End sessions when access changes

How to do it

Put the session cleanup in the same function and transaction as the change, so no code path forgets it. Keep the current session after a password change, because the person just proved who they are. A password reset already ends other sessions, as make password resets safe says. Removal from one organisation ends access there only, as remove access when someone leaves says.

Example

export async function changePassword(db, userId, currentSessionId, newHash) {
  await db.tx(async tx => {
    await tx.none('UPDATE users SET password_hash = $1 WHERE id = $2', [newHash, userId]);
    await tx.none('DELETE FROM sessions WHERE user_id = $1 AND id <> $2', [userId, currentSessionId]);
  });
}

def change_password(conn, user_id: str, current_session_id: str, new_hash: str) -> None:
    with conn.transaction():
        conn.execute("UPDATE users SET password_hash = %s WHERE id = %s", (new_hash, user_id))
        conn.execute("DELETE FROM sessions WHERE user_id = %s AND id <> %s", (user_id, current_session_id))

How to check

Sign in from two browsers and change the password in the first. The second is signed out and the first stays in. Disable the test account as an admin, and the first is signed out too.