Begin preliminary tokenVersion impl

backend/src/controllers/v1/authController.ts

@@ -4,14 +4,21 @@ import jwt from 'jsonwebtoken';
 import * as bigintConversion from 'bigint-conversion';
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const jsrp = require('jsrp');
-import { User, LoginSRPDetail } from '../../models';
+import { 
+  User, 
+  LoginSRPDetail,
+  TokenVersion
+} from '../../models';
 import { createToken, issueAuthTokens, clearTokens } from '../../helpers/auth';
 import { checkUserDevice } from '../../helpers/user';
 import {
   ACTION_LOGIN,
   ACTION_LOGOUT
 } from '../../variables';
-import { BadRequestError } from '../../utils/errors';
+import { 
+  BadRequestError,
+  UnauthorizedRequestError
+} from '../../utils/errors';
 import { EELogService } from '../../ee/services';
 import { getChannelFromUserAgent } from '../../utils/posthog';
 import {
@@ -241,19 +248,31 @@ export const getNewToken = async (req: Request, res: Response) => {
 
     const user = await User.findOne({
       _id: decodedToken.userId
-    }).select('+publicKey +refreshVersion');
+    }).select('+publicKey +refreshVersion +accessVersion');
 
     if (!user) throw new Error('Failed to authenticate unfound user');
     if (!user?.publicKey)
       throw new Error('Failed to authenticate not fully set up account');
+    
+    const tokenVersion = await TokenVersion.findOne({
+      _id: decodedToken.tokenVersionId,
+      user: user._id
+    });
 
-    if (decodedToken?.refreshVersion !== user.refreshVersion) throw BadRequestError({
+    console.log('tokenVersion: ', tokenVersion);
+	
+    if (!tokenVersion) throw UnauthorizedRequestError({
+      message: 'Failed to validate refresh token'
+    });
+
+    if (decodedToken.refreshVersion !== tokenVersion.refreshVersion) throw BadRequestError({
       message: 'Failed to validate refresh token'
     });
 
     const token = createToken({
       payload: {
-        userId: decodedToken.userId
+        userId: decodedToken.userId,
+        accessVersion: tokenVersion.refreshVersion
       },
       expiresIn: await getJwtAuthLifetime(),
       secret: await getJwtAuthSecret()

backend/src/controllers/v1/passwordController.ts

@@ -231,16 +231,16 @@ export const changePassword = async (req: Request, res: Response) => {
 						}
 					);
 				
-					// await clearTokens(user._id);
+					await clearTokens(user._id);
 
-					// // clear httpOnly cookie
+					// clear httpOnly cookie
 					
-					// res.cookie('jid', '', {
-					// 	httpOnly: true,
-					// 	path: '/',
-					// 	sameSite: 'strict',
-					// 	secure: (await getHttpsEnabled()) as boolean
-					// });
+					res.cookie('jid', '', {
+						httpOnly: true,
+						path: '/',
+						sameSite: 'strict',
+						secure: (await getHttpsEnabled()) as boolean
+					});
 
 					return res.status(200).send({
 						message: 'Successfully changed password'

backend/src/controllers/v2/authController.ts

@@ -235,8 +235,6 @@ export const login2 = async (req: Request, res: Response) => {
   }
 };
 
-import { validateUserEmail } from '../../validation';
-
 /**
  * Send MFA token to email [email]
  * @param req 

backend/src/controllers/v3/authController.ts

@@ -113,7 +113,7 @@ export const login2 = async (req: Request, res: Response) => {
 
         const user = await User.findOne({
             email,
-        }).select('+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag');
+        }).select('+salt +verifier +encryptionVersion +protectedKey +protectedKeyIV +protectedKeyTag +publicKey +encryptedPrivateKey +iv +tag +devices');
 
         if (!user) throw new Error('Failed to find user');
 
@@ -183,6 +183,10 @@ export const login2 = async (req: Request, res: Response) => {
                         userAgent: req.headers['user-agent'] ?? ''
                     });
 
+                    console.log('logged in, issue tokens');
+                    console.log('ip: ', req.ip);
+                    console.log('userAgent: ', req.headers['user-agent']);
+
                     // issue tokens
                     const tokens = await issueAuthTokens({ userId: user._id.toString() });