feat(api): Check if JWT is revoked before allowing access

[DafyddLlyr]

What does this PR do?

• Adds a check of the revoked_tokens table by using the isRevoked callback from express-jwt
• This ensures that any tokens which are revoked, fail validation
• Updates API tests to assume all tokens are not revoked by default - doing this once upstream where queryMock is instantiated means we don't have to add this in multiple places.
• API tests -
  • adds a mock so that all JWTs are non-revoked by default
  • updates mocks and describe() blocks - please see comment on PR below

Not yet covered

Requests made directly to Hasura with an existing token (not proxied via API).

To test...

• Log in, make a copy of the token
• Log out, check a record has been added to the revoked_tokens table
• Try to re-use token (e.g. via API docs) - access is not allowed!

Screen.Recording.2025-02-21.at.13.16.13.mov

[github-actions]

Removed vultr server and associated DNS entries

[DafyddLlyr]

Invalidate JWT on logout

[DafyddLlyr]

This pattern is repeated a few times here, grouped in b1d6037

Now that JWT verification needs to make a round trip to the DB, this test needs to access a GraphQL client to do this ($api.client.request) which is not mocked. Using importOriginal() we can only mock the function we want to mock in this test suite and keep the rest of the original behaviour. In this case it's this.export.csvData.

We have an open issue to consolidate these mocks and to make them easier and simpler to manage - the pattern here could be DRY'ed up a but into a setupPlanXCoreMock() function called by vitest setup. I've not tackled this here in order to make process and keep things separate. The issue is here - #2404

[DafyddLlyr]

Another common pattern here is just tighter closures for mocks - a lot were failing because we were relying on queryMock.reset() to manage scope instead of describe() blocks - this meant that the mock query for a non-revoked JWT was then being cleared, and the tests were failing.

[jessicamcinchak]

Thanks for super clear testing instructions here, all works as expected for me repeated over a couple times 🙌

[jessicamcinchak]

👍

[freemvmt]

beautiful! such thorough work on the tests.

also I tested as you suggested and it works like a dream! ✨