raystack / frontier / 25657497033

42%

main: 44%

Build Type

Pull #1595

github

Committed by AmanGIT07

Commit Message

feat(user): revoke sessions on user disable

When a user is disabled, soft-delete all of their active sessions so
outstanding session cookies stop authenticating immediately rather than
lingering until expires_at (up to 7 days). The lazy notDisabledUserExp
filter at the user repo already blocks disabled-user auth, so this is a
hygiene/audit improvement rather than a security fix: it produces an
explicit revocation trail (per-session SessionRevokedEvent records via
the existing audit hook) and prevents pre-disable sessions from silently
resuming if the user is re-enabled within the validity window.

Reuses repo.List + repo.Delete instead of adding a bulk SQL path, so
each revoked session goes through the same audit pipeline as a manual
admin revoke.

Refs: #1585

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #1595: feat(user): revoke sessions on user disable

Coverage Stats

16 of 17 new or added lines in 3 files covered. (94.12%)

8 existing lines in 1 file now uncovered.

15647 of 37268 relevant lines covered (41.99%)

11.88 hits per line