fix: a password change or ban ends authorized device sessions

The device hand-over now refuses a session authorized before the user's
tokens_valid_after, and every AccessRevokedEvent revokes the user's
pending and confirmed device sessions inside the write's transaction
(classes.RevokeDeviceSessions).

classes/device_auth.go

@@ -139,6 +139,20 @@ func HandOverDeviceJTI(ctx context.Context, db *gorm.DB, oldJTI, newJTI string)
 	return err
 }
 
+// RevokeDeviceSessions marks the pending and confirmed device sessions of
+// userIDs revoked, so none of them hands a session token over any more.
+// Used sessions keep their status: their tokens end through
+// tokens_valid_after or a revoke. The plugin calls it on db, the write's
+// transaction, for every AccessRevokedEvent (a ban or a password change).
+func RevokeDeviceSessions(ctx context.Context, db *gorm.DB, userIDs ...uint) error {
+	if db == nil || len(userIDs) == 0 {
+		return nil
+	}
+	return db.WithContext(ctx).Exec(`UPDATE golem15_user_device_auth_sessions
+	SET status = 'revoked', updated_at = NOW()
+	WHERE user_id IN ? AND status IN ('pending', 'confirmed')`, userIDs).Error
+}
+
 // FollowDeviceJTI moves a used device session from oldJTI, the jti of the
 // session token a refresh presented, to newJTI, the jti of the token it
 // minted, and stamps last_activity_at. It reports revoked when no used