v3 : relecture de decbc0b — lien annulé retiré de la page, liens annulés avant les sessions, pluriel espagnol

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/ld-server/src/access.rs

@@ -233,20 +233,7 @@ pub async fn close_sessions(
     admin_only(&user)?;
     auth::load_identity(&state, &id).await?;
     let current = auth::session_hash(&state, &headers).unwrap_or_default();
-    // Counted as the overview counts them; the expired ones go too.
-    let open: i64 = sqlx::query_scalar(
-        "SELECT COUNT(*) FROM sessions WHERE identity_id = ? AND token_hash != ? AND expires_at > ?",
-    )
-    .bind(&id)
-    .bind(&current)
-    .bind(util::now())
-    .fetch_one(&state.db)
-    .await?;
-    sqlx::query("DELETE FROM sessions WHERE identity_id = ? AND token_hash != ?")
-        .bind(&id)
-        .bind(&current)
-        .execute(&state.db)
-        .await?;
+    // The waiting link first: opened in between, it would open a session that stays.
     let links = sqlx::query(
         "UPDATE invitations SET expires_at = ? WHERE identity_id = ? AND used_at IS NULL AND expires_at > ?",
     )
@@ -256,6 +243,19 @@ pub async fn close_sessions(
     .execute(&state.db)
     .await?
     .rows_affected();
+    // Counted as the overview counts them; the expired ones go too.
+    let open = sqlx::query("DELETE FROM sessions WHERE identity_id = ? AND token_hash != ? AND expires_at > ?")
+        .bind(&id)
+        .bind(&current)
+        .bind(util::now())
+        .execute(&state.db)
+        .await?
+        .rows_affected();
+    sqlx::query("DELETE FROM sessions WHERE identity_id = ? AND token_hash != ?")
+        .bind(&id)
+        .bind(&current)
+        .execute(&state.db)
+        .await?;
     tracing::info!(identity = %id, closed = open, links, by = %user.id, "sessions closed");
     Ok(Json(json!({ "closed": open, "links": links })))
 }