feat: add admin API to manage user sessions (#92)

Author: skylenet

docs/api.md

@@ -250,6 +250,8 @@ All endpoints are under the `/api/v1` prefix.
 | `POST` | `/admin/users` | Create a user |
 | `PUT` | `/admin/users/{id}` | Update a user |
 | `DELETE` | `/admin/users/{id}` | Delete a user |
+| `GET` | `/admin/sessions` | List all active sessions |
+| `DELETE` | `/admin/sessions/{id}` | Revoke a session |
 | `GET` | `/admin/github/org-mappings` | List org role mappings |
 | `POST` | `/admin/github/org-mappings` | Create/update org mapping |
 | `DELETE` | `/admin/github/org-mappings/{id}` | Delete org mapping |
@@ -298,7 +300,7 @@ To enable API integration, add the `api` field to the UI's `config.json`:
 
 When the API is configured, the UI provides:
 - **Login page** (`/login`) — username/password form and/or "Sign in with GitHub" button
-- **Admin page** (`/admin`) — user management, GitHub org/user role mapping management
+- **Admin page** (`/admin`) — user management, session management, GitHub org/user role mapping management
 - **Header controls** — sign in/out button, username display, admin link (for admins)
 
 When the API is not configured, none of these features appear and the UI functions as a static results viewer.

pkg/api/admin.go

@@ -205,6 +205,91 @@ func (s *server) handleDeleteUser(
 	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 }
 
+// --- Session management ---
+
+type sessionResponse struct {
+	ID        uint   `json:"id"`
+	UserID    uint   `json:"user_id"`
+	Username  string `json:"username"`
+	Source    string `json:"source"`
+	ExpiresAt string `json:"expires_at"`
+	CreatedAt string `json:"created_at"`
+}
+
+// handleListSessions returns all sessions with resolved usernames.
+func (s *server) handleListSessions(
+	w http.ResponseWriter, r *http.Request,
+) {
+	sessions, err := s.store.ListSessions(r.Context())
+	if err != nil {
+		s.log.WithError(err).Error("Failed to list sessions")
+		writeJSON(w, http.StatusInternalServerError,
+			errorResponse{"internal error"})
+
+		return
+	}
+
+	users, err := s.store.ListUsers(r.Context())
+	if err != nil {
+		s.log.WithError(err).Error("Failed to list users")
+		writeJSON(w, http.StatusInternalServerError,
+			errorResponse{"internal error"})
+
+		return
+	}
+
+	type userInfo struct {
+		Username string
+		Source   string
+	}
+
+	userMap := make(map[uint]userInfo, len(users))
+	for i := range users {
+		userMap[users[i].ID] = userInfo{
+			Username: users[i].Username,
+			Source:   users[i].Source,
+		}
+	}
+
+	resp := make([]sessionResponse, 0, len(sessions))
+	for i := range sessions {
+		info := userMap[sessions[i].UserID]
+		resp = append(resp, sessionResponse{
+			ID:        sessions[i].ID,
+			UserID:    sessions[i].UserID,
+			Username:  info.Username,
+			Source:    info.Source,
+			ExpiresAt: sessions[i].ExpiresAt.Format("2006-01-02T15:04:05Z"),
+			CreatedAt: sessions[i].CreatedAt.Format("2006-01-02T15:04:05Z"),
+		})
+	}
+
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// handleDeleteSessionByID revokes a session by ID.
+func (s *server) handleDeleteSessionByID(
+	w http.ResponseWriter, r *http.Request,
+) {
+	id, err := parseIDParam(r)
+	if err != nil {
+		writeJSON(w, http.StatusBadRequest,
+			errorResponse{err.Error()})
+
+		return
+	}
+
+	if err := s.store.DeleteSessionByID(r.Context(), id); err != nil {
+		s.log.WithError(err).Error("Failed to delete session")
+		writeJSON(w, http.StatusInternalServerError,
+			errorResponse{"internal error"})
+
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+}
+
 // --- GitHub org mapping management ---
 
 type orgMappingRequest struct {

pkg/api/routes.go

@@ -78,6 +78,10 @@ func (s *server) buildRouter() http.Handler {
 			r.Put("/users/{id}", s.handleUpdateUser)
 			r.Delete("/users/{id}", s.handleDeleteUser)
 
