[Mm-7854] [Backend] Add an endpoint to revoke sessions from all users (#11200)

* first steps towards revoke all sessions endpoint

* route added

* change permission into a more restrictive one

* fix url

* add store code

* testing & mocking

* fixing what merge broke

* remove sessions without retrieving them

* flush sessions from cache

* stop going through sessions to revoke caches, not needed anymore

* add test, fix func name

* fix tests

* remove unneeded code

* [MM-7854]remove access tokens, move to users

* fix docstring

* [MM-7854] improve readability by using require

* [MM-7854] fix tests

* [MM-7854]fix comment

* [MM-7854]improve testing logic

api4/user.go

@@ -63,6 +63,7 @@ func (api *API) InitUser() {
 	api.BaseRoutes.User.Handle("/sessions", api.ApiSessionRequired(getSessions)).Methods("GET")
 	api.BaseRoutes.User.Handle("/sessions/revoke", api.ApiSessionRequired(revokeSession)).Methods("POST")
 	api.BaseRoutes.User.Handle("/sessions/revoke/all", api.ApiSessionRequired(revokeAllSessionsForUser)).Methods("POST")
+	api.BaseRoutes.Users.Handle("/sessions/revoke/all", api.ApiSessionRequired(revokeAllSessionsAllUsers)).Methods("POST")
 	api.BaseRoutes.Users.Handle("/sessions/device", api.ApiSessionRequired(attachDeviceId)).Methods("PUT")
 	api.BaseRoutes.User.Handle("/audits", api.ApiSessionRequired(getUserAudits)).Methods("GET")
 
@@ -1500,6 +1501,20 @@ func revokeAllSessionsForUser(c *Context, w http.ResponseWriter, r *http.Request
 	ReturnStatusOK(w)
 }
 
+func revokeAllSessionsAllUsers(c *Context, w http.ResponseWriter, r *http.Request) {
+	if !c.App.SessionHasPermissionTo(c.App.Session, model.PERMISSION_MANAGE_SYSTEM) {
+		c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
+		return
+	}
+
+	if err := c.App.RevokeSessionsFromAllUsers(); err != nil {
+		c.Err = err
+		return
+	}
+
+	ReturnStatusOK(w)
+}
+
 func attachDeviceId(c *Context, w http.ResponseWriter, r *http.Request) {
 	props := model.MapFromJson(r.Body)
 

api4/user_test.go

@@ -2490,6 +2490,46 @@ func TestRevokeAllSessions(t *testing.T) {
 	CheckUnauthorizedStatus(t, resp)
 }
 
+func TestRevokeSessionsFromAllUsers(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+
+	user := th.BasicUser
+	th.Client.Login(user.Email, user.Password)
+	_, resp := th.Client.RevokeSessionsFromAllUsers()
+	CheckForbiddenStatus(t, resp)
+
+	th.Client.Logout()
+	_, resp = th.Client.RevokeSessionsFromAllUsers()
+	CheckUnauthorizedStatus(t, resp)
+
+	th.Client.Login(user.Email, user.Password)
+	admin := th.SystemAdminUser
+	th.Client.Login(admin.Email, admin.Password)
+	sessions, err := th.Server.Store.Session().GetSessions(user.Id)
+	require.NotEmpty(t, sessions)
+	require.Nil(t, err)
+	sessions, err = th.Server.Store.Session().GetSessions(admin.Id)
+	require.NotEmpty(t, sessions)
+	require.Nil(t, err)
+	_, resp = th.Client.RevokeSessionsFromAllUsers()
+	CheckNoError(t, resp)
+
+	// All sessions were revoked, so making the same call
+	// again will fail due to lack of a session.
+	_, resp = th.Client.RevokeSessionsFromAllUsers()
+	CheckUnauthorizedStatus(t, resp)
+
+	sessions, err = th.Server.Store.Session().GetSessions(user.Id)
+	require.Empty(t, sessions)
+	require.Nil(t, err)
+
+	sessions, err = th.Server.Store.Session().GetSessions(admin.Id)
+	require.Empty(t, sessions)
+	require.Nil(t, err)
+
+}
+
 func TestAttachDeviceId(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()