v3 : une session dure jusqu'à ce qu'on la ferme, l'administration ferme celles d'une identité

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/ld-server/src/access.rs

@@ -7,6 +7,7 @@ use crate::error::{AppError, AppResult};
 use crate::util;
 use axum::Json;
 use axum::extract::{Path, State};
+use axum::http::HeaderMap;
 use serde::Deserialize;
 use serde_json::json;
 
@@ -14,7 +15,11 @@ fn admin_only(user: &IdentityRow) -> AppResult<()> {
     if trustin_access::manages_access(&user.to_identity()) { Ok(()) } else { Err(AppError::Forbidden) }
 }
 
-pub async fn overview(State(state): State<AppState>, User(user): User) -> AppResult<Json<serde_json::Value>> {
+pub async fn overview(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    User(user): User,
+) -> AppResult<Json<serde_json::Value>> {
     admin_only(&user)?;
     #[derive(sqlx::FromRow)]
     struct Member {
@@ -34,6 +39,14 @@ pub async fn overview(State(state): State<AppState>, User(user): User) -> AppRes
     .await?;
     let last_seen: Vec<(String, Option<String>)> =
         sqlx::query_as("SELECT id, last_seen_at FROM identities").fetch_all(&state.db).await?;
+    // Open sessions, but the one this page is read with.
+    let sessions: Vec<(String, i64)> = sqlx::query_as(
+        "SELECT identity_id, COUNT(*) FROM sessions WHERE expires_at > ? AND token_hash != ? GROUP BY identity_id",
+    )
+    .bind(util::now())
+    .bind(auth::session_hash(&state, &headers).unwrap_or_default())
+    .fetch_all(&state.db)
+    .await?;
     let came_by: Vec<(String, String)> =
         sqlx::query_as("SELECT i.id, t.label FROM identities i JOIN team_links t ON t.token_hash = i.team_link")
             .fetch_all(&state.db)
@@ -63,6 +76,7 @@ pub async fn overview(State(state): State<AppState>, User(user): User) -> AppRes
             "id": i.id, "kind": i.kind, "displayName": i.display_name, "g1Member": i.g1_member, "admin": i.admin,
             "lastSeenAt": last_seen.iter().find(|(id, _)| id == &i.id).and_then(|(_, at)| at.clone()),
             "teamLink": came_by.iter().find(|(id, _)| id == &i.id).map(|(_, label)| label.clone()),
+            "sessions": sessions.iter().find(|(id, _)| id == &i.id).map_or(0, |(_, n)| *n),
         })).collect::<Vec<_>>(),
         "teamLinks": crate::team::list(&state).await?,
         "invitations": invitations.iter().map(|(hash, label, admin, groups, expires, identity)| json!({
@@ -207,6 +221,26 @@ pub async fn set_admin(
     Ok(Json(json!({ "admin": b.admin })))
 }
 
+/// A lost device, a person who left: every session of this identity closes,
+/// but the one this request comes with.
+pub async fn close_sessions(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    User(user): User,
+    Path(id): Path<String>,
+) -> AppResult<Json<serde_json::Value>> {
+    admin_only(&user)?;
+    auth::load_identity(&state, &id).await?;
+    let closed = sqlx::query("DELETE FROM sessions WHERE identity_id = ? AND token_hash != ?")
+        .bind(&id)
+        .bind(auth::session_hash(&state, &headers).unwrap_or_default())
+        .execute(&state.db)
+        .await?
+        .rows_affected();
+    tracing::info!(identity = %id, closed, by = %user.id, "sessions closed");
+    Ok(Json(json!({ "closed": closed })))
+}
+
 #[derive(Deserialize)]
 pub struct FeedbackBody {
     route: String,