1B,yBAAyB,EAAE,yBAAyB;;;;;;;;;;;YAsDxC,0BAA0B;IA8DlC,qBAAqB,CACzB,wBAAwB,EAAE,wBAAwB;;;;;;;YA6DtC,2BAA2B;IAoEnC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM;;;;IA4B5C,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;IA2BtE,oBAAoB,CACxB,IAAI,EAAE,IAAI,EACV,oBAAoB,CAAC,EAAE,MAAM,EAC7B,SAAS,CAAC,EAAE,MAAM;IA8Bd,aAAa,CAAC,eAAe,EAAE,eAAe;;;;YA2EtC,SAAS;IAuBjB,uBAAuB,CAAC,IAAI,EAAE,IAAI;IAyBlC,iBAAiB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;IAqCpC,yBAAyB,CAAC,IAAI,EAAE,IAAI;IAiCpC,mBAAmB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;IAoCtC,0BAA0B,CAAC,IAAI,EAAE,IAAI;IA0BrC,oBAAoB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;IAoCvC,yCAAyC,CAAC,IAAI,EAAE,IAAI;IA0CpD,mCAAmC,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;IAoCtD,gBAAgB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;YAkC3B,iCAAiC;IAO/C,OAAO,CAAC,6BAA6B;IAQrC,OAAO,CAAC,mBAAmB;YAab,uBAAuB;YAQvB,mBAAmB;IAa3B,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,UAAQ;;;YAgDvC,2BAA2B;IAyBnC,YAAY,CAAC,MAAM,EAAE,MAAM;IAS3B,EAAE,CAAC,UAAU,EAAE,cAAc;;;;;;;;;;IAwC7B,eAAe,CACnB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBzB,eAAe,CAAC,IAAI,EAAE,MAAM;;;;;;;;;;;;CAYnC"}
+{"version":3,"file":"authentication.service.d.ts","sourceRoot":"","sources":["../../src/services/authentication.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAY5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AAOhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAEL,6BAA6B,EAC9B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAa3D,qBACa,qBAAqB;IAI9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAG1C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IA1BhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAG9C,WAAW,EAAE,WAAW,EAExB,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,oBAAoB,EAAE,2BAA2B,EACjD,mBAAmB,EAAE,0BAA0B,EAC/C,sBAAsB,EAAE,6BAA6B,EACrD,WAAW,EAAE,WAAW,EAExB,kBAAkB,EAAE,WAAW,EAE/B,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,YAAY,EAAE,aAAa,EAC3B,cAAc,EAAE,cAAc,EAC9B,mBAAmB,EAAE,mBAAmB,EACxC,0BAA0B,EAAE,0BAA0B,EACtD,cAAc,EAAE,qBAAqB,EACrC,yBAAyB,EAAE,yBAAyB,EAGpD,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa;YAKjC,cAAc;IAItB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;YASnC,4BAA4B;IAoBpC,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM;IAcrD,8BAA8B,CAAC,KAAK,EAAE,MAAM;YAOpC,4BAA4B;YAmB5B,wBAAwB;IAWtC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAUpC;IAEG,MAAM,CACV,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1C,UAAU,GAAE,cAAqB,GAChC,OAAO,CAAC,IAAI,CAAC;YAuBF,aAAa;YA6Db,6BAA6B;YAqD7B,2BAA2B;IAqCnC,sBAAsB,CAAC,CAAC,SAAS,IAAI,EACzC,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,EAChC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC;YAKC,iBAAiB;YAmEjB,gBAAgB;IA8B9B,gBAAgB,CAAC,MAAM,GAAE,MAAU,GAAG,MAAM;YAiB9B,+BAA+B;YAkC/B,qBAAqB;YAQrB,mBAAmB;YAQnB,kBAAkB;IAwD1B,uBAAuB,CAAC,SAAS,EAAE,YAAY;;;IAkCrD,OAAO,CAAC,4BAA4B;YAsBtB,4BAA4B;IAa1C,OAAO,CAAC,mCAAmC;YAM7B,4CAA4C;IAuB1D,OAAO,CAAC,UAAU;YAWJ,qBAAqB;YAqCrB,mCAAmC;IA+HjD,OAAO,CAAC,4BAA4B;YAkCtB,yBAAyB;IAajC,sBAAsB,CAAC,gBAAgB,EAAE,gBAAgB;;;;YAoCjD,gCAAgC;IAe9C,OAAO,CAAC,uBAAuB;IAqB/B,OAAO,CAAC,oBAAoB;IAe5B,OAAO,CAAC,wBAAwB;YAMlB,uDAAuD;YAwBvD,GAAG;IAWjB,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,gBAAgB;IAclB,MAAM,CAAC,SAAS,EAAE,SAAS;;;;;;;;;;;;IA6BjC,OAAO,CAAC,SAAS;IAajB,OAAO,CAAC,UAAU;IAWZ,gBAAgB,CAAC,SAAS,EAAE,YAAY