feat: implement user session management with jwt and database persistence

[Tha-Orakkle]

Description

This PR introduces a comprehensive user session management system. It allows users to see the different devices signed into their account -including their locations- and provides a way to log out from all or specific devices.

Features

The key enhancements include:

Active Session Tracking: Each issued JWT refresh token is stored in the database with associated metadata such as user ID, device details, IP address, expires_at, and location.

Session Revocation: Users can view and selectively revoke active sessions, enabling logout from specific devices without affecting other sessions.

Enhanced Security: By maintaining a centralized session store, compromised tokens can be individually invalidated, reducing potential security risks.

Regular DB Management: Every Sunday midnight, expired and revoked tokens are removed from the db.

​

Related Issue (Link to issue ticket)

#1061

Motivation and Context

Implementing session management enhances user experience by providing control over active sessions and improves security by allowing precise token invalidation. This aligns with best practices for authentication systems, addressing the current limitations where JWTs are stateless and lack centralized management.

How Has This Been Tested?

The following testing strategies were employed

• Integration Tests: Simulated user authentication workflows to verify that session data is accurately recorded and managed.

• Manual Testing: Performed using Postman to validate endpoints for session management, including edge cases like attempting to revoke already invalidated tokens.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
  ​

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[samuelogboye]

Ensure comprehensive testing of the session management system, especially edge cases like concurrent session access and token revocation.
Then make sure all test are passing(currently the CI is failing)

[Tha-Orakkle]

I have refactored the get_session_schema_data to function asynchronously to prevent latency.
Tessts have been created for the different endpoints