feat: sign out all operator sessions (#287)

src/dashboard_auth.py

@@ -140,6 +140,10 @@ def revoke_session(session: Session) -> None:
     _session_store().revoke(session.session_id)
 
 
+async def revoke_all_sessions() -> None:
+    await asyncio.to_thread(_session_store().revoke_all)
+
+
 async def request_session(request: Request) -> Session | None:
     return await asyncio.to_thread(verify_session, request.cookies.get(SESSION_COOKIE))
 

src/main.py

@@ -663,6 +663,39 @@ async def sign_out(request: Request, response: Response):
     return {"authenticated": False, "clear_private_device_data": True}
 
 
+@app.delete("/api/v1/sessions")
+async def sign_out_all_devices(request: Request, response: Response):
+    try:
+        await dashboard_auth.revoke_all_sessions()
+    except dashboard_auth.SessionStoreError:
+        return JSONResponse(
+            {"detail": "Session registry is temporarily unavailable"},
+            status_code=503,
+            headers={"Cache-Control": "no-store"},
+        )
+    path = dashboard_auth.cookie_path(request)
+    response.delete_cookie(
+        dashboard_auth.SESSION_COOKIE,
+        path=path,
+        secure=True,
+        httponly=True,
+        samesite="strict",
+    )
+    response.delete_cookie(
+        dashboard_auth.CSRF_COOKIE,
+        path=path,
+        secure=True,
+        httponly=False,
+        samesite="strict",
+    )
+    response.headers["Cache-Control"] = "no-store"
+    return {
+        "authenticated": False,
+        "all_sessions_revoked": True,
+        "clear_private_device_data": True,
+    }
+
+
 @app.get("/readyz")
 async def readiness():
     """Return readiness after verifying the configured Gitea connection."""

src/session_store.py

@@ -86,3 +86,10 @@ class SessionStore:
                 )
         except (OSError, sqlite3.Error) as exc:
             raise SessionStoreError("Session registry is temporarily unavailable") from exc
+
+    def revoke_all(self) -> None:
+        try:
+            with self._connect() as connection:
+                connection.execute("DELETE FROM active_sessions")
+        except (OSError, sqlite3.Error) as exc:
+            raise SessionStoreError("Session registry is temporarily unavailable") from exc