fix some other bugs of iam

apps/api/src/modules/sessions/app-session.service.ts

@@ -90,6 +90,16 @@ export class AppSessionService {
     return session !== null && session.revokedAt === null;
   }
 
+  /** IAM session ids still tied to this mobile, so logout can end the other app too. */
+  async activeIamSessionIds(mobile: string): Promise<string[]> {
+    if (!this.enabled || !mobile) return [];
+    const rows = await this.prisma.appSession.findMany({
+      where: { mobile, revokedAt: null, iamSessionId: { not: null } },
+      select: { iamSessionId: true },
+    });
+    return [...new Set(rows.map((row) => row.iamSessionId).filter((id): id is string => Boolean(id)))];
+  }
+
   /** Revoke by the IAM's session id (`sid` in a back-channel logout token). */
   revokeByIamSession(iamSessionId: string, reason = 'iam_backchannel_logout'): Promise<number> {
     return this.revokeWhere({ iamSessionId }, reason);