1 files changed, 7 insertions, 1 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index 904d7a0..eb053b7 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -1140,13 +1140,17 @@ async def revoke_all_sessions(
 
     Access tokens already issued run out on their own, within their lifetime.
     A desktop device key is not a session and is left alone — removing the
-    device is what stops it signing back in.
+    device is what stops it signing back in. A phone's push row is dropped:
+    its poll secret is a credential of its own, and "everywhere" is what
+    someone who lost a phone presses. A phone still in hand registers again
+    at its next start.
     """
     result = await db.execute(
         update(RefreshToken)
         .where(RefreshToken.user_id == current_user.id,
                RefreshToken.revoked.is_(False))
         .values(revoked=True))
+    await db.execute(delete(PushSubscription).where(PushSubscription.user_id == current_user.id))
     db.add(IPLog(user_id=current_user.id, event="sessions_revoked",
                  ip_address=client_ip(request)))
     await db.commit()
@@ -1180,10 +1184,12 @@ async def change_password(
     # Every existing session goes stale. Revoke all refresh tokens, then hand
     # this caller a fresh pair so the tab that made the change stays signed in;
     # other browsers fail their next renewal and drop to the sign-in form.
+    # Phones' push rows go too — their poll secrets would outlive the sessions.
     await db.execute(
         update(RefreshToken)
         .where(RefreshToken.user_id == current_user.id)
         .values(revoked=True))
+    await db.execute(delete(PushSubscription).where(PushSubscription.user_id == current_user.id))
 
     memberships = await db.execute(
         select(GroupMember.group_id).where(GroupMember.user_id == current_user.id))