@shipfox/api-auth 10.1.0 → 11.0.0

package/src/presentation/auth/bearer-token-auth.test.ts

@@ -13,9 +13,11 @@ interface TestClaims {
 describe('bearer-token-auth', () => {
   let app: FastifyInstance;
   let verifyToken: ReturnType<typeof vi.fn<(token: string) => Promise<TestClaims | null>>>;
+  let verifierErrorIsInvalid = true;
 
   beforeEach(async () => {
     verifyToken = vi.fn<(token: string) => Promise<TestClaims | null>>();
+    verifierErrorIsInvalid = true;
     app = Fastify();
     app.setValidatorCompiler(validatorCompiler);
     app.setSerializerCompiler(serializerCompiler);
@@ -24,6 +26,7 @@ describe('bearer-token-auth', () => {
     const authMethod = createBearerTokenAuthMethod({
       name: 'test-bearer',
       verifyToken,
+      isInvalidTokenError: () => verifierErrorIsInvalid,
       invalidTokenError: {message: 'Invalid test bearer token', code: 'invalid-test-token'},
       setContext: (request, claims) => {
         (request as FastifyRequest & Record<typeof CONTEXT_KEY, typeof claims>)[CONTEXT_KEY] =
@@ -96,4 +99,18 @@ describe('bearer-token-auth', () => {
     expect(res.json()).toEqual({code: 'invalid-test-token'});
     expect(verifyToken).toHaveBeenCalledWith('invalid-token');
   });
+
+  test('propagates verifier errors classified as service failures', async () => {
+    verifierErrorIsInvalid = false;
+    verifyToken.mockRejectedValue(new Error('database unavailable'));
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/protected',
+      headers: {authorization: 'Bearer valid-token'},
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json().code).not.toBe('invalid-test-token');
+  });
 });

package/src/presentation/auth/bearer-token-auth.ts

@@ -9,6 +9,7 @@ interface UnauthorizedErrorParams {
 interface BearerTokenAuthMethodOptions<TClaims> {
   name: string;
   verifyToken: (token: string) => Promise<TClaims | null>;
+  isInvalidTokenError?: (error: unknown) => boolean;
   invalidTokenError: UnauthorizedErrorParams;
   setContext: (request: FastifyRequest, claims: TClaims) => void;
 }
@@ -27,7 +28,11 @@ export function createBearerTokenAuthMethod<TClaims>(
       const token = extractBearerToken(request.headers.authorization);
       if (!token) throwUnauthorized(missingBearerError);
 
-      const claims = await verifyBearerToken(token, options.verifyToken);
+      const claims = await verifyBearerToken(
+        token,
+        options.verifyToken,
+        options.isInvalidTokenError,
+      );
       if (!claims) throwUnauthorized(options.invalidTokenError);
 
       options.setContext(request, claims);
@@ -38,10 +43,12 @@ export function createBearerTokenAuthMethod<TClaims>(
 async function verifyBearerToken<TClaims>(
   token: string,
   verifyToken: (token: string) => Promise<TClaims | null>,
+  isInvalidTokenError: ((error: unknown) => boolean) | undefined,
 ): Promise<TClaims | null> {
   try {
     return await verifyToken(token);
-  } catch {
+  } catch (error) {
+    if (isInvalidTokenError && !isInvalidTokenError(error)) throw error;
     return null;
   }
 }

package/src/presentation/auth/jwt-auth.test.ts

@@ -9,7 +9,7 @@ import {
   revokeRefreshTokenByHash,
   rotateRefreshToken,
 } from '#db/refresh-tokens.js';
-import {createUser, findUserById} from '#db/users.js';
+import {createUser} from '#db/users.js';
 import {createJwtAuthMethod, getAuthenticatedSessionContext, getClientContext} from './jwt-auth.js';
 
 const SECRET = userAccessTokenKey();
@@ -116,7 +116,7 @@ describe('jwt-auth', () => {
     expect(res.statusCode).toBe(401);
   });
 