;;;;;;;;;;IAmB9C,OAAO,CAAC,gBAAgB;YA2BV,4BAA4B;YAkB5B,gBAAgB;YAqBhB,cAAc;IAsB5B,OAAO,CAAC,qBAAqB;YAcf,6BAA6B;IAwHrC,eAAe,CAAC,gBAAgB,EAAE,gBAAgB;;;;;;;;;;;;IA2CxD,OAAO,CAAC,gBAAgB;YAqBV,aAAa;IA2B3B,OAAO,CAAC,gBAAgB;YAMV,uBAAuB;IAK/B,cAAc,CAClB,iBAAiB,EAAE,iBAAiB,EACpC,UAAU,EAAE,cAAc;YA0Dd,2BAA2B;IAiBnC,sBAAsB,CAC1B,yBAAyB,EAAE,yBAAyB;;;;;;;;;;;YAsDxC,0BAA0B;IA8DlC,qBAAqB,CACzB,wBAAwB,EAAE,wBAAwB;;;;;;;YA6DtC,2BAA2B;IAoEnC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM;;;;IA4B5C,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;IA2BtE,oBAAoB,CACxB,IAAI,EAAE,IAAI,EACV,oBAAoB,CAAC,EAAE,MAAM,EAC7B,SAAS,CAAC,EAAE,MAAM;IA8Bd,aAAa,CAAC,eAAe,EAAE,eAAe;;;;YA2EtC,SAAS;IAuBjB,uBAAuB,CAAC,IAAI,EAAE,IAAI;IAyBlC,iBAAiB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;IAqCpC,yBAAyB,CAAC,IAAI,EAAE,IAAI;IAiCpC,mBAAmB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;IAoCtC,0BAA0B,CAAC,IAAI,EAAE,IAAI;IA0BrC,oBAAoB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;IAoCvC,yCAAyC,CAAC,IAAI,EAAE,IAAI;IA0CpD,mCAAmC,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;IAoCtD,gBAAgB,CAAC,UAAU,EAAE,MAAM;;;;;;;;;;;YAkC3B,iCAAiC;IAO/C,OAAO,CAAC,6BAA6B;IAQrC,OAAO,CAAC,mBAAmB;YAab,uBAAuB;YAQvB,mBAAmB;IAa3B,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,UAAQ;;;YAyFvC,eAAe;YA0Bf,oBAAoB;IA4B5B,2BAA2B,CAC/B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAiB/C,2BAA2B;IAyBnC,YAAY,CAAC,MAAM,EAAE,MAAM;IAS3B,EAAE,CAAC,UAAU,EAAE,cAAc;;;;;;;;;;IAwC7B,eAAe,CACnB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBzB,eAAe,CAAC,IAAI,EAAE,MAAM;;;;;;;;;;;;CAYnC"}

package/dist/services/authentication.service.js

@@ -31,6 +31,7 @@ const constants_1 = require("../constants");
 const user_entity_1 = require("../entities/user.entity");
 const interfaces_1 = require("../interfaces");
 const active_session_storage_service_1 = require("./active-session-storage.service");
+const access_token_denylist_service_1 = require("./access-token-denylist.service");
 const hashing_service_1 = require("./hashing.service");
 const refresh_token_ids_storage_service_1 = require("./refresh-token-ids-storage.service");
 const sso_code_storage_service_1 = require("./sso-code-storage.service");
@@ -49,12 +50,13 @@ var LoginProvider;
     LoginProvider["OTP"] = "otp";
 })(LoginProvider || (LoginProvider = {}));
 let AuthenticationService = AuthenticationService_1 = class AuthenticationService {
-    constructor(userService, userRepository, hashingService, jwtService, activeSessionStorage, refreshTokenIdsStorage, httpService, mailServiceFactory, smsFactory, whatsAppFactory, eventEmitter, settingService, roleMetadataService, userActivityHistoryService, ssoCodeStorage, metadataValidationService, dataSource, solidRegistry) {
+    constructor(userService, userRepository, hashingService, jwtService, activeSessionStorage, accessTokenDenylist, refreshTokenIdsStorage, httpService, mailServiceFactory, smsFactory, whatsAppFactory, eventEmitter, settingService, roleMetadataService, userActivityHistoryService, ssoCodeStorage, metadataValidationService, dataSource, solidRegistry) {
         this.userService = userService;
         this.userRepository = userRepository;
         this.hashingService = hashingService;
         this.jwtService = jwtService;
         this.activeSessionStorage = activeSessionStorage;
+        this.accessTokenDenylist = accessTokenDenylist;
