feat: admin can revoke user sessions (force logout)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/routes/(app)/settings/users/+page.svelte

@@ -68,6 +68,22 @@
 		}
 	}
 
+	async function revokeSessions(user: User) {
+		try {
+			const res = await fetch(`/api/admin/users/${user.id}`, {
+				method: 'PATCH',
+				headers: { 'Content-Type': 'application/json' },
+				body: JSON.stringify({ revokeSessions: true })
+			});
+			if (res.ok) {
+				createMsg = `All sessions revoked for ${user.displayName || user.email}`;
+				createError = false;
+			}
+		} catch {
+			// ignore
+		}
+	}
+
 	async function toggleRole(user: User) {
 		const newRoleValue = user.role === 'admin' ? 'user' : 'admin';
 		try {
@@ -156,6 +172,13 @@
 							{user.role === 'admin' ? 'Make user' : 'Make admin'}
 						</button>
 						{#if user.id !== data.user?.id}
+							<button
+								onclick={() => revokeSessions(user)}
+								class="rounded-sm px-3 py-1 text-xs text-[var(--text-muted)] hover:bg-[var(--border-subtle)]/50"
+								title="Force logout"
+							>
+								Revoke
+							</button>
 							<button
 								onclick={() => deleteUser(user.id)}
 								class="rounded-sm px-3 py-1 text-xs text-[var(--destructive)] hover:bg-[var(--error-bg)]"

src/routes/api/admin/users/[id]/+server.ts

@@ -1,7 +1,7 @@
 import { json, error } from '@sveltejs/kit';
 import type { RequestHandler } from './$types.js';
 import { requireAdmin } from '$lib/server/api-utils.js';
-import { getUser, deleteUser, updateUserRole, resetPassword } from '$lib/server/auth.js';
+import { getUser, deleteUser, updateUserRole, resetPassword, revokeAllSessions } from '$lib/server/auth.js';
 
 export const PATCH: RequestHandler = async ({ params, request, ...event }) => {
 	const admin = requireAdmin(event);
@@ -26,6 +26,10 @@ export const PATCH: RequestHandler = async ({ params, request, ...event }) => {
 		await resetPassword(userId, body.newPassword);
 	}
 
+	if (body.revokeSessions) {
+		revokeAllSessions(userId);
+	}
+
 	const updated = getUser(userId);
 	return json(updated);
 };