-  test('does not read user state during JWT validation', async () => {
+  test('keeps a legacy token verifiable during the migration window', async () => {
     const userId = crypto.randomUUID();
     const email = emailFor('jwt-stateless');
     const token = await signUserToken({
@@ -138,7 +138,35 @@ describe('jwt-auth', () => {
     expect(res.json().client.email).toBe(email);
   });
 
-  test('resolves the active refresh-session identity from an authenticated request', async () => {
+  test('verifies a token from claims when its user and refresh session are missing', async () => {
+    const userId = crypto.randomUUID();
+    const refreshSessionId = crypto.randomUUID();
+    const token = await signUserToken({
+      userId,
+      email: emailFor('jwt-missing-user'),
+      memberships: [],
+      refreshSessionId,
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+
+    const protectedResponse = await app.inject({
+      method: 'GET',
+      url: '/protected',
+      headers: {authorization: `Bearer ${token}`},
+    });
+    const sessionResponse = await app.inject({
+      method: 'GET',
+      url: '/session',
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(protectedResponse.statusCode).toBe(200);
+    expect(sessionResponse.statusCode).toBe(200);
+    expect(sessionResponse.json()).toEqual({userId, refreshSessionId});
+  });
+
+  test('returns the refresh-session identity from an authenticated request', async () => {
     const user = await createUser({email: emailFor('jwt-session'), hashedPassword: 'h'});
     const rawRefreshToken = `refresh-${crypto.randomUUID()}`;
     const refreshToken = await createRefreshToken({
@@ -186,7 +214,7 @@ describe('jwt-auth', () => {
     expect(refreshed.json()).toEqual(initial.json());
   });
 
-  test('rejects an authenticated token after its refresh session is revoked', async () => {
+  test('keeps an authenticated token valid after its refresh session is revoked', async () => {
     const user = await createUser({email: emailFor('jwt-session-revoked'), hashedPassword: 'h'});
     const rawRefreshToken = `refresh-${crypto.randomUUID()}`;
     const refreshToken = await createRefreshToken({
@@ -210,7 +238,8 @@ describe('jwt-auth', () => {
       headers: {authorization: `Bearer ${token}`},
     });
 
-    expect(res.statusCode).toBe(401);
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({userId: user.id, refreshSessionId: refreshToken.sessionId});
   });
 
   test('rejects an authenticated token without a refresh-session claim', async () => {
@@ -231,8 +260,4 @@ describe('jwt-auth', () => {
 
     expect(res.statusCode).toBe(401);
   });
-
-  test('helpers remain available', () => {
-    expect(typeof findUserById).toBe('function');
-  });
 });

package/src/presentation/auth/jwt-auth.ts

@@ -12,7 +12,6 @@ import type {RefreshToken} from '#core/entities/refresh-token.js';
 import type {User} from '#core/entities/user.js';
 import type {UserTokenClaims} from '#core/jwt.js';
 import {verifyUserToken} from '#core/jwt.js';
-import {findActiveRefreshSession} from '#db/refresh-tokens.js';
 import {createBearerTokenAuthMethod} from './bearer-token-auth.js';
 
 const AUTHENTICATED_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth/session');
@@ -31,6 +30,13 @@ export interface CreateJwtAuthMethodOptions {
   secret: string;
 }
 
+class InvalidJwtTokenError extends Error {
+  constructor() {
+    super('Invalid JWT');
+    this.name = 'InvalidJwtTokenError';
+  }
+}
+
 export function getClientContext(request: FastifyRequest): ClientContext | null {
   return getUserContext(request);
 }
@@ -53,10 +59,7 @@ function getAuthenticatedSessionTokenContext(request: FastifyRequest): {
   );
 }
 
