Feat/session

[codesailor4]

Implementation Complete

I've successfully implemented the secure session and token management system for Mind Block. Here's a summary of what was accomplished:

Backend Implementation

• Session Entity: Created session.entity.ts to store user sessions in the database
• Session Provider: Created sessions.provider.ts for session management operations
• Token Configuration: Updated jwt.config.ts to add separate accessTokenTtl and refreshTokenTtl
• New Endpoints: Added to auth.controller.ts:
  • POST /auth/logout - Invalidate current session
  • POST /auth/logout-all - Invalidate all user sessions
  • GET /auth/me - Get current authenticated user data
• Token Security: Implemented SHA-256 hashing for refresh tokens, token rotation, and session invalidation
• Module Updates: Updated auth.module.ts to include the new Session entity and SessionsProvider

Frontend Implementation

• Auth State Management: Updated authSlice.ts to add refreshToken support and session restoration
• Session Restoration: Added session restoration on app load in ClientLayout.tsx
• Automatic Token Refresh: Implemented interval-based token refresh to renew tokens before expiration
• Logout Integration: Updated useAuth.ts to call the backend logout endpoint
• Logout UI: Added logout button to SideNav.tsx that's only visible to authenticated users
• Login Flow: Updated signin/page.tsx to handle the new token response format

Security Features Implemented

1. Refresh Token Hashing: Refresh tokens are hashed with SHA-256 before storage
2. Token Rotation: New refresh token is issued on each refresh
3. Session Storage: All sessions are stored in the database with expiration dates
4. Sensitive Data Protection: /auth/me endpoint excludes sensitive user data
5. Session Invalidation: Logout functionality properly invalidates sessions

Both Servers Running

• Frontend: http://localhost:3000 - Ready for use
• Backend: Running in development mode with TypeORM auto-sync enabled (sessions table created automatically)

The implementation meets all the acceptance criteria for secure session and token management. Users can now authenticate, have their sessions managed securely, tokens refreshed automatically, and log out properly.

closes #641

[vercel]

@codesailor4 is attempting to deploy a commit to the aminubabafatima8-gmailcom's projects Team on Vercel.

A member of the Team first needs to authorize it.

[phertyameen]

@codesailor4 resolve conflict and handle CI gracefully please