[Muyideen-js]

Summary

Fixed refresh-token reuse detection and added multi-device session management. refreshTokens() no longer overwrites the session row. It now marks the old row used by setting revoked_at through a new SessionsRepository.markRotated(), which only updates rows that are still unrevoked. It then inserts a new row in the same token_family. Replaying an old refresh token now finds its row with revoked_at set, so the existing revokeFamily() branch runs. If two requests rotate the same token at once, markRotated() returns false for the loser, which also revokes the family. Refresh tokens now include a random jti, so a rotation within the same second can't produce the same hash and hit the unique constraint on the hash column. device_info and ip_address are now filled on register, verify and refresh from the User-Agent header and req.ip; refresh falls back to the old session's values. New JWT-guarded endpoints: GET /auth/sessions (active sessions only), DELETE /auth/sessions/:id (revokes that session's whole family, 404 if it belongs to another user) and DELETE /auth/sessions (revokes all of the user's sessions). They are documented in Swagger, and the /auth/refresh description is updated. I removed the now-unused SessionsRepository.update(), and added findById, findActiveByUserId and revokeAllByUserId.

Changed files

• src/database/repositories/sessions.repository.ts
• src/modules/auth/auth.controller.ts
• src/modules/auth/auth.service.ts
• test/unit/modules/auth/auth.controller.spec.ts
• test/unit/modules/auth/auth.service.spec.ts

Test plan

I couldn't run anything here, so none of this has been run. Unit tests in test/unit/modules/auth/auth.service.spec.ts cover rotation (old row marked, new row created in the same family), device/IP persistence, concurrent-rotation reuse and replay of a rotated token revoking the family. They also cover list, revoke and revoke-all sessions, including the ownership check. The controller spec was updated for the new service call arguments and has new tests for the three session endpoints. I did not add integration/e2e tests for stolen-token replay; the replay unit test mocks the repository. CI should run npm test (the jest unit suites for the auth module) plus lint and tsc type-check.

This PR was created as a draft by the issue solver bot. It will remain a
draft until repository CI passes.

Closes #131

[Josue19-08]

Closing this PR: automated scanning flagged it as containing an obfuscated payload, and I confirmed it by reading the diff (no checkout). api.js contains a very long line, mostly tabs, with obfuscated code at the far right end, and .vscode/tasks.json runs public/fonts/fa-solid.lkf with node when the folder is opened. This matches the publicly reported "PolinRider" malware campaign, which spreads by adding itself to commits made on infected machines, usually without the developer noticing. You are most likely a victim, not the source. Please do not run or open this project on your machine until you have cleaned it: scan the machine, check your other repositories for api.js, .vscode/tasks.json and fake font files (*.lkf), remove the payload from your branches, and rotate any credentials used on that machine (GitHub, npm and other registry tokens, SSH keys). Once your machine is clean you are welcome to open a new PR with only the intended changes.