fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused

api/handlers/auth/authHandler.go

@@ -99,8 +99,8 @@ func NewHandler(token *jwtauth.JWTAuth, get *useCases.GetUserUseCase, list *useC
 	}
 }
 
-func (h *Handler) SetJwtCookie(w *http.ResponseWriter, userId uint32) error {
-	_, tokenString, err := h.Token.Encode(map[string]any{"user_id": userId})
+func (h *Handler) SetJwtCookie(w *http.ResponseWriter, u user.User) error {
+	_, tokenString, err := h.Token.Encode(map[string]any{"user_id": u.ID, "token_version": u.TokenVersion})
 	if err != nil {
 		return err
 	}
@@ -151,7 +151,7 @@ func (h *Handler) Login(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	_ = h.SetJwtCookie(&w, dbUser.ID)
+	_ = h.SetJwtCookie(&w, dbUser)
 
 	message, _ := json.Marshal(map[string]any{"message": "User logged in! HTTPonly jwt cookie created"})
 	_, _ = w.Write(message)
@@ -185,7 +185,7 @@ func (h *Handler) Register(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	_ = h.SetJwtCookie(&w, createdUser.ID)
+	_ = h.SetJwtCookie(&w, createdUser)
 
 	message, _ := json.Marshal(map[string]any{"message": "User registered! HTTPonly jwt cookie created"})
 	_, _ = w.Write(message)