fix(security): SUM-SEC-01 — reject deactivated users at session resolve

core/engine/templates/base.html

@@ -343,6 +343,19 @@ <h3 class="sum-sidebar-group-title">{{.Name}}</h3>
     <div id="sum-toast-stack" class="sum-toast-stack" aria-live="polite"></div>
     <script>
     (function () {
+      var TAB_KEY = "sumeru_open_tabs";
+      var n = parseInt(localStorage.getItem(TAB_KEY) || "0", 10) + 1;
+      localStorage.setItem(TAB_KEY, String(n));
+
+      window.addEventListener("pagehide", function (ev) {
+        if (ev.persisted) return;
+        n = Math.max(0, parseInt(localStorage.getItem(TAB_KEY) || "1", 10) - 1);
+        localStorage.setItem(TAB_KEY, String(n));
+        if (n === 0 && navigator.sendBeacon) {
+          navigator.sendBeacon("/web/logout");
+        }
+      });
+
       document.addEventListener("click", function (event) {
         var button = event.target.closest(".sum-flash-dismiss");
         if (!button) return;

core/engine/templates/login.html

@@ -42,6 +42,11 @@ <h1>Sign in</h1>
         <button type="submit" class="sum-login-btn">Sign in</button>
     </form>
 </div>
+<script>
+(function () {
+  localStorage.removeItem("sumeru_open_tabs");
+})();
+</script>
 <script src="/static/js/sumeru-password-toggle.js"></script>
 </body>
 </html>

core/orm/session_revoke.go

@@ -0,0 +1,14 @@
+package orm
+
+import (
+	"context"
+)
+
+// DestroySessionsForUser deletes all DB-backed sessions for a user.
+func DestroySessionsForUser(ctx context.Context, userID int) {
+	if DB == nil || userID <= 0 {
+		return
+	}
+	sessionTable := MustQuotedTableName("sys.session")
+	_, _ = DB.ExecContext(ctx, `DELETE FROM `+sessionTable+` WHERE user_id = $1`, userID)
+}

core/orm/user_password.go

@@ -60,5 +60,9 @@ func SetUserPasswordHash(ctx context.Context, userID int, hash string) error {
 		return fmt.Errorf("password hash required")
 	}
 	ctx = ContextAllowPasswordHashWrite(ctx)
-	return UpdateRecordByID(ctx, "core.user", userID, map[string]interface{}{"password": hash})
+	if err := UpdateRecordByID(ctx, "core.user", userID, map[string]interface{}{"password": hash}); err != nil {
+		return err
+	}
+	DestroySessionsForUser(ctx, userID)
+	return nil
 }