security: revoke sessions when an account is deactivated, demoted or its password changes - #2594

Problem

Session JWTs are valid for seven days, and every route trusted their claims without looking at the account again. As a result:

• deactivating or deleting a user did not end their existing sessions;
• removing ROLE_ADMIN left the admin panel reachable with the old token;
• resetting a password did not log out sessions opened with the old one;
• CAS and OpenID logins issued sessions for deactivated accounts (only the password login checked is_active);
• GET /api/yjs/debug/:projectUuid/ws-url minted a fresh token from any valid token, so a session could be renewed indefinitely.

How other projects handle it

This PR combines the first two: no migration, and it covers deletion, deactivation, demotion and password changes with one check.

Changes

• src/services/session-revocation.ts:
  • getSessionRevocationReason(payload) rejects a token when any of these holds:
    • the account is missing or inactive;
    • the token claims a role the account no longer has (gaining a role keeps the session);
    • the token's pwh no longer matches the current password hash;
    • for an impersonation token, the impersonating administrator is no longer an active admin.
  • sessionRevocationGuard() is mounted once in src/index.ts, after the static-file hook and before the maintenance check. It removes a revoked token from the Authorization header or the auth cookie before any route runs, so all ~15 existing verification sites (route plugins, API v1, maintenance bypass) treat the request as anonymous with no per-route changes. Forged or expired tokens are left for the routes to reject as before.
  • Results are cached per token for 5 seconds, because every static asset request carries the auth cookie. A revocation therefore applies within 5 seconds on each instance.
  • verifySessionToken() is now the Yjs WebSocket's default verifier (its token travels in the query string, not in a header).
• Login tokens (password, form login, CAS, OpenID, guest, offline, impersonation) now carry pwh, an HMAC of the stored password hash keyed with the JWT secret. It reveals nothing about the hash.
• PATCH /api/user/password re-signs the caller's own session with the new fingerprint, so changing your own password does not log you out (as Django's update_session_auth_hash does). Other sessions are revoked.
• CAS and OpenID callbacks return 403 for deactivated accounts, matching the password login.
• The yjs-debug ws-url token copies the caller's claims (isGuest, authMethod, pwh) instead of hard-coding them, and its expiry is capped at the caller's own exp.

Compatibility

• Tokens issued before this change have no pwh. They are still checked for account existence, active state and roles, but a password change does not revoke them; they expire within seven days. CLI tokens from jwt:generate behave the same way, but --raw-sub tokens with an email sub are now rejected.
• The WebSocket token embedded in the workarea page has no pwh on purpose, so changing your own password does not break the editor's reconnects.
• A demoted user is logged out and simply logs in again with the new roles. Gaining a role keeps the session.

Not covered (follow-up)

• WebSocket connections that are already open are not closed when an account is revoked; the check applies when a socket connects or reconnects. Closing live sockets across instances is a separate change (multi-instance revocation).

Tests

• src/services/session-revocation.spec.ts: 32 cases at 100% coverage of the new module. They cover:
  • every revocation reason;
  • malformed subjects (missing, zero, negative, fractional, non-numeric);
  • a re-activated user getting a valid session again;
  • unreadable stored roles;
  • forged tokens (rejected without any database lookup);
  • cookie stripping that keeps the other cookies;
  • Bearer stripping;
  • the guard in front of the real withJwtAuth/requireAuth/requireAdmin (deactivated → 401, demoted admin → 401 on admin routes);
  • cache expiry.
• auth.spec.ts: login token carries pwh; CAS and OpenID refuse deactivated accounts.
• user.spec.ts: a password change re-signs the session with the new fingerprint.
• admin.spec.ts: the impersonation token carries the target's pwh and impersonatedBy.
• yjs-debug.spec.ts: the ws-url token never outlives the caller and copies its claims.
• yjs-websocket.spec.ts: the default WebSocket verifier goes through the revocation check.

Verification

• make fix: exit 0; the 44 warnings were already there before this change, none in changed lines.
• make test-unit: exit 0, 9235 pass, 0 fail.
• make test-integration: exit 0, 770 pass, 0 fail.
• Smoke test against a real server (bun src/index.ts, SQLite) with the same cookie: logged-in session returns 200; after deactivating the user, /api/auth/user with the cookie and /api/v1/projects with the Bearer token both return 401 while /login still renders (200); after re-activating, 200 again; after changing the stored password hash, 401.
• E2E not run locally; CI runs it.