feat(auth): implement Android refresh token handling and session management

- Added support for generating Android access tokens and managing refresh sessions in the auth endpoints.
- Implemented new tests for login, logout, and refresh functionalities specific to Android clients.
- Enhanced password reset logging with normalization and masking of email addresses.
- Created a new diagnostics endpoint for password reset attempts, including filtering and summarizing logs.
- Introduced a new utility for managing password reset logs with retention policies.
- Added tests for password reset log utilities to ensure proper functionality and privacy compliance.
- Updated WebAuthn configuration tests to validate origin handling for production and allowed origins.

server/api/profile.put.js

@@ -1,4 +1,4 @@
-import { verifyToken, readUsers, writeUsers, verifyPassword, hashPassword, migrateUserRoles } from '../utils/auth.js'
+import { verifyToken, readUsers, writeUsers, verifyPassword, hashPassword, migrateUserRoles, revokeRefreshSessionsForUser } from '../utils/auth.js'
 import { assertPasswordNotPwned } from '../utils/hibp.js'
 
 export default defineEventHandler(async (event) => {
@@ -42,6 +42,7 @@ export default defineEventHandler(async (event) => {
     }
 
     const user = users[userIndex]
+    let passwordChanged = false
 
     // Check if email is already taken by another user
     if (email !== user.email) {
@@ -91,9 +92,13 @@ export default defineEventHandler(async (event) => {
 
       await assertPasswordNotPwned(newPassword)
       user.password = await hashPassword(newPassword)
+      passwordChanged = true
     }
 
     await writeUsers(users)
+    if (passwordChanged) {
+      await revokeRefreshSessionsForUser(user.id, 'password_changed')
+    }
 
     const migratedUser = migrateUserRoles({ ...user })
     const roles = Array.isArray(migratedUser.roles) ? migratedUser.roles : (migratedUser.role ? [migratedUser.role] : ['mitglied'])
@@ -117,4 +122,3 @@ export default defineEventHandler(async (event) => {
     throw error
   }
 })
-