What: Add an endpoint that lists all active sessions for the authenticated user, showing device info and last activity.
Why: Users need to see where they're logged in and revoke sessions they don't recognize. This is a standard security feature for account management.
Scope: Create sessions table with user_id, token_id, device_info, ip_address, last_active, created_at. Track sessions during authGuard. Add endpoint to list and revoke sessions.
Acceptance criteria:
- Lists all active sessions with device info
- Shows last activity time
- User can revoke individual sessions
- Revoked sessions are blacklisted
Technical context: src/middleware/auth.ts — authGuard. src/modules/auth/auth.service.ts — auth flow.
What: Add an endpoint that lists all active sessions for the authenticated user, showing device info and last activity.
Why: Users need to see where they're logged in and revoke sessions they don't recognize. This is a standard security feature for account management.
Scope: Create
sessionstable with user_id, token_id, device_info, ip_address, last_active, created_at. Track sessions during authGuard. Add endpoint to list and revoke sessions.Acceptance criteria:
Technical context:
src/middleware/auth.ts— authGuard.src/modules/auth/auth.service.ts— auth flow.