@podosoft/podokit 1.4.1 → 1.5.0

package/dist/templates/modules/admin-dashboard/files/apps/api/src/account-sessions/account-sessions.routes.spec.ts

@@ -0,0 +1,152 @@
+import { afterEach, beforeEach, describe, expect, mock, test, type Mock } from "bun:test";
+import { SQL } from "bun";
+import { AppException } from "@podosoft/podokit-contracts";
+import { Elysia } from "elysia";
+import type { AuthService, AuthSession } from "../auth/auth.service";
+import { AdminSessionsService } from "../admin-sessions/admin-sessions.service";
+import {
+  accountSessionRoutes,
+  type AccountSessionPage,
+  type OwnSessionRevoker,
+} from "./account-sessions.routes";
+
+// More sessions than Better Auth's /list-sessions returns.
+const OTHER_SESSIONS = 150;
+const DAY_MS = 86_400_000;
+
+// Callers name their session with a test header; its row says whose it is.
+function authFor(db: SQL): Pick<AuthService, "requireSession"> {
+  return {
+    requireSession: async (request: Request): Promise<AuthSession> => {
+      const id = request.headers.get("x-test-session");
+      const [row] = id
+        ? await db<Array<{ userId: string; createdAt: string }>>`
+            SELECT "userId", "createdAt" FROM "session" WHERE "id" = ${id}
+          `
+        : [];
+      if (!row) throw new AppException("AUTH_REQUIRED", "Authentication is required", 401);
+      return { user: { id: row.userId }, session: { id, createdAt: row.createdAt } };
+    },
+  };
+}
+
+describe("account session routes", () => {
+  let db: SQL;
+  let revoke: Mock<OwnSessionRevoker>;
+  let freshAge: number;
+  let handle: (request: Request) => Promise<Response>;
+  const now = Date.now();
+
+  beforeEach(async () => {
+    db = new SQL(":memory:");
+    await db`CREATE TABLE "user" ("id" TEXT PRIMARY KEY, "email" TEXT NOT NULL, "name" TEXT NOT NULL)`;
+    await db`
+      CREATE TABLE "session" (
+        "id" TEXT PRIMARY KEY, "userId" TEXT NOT NULL, "token" TEXT NOT NULL,
+        "ipAddress" TEXT, "userAgent" TEXT, "impersonatedBy" TEXT,
+        "createdAt" TEXT NOT NULL, "expiresAt" TEXT NOT NULL
+      )
+    `;
+    await db`INSERT INTO "user" VALUES ('user-1', 'one@example.com', 'One'), ('user-2', 'two@example.com', 'Two')`;
+    const expires = new Date(now + DAY_MS).toISOString();
+    // The current session is the oldest, so newest-first paging would put it last.
+    await db`
+      INSERT INTO "session" VALUES ('current', 'user-1', 'secret-current', '203.0.113.7', 'Agent',
+        NULL, ${new Date(now - 60_000).toISOString()}, ${expires})
+    `;
+    for (let index = 0; index < OTHER_SESSIONS; index += 1) {
+      await db`
+        INSERT INTO "session" VALUES (${`other-${index}`}, 'user-1', ${`secret-${index}`}, NULL, NULL, NULL,
+          ${new Date(now - 30_000 + index).toISOString()}, ${expires})
+      `;
+    }
+    await db`
+      INSERT INTO "session" VALUES ('foreign', 'user-2', 'secret-foreign', NULL, NULL, NULL,
+        ${new Date(now).toISOString()}, ${expires})
+    `;
+    revoke = mock<OwnSessionRevoker>(async () => undefined);
+    freshAge = 86_400;
+    const app = new Elysia()
+      .onError(({ code, error, set }) => {
+        if (error instanceof AppException) {
+          set.status = error.statusCode;
+          return { code: error.code };
+        }
