Feat add iam auth

apps/api/src/modules/admin-users/admin-users.service.ts

@@ -3,6 +3,7 @@ import { AdminRole, Prisma } from '@prisma/client';
 import * as bcrypt from 'bcryptjs';
 import { PrismaService } from '../../prisma/prisma.service';
 import { TableService } from '../admin-table/table.service';
+import { AdminSessionService } from '../sessions/admin-session.service';
 import type { TableQueryDto } from '../admin-table/table-query.dto';
 import { faToEn } from '../customer-auth/digits';
 
@@ -24,6 +25,7 @@ export class AdminUsersService {
   constructor(
     private readonly prisma: PrismaService,
     private readonly table: TableService,
+    private readonly sessions: AdminSessionService,
   ) {}
 
   private static readonly ALLOWED = [
@@ -332,7 +334,7 @@ export class AdminUsersService {
       };
     }
 
-    return this.prisma.adminUser.update({
+    const updated = await this.prisma.adminUser.update({
       where: { id },
       data: patch,
       include: {
@@ -342,6 +344,18 @@ export class AdminUsersService {
         salesExpertProfile: { include: { city: true } },
       },
     });
+
+    // Disabling an account or changing its password used to leave every already
+    // issued token working for up to 12h. With session tracking on, those tokens
+    // end here; with it off, nothing happens and the behaviour is as before.
+    if (patch.isActive === false || patch.passwordHash !== undefined) {
+      await this.sessions.revokeAllForAdmin(
+        id,
+        patch.isActive === false ? 'account_disabled' : 'password_changed',
+      );
+    }
+
+    return updated;
   }
 
   /**