fix: session termination after user deletion/deactivation (#11644)

# Which Problems Are Solved

After a user is deactivated, their sessions are still valid. When the
user is redirected to login page, they're stuck in a loop on a blank
page on the `users/me` endpoint as the user's session is still valid.

# How the Problems Are Solved

By terminating a deactivated user's session. This is done by:
- Adding a new reducer in session projection to delete sessions for
`UserDeactivatedEvent`, `UserLockedEvent` and `UserRemovedEvent` events
- Adding a new reducer in the relation session projection to delete
sessions based on `UserDeactivatedEvent`, `UserLockedEvent` events

# Additional Changes
N/A

# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/10307
- todo: add integration test cases for relational session reducers based
on user deactivated, locked, deleted events
This commit is contained in:
Gayathri Vijayan
2026-02-20 10:21:01 +00:00
committed by GitHub
parent 545e2665f3
commit 1494f91f80
4 changed files with 142 additions and 0 deletions
@@ -473,6 +473,8 @@ func TestServer_SessionReduces(t *testing.T) {
assert.Nil(collect, dbSession)
}, retryDuration, tick, "session not found within %v: %v", retryDuration, err)
})
// TODO (@grvijayan): add tests for session reducers based on user deactivated, locked, deleted events
}
func assertSessionsEqual(t *assert.CollectT, expected, actual *domain.Session) {