Invalidate tokens on password change

packages/tests/src/api/server/email.ts

@@ -123,6 +123,13 @@ describe('Test emails', function () {
 
     it('Should reset the password', async function () {
       await server.users.resetPassword({ userId, verificationString, password: 'super_password2' })
+      user.password = 'super_password2'
+    })
+
+    it('Should have invalided user tokens', async function () {
+      await server.users.getMyQuotaUsed({ token: userAccessToken, expectedStatus: HttpStatusCode.UNAUTHORIZED_401 })
+
+      userAccessToken = await server.login.getAccessToken(user)
     })
 
     it('Should not reset the password with the same verification string', async function () {

packages/tests/src/api/users/users.ts

@@ -197,6 +197,12 @@ describe('Test users', function () {
   })
 
   describe('Update my account', function () {
+    let otherToken: string
+
+    before(async function () {
+      otherToken = await server.login.getAccessToken(user)
+    })
+
     it('Should update my password', async function () {
       await server.users.updateMe({
         token: userToken,
@@ -208,6 +214,11 @@ describe('Test users', function () {
       await server.login.login({ user })
     })
 
+    it('Should have invalided other tokens, but not the one that changed the password', async function () {
+      await server.users.getMyQuotaUsed({ token: userToken })
+      await server.users.getMyQuotaUsed({ token: otherToken, expectedStatus: HttpStatusCode.UNAUTHORIZED_401 })
+    })
+
     it('Should be able to change the NSFW display attribute', async function () {
       await server.users.updateMe({
         token: userToken,