AUTH4D-211 Sessions end after a password reset or change

A password reset or change (AUTH4D-144 (repository file docs/api-spec/auth4d-144.md)) now ends the player’s open sessions in the project. Revoking a session also revokes its refresh family and its hosted-login browser session, so existing refresh tokens get invalid_grant and the browser session cookie no longer restores a sign-in. Sessions in other projects, and other players’ sessions, are not touched.

The session Durable Object is the authority and is revoked first, before the new password is stored. If it can’t be reached, the route answers 503 temporarily_unavailable and the old password stays in place. The D1 session index is updated afterwards.

Reset

POST /t/{tenantId}/password/reset/confirm is unchanged on the wire. When the address already had a password, every open session of the player ends, including the one in the browser making the request. Setting a first password (no earlier password) ends nothing, because it replaces no credential.

Change

POST /t/{tenantId}/password/change takes one new optional field:

{
  "client_id": "cli_…",
  "browser_flow_id": "flw_…",
  "email": "player@example.com",
  "current_password": "…",
  "password": "…",
  "keep_current_session": true
}

Any other value answers 400 invalid_request. A wrong current password or a refused new password ends no session.

Audit and events

After a reset of an existing password, or a successful change, the project’s audit log gets authentication.password.sessions_revoked (actor and target are the player) next to authentication.password.reset or authentication.password.changed. Its metadata is:

{
  "client_id": "cli_…",
  "provider": "email",
  "reason": "reset",
  "revoked_sessions": 2,
  "kept_current_session": false
}

reason is reset or change. When at least one session ended, Flows and webhooks (AUTH4D-158 (repository file docs/api-spec/auth4d-158.md)) receive one session.revoked event with application_id: null and data.reason: "password".