password reset

backend/middleware/auth.js

@@ -33,6 +33,14 @@ const authenticateToken = async (req, res, next) => {
       });
     }
 
+    // Validate JWT version to invalidate old tokens after password change
+    if (decoded.jwtVersion !== user.jwtVersion) {
+      return res.status(401).json({
+        error: "Session expired due to password change. Please log in again.",
+        code: "JWT_VERSION_MISMATCH",
+      });
+    }
+
     req.user = user;
     next();
   } catch (error) {
@@ -85,6 +93,12 @@ const optionalAuth = async (req, res, next) => {
       return next();
     }
 
+    // Validate JWT version to invalidate old tokens after password change
+    if (decoded.jwtVersion !== user.jwtVersion) {
+      req.user = null;
+      return next();
+    }
+
     req.user = user;
     next();
   } catch (error) {