-/**
- * Resolves the active refresh session backing an authenticated user request.
- * The session check intentionally happens only for consumers that need browser-session binding.
- */
+/** Returns the refresh-session metadata carried by a verified access token. */
 export async function getAuthenticatedSessionContext(
   request: FastifyRequest,
 ): Promise<AuthenticatedSessionContext> {
@@ -65,19 +68,22 @@ export async function getAuthenticatedSessionContext(
   if (!client || !token || token.userId !== client.userId || !token.refreshSessionId)
     throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});
 
-  const session = await findActiveRefreshSession({
-    sessionId: token.refreshSessionId,
-    userId: client.userId,
-  });
-  if (!session) throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});
-
-  return {userId: client.userId, refreshSessionId: session.sessionId};
+  return await Promise.resolve({userId: client.userId, refreshSessionId: token.refreshSessionId});
 }
 
 export function createJwtAuthMethod(): AuthMethod {
   return createBearerTokenAuthMethod({
     name: AUTH_USER,
-    verifyToken: (token) => verifyUserToken({token, secret: userAccessTokenKey()}),
+    verifyToken: async (token) => {
+      let claims: UserTokenClaims;
+      try {
+        claims = await verifyUserToken({token, secret: userAccessTokenKey()});
+      } catch {
+        throw new InvalidJwtTokenError();
+      }
+      return claims;
+    },
+    isInvalidTokenError: (error) => error instanceof InvalidJwtTokenError,
     invalidTokenError: {message: 'Invalid or expired token', code: 'unauthorized'},
     setContext: (request, claims) => {
       const clientContext: ClientContext = buildUserContext({

package/src/presentation/routes/administration.test.ts

@@ -1,11 +1,20 @@
 import {ADMINISTRATION_ACTION_PERFORMED} from '@shipfox/api-common-dto';
-import {sql} from 'drizzle-orm';
+import {eq, sql} from 'drizzle-orm';
 import type {FastifyInstance} from 'fastify';
 import {type AuthRateLimitAction, hashAuthRateLimitIdentifier} from '#core/rate-limit.js';
 import {db} from '#db/db.js';
 import {authOutbox} from '#db/schema/outbox.js';
 import {authRateLimits} from '#db/schema/rate-limits.js';
-import {createAuthTestApp, createVerifiedSession, resetCapturedMail} from '#test/routes.js';
+import {refreshTokens} from '#db/schema/refresh-tokens.js';
+import {users} from '#db/schema/users.js';
+import {
+  cookieHeader,
+  createAuthTestApp,
+  createVerifiedSession,
+  getSetCookie,
+  login,
+  resetCapturedMail,
+} from '#test/routes.js';
 
 const BOOTSTRAP_TOKEN = 'test-bootstrap-token';
 
