Invalidate sessions after password reset
- Task
- task-invalidate-sessions-after-password-reset
- Handed from
- codex to claude-code
- Code since
- unchanged
Verified behavior and checks run
node --testfailed · exit 1 at 87e0b47 rcpt-node-test-20260914t094000z ⚠ unverified
Failed approaches
- Delete session rows on reset. Failed because
refresh()reads the refresh cache first, so cached sessions keep working. cp-invalidate-sessions-…-094000z ⚠ unverified
Next safe action
- Bump
users.tokenVersionon reset and compare it inrefresh(). cp-invalidate-sessions-…-094000z