feat: Implement Redis-based Refresh Token, Multi-Device Session Management & Token Blacklist

📋 Overview

This issue tracks the implementation of a production-grade stateless JWT security upgrade.
The current implementation issues a 24-hour access token with no refresh mechanism, no logout
capability, and no multi-device session management.

🚨 Current Problems

• Access token lifetime is 24 hours — a stolen token is valid for an entire day
• No logout endpoint — once issued, a token cannot be revoked
• Single-device only — a second login overwrites the first device's session
• loadUserByUsername() hits PostgreSQL on every API request — no caching
• No CORS configuration — frontend applications cannot call this API from a browser

✅ What We Will Implement

1. Redis Infrastructure

• docker-compose.yml with Redis (AOF persistence + volume mount)
• spring-boot-starter-data-redis dependency
• Redis connection configuration in application.yml

2. Refresh Token (Multi-Device)

• Reduce Access Token lifetime: 24 hours → 15 minutes
• Issue a Refresh Token (7 days) on login/register
• Store Refresh Token in Redis: refresh:<userId>:<sessionId>
• POST /v1/api/auth/refresh endpoint — validates + rotates refresh token
• sessionId embedded as a claim inside the Access Token

3. Token Blacklist (Logout)

• POST /v1/api/auth/logout — blacklists current access token in Redis
• Blacklisted token TTL = remaining lifetime of the access token
• JwtAuthenticationFilter updated to check blacklist on every request

4. Logout From All Devices

• POST /v1/api/auth/logout-all endpoint
• Stores invalidated_before:<userId> timestamp in Redis
• Deletes ALL refresh:<userId>:* keys from Redis
• Filter rejects any token issued before the invalidated_before timestamp

5. Password/Email Update Handling

• On credential update → trigger "logout from all devices" automatically

6. CORS Configuration

• CorsConfigurationSource bean in SecurityConfiguration
• Profile-based allowed origins (local vs prod)

7. Flyway Migration

• V2__add_session_tracking.sql — (if any DB changes needed)

🗂️ Files To Be Created

New:
├── docker-compose.yml
├── src/main/java/.../token/RefreshTokenService.java
├── src/main/java/.../token/TokenBlacklistService.java
├── src/main/java/.../auth/dto/RefreshTokenRequest.java
└── src/main/java/.../auth/dto/LogoutRequest.java

Modified:
├── pom.xml                        (add Redis dependency)
├── application.yml                (Redis config)
├── application-local.yml          (Redis local config)
├── AuthController.java            (new endpoints)
├── AuthService.java               (refresh + blacklist logic)
├── AuthResponse.java              (add refreshToken + sessionId fields)
├── JwtService.java                (reduce expiry, add sessionId claim)
├── JwtAuthenticationFilter.java   (blacklist + invalidatedBefore checks)
└── SecurityConfiguration.java    (CORS config)

🔒 Security Improvements Summary

Threat	Before	After
Token theft	24hr window	15min window
Logout	Not possible	Immediate blacklist
Multi-device	Broken	Full session management
All-device logout	Not possible	invalidated_before timestamp
DB load per request	1 query/request	Redis cache (sub-millisecond)
Browser CORS	Blocked	Properly configured

🏷️ Labels

enhancement security redis jwt