Revoke refresh token on logout for enhanced session security

src/main/java/com/skycrate/backend/skycrateBackend/controller/AuthController.java

@@ -27,6 +27,9 @@ public class AuthController {
         this.userRepository = userRepository;
     }
 
+    @Autowired
+    private RefreshTokenService refreshTokenService;
+
     @PostMapping("/login")
     public ResponseEntity<?> login(@RequestBody LoginRequest request, HttpServletRequest servletRequest) {
         String ip = servletRequest.getRemoteAddr();
@@ -75,14 +78,17 @@ public class AuthController {
     }
 
     String token = authHeader.substring(7);
+
+    // Blacklist access token
     tokenBlacklistService.blacklistToken(token);
 
+    // Extract user from token and delete their refresh token
+    String email = jwtService.extractUsername(token);
+    userRepository.findByEmail(email).ifPresent(refreshTokenService::deleteByUser);
+
     return ResponseEntity.ok("Logged out successfully");
 }
 
-    @Autowired
-    private RefreshTokenService refreshTokenService;
-
     @PostMapping("/refresh")
     public ResponseEntity<?> refresh(@RequestBody TokenRefreshRequest request) {
         String requestToken = request.getRefreshToken();

src/main/java/com/skycrate/backend/skycrateBackend/services/RefreshTokenService.java

@@ -39,4 +39,9 @@ public class RefreshTokenService {
     public boolean isExpired(RefreshToken token) {
         return token.getExpiryDate().isBefore(Instant.now());
     }
+
+    public void deleteByUser(User user) {
+        refreshTokenRepo.deleteByUser(user);
+    }
+
 }