Implement AuthService.logout (or integrate with LogoutService) to invalidate the refresh token and terminate the biometric session.
Context
Proper session termination is critical for security, especially on shared devices. This task ensures that logging out fully invalidates the server-side session and prevents further use of the refresh token.
Implementation Guidelines
Key Files: src/server/services/auth.service.ts, src/server/services/logout.service.ts.
- Expose a
logout method in AuthService that calls LogoutService.logout.
- Ensure the sessions table entry corresponding to the
refreshToken's sessionId is deleted.
- Add logic to clear any client-side biometric session state if applicable.
Expectations
What done looks like: After calling logout, the refresh token is deleted from the database and can no longer be used to generate new access tokens.
Implement
AuthService.logout(or integrate withLogoutService) to invalidate the refresh token and terminate the biometric session.Context
Proper session termination is critical for security, especially on shared devices. This task ensures that logging out fully invalidates the server-side session and prevents further use of the refresh token.
Implementation Guidelines
Key Files:
src/server/services/auth.service.ts,src/server/services/logout.service.ts.logoutmethod inAuthServicethat callsLogoutService.logout.refreshToken'ssessionIdis deleted.Expectations
What done looks like: After calling logout, the refresh token is deleted from the database and can no longer be used to generate new access tokens.