         this.refreshTokenIdsStorage = refreshTokenIdsStorage;
         this.httpService = httpService;
         this.mailServiceFactory = mailServiceFactory;
@@ -1490,11 +1492,16 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
             const userId = payload.sub;
             if (allDevices) {
                 await this.refreshTokenIdsStorage.invalidateAll(userId);
+                await this.accessTokenDenylist.revokeAllForUser(userId);
             }
-            else {
+            else if (await this.ownsLiveSession(userId, payload, refreshToken)) {
                 await this.refreshTokenIdsStorage.invalidate(userId, payload.deviceKey);
+                await this.accessTokenDenylist.revokeSession(userId, await this.resolveRevocationKey(userId, payload));
+                await this.activeSessionStorage.clearActiveSession(userId);
+            }
+            else {
+                this.logger.warn(`logout: refresh token does not match the live session for user ${userId}; nothing invalidated`);
             }
-            await this.activeSessionStorage.clearActiveSession(userId);
             const user = await this.userRepository.findOne({
                 where: {
                     id: userId,
@@ -1512,6 +1519,33 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
                 : new common_1.InternalServerErrorException(error_messages_1.ERROR_MESSAGES.LOGOUT_FAILED);
         }
     }
+    async ownsLiveSession(userId, payload, refreshToken) {
+        if (payload.deviceKey) {
+            return true;
+        }
+        const state = await this.refreshTokenIdsStorage.getCurrentRefreshTokenState(userId);
+        return (state?.currentRefreshToken === refreshToken ||
+            (!!state?.previousRefreshToken &&
+                state.previousRefreshToken === refreshToken));
+    }
+    async resolveRevocationKey(userId, payload) {
+        return (payload.deviceKey ??
+            (await this.activeSessionStorage.getActiveSession(userId)));
+    }
+    async resolveSessionRevocationKey(refreshToken) {
+        const payload = await this.verifyRefreshTokenForLogout(refreshToken);
+        if (!payload?.sub) {
+            return null;
+        }
+        const userId = payload.sub;
+        if (!(await this.ownsLiveSession(userId, payload, refreshToken))) {
+            return { userId };
+        }
+        return {
+            userId,
+            revocationKey: await this.resolveRevocationKey(userId, payload),
+        };
+    }
     async verifyRefreshTokenForLogout(refreshToken) {
         try {
             const payload = await this.jwtService.verifyAsync(refreshToken, {
@@ -1590,12 +1624,13 @@ AuthenticationService.SIGNUP_DTO_KEYS = new Set([
 ]);
 exports.AuthenticationService = AuthenticationService = AuthenticationService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __param(16, (0, typeorm_1.InjectDataSource)()),
+    __param(17, (0, typeorm_1.InjectDataSource)()),
     __metadata("design:paramtypes", [user_service_1.UserService,
         user_repository_1.UserRepository,
         hashing_service_1.HashingService,
         jwt_1.JwtService,
         active_session_storage_service_1.ActiveSessionStorageService,
+        access_token_denylist_service_1.AccessTokenDenylistService,
         refresh_token_ids_storage_service_1.RefreshTokenIdsStorageService,
         axios_1.HttpService,
         mail_factory_1.MailFactory,