Invalidate JWTs on profile changes

src/RecNet.Application/Common/Security/ClaimsPrincipalExtensions.cs

@@ -16,4 +16,15 @@ public static class ClaimsPrincipalExtensions
 
         return profileId;
     }
+    
+    public static Guid GetTokenVersion(this ClaimsPrincipal user)
+    {
+        var value = user.FindFirst("token_version")?.Value;
+
+        if (!Guid.TryParse(value, out var tokenVersion))
+            throw new UnauthorizedAccessException(
+                "Token version claim is missing or invalid.");
+
+        return tokenVersion;
+    }
 }

src/RecNet.Application/Common/Tokens/TokenVerifyResult.cs

@@ -2,11 +2,12 @@ namespace RecNet.Application.Common.Tokens;
 
 public sealed record TokenVerifyResult(
     bool Succeeded,
-    Guid? ProfileId)
+    Guid? ProfileId,
+    Guid? TokenVersion)
 {
-    public static TokenVerifyResult Success(Guid profileId)
-        => new(true, profileId);
+    public static TokenVerifyResult Success(Guid profileId, Guid tokenVersion)
+        => new(true, profileId, tokenVersion);
 
     public static TokenVerifyResult Failure()
-        => new(false, null);
+        => new(false, null, null);
 }