trying to fix bug changing in class

[avdheshpatidar27]

Summary

Fixed refresh token replay-attack detection in AuthService. Previously,
refresh() and logout() used findByTokenIdAndRevokedFalse(), which excluded
already-revoked tokens from the query — so a revoked (reused/replayed) token,
an expired token, and a token that never existed all returned the same generic
401 response with zero logging.

Changes:

• Added RefreshTokenRepository.findByTokenId(String tokenId) — looks up a
  token by id without filtering out revoked tokens.
• Added RefreshTokenRepository.revokeAllByUser(Long userId) — revokes all
  active refresh tokens for a user (defense-in-depth on detected replay).
• Reworked AuthService.refresh() to distinguish three cases:
  1. Token id not found → normal 401
  2. Token found but already revoked → treated as a replay attack: logs a
     SECURITY ALERT, persists a SecurityEvent (new
     SecurityEventType.TOKEN_REPLAY_DETECTED), revokes all other sessions
     for the user, returns 401
  3. Token found, not revoked, but hash mismatch/expired → normal 401
• Applied the same detection logic to AuthService.logout().
• Added SecurityEventType.TOKEN_REPLAY_DETECTED enum value.
• Injected SecurityEventRepository into AuthService to persist the audit
  event.

Linked issue

Closes #

How to test

1. Log in — refresh_token HttpOnly cookie is set.
2. Call POST /api/auth/refresh

[GideonBa]

Thanks for working on the replay-token handling. I found a few compile blockers that need to be fixed before this can be merged.

[GideonBa]

This JPQL uses alias r, but the update declares rt. Please change this to rt.revoked = false; otherwise the revoke-all query will fail.

[GideonBa]

AuthService now references TOKEN_REPLAY_DETECTED, but this enum still does not define it. Please add the new enum value here.

[GideonBa]

This field is currently outside the AuthService class body, which makes the file invalid Java. Please move it into the class so @RequiredArgsConstructor can inject it.

[GideonBa]

tokenId is used here before it is assigned. Please restore String tokenId = claims.getId() after parsing the refresh token.

[DenizAltunkapan]

@avdheshpatidar27 please fix the failing workflows