MM-62188 - Revoke user sessions when converted to bot (#29573)

* revoke user sessions when converted to bot

* lint fixes

server/channels/app/bot.go

@@ -614,5 +614,9 @@ func (a *App) ConvertUserToBot(rctx request.CTX, user *model.User) (*model.Bot,
 			return nil, model.NewAppError("CreateBot", "app.bot.createbot.internal_error", nil, "", http.StatusInternalServerError).Wrap(err)
 		}
 	}
+	if err := a.RevokeAllSessions(rctx, user.Id); err != nil {
+		return nil, err
+	}
+
 	return bot, nil
 }

server/channels/app/bot_test.go

@@ -872,21 +872,34 @@ func TestConvertUserToBot(t *testing.T) {
 		})
 	})
 
-	t.Run("valid user", func(t *testing.T) {
+	t.Run("valid user and session revoked", func(t *testing.T) {
 		th := Setup(t).InitBasic()
 		defer th.TearDown()
 
+		session, err := th.App.CreateSession(th.Context, &model.Session{UserId: th.BasicUser.Id, Props: model.StringMap{}})
+		require.Nil(t, err)
+
+		// make sure session is valid
+		testSession, err := th.App.GetSession(session.Token)
+		require.Nil(t, err)
+		require.False(t, testSession.IsExpired())
+
 		bot, err := th.App.ConvertUserToBot(th.Context, &model.User{
 			Username: "username",
 			Id:       th.BasicUser.Id,
 		})
 		require.Nil(t, err)
 		defer func() {
-			err := th.App.PermanentDeleteBot(th.Context, bot.UserId)
+			err = th.App.PermanentDeleteBot(th.Context, bot.UserId)
 			require.Nil(t, err)
 		}()
 		assert.Equal(t, "username", bot.Username)
 		assert.Equal(t, th.BasicUser.Id, bot.OwnerId)
+
+		// make sure session is no longer valid
+		_, err = th.App.GetSession(session.Token)
+		require.NotNil(t, err)
+		require.Equal(t, "api.context.invalid_token.error", err.Id)
 	})
 }