From aaa2d77d40066aef4f14b5a0e99be23a730e0863 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Wed, 18 Feb 2026 20:08:49 +0400 Subject: [PATCH] Sign out any other account when activating via mail token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Émile Ré --- pkg/server/api/connect/v1/v1_resolver.go | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go index fbfd10120..95a3e8622 100644 --- a/pkg/server/api/connect/v1/v1_resolver.go +++ b/pkg/server/api/connect/v1/v1_resolver.go @@ -379,6 +379,24 @@ func (r *mutationResolver) SignOut(ctx context.Context) (*types.SignOutPayload, // ActivateAccount is the resolver for the signUpFromInvitation field. func (r *mutationResolver) ActivateAccount(ctx context.Context, input types.ActivateAccountInput) (*types.ActivateAccountPayload, error) { + session := authn.SessionFromContext(ctx) + + if session != nil { + // Sign out any other account before activating a new one + err := r.iam.SessionService.CloseSession(ctx, session.ID) + if err != nil { + var ErrSessionNotFound *iam.ErrSessionNotFound + if !errors.As(err, &ErrSessionNotFound) { + r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err)) + return nil, gqlutils.Internal(ctx) + } + + } + + w := gqlutils.HTTPResponseWriterFromContext(ctx) + r.sessionCookie.Clear(w) + } + user, createPasswordToken, err := r.iam.AuthService.ActivateAccount( ctx, &iam.ActivateAccountRequest{