fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused

api/router.go

@@ -40,6 +40,7 @@ func NewArticleRouter(container *UseCases) http.Handler {
 	})
 	r.Group(func(r chi.Router) {
 		r.Use(jwtauth.Authenticator(container.Token))
+		r.Use(middleware.RequireCurrentToken(container.GetUserUseCase))
 		r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase))
 		r.Post("/", articleHandler.PostArticle)
 		r.Delete("/{id}", articleHandler.DeleteArticle)
@@ -64,6 +65,7 @@ func NewAuthRouter(container *UseCases, isProduction bool) http.Handler {
 	r.Group(func(r chi.Router) {
 		r.Use(jwtauth.Verifier(container.Token))
 		r.Use(jwtauth.Authenticator(container.Token))
+		r.Use(middleware.RequireCurrentToken(container.GetUserUseCase))
 		r.Post("/verify", authHandler.Verify)
 		r.Delete("/register", authHandler.CancelRegistration)
 	})