@@ -662,4 +671,246 @@ describe('Auth administration routes', () => {
     expect(finalOwnerRevoke.statusCode).toBe(409);
     expect(finalOwnerRevoke.json().code).toBe('last-owner');
   });
+
+  test('suspends users, invalidates sessions, and reactivates without restoring them', async () => {
+    const owner = await createVerifiedSession('admin-user-moderation-owner');
+    const target = await createVerifiedSession('admin-user-moderation-target');
+
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants/bootstrap',
+      headers: authHeaders(owner.token, 'moderation-bootstrap'),
+      payload: {bootstrap_token: BOOTSTRAP_TOKEN},
+    });
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants',
+      headers: authHeaders(owner.token, 'moderation-grant'),
+      payload: {
+        user_id: owner.userId,
+        role: 'admin-operator',
+        reason: 'User moderation access',
+      },
+    });
+
+    const rotatedBeforeSuspension = await app.inject({
+      method: 'POST',
+      url: '/auth/refresh',
+      headers: {cookie: target.refreshCookie},
+      payload: {},
+    });
+    expect(rotatedBeforeSuspension.statusCode).toBe(200);
+    const rotatedRefreshCookie = cookieHeader(getSetCookie(rotatedBeforeSuspension));
+
+    const suspended = await app.inject({
+      method: 'POST',
+      url: `/admin/auth/users/${target.userId}/suspend`,
+      headers: authHeaders(owner.token, 'suspend-user'),
+      payload: {reason: 'Account security review'},
+    });
+
+    expect(suspended.statusCode).toBe(200);
+    expect(suspended.json()).toMatchObject({
+      id: target.userId,
+      status: 'suspended',
+      admin_role: null,
+      correlation_id: expect.any(String),
+    });
+
+    const suspendedMe = await app.inject({
+      method: 'GET',
+      url: '/auth/me',
+      headers: {authorization: `Bearer ${target.token}`},
+    });
+    const suspendedLogin = await login(app, {email: target.email, password: target.password});
+    expect(suspendedMe.statusCode).toBe(200);
+    expect(suspendedMe.json().user).toMatchObject({id: target.userId, status: 'suspended'});
+    expect(suspendedLogin.statusCode).toBe(401);
+
+    const suspendedDbUser = (
+      await db().select({status: users.status}).from(users).where(eq(users.id, target.userId))
+    )[0];
+    const targetSessions = await db()
+      .select({sessionId: refreshTokens.sessionId, revokedAt: refreshTokens.revokedAt})
+      .from(refreshTokens)
+      .where(eq(refreshTokens.userId, target.userId));
+    expect(suspendedDbUser?.status).toBe('suspended');
+    expect(targetSessions).toHaveLength(2);
+    expect(targetSessions.every(({revokedAt}) => revokedAt instanceof Date)).toBe(true);
+
+    const suspendedRefresh = await app.inject({
+      method: 'POST',
+      url: '/auth/refresh',
+      headers: {cookie: rotatedRefreshCookie},
+      payload: {},
+    });
+    expect(suspendedRefresh.statusCode).toBe(401);
+
+    const suspensionEvent = (await db().select().from(authOutbox)).find(
+      (event) =>
+        event.eventType === ADMINISTRATION_ACTION_PERFORMED &&
+        (event.payload as {command?: string}).command === 'auth.user.suspend',
+    );
+    expect(suspensionEvent?.payload).toMatchObject({
+      actorId: owner.userId,
+      actorRole: 'admin-owner',
+      requiredRole: 'admin-operator',
+      targetId: target.userId,
+      reason: 'Account security review',
+      result: 'succeeded',
+    });
+    expect(JSON.stringify(suspensionEvent?.payload)).not.toContain('suspend-user');
+    expect(JSON.stringify(suspensionEvent?.payload)).not.toContain(target.password);
+
+    const repeatedSuspension = await app.inject({
+      method: 'POST',
+      url: `/admin/auth/users/${target.userId}/suspend`,
+      headers: authHeaders(owner.token, 'suspend-user'),
+      payload: {reason: 'Account security review'},
+    });
+    expect(repeatedSuspension.statusCode).toBe(200);
+    expect(repeatedSuspension.json().correlation_id).toBe(suspended.json().correlation_id);
+
+    const reusedSuspensionKey = await app.inject({
+      method: 'POST',
+      url: `/admin/auth/users/${target.userId}/suspend`,
+      headers: authHeaders(owner.token, 'suspend-user'),
+      payload: {reason: 'A different reason'},
+    });
+    expect(reusedSuspensionKey.statusCode).toBe(409);
+    expect(reusedSuspensionKey.json().code).toBe('idempotency-key-reused');
+
+    const reactivated = await app.inject({
+      method: 'POST',
+      url: `/admin/auth/users/${target.userId}/reactivate`,
