fix(auth): revoke JWT on logout and harden Google sign-in

Logout now increments sessionVersion so existing JWTs are rejected
server-side, deletes orphaned DB sessions, and uses redirectTo for signOut.
Google OAuth requests account selection each time; optional AUTH_GOOGLE_PROMPT=login
forces Google re-authentication on shared devices.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/.env.example

@@ -24,6 +24,7 @@ NEXTAUTH_URL="http://localhost:3000"
 # Authorized redirect URI: {NEXTAUTH_URL}/api/auth/callback/google
 # AUTH_GOOGLE_ID="....apps.googleusercontent.com"
 # AUTH_GOOGLE_SECRET="GOCSPX-..."
+# AUTH_GOOGLE_PROMPT="select_account"  # or "login" to force Google password every time
 
 # -----------------------------------------------------------------------------
 # AI Providers

memento-note/app/(auth)/login/page.tsx

@@ -2,14 +2,20 @@ import { LoginForm } from '@/components/login-form';
 import { getSystemConfig } from '@/lib/config';
 import { isGoogleAuthEnabled } from '@/lib/auth-providers';
 
-export default async function LoginPage() {
+export default async function LoginPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ error?: string }>;
+}) {
   const config = await getSystemConfig();
   const allowRegister = config.ALLOW_REGISTRATION !== 'false' && process.env.ALLOW_REGISTRATION !== 'false';
+  const { error: authError } = await searchParams;
 
   return (
     <LoginForm
       allowRegister={allowRegister}
       googleAuthEnabled={isGoogleAuthEnabled()}
+      authError={authError}
     />
   );
 }

memento-note/app/(main)/settings/profile/profile-form.tsx

@@ -4,7 +4,7 @@ import { useState } from 'react'
 import { Input } from '@/components/ui/input'
 import { updateProfile, changePassword } from '@/app/actions/profile'
 import { updateUserSettings } from '@/app/actions/user-settings'
-import { signOut } from 'next-auth/react'
+import { performSignOut } from '@/lib/auth-client'
 import { toast } from 'sonner'
 import { useLanguage } from '@/lib/i18n'
 import { User, Mail, Shield, LogOut, Camera, Bell } from 'lucide-react'
@@ -143,7 +143,7 @@ export function ProfileForm({ user }: { user: { name: string | null; email: stri
           {/* Logout */}
           <div className="pt-8 border-t border-border/40">
             <button
-              onClick={() => signOut({ callbackUrl: '/login' })}
+              onClick={() => performSignOut('/login')}
               className="flex items-center gap-3 px-6 py-3 bg-rose-50 dark:bg-rose-500/10 text-rose-600 rounded-xl font-bold uppercase tracking-widest text-[10px] hover:bg-rose-100 transition-colors"
             >
               <LogOut size={16} />

memento-note/auth.config.ts

@@ -9,6 +9,8 @@ export const authConfig = {
   trustHost: true,
   session: {
     strategy: 'jwt',
+    maxAge: 60 * 60 * 24 * 7,
+    updateAge: 60 * 60 * 12,
   },
   callbacks: {
     authorized({ auth, request: { nextUrl } }) {

