Add TTL to Revoked Access Tokens in Redis

[Sourav-kashyap]

Problem

Revoked access tokens were being written to Redis without a TTL (Time-To-Live) in the authentication service's login.controller.ts. This occurred at two call sites:

1. resetPassword method – When users reset their password.
2. createTokenPayload method – During token refresh and tenant switching operations.

---

Solution

Added a TTL to every revoked access token written to Redis.

1. Added revokedTokenTtlMs() Helper

Created a private helper method that:

• Decodes the JWT.
• Extracts the exp (expiration) claim.
• Calculates the remaining lifetime using:

(exp - current_time) + 60 seconds grace period

• Returns the TTL in milliseconds.
• Ensures the TTL is at least 1 second.
• Falls back to 1 hour if:
  • exp is missing.
  • JWT decoding fails.

---

Result

• Revoked access tokens now expire automatically after their remaining JWT lifetime.
• Redis no longer retains revoked tokens indefinitely.
• Prevents long-term Redis memory growth.
• Avoids accumulation of stale JWT entries.
• Reduces the risk of Redis memory exhaustion and AOF rewrite failures.
• Prevents recurrence of the production issue caused by permanent revoked-token entries.