+      headers: authHeaders(owner.token, 'reactivate-user'),
+      payload: {},
+    });
+    expect(reactivated.statusCode).toBe(200);
+    expect(reactivated.json()).toMatchObject({
+      id: target.userId,
+      status: 'active',
+      correlation_id: expect.any(String),
+    });
+
+    const oldRefreshAfterReactivation = await app.inject({
+      method: 'POST',
+      url: '/auth/refresh',
+      headers: {cookie: target.refreshCookie},
+      payload: {},
+    });
+    expect(oldRefreshAfterReactivation.statusCode).toBe(401);
+    const rotatedRefreshAfterReactivation = await app.inject({
+      method: 'POST',
+      url: '/auth/refresh',
+      headers: {cookie: rotatedRefreshCookie},
+      payload: {},
+    });
+    expect(rotatedRefreshAfterReactivation.statusCode).toBe(401);
+
+    const newLogin = await login(app, {email: target.email, password: target.password});
+    expect(newLogin.statusCode).toBe(200);
+    const secondLogin = await login(app, {email: target.email, password: target.password});
+    expect(secondLogin.statusCode).toBe(200);
+
+    const revoked = await app.inject({
+      method: 'POST',
+      url: `/admin/auth/users/${target.userId}/revoke-sessions`,
+      headers: authHeaders(owner.token, 'revoke-user-sessions'),
+      payload: {reason: 'End all active sessions'},
+    });
+    expect(revoked.statusCode).toBe(200);
+    expect(revoked.json()).toMatchObject({
+      id: target.userId,
+      status: 'active',
+      sessions_revoked: 2,
+      correlation_id: expect.any(String),
+    });
+
+    const newRefresh = await app.inject({
+      method: 'POST',
+      url: '/auth/refresh',
+      headers: {cookie: cookieHeader(getSetCookie(newLogin))},
+      payload: {},
+    });
+    expect(newRefresh.statusCode).toBe(401);
+    const secondRefresh = await app.inject({
+      method: 'POST',
+      url: '/auth/refresh',
+      headers: {cookie: cookieHeader(getSetCookie(secondLogin))},
+      payload: {},
+    });
+    expect(secondRefresh.statusCode).toBe(401);
+
+    const revokedAccess = await app.inject({
+      method: 'GET',
+      url: '/auth/me',
+      headers: {authorization: `Bearer ${newLogin.json().token}`},
+    });
+    expect(revokedAccess.statusCode).toBe(200);
+
+    const repeatedRevoke = await app.inject({
+      method: 'POST',
+      url: `/admin/auth/users/${target.userId}/revoke-sessions`,
+      headers: authHeaders(owner.token, 'revoke-user-sessions'),
+      payload: {reason: 'End all active sessions'},
+    });
+    expect(repeatedRevoke.statusCode).toBe(200);
+    expect(repeatedRevoke.json().sessions_revoked).toBe(2);
+    expect(repeatedRevoke.json().correlation_id).toBe(revoked.json().correlation_id);
+  });
+
+  test('protects the final active owner from suspension', async () => {
+    const owner = await createVerifiedSession('admin-suspend-final-owner');
+
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants/bootstrap',
+      headers: authHeaders(owner.token, 'suspend-final-bootstrap'),
+      payload: {bootstrap_token: BOOTSTRAP_TOKEN},
+    });
+
+    const suspended = await app.inject({
+      method: 'POST',
+      url: `/admin/auth/users/${owner.userId}/suspend`,
+      headers: authHeaders(owner.token, 'suspend-final-owner'),
+      payload: {reason: 'Attempt to suspend final owner'},
+    });
+
+    expect(suspended.statusCode).toBe(409);
+    expect(suspended.json().code).toBe('last-owner');
+  });
+
+  test('rejects user moderation by an observer', async () => {
+    const owner = await createVerifiedSession('admin-moderation-role-owner');
+    const observer = await createVerifiedSession('admin-moderation-role-observer');
+    const target = await createVerifiedSession('admin-moderation-role-target');
+
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants/bootstrap',
+      headers: authHeaders(owner.token, 'moderation-role-bootstrap'),
+      payload: {bootstrap_token: BOOTSTRAP_TOKEN},
+    });
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants',
+      headers: authHeaders(owner.token, 'moderation-role-grant'),
+      payload: {
+        user_id: observer.userId,
+        role: 'admin-observer',
+        reason: 'Read-only administration access',
+      },
+    });
+
+    const response = await app.inject({
+      method: 'POST',
+      url: `/admin/auth/users/${target.userId}/suspend`,
+      headers: authHeaders(observer.token, 'moderation-role-suspend'),
+      payload: {reason: 'Observer should not mutate users'},
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json().code).toBe('forbidden');
+  });
 });

