No Session Invalidation on Password Change

// BAD: password change doesn't invalidate sessions
async function changePassword(userId: string, newPassword: string) {
  const hash = await bcrypt.hash(newPassword, 12);
  await db.users.update({ where: { id: userId }, data: { passwordHash: hash } });
  // All existing sessions still valid — attacker stays in
}

// GOOD: invalidate all sessions on password change
async function changePassword(userId: string, newPassword: string) {
  const hash = await bcrypt.hash(newPassword, 12);
  // Rotate a secret version token stored with the user
  const sessionVersion = crypto.randomUUID();
  await db.users.update({
    where: { id: userId },
    data: { passwordHash: hash, sessionVersion }
  });
  // Tokens issued before this version are now invalid
}