[Mm-7854] [Backend] Add an endpoint to revoke sessions from all users (#11200)

* first steps towards revoke all sessions endpoint

* route added

* change permission into a more restrictive one

* fix url

* add store code

* testing & mocking

* fixing what merge broke

* remove sessions without retrieving them

* flush sessions from cache

* stop going through sessions to revoke caches, not needed anymore

* add test, fix func name

* fix tests

* remove unneeded code

* [MM-7854]remove access tokens, move to users

* fix docstring

* [MM-7854] improve readability by using require

* [MM-7854] fix tests

* [MM-7854]fix comment

* [MM-7854]improve testing logic

app/session.go

@@ -113,6 +113,23 @@ func (a *App) RevokeAllSessions(userId string) *model.AppError {
 	return nil
 }
 
+// RevokeSessionsFromAllUsers will go through all the sessions active
+// in the server and revoke them
+func (a *App) RevokeSessionsFromAllUsers() *model.AppError {
+	// revoke tokens before sessions so they can't be used to relogin
+	tErr := a.Srv.Store.OAuth().RemoveAllAccessData()
+	if tErr != nil {
+		return tErr
+	}
+	err := a.Srv.Store.Session().RemoveAllSessions()
+	if err != nil {
+		return err
+	}
+	a.ClearSessionCacheForAllUsers()
+
+	return nil
+}
+
 func (a *App) ClearSessionCacheForUser(userId string) {
 	a.ClearSessionCacheForUserSkipClusterSend(userId)
 
@@ -126,6 +143,18 @@ func (a *App) ClearSessionCacheForUser(userId string) {
 	}
 }
 
+func (a *App) ClearSessionCacheForAllUsers() {
+	a.ClearSessionCacheForAllUsersSkipClusterSend()
+
+	if a.Cluster != nil {
+		msg := &model.ClusterMessage{
+			Event:    model.CLUSTER_EVENT_CLEAR_SESSION_CACHE_FOR_ALL_USERS,
+			SendType: model.CLUSTER_SEND_RELIABLE,
+		}
+		a.Cluster.SendClusterMessage(msg)
+	}
+}
+
 func (a *App) ClearSessionCacheForUserSkipClusterSend(userId string) {
 	keys := a.Srv.sessionCache.Keys()
 
@@ -144,6 +173,11 @@ func (a *App) ClearSessionCacheForUserSkipClusterSend(userId string) {
 	a.InvalidateWebConnSessionCacheForUser(userId)
 }
 
+func (a *App) ClearSessionCacheForAllUsersSkipClusterSend() {
+	mlog.Info("Purging sessions cache")
+	a.Srv.sessionCache.Purge()
+}
+
 func (a *App) AddSessionToCache(session *model.Session) {
 	a.Srv.sessionCache.AddWithExpiresInSecs(session.Token, session, int64(*a.Config().ServiceSettings.SessionCacheInMinutes*60))
 }