Cascade token revocation from the settings page and password changes
Both paths deleted the access_tokens row directly, relying on D1 triggers that went away with the move to AccountState; they now go through revokeAccessTokens so child, delegated and deploy tokens minted by the token go too. A password change revokes sessions before the token cascade and still signs the user back in if the cascade fails. Assisted-by: Crush
1 file changed+8−2
Rendering diff…