mirror of
https://github.com/penpot/penpot.git
synced 2026-08-08 22:08:39 +00:00
2f04fcddbf
When a profile is deleted, only the current session was being invalidated. Other active sessions on different devices remained functional until the background cleanup task completed. Add session/invalidate-all helper that deletes all sessions for a profile by profile_id, and call it from delete-profile before the response transform. This ensures immediate access revocation across all devices when an account is deleted. Closes #11114 AI-assisted-by: qwen3.7-plus