feat: session revoking (#7755)

* feat(labrinth): user lock db schema

* feat(labrinth): check user lock state

* feat(frontend): user locking

* fix(labrinth): use deleted user if staff account is deleted

* fix(labrinth): error text

* fix(labrinth): allow perform analytics

* fix(labrinth): require user auth write for creating oauth links

* fix(labrinth): prevent linking paypal account if user is locked

* chore(frontend): reword warning

* fix: only allow admins to lock users

* refactor(labrinth): user is_admin

* feat(labrinth): revoke session

* feat(frontend): session revoking

* fix(labrinth): reorder cache purge

* fix(frontend): don't show revoke session on own page

* style(labrinth): fmt

* fix: only allow admins to revoke sessions

* refactor(labrinth): use is_admin

* style(labrinth): remove unused import

* remove(frontend): locked banner

* fix(labrinth): also prevent reads for locked accounts

* refactor(labrinth): remove redundant auth checks

* style(labrinth): fmt

* feat(labrinth): revoke pats for user

* refactor(labrinth): endpoint mount point

* refactor(labrinth): move session revoke to admin

Author: Sychic

apps/labrinth/.sqlx/query-020b692a64fb8eef0252621a2df47f07e97cbe0b616dba4fb639525b590cf62f.json

@@ -260,4 +260,38 @@ impl DBPersonalAccessToken {
 
         Ok(Some(()))
     }
+
+    pub async fn remove_all_for_user(
+        user_id: DBUserId,
+        transaction: &mut PgTransaction<'_>,
+    ) -> Result<Vec<(DBPatId, String)>> {
+        let pats = sqlx::query!(
+            "
+            DELETE FROM pats WHERE user_id = $1 RETURNING id, access_token
+            ",
+            user_id.0
+        )
+        .fetch(&mut *transaction)
+        .map_ok(|x| (DBPatId(x.id), x.access_token))
+        .try_collect()
+        .await
+        .wrap_err("removing user personal access tokens")?;
+
+        Ok(pats)
+    }
+
+    pub async fn clear_user_pats_cache(
+        user_id: DBUserId,
+        pats: Vec<(DBPatId, String)>,
+        redis: &RedisPool,
+    ) -> Result<()> {
+        Self::clear_cache(
+            pats.into_iter()
+                .map(|(id, token)| (Some(id), Some(token), None))
+                .chain(std::iter::once((None, None, Some(user_id))))
+                .collect(),
+            redis,
+        )
+        .await
+    }
 }

apps/labrinth/src/database/models/pat_item.rs

@@ -349,4 +349,20 @@ impl DBSession {
 
         Ok(sessions)
     }
+
+    pub async fn clear_user_sessions_cache(
+        user_id: DBUserId,
+        sessions: Vec<(DBSessionId, String)>,
+        redis: &RedisPool,
+    ) -> Result<()> {
+        Self::clear_cache(
+            sessions
+                .into_iter()
+                .map(|(id, session)| (Some(id), Some(session), None))
+                .chain(std::iter::once((None, None, Some(user_id))))
+                .collect(),
+            redis,
+        )
+        .await
+    }
 }

apps/labrinth/src/database/models/session_item.rs

@@ -25,14 +25,19 @@ use tracing::trace;
 use xredis::RedisPool;
 
 pub mod user_lock;
+pub mod user_sessions;
 
 pub fn config(cfg: &mut actix_web::web::ServiceConfig) {
     cfg.service(
         web::scope("/admin")
             .service(count_download)
             .service(force_reindex)
             .service(force_reindex_project)
-            .service(web::scope("/user").configure(user_lock::config)),
+            .service(
+                web::scope("/user")
+                    .configure(user_lock::config)
+                    .configure(user_sessions::config),
+            ),
     );
 }
 

apps/labrinth/src/routes/internal/admin.rs

@@ -6,6 +6,7 @@ use xredis::RedisPool;
 use crate::auth::get_user_from_headers;
 use crate::database::PgPool;
 use crate::database::models::DBUser;
+use crate::database::models::session_item::DBSession;
 use crate::database::models::user_lock_item::DBUserLock;
 use crate::models::pats::Scopes;
 use crate::models::users::Role;
@@ -22,7 +23,8 @@ pub struct LockUserRequest {
     pub reason: String,
 }
 
-/// Locks a user's account, preventing it from performing any write operations.
+/// Locks a user's account, preventing it from performing any write operations,
+/// and revokes all of its sessions.
 ///
 /// Locking an already locked user replaces the existing lock's reason.
 #[utoipa::path(
@@ -69,14 +71,31 @@ pub async fn lock_user(
         return Err(ApiError::Auth(eyre!("cannot lock a staff account")));
     }
 
-    DBUserLock::upsert(target.id, user.id.into(), reason, &**pool)
+    let mut txn = pool
+        .begin()
+        .await
+        .wrap_internal_err("starting database transaction")?;
+
+    DBUserLock::upsert(target.id, user.id.into(), reason, &mut txn)
         .await
         .wrap_internal_err("locking user")?;
 
+    let sessions = DBSession::remove_all_for_user(target.id, &mut txn)
+        .await
+        .wrap_internal_err("revoking user sessions")?;
+
+    txn.commit()
+        .await
+        .wrap_internal_err("committing database transaction")?;
+
     DBUser::clear_caches(&[(target.id, Some(target.username))], &redis)
         .await
         .wrap_internal_err("clearing user cache")?;
 
