From efe40a4d7d14644b9d3ab522024fcb0c82c7bfc5 Mon Sep 17 00:00:00 2001
From: bytedream <me@bytedream.dev>
Date: Sat, 31 Oct 2026 14:46:42 +0100
Subject: [PATCH] revoke admin session when admin is deleted

---
 src/app/admin/admins/admins.ts | 3 +++
 src/util/session.ts            | 6 +++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/app/admin/admins/admins.ts b/src/app/admin/admins/admins.ts
index f1204c2..debdae1 100644
--- a/src/app/admin/admins/admins.ts
+++ b/src/app/admin/admins/admins.ts
@@ -2,6 +2,7 @@ import { type ActionReturnType, actions } from 'astro:actions';
 import { writable } from 'svelte/store';
 import { actionErrorPopup } from '@util/action.ts';
 import { addToWritableArray, deleteFromWritableArray, updateWritableArray } from '@util/state.ts';
+import { Session } from '@util/session';
 
 // types
 export type Admins = Exclude<ActionReturnType<typeof actions.admin.admins>['data'], undefined>['admins'];
@@ -49,4 +50,6 @@ export async function deleteAdmin(admin: Admin) {
   }
 
   deleteFromWritableArray(admins, (t) => t.id == admin.id);
+
+  Session.revokeForAdminId(admin.id);
 }
diff --git a/src/util/session.ts b/src/util/session.ts
index c87006a..92f0767 100644
--- a/src/util/session.ts
+++ b/src/util/session.ts
@@ -27,7 +27,7 @@ export class Session {
   invalidate(cookies?: AstroCookies) {
     for (let i = 0; i < Session.#sessions.length; i++) {
       if (Session.#sessions[i] == this) {
-        Session.#sessions = Session.#sessions.splice(i, 1);
+        Session.#sessions.splice(i, 1);
         if (cookies) cookies.delete(ADMIN_COOKIE, Session.#cookieOptions);
         break;
       }
@@ -74,4 +74,8 @@ export class Session {
 
     throw new ActionError({ code: 'UNAUTHORIZED' });
   }
+
+  static revokeForAdminId(adminId: number) {
+    Session.#sessions = Session.#sessions.filter((session) => session.adminId != adminId);
+  }
 }