package/src/presentation/routes/administration.ts

@@ -2,6 +2,7 @@ import {AUTH_USER} from '@shipfox/api-auth-context';
 import {
   adminBootstrapStateSchema,
   administratorUserLookupQuerySchema,
+  administratorUserMutationResponseSchema,
   administratorUserSummarySchema,
   bootstrapAdminOwnerBodySchema,
   bootstrapAdminOwnerResponseSchema,
@@ -9,8 +10,12 @@ import {
   grantAdminRoleResponseSchema,
   listAdminGrantsQuerySchema,
   listAdminGrantsResponseSchema,
+  reactivateAdministratorUserBodySchema,
   revokeAdminGrantBodySchema,
   revokeAdminGrantResponseSchema,
+  revokeAdministratorUserSessionsBodySchema,
+  revokeAdministratorUserSessionsResponseSchema,
+  suspendAdministratorUserBodySchema,
 } from '@shipfox/api-auth-dto';
 import {decodeTimestampIdCursor, encodeTimestampIdCursor} from '@shipfox/node-drizzle';
 import {ClientError, defineRoute, type RouteGroup} from '@shipfox/node-fastify';
@@ -23,7 +28,10 @@ import {
   getAdminBootstrapState,
   grantAdministratorRole,
   listAdministratorGrantSummaries,
+  reactivateAdministratorUser,
   revokeAdministratorGrant,
+  revokeAdministratorUserSessions,
+  suspendAdministratorUser,
 } from '#core/administration.js';
 import type {AdminGrant} from '#core/entities/admin-grant.js';
 import type {
@@ -101,6 +109,16 @@ function toAdministratorGrantSummaryDto(grant: AdministratorGrantSummary) {
   };
 }
 
+function toAdministratorUserMutationDto(result: {
+  user: AdministratorUserSummary;
+  correlationId: string;
+}) {
+  return {
+    ...toAdministratorUserSummaryDto(result.user),
+    correlation_id: result.correlationId,
+  };
+}
+
 function translateAdministrationError(error: unknown): never {
   if (error instanceof AdminRoleRequiredError) {
     throw new ClientError('Administrator role required', 'forbidden', {
@@ -229,6 +247,75 @@ const userLookupRoute = defineRoute({
   },
 });
 