+			// Session management.
+			r.Get("/sessions", s.handleListSessions)
+			r.Delete("/sessions/{id}", s.handleDeleteSessionByID)
+
 			// GitHub org mappings.
 			r.Get("/github/org-mappings", s.handleListOrgMappings)
 			r.Post("/github/org-mappings", s.handleUpsertOrgMapping)

pkg/api/store/store.go

@@ -30,7 +30,9 @@ type Store interface {
 	// Session CRUD.
 	CreateSession(ctx context.Context, session *Session) error
 	GetSessionByToken(ctx context.Context, token string) (*Session, error)
+	ListSessions(ctx context.Context) ([]Session, error)
 	DeleteSession(ctx context.Context, token string) error
+	DeleteSessionByID(ctx context.Context, id uint) error
 	DeleteExpiredSessions(ctx context.Context) error
 
 	// GitHub org mapping CRUD.
@@ -221,6 +223,17 @@ func (s *store) GetSessionByToken(
 	return &session, nil
 }
 
+func (s *store) ListSessions(ctx context.Context) ([]Session, error) {
+	var sessions []Session
+	if err := s.db.WithContext(ctx).
+		Order("id ASC").
+		Find(&sessions).Error; err != nil {
+		return nil, fmt.Errorf("listing sessions: %w", err)
+	}
+
+	return sessions, nil
+}
+
 func (s *store) DeleteSession(ctx context.Context, token string) error {
 	if err := s.db.WithContext(ctx).
 		Where("token = ?", token).
@@ -231,6 +244,15 @@ func (s *store) DeleteSession(ctx context.Context, token string) error {
 	return nil
 }
 
+func (s *store) DeleteSessionByID(ctx context.Context, id uint) error {
+	if err := s.db.WithContext(ctx).
+		Delete(&Session{}, id).Error; err != nil {
+		return fmt.Errorf("deleting session by id: %w", err)
+	}
+
+	return nil
+}
+
 func (s *store) DeleteExpiredSessions(ctx context.Context) error {
 	result := s.db.WithContext(ctx).
 		Where("expires_at < ?", time.Now()).

ui/src/api/hooks/useAdmin.ts

@@ -33,6 +33,32 @@ async function adminFetch<T>(path: string, options?: RequestInit): Promise<T> {
   return resp.json()
 }
 
+// Sessions
+export interface AdminSession {
+  id: number
+  user_id: number
+  username: string
+  source: string
+  expires_at: string
+  created_at: string
+}
+
+export function useSessions() {
+  return useQuery<AdminSession[]>({
+    queryKey: ['admin', 'sessions'],
+    queryFn: () => adminFetch('/api/v1/admin/sessions'),
+  })
+}
+
+export function useDeleteSession() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (id: number) =>
+      adminFetch(`/api/v1/admin/sessions/${id}`, { method: 'DELETE' }),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ['admin', 'sessions'] }),
+  })
+}
+
 // Users
 export function useUsers() {
   return useQuery<AuthUser[]>({

ui/src/pages/AdminPage.tsx

@@ -1,4 +1,5 @@
 import { useMemo, useState } from 'react'
+import { useNavigate, useSearch } from '@tanstack/react-router'
 import { useAuth } from '@/hooks/useAuth'
 import type { AuthConfig } from '@/api/auth-client'
 import { Modal } from '@/components/shared/Modal'
@@ -7,6 +8,8 @@ import {
   useCreateUser,
   useUpdateUser,
   useDeleteUser,
+  useSessions,
+  useDeleteSession,
   useOrgMappings,
   useUpsertOrgMapping,
   useDeleteOrgMapping,
@@ -17,7 +20,7 @@ import {
 import { Plus, Pencil, Trash2 } from 'lucide-react'
 import clsx from 'clsx'
 
-type Tab = 'users' | 'github-mappings'
+type Tab = 'users' | 'github-mappings' | 'sessions'
 
 export function AdminPage() {
   const { isAdmin, authConfig } = useAuth()
@@ -26,12 +29,19 @@ export function AdminPage() {
     const result: { key: Tab; label: string }[] = []
     if (authConfig?.auth.basic_enabled) result.push({ key: 'users', label: 'Users' })
     if (authConfig?.auth.github_enabled) result.push({ key: 'github-mappings', label: 'GitHub Mappings' })
+    result.push({ key: 'sessions', label: 'Sessions' })
     return result
   }, [authConfig])
 
-  const [activeTab, setActiveTab] = useState<Tab>('users')
+  const navigate = useNavigate()
+  const search = useSearch({ from: '/admin' }) as { tab?: string }
+  const activeTab = (search.tab as Tab) || tabs[0]?.key
   const resolvedTab = tabs.find((t) => t.key === activeTab) ? activeTab : tabs[0]?.key
 
