log token revoke as a security event

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/auth/auth.ts

@@ -20,6 +20,7 @@ import { resetPasswordHandler } from './reset-password';
 import { bootstrapHandler } from './bootstrap';
 import { usersMe } from './users-me';
 import { panicHandler } from './panic-handler';
+import { revokeHandler } from './revoke-handler';
 import { passkeyRouter } from './passkey-router';
 
 export const authRouter = createRouter();
@@ -33,8 +34,9 @@ authRouter.use('/', async (ctx) => ctx.json({ officerAuthServer: 'ok' }));
 authRouter.get('/me', userMiddleware, usersMe);
 authRouter.post('/signin', signinRateLimiter, signinHandler);
 authRouter.post('/signout', userMiddleware, signoutHandler);
-// Revoke the current token — blacklists this JWT (same effect as signout). The app's "distress".
-authRouter.post('/revoke', userMiddleware, signoutHandler);
+// Revoke the current token — blacklists this JWT (same effect as signout), logged as a security
+// event. The app's "distress".
+authRouter.post('/revoke', userMiddleware, revokeHandler);
 // Trigger the panic lockdown — authenticated, no password in the body.
 authRouter.post('/panic', userMiddleware, panicHandler);
 authRouter.post('/signup', signupRateLimiter, signupHandler);

src/servers/api/auth/revoke-handler.ts

@@ -0,0 +1,18 @@
+import type { Handler } from 'hono';
+import { blacklistToken, cleanupExpiredTokens } from 'officerdb';
+import { clientIp } from './client-ip';
+
+// Distress: blacklist the current token (same as signout) but log it as a security event.
+export const revokeHandler: Handler = async (ctx) => {
+  const user = ctx.get('user') as { jti: string; exp: number; email?: string };
+  const origin = ctx.get('origin') as string | undefined;
+
+  console.warn(
+    `[SECURITY] token revoked (distress) — user=${user.email || '?'}, origin=${origin || '-'}, ip=${clientIp(ctx)} — ${new Date().toISOString()}`,
+  );
+
+  await blacklistToken(user.jti, user.exp);
+  cleanupExpiredTokens().catch(() => {});
+
+  return ctx.json({ ok: true });
+};