+        if (code === "VALIDATION") {
+          set.status = 400;
+          return { code: "VALIDATION_ERROR" };
+        }
+        return undefined;
+      })
+      .use(accountSessionRoutes({
+        auth: authFor(db),
+        sessions: new AdminSessionsService(db, "sqlite"),
+        revoke,
+        freshAgeSeconds: async () => freshAge,
+      }));
+    handle = (request) => app.handle(request);
+  });
+
+  afterEach(async () => {
+    await db.close();
+  });
+
+  async function send(path: string, init: RequestInit = {}, session: string | null = "current"): Promise<Response> {
+    const headers = new Headers(init.headers);
+    if (session) headers.set("x-test-session", session);
+    return handle(new Request(`http://localhost${path}`, { ...init, headers }));
+  }
+
+  test("returns the current session on every page and pages through every other one", async () => {
+    const seen: string[] = [];
+    let cursor: string | null = null;
+    let pages = 0;
+    do {
+      const response = await send(`/account/sessions?limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`);
+      expect(response.status).toBe(200);
+      const text = await response.text();
+      expect(text).not.toContain("secret-");
+      const page = JSON.parse(text) as AccountSessionPage;
+      expect(page.current).toMatchObject({ id: "current", ipAddress: "203.0.113.7", userAgent: "Agent" });
+      expect(page.total).toBe(OTHER_SESSIONS + 1);
+      seen.push(...page.items.map((item) => item.id));
+      cursor = page.nextCursor;
+      pages += 1;
+    } while (cursor);
+
+    expect(pages).toBe(2);
+    expect(seen).toHaveLength(OTHER_SESSIONS);
+    expect(new Set(seen).size).toBe(OTHER_SESSIONS);
+    expect(seen).not.toContain("current");
+    expect(seen).not.toContain("foreign");
+    expect(seen[0]).toBe(`other-${OTHER_SESSIONS - 1}`);
+  });
+
+  test("refuses anonymous callers and a session too old to list sessions", async () => {
+    expect((await send("/account/sessions", {}, null)).status).toBe(401);
+    await db`UPDATE "session" SET "createdAt" = ${new Date(now - 2 * DAY_MS).toISOString()} WHERE "id" = 'current'`;
+    const stale = await send("/account/sessions");
+    expect(stale.status).toBe(403);
+    expect(await stale.json()).toEqual({ code: "SESSION_NOT_FRESH" });
+    freshAge = 0;
+    expect((await send("/account/sessions")).status).toBe(200);
+  });
+
+  test("revokes one of the caller's sessions by id with the token looked up on the server", async () => {
+    const response = await send("/account/sessions/other-3", { method: "DELETE", headers: { cookie: "session=1" } });
+
+    expect(response.status).toBe(204);
+    expect(revoke).toHaveBeenCalledTimes(1);
+    const [token, headers] = revoke.mock.calls[0] ?? [];
+    expect(token).toBe("secret-3");
+    expect(headers?.get("cookie")).toBe("session=1");
+  });
+
+  test("does not reveal or revoke another user's session", async () => {
+    const response = await send("/account/sessions/foreign", { method: "DELETE" });
+
+    expect(response.status).toBe(404);
+    expect(await response.json()).toEqual({ code: "ACCOUNT_SESSION_NOT_FOUND" });
+    expect(revoke).not.toHaveBeenCalled();
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/api/src/account-sessions/account-sessions.routes.ts

