feat(api): invalidate sessions on user deactivation (MS21-AUTH-004)

apps/api/src/admin/admin.service.ts

@@ -192,7 +192,8 @@ export class AdminService {
       throw new BadRequestException(`User ${id} is already deactivated`);
     }
 
-    const user = await this.prisma.user.update({
+    const [user] = await this.prisma.$transaction([
+      this.prisma.user.update({
         where: { id },
         data: { deactivatedAt: new Date() },
         include: {
@@ -202,9 +203,11 @@ export class AdminService {
             },
           },
         },
-    });
+      }),
+      this.prisma.session.deleteMany({ where: { userId: id } }),
+    ]);
 
-    this.logger.log(`User deactivated: ${id}`);
+    this.logger.log(`User deactivated and sessions invalidated: ${id}`);
 
     return {
       id: user.id,