memento-note/auth.ts

@@ -19,6 +19,24 @@ export const { auth, signIn, signOut, handlers } = NextAuth({
         data: { role: 'ADMIN', emailVerified: new Date() },
       });
     },
+    async signOut(message) {
+      const userId =
+        'token' in message && message.token?.sub
+          ? message.token.sub
+          : 'session' in message && message.session?.userId
+            ? message.session.userId
+            : null;
+
+      if (!userId) return;
+
+      await prisma.$transaction([
+        prisma.user.update({
+          where: { id: userId },
+          data: { sessionVersion: { increment: 1 } },
+        }),
+        prisma.session.deleteMany({ where: { userId } }),
+      ]);
+    },
   },
   callbacks: {
     ...authConfig.callbacks,
@@ -41,18 +59,26 @@ export const { auth, signIn, signOut, handlers } = NextAuth({
         token.id = user.id;
         const dbUser = await prisma.user.findUnique({
           where: { id: user.id },
-          select: { role: true },
+          select: { role: true, sessionVersion: true },
         });
-        token.role = dbUser?.role ?? 'USER';
+        if (!dbUser) return null;
+        token.role = dbUser.role;
+        token.sessionVersion = dbUser.sessionVersion;
       } else if (token.sub) {
         const dbUser = await prisma.user.findUnique({
           where: { id: token.sub },
-          select: { role: true },
+          select: { role: true, sessionVersion: true },
         });
-        if (dbUser) {
-          token.id = token.sub;
-          token.role = dbUser.role;
+        if (!dbUser) return null;
+        if (
+          typeof token.sessionVersion === 'number' &&
+          token.sessionVersion !== dbUser.sessionVersion
+        ) {
+          return null;
         }
+        token.id = token.sub;
+        token.role = dbUser.role;
+        token.sessionVersion = dbUser.sessionVersion;
       }
       return token;
     },

memento-note/components/admin-sidebar.tsx

@@ -1,7 +1,8 @@
 'use client'
 
 import { usePathname } from 'next/navigation'
-import { signOut, useSession } from 'next-auth/react'
+import { useSession } from 'next-auth/react'
+import { performSignOut } from '@/lib/auth-client'
 import {
   LayoutDashboard,
   Users,
@@ -113,7 +114,7 @@ export function AdminSidebar({ className }: { className?: string }) {
               <DropdownMenuSeparator />
               <DropdownMenuItem
                 className="cursor-pointer text-destructive focus:text-destructive"
-                onClick={() => signOut({ callbackUrl: '/login' })}
+                onClick={() => performSignOut('/login')}
               >
                 <LogOut className="mr-2 h-4 w-4" />
                 {t('auth.signOut')}

memento-note/components/legal/delete-account-dialog.tsx

@@ -1,7 +1,7 @@
 'use client'
 
 import { useState } from 'react'
-import { signOut } from 'next-auth/react'
+import { performSignOut } from '@/lib/auth-client'
 import { Loader2, ShieldAlert } from 'lucide-react'
 import { toast } from 'sonner'
 import { useLanguage } from '@/lib/i18n'
@@ -42,7 +42,7 @@ export function DeleteAccountDialog({ userEmail, open, onOpenChange }: DeleteAcc
       }
 
       toast.success(t('account.deleteAccount.successRedirect'))
-      await signOut({ callbackUrl: '/login?deleted=true' })
+      await performSignOut('/login?deleted=true')
     } catch {
       toast.error(t('account.deleteAccount.errorFailed'))
       setIsDeleting(false)

memento-note/components/login-form.tsx

@@ -44,12 +44,20 @@ function LoginButton() {
 export function LoginForm({
   allowRegister = true,
   googleAuthEnabled = false,
+  authError,
 }: {
   allowRegister?: boolean;
   googleAuthEnabled?: boolean;
+  authError?: string;
 }) {
   const [errorMessage, dispatch] = useActionState(authenticate, undefined);
   const { t } = useLanguage();
+  const oauthError =
+    authError === 'SessionRequired'
+      ? t('auth.sessionExpired')
+      : authError === 'OAuthAccountNotLinked'
+        ? t('auth.oauthAccountNotLinked')
+        : authError ?? null;
 
   return (
     <div className="bg-white dark:bg-[var(--background)]/50 border border-[var(--border)] p-8 md:p-10 rounded-[48px] shadow-2xl">
@@ -63,6 +71,12 @@ export function LoginForm({
           </p>
         </div>
 
