fix(platform-objects): sys_session.revoke_reason description names admin_password_reset

.changeset/23477-revoke-reason-vocabulary.md

@@ -0,0 +1,5 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+fix(platform-objects): the `sys_session.revoke_reason` description names `admin_password_reset`, the value an administrator's forced password reset writes on the sessions it revokes. Description text only; nothing is accepted or refused differently.

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -342,7 +342,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "Revoke Reason",
-        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, …)."
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, admin_password_reset, …)."
       },
       active_organization_id: {
         label: "Active Organization"

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -342,7 +342,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "Motivo de la revocación",
-        help: "Por qué se revocó la sesión (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, …)."
+        help: "Por qué se revocó la sesión (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, admin_password_reset, …)."
       },
       active_organization_id: {
         label: "Organización activa"

packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts

@@ -342,7 +342,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "失効理由",
-        help: "セッションが失効した理由（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended など）。"
+        help: "セッションが失効した理由（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended、admin_password_reset など）。"
       },
       active_organization_id: {
         label: "アクティブ組織"

packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts

@@ -342,7 +342,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "撤销原因",
-        help: "会话被撤销的原因（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended 等）。"
+        help: "会话被撤销的原因（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended、admin_password_reset 等）。"
       },
       active_organization_id: {
         label: "当前组织"

packages/platform-objects/src/identity/sys-session.object.ts

@@ -196,9 +196,12 @@ export const SysSession = ObjectSchema.create({
       // backing a session's active organization ends and the user holds no
       // other. ⛔ It is a COURTESY, never the enforcement: the wall is the
       // per-request membership check in `resolve-authz-context.ts`.
+      // `admin_password_reset` is the second authorization-event cause: an
+      // administrator's forced password reset revoked the session
+      // (`plugin-auth/forced-reset-revocation.ts`, `FORCED_RESET_REVOKE_REASON`).
       description:
         'Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, '
-        + 'admin, organization_membership_ended, …).',
+        + 'admin, organization_membership_ended, admin_password_reset, …).',
     }),
 
     // ── Active context (multi-org/team) ──────────────────────────

packages/plugins/plugin-auth/src/forced-reset-revoke-reason-vocabulary.test.ts

@@ -0,0 +1,13 @@
+import { describe, it, expect } from 'vitest';
+import { SysSession } from '@objectstack/platform-objects/identity';
+import { FORCED_RESET_REVOKE_REASON } from './forced-reset-revocation';
+
+// `sys_session.revoke_reason` is free text; its description is the only
+// published vocabulary, so a value this producer writes must be named there.
+describe('sys_session.revoke_reason vocabulary', () => {
+  it('names the value a forced reset writes', () => {
+    expect(FORCED_RESET_REVOKE_REASON).toBe('admin_password_reset');
+    const description = String((SysSession.fields as any).revoke_reason.description);
+    expect(description).toContain(FORCED_RESET_REVOKE_REASON);
+  });
+});