fix(auth): Revoke all workspace sessions on logout

[stack72]

Updates logout behavior to revoke all web session tokens for a workspace (not just the current session) and hides web session tokens from the API Tokens management page. Fixes multi-session logout behavior where users expect "logout" to end all active sessions for a workspace, not just the current tab.

With the initial secure bearer tokens implementation:

• ❌ Logout only revoked the specific token from the current tab
• ❌ Other tabs/sessions remained active after logout (zombie sessions)

Logout Now Revokes All Sessions

When a user logs out from a workspace:

1. Revokes all web session tokens for that user+workspace combination
2. Other tabs get 401 on next request and auto-logout
3. Clean session termination across all tabs/devices

Why this is correct:

• Matches user expectation ("logout" = "end my session completely")
• Consistent with other apps (Gmail, GitHub, Slack)
• Security-conscious: prevents zombie sessions
• Multi-tab support during active use, clean break on logout

Multi-Session Behavior

During Active Use (Multiple Tabs):

Tab 1: Working in workspace
Tab 2: Click workspace link
→ New token created for Tab 2
→ Tab 1's token NOT revoked
→ Both tabs work independently ✅

On Logout (Global Termination):

Tab 1: Clicks logout
→ All web tokens for user+workspace revoked
→ Tab 1 redirects to login
→ Tab 2 next request → 401
→ Tab 2 auto-logout via 401 interceptor
→ Clean session end across all tabs ✅

Token Accumulation

Multiple sessions are allowed and expected:

• Users can open workspace in multiple tabs/devices
• Each session gets its own token
• All tokens validated on every request
• Tokens expire in 30 days automatically
• Logout revokes all sessions for clean termination

This is NOT a security issue because:

• Each token individually validated against database
• All tokens have 30-day expiration
• Revocation check on every request
• Logout provides global revocation option
• Similar to GitHub, Gmail, Slack session management

[github-actions]

Dependency Review

✅ No vulnerabilities or OpenSSF Scorecard issues found.

Scanned Files

None

[nickgerace]

Looks great! Just one question.