fix: clean up login tokens in users.deactivateidle

Merged
JU
5mo ago
+58-2

Proposed changes (including videos or screenshots)

When idle users are bulk-deactivated via users.deactivateIdle, their Meteor login tokens (services.resume.loginTokens) were previously left intact. A deactivated user with an existing session token could continue using authenticated APIs.

This change folds the token clearance ('services.resume.loginTokens': []) into the same atomic updateMany that sets active: false, so deactivation and token revocation are a single write.

Additionally, WebSocket notifications are now pushed to affected clients so they immediately discover the deactivation instead of silently failing on the next API call. The old code had a comment claiming "there is no need to send data through WS" because the users "are not logged in," but this seems incorrect - a user's lastLogin timestamp could be stale while their WebSocket connection remains open.

Issue(s)

https://rocketchat.atlassian.net/browse/VLN-366

Steps to test or reproduce

  • N/A

Further comments

  • N/A

Summary by CodeRabbit

  • Chores

    • Bumped package patch versions.

  • Bug Fixes

    • Login tokens for idle-deactivated users are now cleaned up to prevent re-authentication.
    • System now emits notifications when users are deactivated for inactivity.

  • Tests

    • Added end-to-end test validating idle user deactivation and token invalidation.

Review Change Stack