@@ -0,0 +1,112 @@
+import { AppException } from "@podosoft/podokit-contracts";
+import { Elysia, t } from "elysia";
+import type { AuthService, AuthSession } from "../auth/auth.service";
+import type { ElysiaPlugin } from "../core/services";
+import {
+  ADMIN_SESSIONS_MAX_LIMIT,
+  type AdminSessionsService,
+  type AdminSessionView,
+} from "../admin-sessions/admin-sessions.service";
+
+export const ACCOUNT_SESSION_NOT_FOUND = "ACCOUNT_SESSION_NOT_FOUND";
+/** Better Auth's code for a session older than `session.freshAge`. */
+export const SESSION_NOT_FRESH = "SESSION_NOT_FRESH";
+
+/** One of the caller's own sessions. The bearer token never leaves the server. */
+export interface AccountSessionView {
+  id: string;
+  ipAddress: string | null;
+  userAgent: string | null;
+  createdAt: string;
+  expiresAt: string;
+}
+
+export interface AccountSessionPage {
+  /** The session making the request, on every page. */
+  current: AccountSessionView | null;
+  /** The caller's other active sessions, newest first. */
+  items: AccountSessionView[];
+  nextCursor: string | null;
+  /** Every active session of the caller, the current one included. */
+  total: number;
+}
+
+/** Revokes one of the caller's sessions by its bearer token. */
+export type OwnSessionRevoker = (sessionToken: string, headers: Headers) => Promise<void>;
+
+export interface AccountSessionRoutesOptions {
+  auth: Pick<AuthService, "requireSession">;
+  sessions: AdminSessionsService;
+  revoke: OwnSessionRevoker;
+  /** Better Auth's `session.freshAge` in seconds; 0 turns the check off. */
+  freshAgeSeconds: () => Promise<number>;
+}
+
+function accountView(session: AdminSessionView): AccountSessionView {
+  return {
+    id: session.id,
+    ipAddress: session.ipAddress,
+    userAgent: session.userAgent,
+    createdAt: session.createdAt,
+    expiresAt: session.expiresAt,
+  };
+}
+
+// Better Auth lists sessions only for a fresh session; this list keeps that rule.
+function requireFresh(session: AuthSession, freshAgeSeconds: number): void {
+  if (freshAgeSeconds === 0) return;
+  const createdAt = new Date(session.session.createdAt as string | Date).getTime();
+  if (Date.now() - createdAt >= freshAgeSeconds * 1000) {
+    throw new AppException(SESSION_NOT_FRESH, "Session is not fresh", 403);
+  }
+}
+
+/**
+ * The signed-in user's own sessions, paged on the server. Better Auth's
+ * `/list-sessions` returns at most 100 sessions, which could leave out the
+ * current one.
+ */
+export function accountSessionRoutes({
+  auth,
+  sessions,
+  revoke,
+  freshAgeSeconds,
+}: AccountSessionRoutesOptions): ElysiaPlugin {
+  return new Elysia({ name: "podokit.account.sessions" })
+    .get("/account/sessions", async ({ request, query }) => {
+      const session = await auth.requireSession(request);
+      requireFresh(session, await freshAgeSeconds());
+      const currentId = String(session.session.id);
+      const [page, current] = await Promise.all([
+        sessions.list({ ...query, userId: session.user.id, excludeId: currentId }),
+        sessions.find(currentId),
+      ]);
+      const result: AccountSessionPage = {
+        current: current ? accountView(current) : null,
+        items: page.items.map(accountView),
+        nextCursor: page.nextCursor,
+        total: page.total + (current ? 1 : 0),
+      };
+      return result;
+    }, {
+      query: t.Object({
+        cursor: t.Optional(t.String({ minLength: 1, maxLength: 512 })),
+        limit: t.Optional(t.Numeric({ minimum: 1, maximum: ADMIN_SESSIONS_MAX_LIMIT })),
+      }),
+      detail: {
+        tags: ["account"],
+        summary: "List the current user's active sessions",
+        description: "`current` is the session making the request; `items` are the other sessions, newest first, keyset-paged with `cursor`. Session tokens are never returned. A session older than Better Auth's `session.freshAge` gets 403 `SESSION_NOT_FRESH`, as with `/api/auth/list-sessions`.",
+      },
+    })
+    .delete("/account/sessions/:id", async ({ request, params, set }) => {
+      const session = await auth.requireSession(request);
+      const token = await sessions.tokenOf(params.id, session.user.id);
+      if (!token) throw new AppException(ACCOUNT_SESSION_NOT_FOUND, "Session not found.", 404);
+      await revoke(token, request.headers);
+      set.status = 204;
+    }, {
+      params: t.Object({ id: t.String({ minLength: 1, maxLength: 255 }) }),
+      detail: { tags: ["account"], summary: "Revoke one of the current user's sessions by id" },
+    });
+}

