Session management per device

[geolunalg]

Overview

User Story:
As a user, I want the system to recognize my device sessions so I can manage them.

Action Items

Acceptance Criteria:

• Backend stores refresh token metadata: device name (optional), IP, user agent, created_at, last_used_at.
• Endpoint to list active sessions returns metadata (not tokens).
• Endpoint to revoke a specific session invalidates its refresh token.

Resources/Instructions

• This issue is part of the epic: EPIC: Authentication & Session Management (JWT + Refresh) #2065

[rteas]

Backend

Has this data for refresh tokens and has some code already, however needs to be further tested (for ip).

Create a GET /auth/user-sessions/ API for retrieving all refresh tokens via userId. Currently, all expired refresh tokens will be deleted to save space. Send refresh token ID, not hash value.

Create a DELETE /refresh-token/ api to delete refresh tokens by its ID.

Frontend

Create a 'Manage Sessions' page
Create a 'Manage Sessions' option in user profile.
Use API in backend to retrieve user sessions and display to user (device info, ip address, created).
Have delete button for each user session wired to backend DELETE tokens api.

[geolunalg]

@JackHaeg @trillium @rteas

I think we can skip this one for now, this is probably a nice to have

Size: XL

[JackHaeg]

Not Implementing now - deprioritized.