ECSoC_2026 & ELUSoC_2026 Duplicate refreshToken definition in User schema (Silent Override)

[Sairaj2033]

Bug Description

The refreshToken field is defined twice in userSchema[cite: 1].

• It appears once at lines 80–83[cite: 1].
• It appears again at lines 113–116 under the comment "Add this field for refresh token system."[cite: 1].

Technical Impact

• Mongoose silently uses the last definition encountered for duplicate keys in a schema object literal[cite: 1].
• While both definitions are currently identical, this is a latent data integrity risk[cite: 1].
• If either definition is modified independently during a refactor (e.g., adding a select: false only to one), the behavior will change unexpectedly without a visible error, and the duplicate will hide the regression[cite: 1].

Location & Severity

• File: models/User.js[cite: 1]
• Severity: Medium[cite: 1]

[Sairaj2033]

@Sitaram8472 i would like to Fix this issue,I request You to Assign this Issue to me,
Contributor from ECSOC and ELUSOC both