Feat add iam auth

apps/api/src/modules/auth/jwt.strategy.ts

@@ -3,11 +3,19 @@ import { PassportStrategy } from '@nestjs/passport';
 import { ExtractJwt, Strategy } from 'passport-jwt';
 import { PrismaService } from '../../prisma/prisma.service';
 import { envOr } from '../../common/env';
+import { AdminSessionService } from '../sessions/admin-session.service';
 import { expandWithParents } from './acl.constants';
 
 export interface JwtPayload {
   sub: string;
   mobile: string;
+  /**
+   * Present only on tokens issued while session tracking is on. It identifies the
+   * AdminSession row, which is what makes revoking a token before it expires
+   * possible. A token without it predates tracking and stays valid until it
+   * expires, so switching the feature on does not sign everyone out.
+   */
+  jti?: string;
   /**
    * Set on APP tokens only ('customer' or 'sales-expert'). An admin-panel
    * token has no `typ`. Checked in validate() below — see the note there.
@@ -46,7 +54,10 @@ export interface AuthenticatedAdmin {
 
 @Injectable()
 export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
-  constructor(private readonly prisma: PrismaService) {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly sessions: AdminSessionService,
+  ) {
     super({
       jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
       ignoreExpiration: false,
@@ -60,6 +71,13 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
       throw new UnauthorizedException();
     }
 
+    // Revoked centrally (IAM back-channel logout) or locally? While tracking is
+    // off this returns true without touching the database, so the request costs
+    // exactly what it did before.
+    if (!(await this.sessions.isActive(payload.jti))) {
+      throw new UnauthorizedException();
+    }
+
     const user = await this.prisma.adminUser.findUnique({
       where: { id: payload.sub },
       include: { userType: { include: { permissions: true } } },