[Backend] optionalAuth middleware skips revocation check — revoked tokens still authenticate on public routes

[OlaGreat]

Summary

requireAuth correctly queries prisma.revokedToken.findUnique() before accepting a token. optionalAuth does not — it accepts any structurally valid JWT including revoked ones.

This means: after a user logs out (and their jti is added to RevokedToken), routes protected by optionalAuth will still populate req.auth with the revoked token's claims, allowing the user to appear authenticated on those routes.

Location

backend/src/auth.ts, optionalAuth function (line ~118)

Fix

Apply the same revocation check inside optionalAuth after calling verifyJWT:

if (auth.jti) {
  const revoked = await prisma.revokedToken.findUnique({ where: { jti: auth.jti } });
  if (revoked) return next(); // treat as unauthenticated
}