fix(security): revoke 2FA remember tokens when credentials or 2FA change (#7682)

src/db/models/device.rs

@@ -266,10 +266,22 @@ impl Device {
         let devices = Self::find_by_user(user_uuid, conn).await;
         for mut device in devices {
             device.refresh_token = Device::generate_refresh_token();
+            device.twofactor_remember = None;
             device.save(false, conn).await?;
         }
         Ok(())
     }
+
+    pub async fn clear_twofactor_remember_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
+        conn.run(move |conn| {
+            diesel::update(devices::table)
+                .filter(devices::user_uuid.eq(user_uuid))
+                .set(devices::twofactor_remember.eq::<Option<String>>(None))
+                .execute(conn)
+                .map_res("Error removing two factor remember tokens")
+        })
+        .await
+    }
 }
 
 #[derive(Display)]