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin-sessions/admin-sessions.revoker.ts

@@ -1,13 +1,19 @@
 import { AppException } from "@podosoft/podokit-contracts";
 import { APIError } from "better-auth/api";
+import type { OwnSessionRevoker } from "../account-sessions/account-sessions.routes";
 import type { SessionRevoker } from "./admin-sessions.routes";
 
 export const ADMIN_SESSION_REVOKE_FAILED = "ADMIN_SESSION_REVOKE_FAILED";
+export const ACCOUNT_SESSION_REVOKE_FAILED = "ACCOUNT_SESSION_REVOKE_FAILED";
 
 export interface RevokeUserSessionApi {
   revokeUserSession(input: { body: { sessionToken: string }; headers: Headers }): Promise<unknown>;
 }
 
+export interface RevokeSessionApi {
+  revokeSession(input: { body: { token: string }; headers: Headers }): Promise<unknown>;
+}
+
 /**
  * Revokes through the Better Auth admin endpoint rather than deleting the row, so
  * its permission check and after-hooks (including the audit log) still run.
@@ -24,3 +30,21 @@ export function createSessionRevoker(api: () => RevokeUserSessionApi): SessionRe
     }
   };
 }
+
+/**
+ * Revokes one of the caller's own sessions through Better Auth's
+ * `/revoke-session`, so its ownership check and after-hooks (including the
+ * audit log's `session.revoke`) still run.
+ */
+export function createOwnSessionRevoker(api: () => RevokeSessionApi): OwnSessionRevoker {
+  return async (token, headers) => {
+    try {
+      await api().revokeSession({ body: { token }, headers });
+    } catch (error) {
+      if (error instanceof APIError) {
+        throw new AppException(ACCOUNT_SESSION_REVOKE_FAILED, error.message, error.statusCode);
+      }
+      throw error;
+    }
+  };
+}

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin-sessions/admin-sessions.service.spec.ts

@@ -183,5 +183,23 @@ describe("AdminSessionsService", () => {
 
     expect(await service.tokenOf("a")).toBe("token-a");
     expect(await service.tokenOf("missing")).toBeNull();
+    // With a user, only that user's session.
+    expect(await service.tokenOf("a", "alice")).toBe("token-a");
+    expect(await service.tokenOf("a", "bob")).toBeNull();
+  });
+
+  test("leaves one session out and finds an active session by id", async () => {
+    await seed(db, [
+      { id: "a", userId: "alice", createdAt: "2026-01-01T00:00:01.000Z" },
+      { id: "b", userId: "alice", createdAt: "2026-01-01T00:00:02.000Z" },
+      { id: "old", userId: "alice", createdAt: "2026-01-01T00:00:03.000Z", expiresAt: "2020-01-01T00:00:00.000Z" },
+    ]);
+
+    const page = await service.list({ userId: "alice", excludeId: "b" });
+    expect(page.items.map((item) => item.id)).toEqual(["a"]);
+    expect(page.total).toBe(1);
+    expect(await service.find("b")).toMatchObject({ id: "b", userId: "alice", ipAddress: "203.0.113.7" });
+    expect(await service.find("old")).toBeNull();
+    expect(await service.find("missing")).toBeNull();
   });
 });

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin-sessions/admin-sessions.service.ts

@@ -30,6 +30,8 @@ export interface AdminSessionQuery {
   cursor?: string;
   search?: string;
   userId?: string;
+  /** A session to leave out, such as the caller's own. */
+  excludeId?: string;
 }
 
 interface SessionRow {
@@ -76,6 +78,20 @@ function decodeCursor(value: string): Cursor {
   throw new AppException(ADMIN_SESSION_CURSOR_INVALID, "The sessions cursor is invalid.", 400);
 }
 
+function view(row: SessionRow): AdminSessionView {
+  return {
+    id: row.id,
+    userId: row.userId,
+    userEmail: row.userEmail,
+    userName: row.userName ?? "",
+    ipAddress: row.ipAddress,
+    userAgent: row.userAgent,
+    impersonatedBy: row.impersonatedBy,
+    createdAt: iso(row.createdAt),
+    expiresAt: iso(row.expiresAt),
+  };
+}
+
 function likePattern(search: string): string {
   return `%${search.replace(/[\\%_]/g, (character) => `\\${character}`)}%`;
 }
@@ -100,6 +116,7 @@ export class AdminSessionsService {
     const filters = (): SQL.Query<unknown> => this.sql`
       WHERE s."expiresAt" > ${now}
       ${query.userId ? this.sql`AND s."userId" = ${query.userId}` : this.sql``}
+      ${query.excludeId ? this.sql`AND s."id" <> ${query.excludeId}` : this.sql``}
       ${search ? this.searchFilter(likePattern(search)) : this.sql``}
     `;
     const [rows, totals] = await Promise.all([
@@ -127,17 +144,7 @@ export class AdminSessionsService {
     const page = rows.slice(0, limit);
     const last = page.at(-1);
     return {
-      items: page.map((row) => ({
-        id: row.id,
-        userId: row.userId,
-        userEmail: row.userEmail,
-        userName: row.userName ?? "",
-        ipAddress: row.ipAddress,
-        userAgent: row.userAgent,
-        impersonatedBy: row.impersonatedBy,
-        createdAt: iso(row.createdAt),
-        expiresAt: iso(row.expiresAt),
-      })),
+      items: page.map(view),
       // The cursor keeps the database's own text form so sub-millisecond
       // timestamps cannot skip or repeat rows at a page boundary.
       nextCursor: rows.length > limit && last ? encodeCursor({ createdAt: last.cursorAt, id: last.id }) : null,
@@ -145,9 +152,25 @@ export class AdminSessionsService {
     };
   }
 
