Advanced Auth Patterns — Series 3

Preview — 3 of 10 questions

What should happen, and why?

javascript

Rotation: each refresh call issues a new refresh token and invalidates the old one.
A request arrives presenting a refresh token that was already used.

AIssue a new pair anyway, since the token verified correctly

BReject that one request and leave the family untouched

CLog the user out of the current device only

DTreat it as evidence of theft — a legitimate client never reuses a rotated token, so either an attacker has a stolen copy or the real client replayed one — and revoke the whole token family, forcing re-authentication

What makes this approach workable, and where does it fail?

javascript

export class UserDto {
  @Expose() id: string;
  @Expose({ groups: ['self', 'admin'] }) email: string;
  @Expose({ groups: ['admin'] }) riskScore: number;
}

AIt fails entirely — serialisation cannot depend on the caller

BIt works when the groups are chosen per request from the caller's identity, so one entity serves several representations — but the default is inclusion, so a property added later with no group annotation is exposed to everyone, which makes omission the dangerous failure mode

CIt works only for top-level properties, never nested objects

DIt requires a separate DTO class per role, which defeats the purpose

Why is filtering after the query the wrong shape?

javascript

@Get()
async findAll(@CurrentUser() user: JwtUser) {
  const orders = await this.orders.findAll();
  return orders.filter((o) => o.tenantId === user.tenantId);   // ✗
}

AThe database returned every tenant's rows before the filter ran, so the work, the memory and the exposure all scale with the whole table rather than the caller's slice — and any code path that forgets the filter, or any pagination applied before it, leaks data; the predicate belongs in the query

Bfilter is synchronous, so it blocks the event loop for large result sets

CNest caches the pre-filter result, which would serve the wrong tenant later

DThe comparison should use !== to exclude rather than include

Answer all 10 questions (7 more), see explanations for every answer, and track your score.