Missing Functionality: User session not invalidated after password or permission update

[naveed-jameel-comsian]

When a user's password or permissions are updated, the system does not invalidate the existing user session. The user remains logged in and can continue using the system without being forced to re-authenticate.

Steps to Reproduce
Log in as a team member user
From an admin account, update the user's password or permissions
Return to the existing session of the team member user

Expected Behavior
The user session should be invalidated immediately after password or permission changes.
The user should be forced to log in again using the updated credentials.

Actual Behavior
The user remains logged in with the existing session.
No prompt appears requesting the user to re-authenticate.

[Israeltheminer]

@naveed-jameel-comsian Thanks for the report. I agree session invalidation makes sense for password changes — if an admin resets a user's password, the existing session should be invalidated to force re-authentication. We'll implement that.

For permission changes, this isn't actually needed in our case. We use Convex, which is reactive — permission changes in the database propagate to the client in real-time via subscriptions. There's no stale permission window since we check roles against the database on every request, not from cached JWT claims. Forcing a re-login on permission changes would just add friction with no security benefit.

[Israeltheminer]

Fixed — user sessions are now invalidated when their password is changed.