+  const setActiveTab = (tab: Tab) => {
+    navigate({ to: '/admin', search: { tab } })
+  }
+
   if (!isAdmin) {
     return (
       <div className="py-12 text-center text-gray-500 dark:text-gray-400">
@@ -67,6 +77,7 @@ export function AdminPage() {
 
           {resolvedTab === 'users' && <UsersTab />}
           {resolvedTab === 'github-mappings' && <GitHubMappingsTab />}
+          {resolvedTab === 'sessions' && <SessionsTab />}
         </>
       )}
     </div>
@@ -219,6 +230,106 @@ function UsersTab() {
   )
 }
 
+// --- Sessions Tab ---
+
+function formatTimestamp(iso: string): string {
+  const date = new Date(iso)
+  const now = new Date()
+  const diffMs = date.getTime() - now.getTime()
+  const absDiffMs = Math.abs(diffMs)
+  const isPast = diffMs < 0
+
+  const minutes = Math.floor(absDiffMs / 60000)
+  const hours = Math.floor(minutes / 60)
+  const days = Math.floor(hours / 24)
+
+  let relative: string
+  if (minutes < 1) relative = 'just now'
+  else if (minutes < 60) relative = `${minutes}m ${isPast ? 'ago' : 'from now'}`
+  else if (hours < 24) relative = `${hours}h ${isPast ? 'ago' : 'from now'}`
+  else relative = `${days}d ${isPast ? 'ago' : 'from now'}`
+
+  return `${relative} (${date.toLocaleString()})`
+}
+
+function SessionsTab() {
+  const { data: sessions = [], isLoading } = useSessions()
+  const deleteSession = useDeleteSession()
+
+  if (isLoading) return <div className="text-sm text-gray-500">Loading...</div>
+
+  return (
+    <div>
+      <div className="mb-4">
+        <h2 className="text-sm font-medium text-gray-700 dark:text-gray-300">
+          {sessions.length} session{sessions.length !== 1 ? 's' : ''}
+        </h2>
+      </div>
+
+      <div className="overflow-hidden rounded-sm border border-gray-200 dark:border-gray-700">
+        <table className="w-full text-left text-sm">
+          <thead className="bg-gray-50 text-xs text-gray-500 uppercase dark:bg-gray-800 dark:text-gray-400">
+            <tr>
+              <th className="px-4 py-2">Username</th>
+              <th className="px-4 py-2">Source</th>
+              <th className="px-4 py-2">Created</th>
+              <th className="px-4 py-2">Expires</th>
+              <th className="px-4 py-2 text-right">Actions</th>
+            </tr>
+          </thead>
+          <tbody className="divide-y divide-gray-200 dark:divide-gray-700">
+            {sessions.map((s) => (
+              <tr key={s.id} className="bg-white dark:bg-gray-900">
+                <td className="px-4 py-2 font-medium text-gray-900 dark:text-gray-100">
+                  {s.username || `User #${s.user_id}`}
+                </td>
+                <td className="px-4 py-2">
+                  <span
+                    className={clsx(
+                      'inline-block rounded-full px-2 py-0.5 text-xs font-medium',
+                      s.source === 'github'
+                        ? 'bg-purple-100 text-purple-700 dark:bg-purple-900/30 dark:text-purple-400'
+                        : 'bg-gray-100 text-gray-600 dark:bg-gray-800 dark:text-gray-400',
+                    )}
+                  >
+                    {s.source}
+                  </span>
+                </td>
+                <td className="px-4 py-2 text-gray-500 dark:text-gray-400">
+                  {formatTimestamp(s.created_at)}
+                </td>
+                <td className="px-4 py-2 text-gray-500 dark:text-gray-400">
+                  {formatTimestamp(s.expires_at)}
+                </td>
+                <td className="px-4 py-2 text-right">
+                  <button
+                    onClick={() => {
+                      if (confirm(`Revoke session for "${s.username || `User #${s.user_id}`}"?`)) {
+                        deleteSession.mutate(s.id)
+                      }
+                    }}
+                    className="rounded-sm p-1 text-gray-400 hover:text-red-600 dark:hover:text-red-400"
+                    title="Revoke session"
+                  >
+                    <Trash2 className="size-3.5" />
+                  </button>
+                </td>
+              </tr>
+            ))}
+            {sessions.length === 0 && (
+              <tr>
+                <td colSpan={5} className="px-4 py-6 text-center text-sm text-gray-500 dark:text-gray-400">
+                  No active sessions
+                </td>
+              </tr>
+            )}
+          </tbody>
+        </table>
+      </div>
+    </div>
+  )
+}
+
 // --- GitHub Mappings Tab ---
 
 function GitHubMappingsTab() {