+const suspendUserRoute = defineRoute({
+  method: 'POST',
+  path: '/:userId/suspend',
+  description: 'Suspend a user and revoke all of its active sessions.',
+  schema: {
+    params: z.object({userId: z.string().uuid()}),
+    body: suspendAdministratorUserBodySchema,
+    response: {200: administratorUserMutationResponseSchema},
+  },
+  errorHandler: translateAdministrationError,
+  handler: async (request) => {
+    const result = await suspendAdministratorUser({
+      actorId: requireActorId(request),
+      userId: request.params.userId,
+      reason: request.body.reason,
+      idempotencyKey: requireIdempotencyKey(request),
+      correlationId: request.id,
+    });
+    return toAdministratorUserMutationDto(result);
+  },
+});
+
+const reactivateUserRoute = defineRoute({
+  method: 'POST',
+  path: '/:userId/reactivate',
+  description: 'Reactivate a suspended user without restoring revoked sessions.',
+  schema: {
+    params: z.object({userId: z.string().uuid()}),
+    body: reactivateAdministratorUserBodySchema,
+    response: {200: administratorUserMutationResponseSchema},
+  },
+  errorHandler: translateAdministrationError,
+  handler: async (request) => {
+    const result = await reactivateAdministratorUser({
+      actorId: requireActorId(request),
+      userId: request.params.userId,
+      ...(request.body.reason ? {reason: request.body.reason} : {}),
+      idempotencyKey: requireIdempotencyKey(request),
+      correlationId: request.id,
+    });
+    return toAdministratorUserMutationDto(result);
+  },
+});
+
+const revokeUserSessionsRoute = defineRoute({
+  method: 'POST',
+  path: '/:userId/revoke-sessions',
+  description: 'Revoke all active sessions for a user without changing account status.',
+  schema: {
+    params: z.object({userId: z.string().uuid()}),
+    body: revokeAdministratorUserSessionsBodySchema,
+    response: {200: revokeAdministratorUserSessionsResponseSchema},
+  },
+  errorHandler: translateAdministrationError,
+  handler: async (request) => {
+    const result = await revokeAdministratorUserSessions({
+      actorId: requireActorId(request),
+      userId: request.params.userId,
+      ...(request.body.reason ? {reason: request.body.reason} : {}),
+      idempotencyKey: requireIdempotencyKey(request),
+      correlationId: request.id,
+    });
+    return {
+      ...toAdministratorUserMutationDto(result),
+      sessions_revoked: result.sessionsRevoked,
+    };
+  },
+});
+
 const grantRoute = defineRoute({
   method: 'POST',
   path: '/',
@@ -290,5 +377,5 @@ export const administrationBootstrapRoutes: RouteGroup = {
 export const administrationUserRoutes: RouteGroup = {
   prefix: '/admin/auth/users',
   auth: AUTH_USER,
-  routes: [userLookupRoute],
+  routes: [userLookupRoute, suspendUserRoute, reactivateUserRoute, revokeUserSessionsRoute],
 };

package/src/presentation/routes/password/change-password.test.ts

@@ -48,6 +48,11 @@ describe('POST /auth/change-password', () => {
       headers: {cookie: cookieHeader(account.refreshCookie)},
       payload: {},
     });
+    const access = await app.inject({
+      method: 'GET',
+      url: '/auth/me',
+      headers: {authorization: `Bearer ${account.token}`},
+    });
     const oldPasswordValid = await verifyPassword({
       password: account.password,
       hash: updatedUser?.hashedPassword ?? '',
@@ -62,6 +67,7 @@ describe('POST /auth/change-password', () => {
     expect(oldPasswordValid).toBe(false);
     expect(newPasswordValid).toBe(true);
     expect(refresh.statusCode).toBe(200);
+    expect(access.statusCode).toBe(200);
   });
 
   test('transforms invalid current password into 401', async () => {

package/src/presentation/routes/password/password-reset-confirm.test.ts

@@ -1,6 +1,7 @@
 import {AUTH_PASSWORD_RESET_SEND_REQUESTED} from '@shipfox/api-auth-dto';
 import type {FastifyInstance} from 'fastify';
 import {
+  cookieHeader,
   createAuthTestApp,
   extractToken,
   getSetCookie,
@@ -42,12 +43,25 @@ describe('POST /auth/password-reset/confirm', () => {
       payload: {token: resetToken, new_password: 'reset password is long'},
     });
     const loginRes = await login(app, {email: account.email, password: 'reset password is long'});
+    const oldRefresh = await app.inject({
+      method: 'POST',
+      url: '/auth/refresh',
+      headers: {cookie: cookieHeader(account.refreshCookie)},
+      payload: {},
+    });
+    const oldAccess = await app.inject({
+      method: 'GET',
+      url: '/auth/me',
+      headers: {authorization: `Bearer ${account.token}`},
+    });
 
     expect(confirm.statusCode).toBe(200);
     expect(confirm.json().token).toBeDefined();
     expect(confirm.json().user.email).toBe(account.email);
     expect(getSetCookie(confirm)).toContain('shipfox_refresh_token=');
     expect(loginRes.statusCode).toBe(200);
+    expect(oldRefresh.statusCode).toBe(401);
+    expect(oldAccess.statusCode).toBe(200);
   });
 
   test('transforms invalid token into 410', async () => {