[Mm-7854] [Backend] Add an endpoint to revoke sessions from all users (#11200)

* first steps towards revoke all sessions endpoint

* route added

* change permission into a more restrictive one

* fix url

* add store code

* testing & mocking

* fixing what merge broke

* remove sessions without retrieving them

* flush sessions from cache

* stop going through sessions to revoke caches, not needed anymore

* add test, fix func name

* fix tests

* remove unneeded code

* [MM-7854]remove access tokens, move to users

* fix docstring

* [MM-7854] improve readability by using require

* [MM-7854] fix tests

* [MM-7854]fix comment

* [MM-7854]improve testing logic

api4/user_test.go

@@ -2490,6 +2490,46 @@ func TestRevokeAllSessions(t *testing.T) {
 	CheckUnauthorizedStatus(t, resp)
 }
 
+func TestRevokeSessionsFromAllUsers(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+
+	user := th.BasicUser
+	th.Client.Login(user.Email, user.Password)
+	_, resp := th.Client.RevokeSessionsFromAllUsers()
+	CheckForbiddenStatus(t, resp)
+
+	th.Client.Logout()
+	_, resp = th.Client.RevokeSessionsFromAllUsers()
+	CheckUnauthorizedStatus(t, resp)
+
+	th.Client.Login(user.Email, user.Password)
+	admin := th.SystemAdminUser
+	th.Client.Login(admin.Email, admin.Password)
+	sessions, err := th.Server.Store.Session().GetSessions(user.Id)
+	require.NotEmpty(t, sessions)
+	require.Nil(t, err)
+	sessions, err = th.Server.Store.Session().GetSessions(admin.Id)
+	require.NotEmpty(t, sessions)
+	require.Nil(t, err)
+	_, resp = th.Client.RevokeSessionsFromAllUsers()
+	CheckNoError(t, resp)
+
+	// All sessions were revoked, so making the same call
+	// again will fail due to lack of a session.
+	_, resp = th.Client.RevokeSessionsFromAllUsers()
+	CheckUnauthorizedStatus(t, resp)
+
+	sessions, err = th.Server.Store.Session().GetSessions(user.Id)
+	require.Empty(t, sessions)
+	require.Nil(t, err)
+
+	sessions, err = th.Server.Store.Session().GetSessions(admin.Id)
+	require.Empty(t, sessions)
+	require.Nil(t, err)
+
+}
+
 func TestAttachDeviceId(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()