feat(api): invalidate sessions on user deactivation (MS21-AUTH-004) (#582)

Co-authored-by: Jason Woltje <[email protected]> Co-committed-by: Jason Woltje <[email protected]>
2026-02-28 23:41:11 +00:00
parent b57f549d39
commit af68f84dcd
2 changed files with 25 additions and 16 deletions
@@ -192,19 +192,22 @@ export class AdminService {
      throw new BadRequestException(`User ${id} is already deactivated`);
    }

-    const user = await this.prisma.user.update({
-      where: { id },
-      data: { deactivatedAt: new Date() },
-      include: {
-        workspaceMemberships: {
-          include: {
-            workspace: { select: { id: true, name: true } },
+    const [user] = await this.prisma.$transaction([
+      this.prisma.user.update({
+        where: { id },
+        data: { deactivatedAt: new Date() },
+        include: {
+          workspaceMemberships: {
+            include: {
+              workspace: { select: { id: true, name: true } },
+            },
          },
        },
-      },
-    });
+      }),
+      this.prisma.session.deleteMany({ where: { userId: id } }),
+    ]);

-    this.logger.log(`User deactivated: ${id}`);
+    this.logger.log(`User deactivated and sessions invalidated: ${id}`);

    return {
      id: user.id,