feat(07.2-03): add import time + user_nbf writes to api/auth.py (change_password, enable_totp, disable_totp)

backend/api/auth.py

@@ -20,6 +20,7 @@ Security invariants:
 from __future__ import annotations
 
 import hashlib
+import time
 import uuid
 from typing import Literal, Optional
 
@@ -503,6 +504,12 @@ async def change_password(
         ip_address=_ip,
         metadata_={"sessions_revoked": revoked},
     )
+    # Revoke any pre-change access tokens still within their TTL window (T-7.2-01)
+    await request.app.state.redis.set(
+        f"user_nbf:{current_user.id}",
+        int(time.time()),
+        ex=settings.access_token_expire_minutes * 60,
+    )
     await session.commit()
 
     return {"message": "Password updated", "sessions_revoked": revoked}
@@ -596,6 +603,12 @@ async def enable_totp(
         ip_address=_ip,
         metadata_={"sessions_revoked": revoked},
     )
+    # Revoke any pre-enroll access tokens still within their TTL window (T-7.2-01)
+    await redis_client.set(
+        f"user_nbf:{current_user.id}",
+        int(time.time()),
+        ex=settings.access_token_expire_minutes * 60,
+    )
     await session.commit()
 
     return {"backup_codes": plain_codes, "sessions_revoked": revoked}
@@ -636,6 +649,12 @@ async def disable_totp(
         ip_address=_ip,
         metadata_={"sessions_revoked": revoked},
     )
+    # Revoke any pre-revoke access tokens still within their TTL window (T-7.2-01)
+    await request.app.state.redis.set(
+        f"user_nbf:{current_user.id}",
+        int(time.time()),
+        ex=settings.access_token_expire_minutes * 60,
+    )
     await session.commit()
 
     return {"message": "TOTP disabled", "sessions_revoked": revoked}