fix: disconnect live socket sessions when tokens are revoked

Token revocation only took effect at the Socket.IO handshake, so connections established beforehand kept running. Both revocation helpers now drop the user's live sessions after writing the revocation marker, which covers signout, password change, admin user update and OIDC back-channel logout in one place. Clients holding a still-valid token reconnect immediately.

backend/open_webui/utils/auth.py

@@ -303,6 +303,12 @@ async def invalidate_token(request, token):
                     ex=ttl,
                 )
 
+                user_id = decoded.get('id')
+                if user_id:
+                    from open_webui.socket.main import disconnect_user_sessions
+
+                    await disconnect_user_sessions(user_id)
+
 
 async def revoke_user_tokens(request, user_id: str):
     """Reject every token already issued to a user. Requires Redis."""
@@ -324,6 +330,10 @@ async def revoke_user_tokens(request, user_id: str):
         ex=int(expires_delta.total_seconds()) if expires_delta else None,
     )
 
+    from open_webui.socket.main import disconnect_user_sessions
+
+    await disconnect_user_sessions(user_id)
+
 
 def extract_token_from_auth_header(auth_header: str):
     return auth_header[len('Bearer ') :]