Vikrant Gupta e2e9173986 fix(user): revoke sessions when a user is deleted (#12943) ...

#### Description

- `DeleteUser` never told the tokenizer about the deletion.
`SoftDeleteUser` removed the `auth_token` rows with raw SQL, so the
opaque tokenizer kept serving the deleted user's session from cache
until rotation forced a DB read, up to `rotation.interval` later.
- The tokenizer eviction now runs before the soft delete, inside one
transaction; `SoftDeleteUser` joins the caller's transaction instead of
opening its own.
- The hourly last-observed-at flush returned an error for any org with
nothing to flush because bun rejects an empty `VALUES` slice. It now
returns early.
- Adds an integration test asserting a deleted user's held token is
rejected on the next request.

#### Additional Information

Only affects the opaque tokenizer; under the JWT tokenizer
`DeleteTokensByUserID` is a no-op.

2026-09-22 12:14:51 +00:00

..

bootstrap

test(callbackauthn): cover the google authn flow end to end (#12486)

2026-08-10 08:35:58 +00:00

testdata

feat(authz): enable FGA for cloud integration (#12895)

2026-09-21 14:20:11 +00:00

tests

fix(user): revoke sessions when a user is deleted (#12943)

2026-09-22 12:14:51 +00:00