Repository navigation
Revoke all of a user's sessions on email password recovery - #779
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
This was referenced Oct 21, 2026
Collaborator
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
This was referenced Oct 21, 2026
This was referenced Oct 22, 2026
dowski
force-pushed
the
dowski/revoke-sessions-on-password-recovery
branch
from
October 23, 2026 20:56
3855760 to
b6bf24b
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 23, 2026 20:56
afe8173 to
fcde1bf
Compare
commit: |
dowski
marked this pull request as ready for review
October 23, 2026 21:10
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 6 files
This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.
Re-trigger cubic
dowski
force-pushed
the
dowski/revoke-sessions-on-password-recovery
branch
from
October 26, 2026 23:27
b6bf24b to
235036d
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 26, 2026 23:27
fcde1bf to
201b3bd
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 26, 2026 23:44
201b3bd to
957d13b
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-recovery
branch
from
October 26, 2026 23:44
235036d to
598fd10
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
2 times, most recently
from
October 26, 2026 23:50
520e0ba to
2a03112
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-recovery
branch
from
October 26, 2026 23:52
598fd10 to
230980a
Compare
dowski
force-pushed
the
dowski/revoke-session-handle
branch
from
October 27, 2026 14:51
2a03112 to
adf014c
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-recovery
branch
from
October 27, 2026 14:51
230980a to
50e1224
Compare
dowski
changed the base branch from
dowski/revoke-session-handle
to
graphite-base/779
October 27, 2026 15:00
dowski
force-pushed
the
dowski/revoke-sessions-on-password-recovery
branch
from
October 27, 2026 15:02
50e1224 to
12672cb
Compare
dowski
force-pushed
the
graphite-base/779
branch
from
October 27, 2026 15:02
adf014c to
09915cc
Compare
dowski
force-pushed
the
dowski/revoke-sessions-on-password-recovery
branch
from
October 27, 2026 15:03
12672cb to
8dd4293
Compare
Add ctx.convexAuth.revokeAllSessions(userId), which revokes every session of a user without needing a signed-in caller, for flows that prove ownership another way. completePasswordRecovery calls it after setting the new password and before minting the new session, so a recovery after an account takeover signs out whoever knew the old password. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dowski
force-pushed
the
dowski/revoke-sessions-on-password-recovery
branch
from
October 27, 2026 15:51
8dd4293 to
98c0415
Compare
Nicolapps
approved these changes
Oct 27, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is accomplished via a new ctx.convexAuth.revokeAllSessions(userId)
helper, which revokes every session for the given userId.
That function is only available to authentication methods. It is only meant
to be called when confirming via some other means that all sessions for
userId should be deleted (e.g. after proof that the associated email address
was just verified).
It's used that way in completePasswordRecovery, which calls it after setting
the new password and before minting the new session.