From 32380b1935c6811c3b183c80eecbf03893ca67aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Thu, 6 Aug 2026 03:08:51 +0200
Subject: [PATCH] fix: clear revoked Guardian sessions

Return a removed Guardian's browsers to their own record.
---
 src/lib/sharing/grants.ts                           | 4 ++++
 tests/integration/managed-profile-lifecycle.test.ts | 9 +++++++++
 2 files changed, 13 insertions(+)

diff --git a/src/lib/sharing/grants.ts b/src/lib/sharing/grants.ts
index 7696c978c..0184f0c43 100644
--- a/src/lib/sharing/grants.ts
+++ b/src/lib/sharing/grants.ts
@@ -542,6 +542,10 @@ export async function revokeManagedProfileGuardian(input: {
         where: { id: target.id },
         data: { revokedAt: new Date(), revokedBy: "GRANTOR" },
       });
+      await clearActingSessions(
+        { grantorId: profile.id, granteeId: target.granteeId },
+        tx,
+      );
       return tx.accountGrant.findUniqueOrThrow({ where: { id: target.id } });
     });
   });
diff --git a/tests/integration/managed-profile-lifecycle.test.ts b/tests/integration/managed-profile-lifecycle.test.ts
index 050cc7553..2b79f0283 100644
--- a/tests/integration/managed-profile-lifecycle.test.ts
+++ b/tests/integration/managed-profile-lifecycle.test.ts
@@ -306,6 +306,10 @@ describe("managed profile lifecycle (real Postgres)", () => {
       { params: Promise.resolve({ id: invitation.id }) },
     );
     expect(accepted.status).toBe(200);
+    await getPrismaClient().session.update({
+      where: { id: secondGuardian.sessionId },
+      data: { actingAsUserId: profile.id },
+    });
 
     cookieJar.set("healthlog_session", creator.sessionId);
     const { DELETE: revokeGuardian } =
@@ -323,6 +327,11 @@ describe("managed profile lifecycle (real Postgres)", () => {
         where: { id: invitation.id },
       }),
     ).toMatchObject({ revokedBy: "GRANTOR" });
+    expect(
+      await getPrismaClient().session.findUniqueOrThrow({
+        where: { id: secondGuardian.sessionId },
+      }),
+    ).toMatchObject({ actingAsUserId: null });
   });
 
   it("rolls managed Guardian acceptance back when the grant update fails", async () => {