Fix #657 logout revocation across a session family

architecture.json

@@ -2939,6 +2939,10 @@
       "entity": "UserSession",
       "file": "src/Orbit.Domain/Entities/UserSession.cs"
     },
+    {
+      "entity": "UserSessionRefreshToken",
+      "file": "src/Orbit.Domain/Entities/UserSessionRefreshToken.cs"
+    },
     {
       "entity": "XpAwardLog",
       "file": "src/Orbit.Domain/Entities/XpAwardLog.cs"
@@ -5574,7 +5578,8 @@
         "file": "tests/Orbit.Application.Tests/Services/AuthSessionServiceTests.cs",
         "references": [
           "User",
-          "UserSession"
+          "UserSession",
+          "UserSessionRefreshToken"
         ]
       },
       {
@@ -6746,6 +6751,13 @@
           "User"
         ]
       },
+      {
+        "testClass": "UserSessionRefreshTokenTests",
+        "file": "tests/Orbit.Domain.Tests/Entities/UserSessionRefreshTokenTests.cs",
+        "references": [
+          "UserSessionRefreshToken"
+        ]
+      },
       {
         "testClass": "UserSessionTests",
         "file": "tests/Orbit.Domain.Tests/Entities/UserSessionTests.cs",
@@ -7767,31 +7779,44 @@
         "file": "tests/Orbit.Infrastructure.Tests/Services/AuthSessionServiceConcurrentRefreshTests.cs",
         "references": [
           "User",
-          "UserSession"
+          "UserSession",
+          "UserSessionRefreshToken"
         ]
       },
       {
         "testClass": "AuthSessionServiceHasSessionForTokenTests",
         "file": "tests/Orbit.Infrastructure.Tests/Services/AuthSessionServiceHasSessionForTokenTests.cs",
         "references": [
           "User",
-          "UserSession"
+          "UserSession",
+          "UserSessionRefreshToken"
+        ]
+      },
+      {
+        "testClass": "AuthSessionServiceLogoutRaceTests",
+        "file": "tests/Orbit.Infrastructure.Tests/Services/AuthSessionServiceLogoutRaceTests.cs",
+        "references": [
+          "User",
+          "UserSession",
+          "UserSessionRefreshToken"
         ]
       },
       {
         "testClass": "AuthSessionServiceRevokeAllTests",
         "file": "tests/Orbit.Infrastructure.Tests/Services/AuthSessionServiceRevokeAllTests.cs",
         "references": [
           "User",
-          "UserSession"
+          "UserSession",
+          "UserSessionRefreshToken"
         ]
       },
       {
         "testClass": "AuthSessionServiceTests",
         "file": "tests/Orbit.Infrastructure.Tests/Services/AuthSessionServiceTests.cs",
         "references": [
           "User",
-          "UserSession"
+          "UserSession",
+          "UserSessionRefreshToken"
         ]
       },
       {

src/Orbit.Api/Extensions/ServiceCollectionExtensions.cs

@@ -1,4 +1,5 @@
 using System.Text;
+using System.Security.Claims;
 using FluentValidation;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
@@ -233,6 +234,24 @@ public static WebApplicationBuilder AddOrbitAuthentication(this WebApplicationBu
                     Encoding.UTF8.GetBytes(jwtSettings.SecretKey)),
                 ClockSkew = TimeSpan.Zero
             };
+            options.Events = new JwtBearerEvents
+            {
+                OnTokenValidated = async context =>
+                {
+                    var sessionClaim = context.Principal?.FindFirst("orbit_session_id")?.Value;
+                    if (sessionClaim is null)
+                        // https://github.com/thomasluizon/orbit-api/issues/660: Pre-deploy tokens remain valid for 168 hours; #660 removes this allowance.
+                        return;
+
+                    var userClaim = context.Principal?.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+                    if (!Guid.TryParse(sessionClaim, out var sessionId)
+                        || !Guid.TryParse(userClaim, out var userId)
+                        || !await context.HttpContext.RequestServices
+                            .GetRequiredService<IAuthSessionService>()
+                            .IsSessionActiveAsync(sessionId, userId, context.HttpContext.RequestAborted))
+                        context.Fail("Session is no longer active.");
+                }
+            };
         })
         .AddScheme<AuthenticationSchemeOptions, ApiKeyAuthenticationHandler>("ApiKey", null)
         .AddPolicyScheme("MultiScheme", "JWT or API Key", options =>

src/Orbit.Domain/Entities/UserSessionRefreshToken.cs

@@ -0,0 +1,26 @@
+using Orbit.Domain.Common;
+
+namespace Orbit.Domain.Entities;
+
+public class UserSessionRefreshToken : Entity
+{
+    public Guid UserSessionId { get; private set; }
+    public string TokenHash { get; private set; } = null!;
+
+    private UserSessionRefreshToken() { }
+
+    public static Result<UserSessionRefreshToken> Create(Guid userSessionId, string tokenHash)
+    {
+        if (userSessionId == Guid.Empty)
+            return Result.Failure<UserSessionRefreshToken>(DomainErrors.SessionNotActive);
+
+        if (string.IsNullOrWhiteSpace(tokenHash))
+            return Result.Failure<UserSessionRefreshToken>(DomainErrors.TokenHashRequired);
+
+        return Result.Success(new UserSessionRefreshToken
+        {
+            UserSessionId = userSessionId,
+            TokenHash = tokenHash
+        });
+    }
+}

src/Orbit.Domain/Interfaces/IAuthSessionService.cs

@@ -17,4 +17,5 @@ public interface IAuthSessionService
     /// throttled per source IP, closing the token-varying rate-limit bypass.
     /// </summary>
     Task<bool> HasSessionForTokenAsync(string refreshToken, CancellationToken cancellationToken = default);
+    Task<bool> IsSessionActiveAsync(Guid sessionId, Guid userId, CancellationToken cancellationToken = default);
 }

src/Orbit.Domain/Interfaces/ITokenService.cs

@@ -2,5 +2,5 @@ namespace Orbit.Domain.Interfaces;
 
 public interface ITokenService
 {
-    string GenerateToken(Guid userId, string email);
+    string GenerateToken(Guid userId, string email, Guid sessionId);
 }