sync and revoke auth refresh sessions

src/auth/routes.ts

@@ -4,7 +4,7 @@ import { z } from 'zod'
 import { config } from '../config'
 import { sendEmailVerificationCode } from '../mail'
 import { verifyPassword } from '../security/password'
-import { signAccessToken } from '../security/tokens'
+import { signAccessToken, verifyAccessToken } from '../security/tokens'
 import type { AuthUser } from '../types'
 import { authRequired, type AuthVariables } from './middleware'
 import {
@@ -25,6 +25,7 @@ import {
   markLastLogin,
   recordFailedLogin,
   revokeRefreshToken,
+  revokeRefreshTokensForUser,
   rotateRefreshToken,
   storeEmailVerificationCode,
   storePasswordResetCode,
@@ -381,6 +382,16 @@ authRoutes.post('/logout', async (c) => {
     await revokeRefreshToken(refreshToken)
   }
 
+  const bearerToken = c.req.header('authorization')?.match(/^Bearer\s+(.+)$/i)?.[1]
+  if (bearerToken) {
+    try {
+      const claims = await verifyAccessToken(bearerToken)
+      await revokeRefreshTokensForUser(claims.sub)
+    } catch {
+      // Logout should remain idempotent even when the access token is already invalid.
+    }
+  }
+
   clearRefreshCookie(c)
   return c.json({ ok: true })
 })