From a499c589feade3d9cd7a8ebafec919429081da17 Mon Sep 17 00:00:00 2001
From: Emelia Smith <ThisIsMissEm@users.noreply.github.com>
Date: Wed, 17 Jan 2024 20:38:21 +0100
Subject: [PATCH] Ensure password resets revoke access to Streaming API

---
 app/models/user.rb       | 7 +++++++
 spec/models/user_spec.rb | 5 +++++
 2 files changed, 12 insertions(+)

diff --git a/app/models/user.rb b/app/models/user.rb
index 674135eea2..64edd3557d 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -360,6 +360,13 @@ class User < ApplicationRecord
     Doorkeeper::AccessToken.by_resource_owner(self).in_batches do |batch|
       batch.update_all(revoked_at: Time.now.utc)
       Web::PushSubscription.where(access_token_id: batch).delete_all
+
+      # Revoke each access token for the Streaming API, since `update_all``
+      # doesn't trigger ActiveRecord Callbacks:
+      # TODO: #28793 Combine into a single topic
+      batch.each do |token|
+        redis.publish("timeline:access_token:#{token.id}", Oj.dump(event: :kill))
+      end
     end
   end
 
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index bb61c02a63..f351db3720 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -433,6 +433,7 @@ RSpec.describe User do
     let!(:web_push_subscription) { Fabricate(:web_push_subscription, access_token: access_token) }
 
     before do
+      allow(redis).to receive_messages(publish: nil)
       user.reset_password!
     end
 
@@ -448,6 +449,10 @@ RSpec.describe User do
       expect(Doorkeeper::AccessToken.active_for(user).count).to eq 0
     end
 
+    it 'revokes streaming access for all access tokens' do
+      expect(redis).to have_received(:publish).with("timeline:access_token:#{access_token.id}", Oj.dump(event: :kill)).once
+    end
+
     it 'removes push subscriptions' do
       expect(Web::PushSubscription.where(user: user).or(Web::PushSubscription.where(access_token: access_token)).count).to eq 0
     end