-  async tokenOf(sessionId: string): Promise<string | null> {
+  /** One active session, or null when it does not exist or has expired. */
+  async find(sessionId: string): Promise<AdminSessionView | null> {
+    const now = new Date().toISOString();
+    const rows = await this.sql<SessionRow[]>`
+      SELECT s."id", s."userId", u."email" AS "userEmail", u."name" AS "userName",
+             s."ipAddress", s."userAgent", s."impersonatedBy", s."createdAt", s."expiresAt",
+             CAST(s."createdAt" AS TEXT) AS "cursorAt"
+      FROM "session" s
+      JOIN "user" u ON u."id" = s."userId"
+      WHERE s."id" = ${sessionId} AND s."expiresAt" > ${now}
+    `;
+    return rows[0] ? view(rows[0]) : null;
+  }
+
+  /** The token of a session, only when `userId` is given and owns it. */
+  async tokenOf(sessionId: string, userId?: string): Promise<string | null> {
     const rows = await this.sql<Array<{ token: string }>>`
-      SELECT "token" FROM "session" WHERE "id" = ${sessionId}
+      SELECT "token" FROM "session"
+      WHERE "id" = ${sessionId} ${userId === undefined ? this.sql`` : this.sql`AND "userId" = ${userId}`}
     `;
     return rows[0]?.token ?? null;
   }

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin.module.ts

@@ -5,8 +5,14 @@ import {
 } from "@podosoft/podokit-contracts";
 import { OBJECT_STORAGE } from "@podosoft/podokit-runtime";
 import { Elysia, t } from "elysia";
+import { accountSessionRoutes } from "./account-sessions/account-sessions.routes";
 import { adminSessionRoutes } from "./admin-sessions/admin-sessions.routes";
-import { createSessionRevoker, type RevokeUserSessionApi } from "./admin-sessions/admin-sessions.revoker";
+import {
+  createOwnSessionRevoker,
+  createSessionRevoker,
+  type RevokeSessionApi,
+  type RevokeUserSessionApi,
+} from "./admin-sessions/admin-sessions.revoker";
 import { AdminSessionsService } from "./admin-sessions/admin-sessions.service";
 import { adminUserRoutes } from "./admin-users/admin-users.routes";
 import { AdminUsersService } from "./admin-users/admin-users.service";
@@ -57,6 +63,12 @@ const adminPlugin: AppPlugin = ({ services }) => {
       sessions: services.resolve(ADMIN_SESSIONS),
       revoke: createSessionRevoker(() => getAuth().api as unknown as RevokeUserSessionApi),
     }))
+    .use(accountSessionRoutes({
+      auth,
+      sessions: services.resolve(ADMIN_SESSIONS),
+      revoke: createOwnSessionRevoker(() => getAuth().api as unknown as RevokeSessionApi),
+      freshAgeSeconds: async () => (await getAuth().$context).sessionConfig.freshAge,
+    }))
     .use(adminUserRoutes({ auth, users: services.resolve(ADMIN_USERS) }))
     .use(siteAssetRoutes(site, profileImages))
     .get("/site/settings", async () => {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/hooks.server.test.ts

@@ -1,6 +1,7 @@
 import { ApiError } from "@podosoft/podokit-api-client";
 import type { RequestEvent } from "@sveltejs/kit";
 import { beforeEach, describe, expect, it, vi } from "vitest";
+import { BackendUnavailableError } from "#lib/server/api.js";
 import { handle } from "./hooks.server";
 
 type SessionResult = {
@@ -13,7 +14,8 @@ const client = vi.hoisted(() => ({
   getSession: vi.fn<() => Promise<SessionResult>>(),
 }));
 
