From a2ff5d9b560a5411226c376cf15743b2109eb13f Mon Sep 17 00:00:00 2001
From: Alex Holliday <ajhollid@gmail.com>
Date: Fri, 9 Aug 2024 13:53:10 -0700
Subject: [PATCH] Revoke token from user on JWT verification failure in
 middleware

---
 Server/db/mongo/modules/userModule.js |  1 -
 Server/middleware/verifyJWT.js        | 29 ++++++++++++++++++++-------
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/Server/db/mongo/modules/userModule.js b/Server/db/mongo/modules/userModule.js
index de7d54ebf..144295b6d 100644
--- a/Server/db/mongo/modules/userModule.js
+++ b/Server/db/mongo/modules/userModule.js
@@ -27,7 +27,6 @@ const insertUser = async (req, res) => {
       const avatar = await GenerateAvatarImage(req.file);
       userData.avatarImage = avatar;
     }
-    console.log(userData);
     const newUser = new UserModel(userData);
     await newUser.save();
     return await UserModel.findOne({ _id: newUser._id })
diff --git a/Server/middleware/verifyJWT.js b/Server/middleware/verifyJWT.js
index 1dbbe8d99..e6171bda3 100644
--- a/Server/middleware/verifyJWT.js
+++ b/Server/middleware/verifyJWT.js
@@ -3,6 +3,8 @@ const logger = require("../utils/logger");
 const SERVICE_NAME = "verifyJWT";
 const TOKEN_PREFIX = "Bearer ";
 const { errorMessages } = require("../utils/messages");
+const { parse } = require("path");
+const User = require("../models/user");
 /**
  * Verifies the JWT token
  * @function
@@ -32,14 +34,27 @@ const verifyJWT = (req, res, next) => {
 
   const parsedToken = token.slice(TOKEN_PREFIX.length, token.length);
   // Verify the token's authenticity
-  jwt.verify(parsedToken, process.env.JWT_SECRET, (err, decoded) => {
+  jwt.verify(parsedToken, process.env.JWT_SECRET, async (err, decoded) => {
     if (err) {
-      logger.error(errorMessages.INVALID_AUTH_TOKEN, {
-        service: SERVICE_NAME,
-      });
-      return res
-        .status(401)
-        .json({ success: false, msg: errorMessages.INVALID_AUTH_TOKEN });
+      try {
+        const userId = jwt.decode(parsedToken)._id;
+        await User.updateOne({ _id: userId }, { $unset: { authToken: null } });
+        logger.error(errorMessages.INVALID_AUTH_TOKEN, {
+          service: SERVICE_NAME,
+        });
+        return res
+          .status(401)
+          .json({ success: false, msg: errorMessages.INVALID_AUTH_TOKEN });
+      } catch (error) {
+        logger.error(errorMessages.UNKNOWN_ERROR, {
+          service: SERVICE_NAME,
+          error: error,
+        });
+        error.status = 401;
+        error.service = SERVICE_NAME;
+        next(error);
+        return;
+      }
     }
     //Add the user to the request object for use in the route
     req.user = decoded;