feat: enhance security with token blacklisting and input sanitization; add helmet for security headers

backend/src/utils/tokenBlacklist.ts

@@ -0,0 +1,46 @@
+/**
+ * In-memory token blacklist with SQLite persistence.
+ * Tokens are blacklisted on logout and expire automatically based on JWT expiry.
+ */
+
+import { getDb } from '../db/database.js'
+
+const memoryCache = new Set<string>()
+let initialized = false
+
+function initCache(): void {
+  if (initialized) return
+  const db = getDb()
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS token_blacklist (
+      token_hash TEXT PRIMARY KEY,
+      expires_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_token_blacklist_expires ON token_blacklist(expires_at);
+  `)
+  // Load recent blacklisted tokens into memory
+  const rows = db.prepare('SELECT token_hash FROM token_blacklist WHERE expires_at > ?')
+    .all(Date.now()) as { token_hash: string }[]
+  for (const row of rows) {
+    memoryCache.add(row.token_hash)
+  }
+  initialized = true
+}
+
+export function isTokenBlacklisted(tokenHash: string): boolean {
+  initCache()
+  return memoryCache.has(tokenHash)
+}
+
+export function blacklistToken(tokenHash: string, expiresAt: number): void {
+  initCache()
+  memoryCache.add(tokenHash)
+  const db = getDb()
+  db.prepare('INSERT OR IGNORE INTO token_blacklist (token_hash, expires_at) VALUES (?, ?)')
+    .run(tokenHash, expiresAt)
+}
+
+export function cleanupExpiredTokens(): void {
+  const db = getDb()
+  db.prepare('DELETE FROM token_blacklist WHERE expires_at <= ?').run(Date.now())
+}