-vi.mock("#lib/server/api.js", () => ({
+vi.mock("#lib/server/api.js", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("#lib/server/api.js")>()),
   serverApiClient: () => ({ get: client.get, auth: { getSession: client.getSession } }),
 }));
 
@@ -98,6 +100,16 @@ describe("handle", () => {
     });
   });
 
+  it("treats an API known to be unreachable as an outage", async () => {
+    client.get.mockRejectedValue(new BackendUnavailableError());
+    client.getSession.mockRejectedValue(new BackendUnavailableError());
+
+    await expect(handle({ event: requestEvent("/account"), resolve })).rejects.toMatchObject({ status: 503 });
+    const event = requestEvent("/");
+    await handle({ event, resolve });
+    expect(event.locals).toMatchObject({ site: null, siteUnavailable: true, authUnavailable: true, user: null });
+  });
+
   it("confirms an anonymous visitor on a 401 session response", async () => {
     client.get.mockResolvedValue({ locale: null });
     client.getSession.mockResolvedValue({ data: null, error: { status: 401 } });
@@ -121,4 +133,15 @@ describe("handle", () => {
     expect(client.get).not.toHaveBeenCalled();
     expect(client.getSession).not.toHaveBeenCalled();
   });
+
+  it("answers the health route without runtime lookups", async () => {
+    client.get.mockRejectedValue(new BackendUnavailableError());
+    client.getSession.mockRejectedValue(new BackendUnavailableError());
+
+    await handle({ event: requestEvent("/healthz"), resolve });
+
+    expect(client.get).not.toHaveBeenCalled();
+    expect(client.getSession).not.toHaveBeenCalled();
+    expect(resolve).toHaveBeenCalledTimes(1);
+  });
 });

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/account-sessions.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest";
+import { listAccountSessions, revokeAccountSession } from "./account-sessions";
+
+describe("account sessions", () => {
+  it("asks for one page with the cursor", async () => {
+    const paths: string[] = [];
+    const client = {
+      get: <T>(path: string): Promise<T> => {
+        paths.push(path);
+        return Promise.resolve({ current: null, items: [], nextCursor: null, total: 0 } as unknown as T);
+      },
+    };
+
+    await listAccountSessions(client, { limit: 20, cursor: "abc" });
+    await listAccountSessions(client, { limit: 20, cursor: null });
+
+    expect(paths).toEqual(["/account/sessions?limit=20&cursor=abc", "/account/sessions?limit=20"]);
+  });
+
+  it("revokes by id", async () => {
+    const paths: string[] = [];
+    const client = {
+      del: <T>(path: string): Promise<T> => {
+        paths.push(path);
+        return Promise.resolve(undefined as unknown as T);
+      },
+    };
+
+    await revokeAccountSession(client, "id/with slash");
+
+    expect(paths).toEqual(["/account/sessions/id%2Fwith%20slash"]);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/account-sessions.ts

@@ -0,0 +1,34 @@
+import type { ApiClient } from "@podosoft/podokit-api-client";
+
+/** One of the signed-in user's sessions from `GET /account/sessions`. The API never returns the token. */
+export type AccountSession = {
+  id: string;
+  ipAddress: string | null;
+  userAgent: string | null;
+  createdAt: string;
+  expiresAt: string;
+};
+
+export type AccountSessionPage = {
+  /** The session making the request, on every page. */
+  current: AccountSession | null;
+  /** The other sessions, newest first. */
+  items: AccountSession[];
+  nextCursor: string | null;
+  /** Every active session, the current one included. */
+  total: number;
+};
+
+export function listAccountSessions(
+  client: Pick<ApiClient, "get">,
+  query: { limit: number; cursor?: string | null },
+): Promise<AccountSessionPage> {
+  const params = new URLSearchParams({ limit: String(query.limit) });
+  if (query.cursor) params.set("cursor", query.cursor);
+  return client.get<AccountSessionPage>(`/account/sessions?${params.toString()}`);
+}
+
+/** Revokes one of the user's own sessions by id; the server looks up the token. */
+export function revokeAccountSession(client: Pick<ApiClient, "del">, id: string): Promise<void> {
+  return client.del<void>(`/account/sessions/${encodeURIComponent(id)}`);
+}