Feature: Expose Session and Device Management API

[3m1n3nc3]

Description

Allow learners to list and revoke their active refresh sessions.

File Location

Session controller/routes/service/schemas and tests

Design Reference

API Roadmap Phase 1: Expose Session and Device Management API.

Dependencies

• Status: Blocked
• Blocked by: Feature: Implement Refresh Rotation and Logout API #130 (Implement Refresh Rotation and Logout API)
• Blocks: Feature: Add Identity Profile Wallet Integration Test Suite #137 (Add Identity Profile Wallet Integration Test Suite)

Tasks

• List safe device/browser, approximate location, created, last-used, and current markers
• Revoke one other session and all other sessions
• Prevent cross-user access and unsafe current-session handling
• Redact tokens, raw IPs, and excessive fingerprints
• Audit revocation with stable repeat behavior
• Test authorization, pagination, redaction, and revocation

Acceptance Criteria

• Users see/revoke only their sessions
• No token or raw sensitive identifier is returned
• Current session behavior is explicit
• Revocation blocks refresh immediately
• Tests and OpenAPI pass

Verification Evidence

• Attach redacted curl and cross-user/revocation tests

Difficulty

Medium

[Anichris-koded]

Hi, my name is Koded, and I’m a professional software engineer experienced in backend API development, authentication systems, and account security. I can implement a secure Session and Device Management API that enables users and administrators to manage active sessions, registered devices, and access states effectively. My approach focuses on strong authorization, secure session lifecycle management, clear API contracts, and comprehensive testing for reliable account security.

[grantfox-oss]

🦊 GrantFox — @Anichris-koded has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #131)
2. Your PR will be reviewed by the learnault maintainers

Good luck! Track your progress on GrantFox.