+        {oauthError && (
+          <p className="text-sm text-red-500 text-center px-2" role="alert">
+            {oauthError}
+          </p>
+        )}
+
         {googleAuthEnabled && (
           <>
             <GoogleSignInButton label={t('auth.continueWithGoogle')} />

memento-note/components/sidebar.tsx

@@ -48,7 +48,7 @@ import {
   DropdownMenuSeparator,
   DropdownMenuTrigger,
 } from '@/components/ui/dropdown-menu'
-import { signOut } from 'next-auth/react'
+import { performSignOut } from '@/lib/auth-client'
 import { useNoteRefresh } from '@/context/NoteRefreshContext'
 import { useBrainstormSessions, useDeleteBrainstorm } from '@/hooks/use-brainstorm'
 import { UsageMeter } from './usage-meter'
@@ -849,7 +849,7 @@ export function Sidebar({ className, user }: { className?: string; user?: any })
                 <DropdownMenuSeparator />
                 <DropdownMenuItem
                   className="text-destructive focus:text-destructive"
-                  onClick={() => signOut({ callbackUrl: '/login' })}
+                  onClick={() => performSignOut('/login')}
                 >
                   <LogOut className="h-4 w-4 me-2" />
                   {t('sidebar.signOut')}

memento-note/lib/auth-client.ts

@@ -0,0 +1,8 @@
+'use client';
+
+import { signOut } from 'next-auth/react';
+
+/** Ends the Momento session server-side (JWT revoked) and redirects to login. */
+export async function performSignOut(callbackUrl = '/login') {
+  await signOut({ redirectTo: callbackUrl });
+}

memento-note/lib/auth-providers.ts

@@ -9,11 +9,19 @@ export function buildAuthProviders() {
   const providers = [];
 
   if (process.env.AUTH_GOOGLE_ID && process.env.AUTH_GOOGLE_SECRET) {
+    const googlePrompt =
+      process.env.AUTH_GOOGLE_PROMPT === 'login' ? 'login' : 'select_account';
+
     providers.push(
       Google({
         clientId: process.env.AUTH_GOOGLE_ID,
         clientSecret: process.env.AUTH_GOOGLE_SECRET,
-        allowDangerousEmailAccountLinking: true,
+        authorization: {
+          params: {
+            prompt: googlePrompt,
+            access_type: 'online',
+          },
+        },
       }),
     );
   }

memento-note/locales/en.json

@@ -19,6 +19,8 @@
     "rememberMe": "Remember me",
     "orContinueWith": "Or continue with",
     "continueWithGoogle": "Continue with Google",
+    "sessionExpired": "Your session has expired. Please sign in again.",
+    "oauthAccountNotLinked": "This Google account does not match your existing account. Use the same email or sign in with your password.",
     "checkYourEmail": "Check your email",
     "resetEmailSent": "We have sent a password reset link to your email address if it exists in our system.",
     "returnToLogin": "Return to Login",

memento-note/locales/fr.json

@@ -19,6 +19,8 @@
     "rememberMe": "Se souvenir de moi",
     "orContinueWith": "Ou continuer avec",
     "continueWithGoogle": "Continuer avec Google",
+    "sessionExpired": "Votre session a expiré. Connectez-vous à nouveau.",
+    "oauthAccountNotLinked": "Ce compte Google ne correspond pas à votre compte existant. Utilisez le même e-mail ou connectez-vous par mot de passe.",
     "checkYourEmail": "Vérifiez votre email",
     "resetEmailSent": "Nous avons envoyé un lien de réinitialisation à votre adresse email si elle existe dans notre système.",
     "returnToLogin": "Retour à la connexion",

memento-note/prisma/migrations/20260517180000_add_user_session_version/migration.sql

@@ -0,0 +1,2 @@
+-- Invalidate all JWT sessions on logout by bumping sessionVersion (additive, no data loss)
+ALTER TABLE "User" ADD COLUMN IF NOT EXISTS "sessionVersion" INTEGER NOT NULL DEFAULT 0;

memento-note/prisma/schema.prisma

@@ -15,6 +15,7 @@ model User {
   emailVerified         DateTime?
   password              String?
   role                  String                  @default("USER")
+  sessionVersion        Int                     @default(0)
   image                 String?
   theme                 String                  @default("light")
   resetToken            String?                 @unique