Fix case where user can get stuck in a deleted organization if they were prev logged into it

backend/package-lock.json

@@ -21,7 +21,7 @@
         "@fastify/etag": "^5.1.0",
         "@fastify/formbody": "^7.4.0",
         "@fastify/helmet": "^11.1.1",
-        "@fastify/multipart": "8.3.1",
+        "@fastify/multipart": "^8.3.1",
         "@fastify/passport": "^2.4.0",
         "@fastify/rate-limit": "^9.0.0",
         "@fastify/request-context": "^5.1.0",

backend/src/server/routes/v1/auth-router.ts

@@ -1,11 +1,9 @@
 import jwt from "jsonwebtoken";
 import { z } from "zod";
-
 import { getConfig } from "@app/lib/config/env";
-import { NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { authRateLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode, AuthModeRefreshJwtTokenPayload, AuthTokenType } from "@app/services/auth/auth-type";
+import { AuthMode, AuthTokenType } from "@app/services/auth/auth-type";
 
 export const registerAuthRoutes = async (server: FastifyZodProvider) => {
   server.route({
@@ -21,18 +19,19 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => {
         })
       }
     },
-    onRequest: verifyAuth([AuthMode.JWT], { requireOrg: false }),
     handler: async (req, res) => {
+      const { decodedToken } = await server.services.authToken.validateRefreshToken(req.cookies.jid);
       const appCfg = getConfig();
-      if (req.auth.authMode === AuthMode.JWT) {
-        await server.services.login.logout(req.permission.id, req.auth.tokenVersionId);
-      }
+
+      await server.services.login.logout(decodedToken.userId, decodedToken.tokenVersionId);
+
       void res.cookie("jid", "", {
         httpOnly: true,
         path: "/",
         sameSite: "strict",
         secure: appCfg.HTTPS_ENABLED
       });
+
       return { message: "Successfully logged out" };
     }
   });
@@ -69,37 +68,8 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const refreshToken = req.cookies.jid;
+      const { decodedToken, tokenVersion } = await server.services.authToken.validateRefreshToken(req.cookies.jid);
       const appCfg = getConfig();
-      if (!refreshToken)
-        throw new NotFoundError({
-          name: "AuthTokenNotFound",
-          message: "Failed to find refresh token"
-        });
-
-      const decodedToken = jwt.verify(refreshToken, appCfg.AUTH_SECRET) as AuthModeRefreshJwtTokenPayload;
-      if (decodedToken.authTokenType !== AuthTokenType.REFRESH_TOKEN)
-        throw new UnauthorizedError({
-          message: "The token provided is not a refresh token",
-          name: "InvalidToken"
-        });
-
-      const tokenVersion = await server.services.authToken.getUserTokenSessionById(
-        decodedToken.tokenVersionId,
-        decodedToken.userId
-      );
-      if (!tokenVersion)
-        throw new UnauthorizedError({
-          message: "Valid token version not found",
-          name: "InvalidToken"
-        });
-
-      if (decodedToken.refreshVersion !== tokenVersion.refreshVersion) {
-        throw new UnauthorizedError({
-          message: "Token version mismatch",
-          name: "InvalidToken"
-        });
-      }
 
       const token = jwt.sign(
         {

backend/src/services/auth-token/auth-token-service.ts

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import jwt from "jsonwebtoken";
 
 import bcrypt from "bcrypt";
 import { Knex } from "knex";
@@ -8,7 +9,7 @@ import { getConfig } from "@app/lib/config/env";
 import { ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
 
-import { AuthModeJwtTokenPayload } from "../auth/auth-type";
+import { AuthModeJwtTokenPayload, AuthModeRefreshJwtTokenPayload, AuthTokenType } from "../auth/auth-type";
 import { TUserDALFactory } from "../user/user-dal";
 import { TTokenDALFactory } from "./auth-token-dal";
 import { TCreateTokenForUserDTO, TIssueAuthTokenDTO, TokenType, TValidateTokenForUserDTO } from "./auth-token-types";
@@ -100,6 +101,40 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, orgMembershipDAL }: TAu
     return token;
   };
 
+  const validateRefreshToken = async (refreshToken?: string) => {
+    const appCfg = getConfig();
+    if (!refreshToken)
+      throw new NotFoundError({
+        name: "AuthTokenNotFound",
+        message: "Failed to find refresh token"
+      });
+
+    const decodedToken = jwt.verify(refreshToken, appCfg.AUTH_SECRET) as AuthModeRefreshJwtTokenPayload;
+
+    if (decodedToken.authTokenType !== AuthTokenType.REFRESH_TOKEN)
+      throw new UnauthorizedError({
+        message: "The token provided is not a refresh token",
+        name: "InvalidToken"
+      });
+
+    const tokenVersion = await getUserTokenSessionById(decodedToken.tokenVersionId, decodedToken.userId);
+
+    if (!tokenVersion)
+      throw new UnauthorizedError({
+        message: "Valid token version not found",
+        name: "InvalidToken"
+      });
+
+    if (decodedToken.refreshVersion !== tokenVersion.refreshVersion) {
+      throw new UnauthorizedError({
+        message: "Token version mismatch",
+        name: "InvalidToken"
+      });
+    }
+
+    return { decodedToken, tokenVersion };
+  };
+
   const validateTokenForUser = async ({
     type,
     userId,
@@ -183,6 +218,7 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, orgMembershipDAL }: TAu
 
   return {
     createTokenForUser,
+    validateRefreshToken,
     validateTokenForUser,
     getUserTokenSession,
     clearTokenSessionById,

backend/src/services/auth/auth-fns.ts

@@ -2,7 +2,6 @@ import jwt from "jsonwebtoken";
 
 import { getConfig } from "@app/lib/config/env";
 import { ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
-
 import { AuthModeProviderJwtTokenPayload, AuthModeProviderSignUpTokenPayload, AuthTokenType } from "./auth-type";
 
 export const validateProviderAuthToken = (providerToken: string, username?: string) => {