auth: 'Sign out all devices' — expose sign-out-everywhere sentinel

Open
#112 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
68/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
typescript
Domain
api, authentication, documentation, frontend

Research direction

Start with apps/api/src/auth/revocation.ts and specs/behaviors/authorization.md to understand the existing '*' sentinel, then inspect the API auth endpoint structure and apps/web/src/screens/Account.tsx. The work is done when an authenticated user can trigger the all-device revocation, the Account screen exposes it, and the endpoint and action tables are updated in specs/api/auth.md and specs/screens/account.md.

Written by the indexing model from the issue text.

Description

What's missing

`specs/behaviors/authorization.md` describes a `jti = '*'` sentinel in the revocations sheet that revokes every JWT for a personId whose `iat` precedes the sentinel's `revokedAt`. The verifier-side code at `apps/api/src/auth/revocation.ts` fully implements the sentinel.

But there's no way for a user to trigger it. No API endpoint exposes "sign out all devices," and the Account screen (`specs/screens/account.md`) only offers "Sign out of this session." A user whose phone is lost can revoke that one session but can't blast every JWT issued before now.

Fix shape

  1. Add `POST /api/auth/logout-all` (or `POST /api/auth/sessions/revoke-all`) — writes a sentinel `Revocation` with `jti = '*'`, `personId = caller.id`, `revokedAt = now`.
  2. Add a "Sign out of all devices" button to the Account settings screen (`apps/web/src/screens/Account.tsx`).
  3. Update `specs/api/auth.md` endpoints table + `specs/screens/account.md` Actions table.

Why it's worth the work

Compromised-device recovery is a real account-security need. The hard part (the verifier-side sentinel) is already done; this is just plumbing.

Identified during the 2026-05-30 post-cutover-blog spec-drift audit.

Dominant language
TypeScript
Stars
1
Forks
1
Avg merge
1d 20h
Merged PRs (30d)
25

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from CodeForPhilly/codeforphilly-ng

All issues in CodeForPhilly/codeforphilly-ng

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.