From 2c32a58a064c6d598bf499bc49d81237a2f2c1a0 Mon Sep 17 00:00:00 2001 From: Ilker Manap Date: Thu, 12 Nov 2026 22:38:54 +0100 Subject: [PATCH] Suspending a person says their keys are refused, which they are The message said their API keys still worked and should be revoked; the store has refused a key whose owner is not active for a while. Tried on the test cluster: refused 26 s after the suspend (auth.cache_ttl, 30 s), answered again 6 s after reinstating. Co-Authored-By: Claude Opus 5.5 --- internal/cli/users.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/internal/cli/users.go b/internal/cli/users.go index 4f51923..ea05b97 100644 --- a/internal/cli/users.go +++ b/internal/cli/users.go @@ -171,7 +171,10 @@ func newUserStateCmd(open userOpener, verb string, state store.UserState, short if err := s.DeleteUserSessions(cmd.Context(), u.ID); err != nil { return err } - cmd.PrintErrln("Their sessions were closed. Their API keys still work — revoke those separately.") + // The keys are refused by their owner's state, which every + // router reads again within auth.cache_ttl. + cmd.PrintErrln("Their sessions were closed. Their API keys are refused within auth.cache_ttl " + + "(30 s by default), and work again if they are reinstated.") } fmt.Fprintf(cmd.OutOrStdout(), "%s is now %s\n", u.Email, state) return nil