From d6f1ecf75c28610c42008685277fac1a83d5225a Mon Sep 17 00:00:00 2001
From: Marco Beretta <81851188+berry-13@users.noreply.github.com>
Date: Mon, 23 Dec 2024 18:38:16 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20fix:=20update=20refresh=20token?=
 =?UTF-8?q?=20handling=20to=20use=20plain=20token=20instead=20of=20hashed?=
 =?UTF-8?q?=20token=20(#5088)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* 🔒 fix: update refresh token handling to use plain token instead of hashed token

* 🔒 fix: simplify logoutUser by using plain refresh token for session lookup
---
 api/server/controllers/AuthController.js | 7 ++-----
 api/server/services/AuthService.js       | 8 ++------
 2 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/api/server/controllers/AuthController.js b/api/server/controllers/AuthController.js
index 4f83c4e8a3..71551ea867 100644
--- a/api/server/controllers/AuthController.js
+++ b/api/server/controllers/AuthController.js
@@ -7,7 +7,6 @@ const {
   requestPasswordReset,
 } = require('~/server/services/AuthService');
 const { findSession, getUserById, deleteAllUserSessions } = require('~/models');
-const { hashToken } = require('~/server/utils/crypto');
 const { logger } = require('~/config');
 
 const registrationController = async (req, res) => {
@@ -74,11 +73,9 @@ const refreshController = async (req, res) => {
       return res.status(200).send({ token, user });
     }
 
-    // Hash the refresh token
-    const hashedToken = await hashToken(refreshToken);
-
     // Find the session with the hashed refresh token
-    const session = await findSession({ userId: userId, refreshToken: hashedToken });
+    const session = await findSession({ userId: userId, refreshToken: refreshToken });
+
     if (session && session.expiration > new Date()) {
       const token = await setAuthTokens(userId, res, session._id);
       res.status(200).send({ token, user });
diff --git a/api/server/services/AuthService.js b/api/server/services/AuthService.js
index 624f8af0c2..49c3c4a17d 100644
--- a/api/server/services/AuthService.js
+++ b/api/server/services/AuthService.js
@@ -22,7 +22,6 @@ const {
 const { isEnabled, checkEmailConfig, sendEmail } = require('~/server/utils');
 const { isEmailDomainAllowed } = require('~/server/services/domains');
 const { registerSchema } = require('~/strategies/validators');
-const { hashToken } = require('~/server/utils/crypto');
 const { logger } = require('~/config');
 
 const domains = {
@@ -42,10 +41,7 @@ const genericVerificationMessage = 'Please check your email to verify your email
  */
 const logoutUser = async (userId, refreshToken) => {
   try {
-    const hash = await hashToken(refreshToken);
-
-    // Find the session with the matching user and refreshTokenHash
-    const session = await findSession({ userId: userId, refreshToken: hash });
+    const session = await findSession({ userId: userId, refreshToken: refreshToken });
 
     if (session) {
       try {
@@ -343,7 +339,7 @@ const setAuthTokens = async (userId, res, sessionId = null) => {
     let refreshTokenExpires;
 
     if (sessionId) {
-      session = await findSession({ sessionId: sessionId });
+      session = await findSession({ sessionId: sessionId }, { lean: false });
       refreshTokenExpires = session.expiration.getTime();
       refreshToken = await generateRefreshToken(session);
     } else {