feat: JWT refresh token rotation implemented

[ADARSHsri2004]

Description

This pull request completes the full backend implementation of the JWT-based authentication system with Refresh Token Rotation. It also integrates and finalizes two external OAuth providers.

Key features implemented include:

• 🔄 Token Rotation: Implemented the /api/auth/refresh endpoint for securely issuing a new Access Token and rotating the Refresh Token stored as an HTTP-only cookie.
• 🚪 Logout: Implemented the /api/auth/logout controller to clear the HTTP-only cookie and delete the token from the database.
• 🔒 Access Control: Implemented the protect middleware to secure routes like /api/auth/me.

---

Semver Changes

• Patch (bug fix, no new features)
• Minor (new features, no breaking changes)
• Major (breaking changes)

---

Issues

Closes #25

---

Checklist

• I have read the Contributing Guidelines.

[Copilot]

Pull Request Overview

This PR implements JWT refresh token rotation for enhanced authentication security, replacing the previous single-token approach with separate access and refresh tokens. The implementation includes token rotation on refresh, secure logout, and protected route access control.

Key Changes:

• Introduced dual-token system with separate access and refresh tokens, each using dedicated JWT secrets and configurable expiration times
• Implemented refresh token rotation with reuse detection to mitigate token theft attacks
• Added logout functionality that properly clears cookies and invalidates refresh tokens from the database

Reviewed Changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
backend/src/utils/generateToken.ts	Split token generation into separate functions for access and refresh tokens with configurable expiration
backend/src/routes/authRoutes.ts	Added new routes for logout and token refresh endpoints
backend/src/models/userModel.ts	Extended user schema to store array of valid refresh tokens
backend/src/middleware/authMiddleware.ts	Updated to use new JWT_ACCESS_SECRET environment variable
backend/src/controllers/authController.ts	Implemented refresh token rotation, logout logic, and OAuth callback with token management
backend/src/app.ts	Added cookie-parser middleware for handling HTTP-only cookies
backend/package.json	Added cookie-parser dependency and its TypeScript types

Files not reviewed (2)

• backend/package-lock.json: Language not supported
• frontend/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[04shubham7]

Looks Fine

[04shubham7]

@ADARSHsri2004 go through the copilot's issues resolve them one by one pls before getting merged

[ADARSHsri2004]

@04shubham7 changes have been applied

[Copilot]

Pull Request Overview

Copilot reviewed 7 out of 9 changed files in this pull request and generated 8 comments.

Files not reviewed (2)

• backend/package-lock.json: Language not supported
• frontend/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ADARSHsri2004]

@04shubham7 I have applied the changes

[04shubham7]

Looks Fine