feat: revoke other login sessions

tests/test_app.py

@@ -174,6 +174,30 @@ def test_logout_revokes_current_session(client):
     assert client.get("/api/v1/me").status_code == 401
 
 
+def test_revoke_other_sessions_keeps_current_session(client):
+    password = "correct horse battery staple"
+    client.post("/api/v1/setup/initialize", json={"username": "owner", "password": password})
+    other = type(client)(client.app)
+    third = type(client)(client.app)
+    try:
+        assert other.post("/api/v1/auth/login", json={"username": "owner", "password": password}).status_code == 200
+        assert third.post("/api/v1/auth/login", json={"username": "owner", "password": password}).status_code == 200
+        assert len(client.get("/api/v1/sessions").json()) == 3
+
+        assert client.delete("/api/v1/sessions/others").status_code == 204
+
+        remaining = client.get("/api/v1/sessions")
+        assert remaining.status_code == 200
+        assert len(remaining.json()) == 1
+        assert remaining.json()[0]["current"] is True
+        assert client.get("/api/v1/me").status_code == 200
+        assert other.get("/api/v1/me").status_code == 401
+        assert third.get("/api/v1/me").status_code == 401
+    finally:
+        other.close()
+        third.close()
+
+
 def test_change_password_checks_current_password_and_revokes_other_sessions(client):
     old_password = "correct horse battery staple"
     new_password = "new correct horse battery staple"