+    DBSession::clear_user_sessions_cache(target.id, sessions, &redis)
+        .await
+        .wrap_internal_err("clearing session cache")?;
+
     Ok(())
 }
 

apps/labrinth/src/routes/internal/admin/user_lock.rs

@@ -0,0 +1,83 @@
+use actix_web::{HttpRequest, delete, web};
+use eyre::eyre;
+use xredis::RedisPool;
+
+use crate::auth::get_user_from_headers;
+use crate::database::PgPool;
+use crate::database::models::DBUser;
+use crate::database::models::pat_item::DBPersonalAccessToken;
+use crate::database::models::session_item::DBSession;
+use crate::models::pats::Scopes;
+use crate::queue::session::AuthQueue;
+use crate::routes::ApiError;
+use crate::util::error::Context as _;
+
+pub fn config(cfg: &mut web::ServiceConfig) {
+    cfg.service(revoke_user_sessions);
+}
+
+/// Revokes all sessions and personal access tokens of a user, signing them out everywhere.
+#[utoipa::path(
+	context_path = "/admin/user",
+	tag = "moderation",
+	responses((status = NO_CONTENT))
+)]
+#[delete("/{id}/sessions")]
+pub async fn revoke_user_sessions(
+    req: HttpRequest,
+    path: web::Path<(String,)>,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+) -> Result<(), ApiError> {
+    let user = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::SESSION_ACCESS,
+    )
+    .await
+    .wrap_auth_err("authenticating API request")?
+    .1;
+
+    if !user.role.is_admin() {
+        return Err(ApiError::Auth(eyre!(
+            "only admins can revoke user sessions"
+        )));
+    }
+
+    let target = DBUser::get(&path.into_inner().0, &**pool, &redis)
+        .await
+        .wrap_internal_err("fetching user from database")?
+        .wrap_not_found_err("user not found")?;
+
+    let mut transaction = pool
+        .begin()
+        .await
+        .wrap_internal_err("starting database transaction")?;
+
+    let sessions = DBSession::remove_all_for_user(target.id, &mut transaction)
+        .await
+        .wrap_internal_err("revoking user sessions")?;
+
+    let pats =
+        DBPersonalAccessToken::remove_all_for_user(target.id, &mut transaction)
+            .await
+            .wrap_internal_err("revoking user personal access tokens")?;
+
+    transaction
+        .commit()
+        .await
+        .wrap_internal_err("committing database transaction")?;
+
+    DBSession::clear_user_sessions_cache(target.id, sessions, &redis)
+        .await
+        .wrap_internal_err("clearing session cache")?;
+
+    DBPersonalAccessToken::clear_user_pats_cache(target.id, pats, &redis)
+        .await
+        .wrap_internal_err("clearing personal access token cache")?;
+
+    Ok(())
+}

apps/labrinth/src/routes/internal/admin/user_sessions.rs

@@ -3896,16 +3896,9 @@ pub async fn authenticate_passkey_finish(
                     .commit()
                     .await
                     .wrap_internal_err("committing database transaction")?;
-                DBSession::clear_cache(
-                    sessions
-                        .into_iter()
-                        .map(|(id, session)| (Some(id), Some(session), None))
-                        .chain(std::iter::once((
-                            None,
-                            None,
-                            Some(db_passkey.user_id),
-                        )))
-                        .collect(),
+                DBSession::clear_user_sessions_cache(
+                    db_passkey.user_id,
+                    sessions,
                     &redis,
                 )
                 .await

apps/labrinth/src/routes/internal/flows.rs

@@ -143,6 +143,7 @@ pub fn config(cfg: &mut web::ServiceConfig) {
 		moderation::external_license::update_license,
 		admin::user_lock::lock_user,
 		admin::user_lock::unlock_user,
+		admin::user_sessions::revoke_user_sessions,
 		affiliate::ingest_click,
 		affiliate::get_all,
 		affiliate::create,

apps/labrinth/src/routes/internal/mod.rs

@@ -104,6 +104,14 @@ export class LabrinthModerationInternalModule extends AbstractModule {
 		})
 	}
 
+	public async revokeUserSessions(userId: string): Promise<void> {
+		return this.client.request<void>(`/admin/user/${userId}/sessions`, {
+			api: 'labrinth',
+			version: 'internal',
+			method: 'DELETE',
+		})
+	}
+
 	public async setProjectJudgements(
 		judgements: Labrinth.Moderation.Internal.ProjectJudgements,
 	): Promise<void> {

packages/api-client/src/modules/labrinth/moderation/internal.ts

@@ -109,6 +109,7 @@ import {
 	InfoIcon,
 	LockIcon,
 	LockOpenIcon,
+	LogOutIcon,
 	MoreVerticalIcon,
 	ReportIcon,
 } from '@modrinth/assets'
@@ -196,6 +197,10 @@ const messages = defineMessages({
 		id: 'profile.button.unlock',
 		defaultMessage: 'Unlock account',
 	},
+	revokeSessionsButton: {
+		id: 'profile.button.revoke-sessions',
+		defaultMessage: 'Revoke all sessions',
+	},
 })
 
 const props = withDefaults(
@@ -247,6 +252,7 @@ const emit = defineEmits<{
 	openAnalytics: []
 	editUser: []
 	toggleLock: []
+	revokeSessions: []
 }>()
 
 const { formatMessage } = useVIntl()
@@ -331,6 +337,14 @@ const moreActions = computed<ButtonMenuOption[]>(() => [
 		tone: 'red',
 		shown: props.showStaffActions && props.isAdmin && props.user.role === 'developer',
 	},
+	{
+		id: 'revoke-sessions',
+		label: formatMessage(messages.revokeSessionsButton),
+		icon: LogOutIcon,
+		action: () => emit('revokeSessions'),
+		tone: 'red',
+		shown: props.showStaffActions && props.isAdmin && !props.isSelf,
+	},
 	{
 		id: 'open-shared-instances',
 		label: formatMessage(messages.sharedInstancesButton),