fix revokation bugs and add unit tests

src/main/java/com/ddf/vodsystem/controllers/UserController.java

@@ -80,20 +80,20 @@ public class UserController {
     }
 
     /**
-     * Exchanges a refresh token for a new refresh token and JWT, replacing both cookies.
+     * Exchanges the {@code refreshToken} cookie for a new refresh token and JWT, replacing both cookies.
      *
-     * @param token    the payload carrying the current refresh token
-     * @param response the response the new cookies are written to
-     * @param request  the incoming request, used to decide the cookies' {@code Secure} flag
+     * @param refreshToken the refresh token from the {@code refreshToken} cookie, if present
+     * @param request      the incoming request, used to decide the cookies' {@code Secure} flag
+     * @param response     the response the new cookies are written to
      * @return {@code 200 OK} with no data
-     * @throws NotAuthenticated if the refresh token is rejected
+     * @throws NotAuthenticated if the refresh token is missing or rejected
      */
     @PostMapping("/refresh")
     public ResponseEntity<APIResponse<Void>> refresh(
-            @RequestBody Token token,
-            HttpServletResponse response,
-            HttpServletRequest request) {
-        TokenPackage tokenPackage = userService.refresh(token.token());
+            @CookieValue(name = "refreshToken", required = false) String refreshToken,
+            HttpServletRequest request,
+            HttpServletResponse response) {
+        TokenPackage tokenPackage = userService.refresh(refreshToken);
         addCookies(request, response, tokenPackage.accessToken(), tokenPackage.refreshToken());
 
         return ResponseEntity.ok(
@@ -102,35 +102,46 @@ public class UserController {
     }
 
     /**
-     * Logs the user out by revoking the session tied to the {@code refreshToken} cookie.
-     * The auth cookies are not cleared.
+     * Logs the user out by revoking the session tied to the {@code refreshToken} cookie and clearing
+     * both auth cookies. Succeeds even if no refresh token cookie is present.
      *
      * @param refreshToken the refresh token from the {@code refreshToken} cookie, if present
+     * @param request      the incoming request, used to decide the cookies' {@code Secure} flag
+     * @param response     the response the expired cookies are written to
      * @return {@code 200 OK} confirming logout
      */
     @PostMapping("/logout")
     public ResponseEntity<APIResponse<Void>> logout(
-            @CookieValue(name = "refreshToken", required = false) String refreshToken) {
+            @CookieValue(name = "refreshToken") String refreshToken,
+            HttpServletRequest request,
+            HttpServletResponse response) {
         userService.logout(refreshToken);
+        writeCookies(request, response, "", Duration.ZERO, "", Duration.ZERO);
 
         return ResponseEntity.ok(
                 new APIResponse<>(SUCCESS, "Logged out successfully", null)
         );
     }
 
-    /**
-     * Writes the {@code accessToken} cookie ({@code SameSite=Lax}, path {@code /}) and the
-     * {@code refreshToken} cookie ({@code SameSite=Strict}, path {@code /api/v1/users}), both HttpOnly
-     * and {@code Secure} when the request is.
-     */
     private void addCookies(
             HttpServletRequest request,
             HttpServletResponse response,
             String accessToken,
             String refreshToken) {
+        writeCookies(request, response, accessToken, jwtExpiration, refreshToken, refreshTokenExpiration);
+    }
+
+
+    private void writeCookies(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            String accessToken,
+            Duration accessTokenMaxAge,
+            String refreshToken,
+            Duration refreshTokenMaxAge) {
         ResponseCookie accessTokenCookie = ResponseCookie.from("accessToken", accessToken)
                 .httpOnly(true)
-                .maxAge(jwtExpiration.getSeconds())
+                .maxAge(accessTokenMaxAge)
                 .sameSite("Lax")
                 .secure(request.isSecure())
                 .path(ACCESS_COOKIE_PATH)
@@ -138,7 +149,7 @@ public class UserController {
 
         ResponseCookie refreshTokenCookie = ResponseCookie.from("refreshToken", refreshToken)
                 .httpOnly(true)
-                .maxAge(refreshTokenExpiration.getSeconds())
+                .maxAge(refreshTokenMaxAge)
                 .sameSite("Strict")
                 .secure(request.isSecure())
                 .path(REFRESH_COOKIE_PATH)

src/main/java/com/ddf/vodsystem/security/TokenService.java

@@ -158,13 +158,14 @@ public class TokenService {
 
     /**
      * Revokes a refresh token and its whole token family, ending the session. Does nothing if the
-     * token is unknown, and leaves existing revocation timestamps unchanged.
+     * token is missing or unknown, and leaves existing revocation timestamps unchanged.
      *
-     * @param hexToken the raw refresh token as a hex string
+     * @param hexToken the raw refresh token as a hex string, may be {@code null}
      * @throws NotAuthenticated if the token is not valid hex
      */
+    @Transactional
     public void revoke(String hexToken) {
-        Instant now = Instant.now(clock);
+        if (hexToken == null || hexToken.isBlank()) return;
 
         byte[] hash;
         try {
@@ -173,14 +174,22 @@ public class TokenService {
             throw new NotAuthenticated("Malformed refresh token");
         }
 
-        Optional<RefreshToken> found = refreshTokenRepository.findByHash(sha256(hash));
+        Optional<RefreshToken> found = refreshTokenRepository.findByHash(hash);
         if (found.isEmpty()) return;
 
+        Instant now = Instant.now(clock);
         RefreshToken refreshToken = found.get();
         TokenFamily family = refreshToken.getTokenFamily();
 
-        if (family.getRevokedAt() == null) family.setRevokedAt(now);
-        if (refreshToken.getRevokedAt() == null) refreshToken.setRevokedAt(now);
+        if (family.getRevokedAt() == null) {
+            family.setRevokedAt(now);
+            tokenFamilyRepository.save(family);
+        }
+
+        if (refreshToken.getRevokedAt() == null) {
+            refreshToken.setRevokedAt(now);
+            refreshTokenRepository.save(refreshToken);
+        }
     }
 
     /**

src/main/java/com/ddf/vodsystem/services/UserService.java

@@ -99,7 +99,7 @@ public class UserService {
      * Ends the session tied to a refresh token by revoking its token family.
      * Already-issued JWT access tokens stay valid until they expire.
      *
-     * @param refreshToken the raw refresh token as a hex string
+     * @param refreshToken the raw refresh token as a hex string, may be {@code null}
      * @throws NotAuthenticated if the token is not valid hex
      */
     public void logout(String refreshToken) {