# Plan 07.1-02 Summary — Tests + frontend toasts

**Status:** Complete  
**Wave:** 2

## What was done

### backend/tests/test_auth_api.py
- Added `RefreshToken` to imports from `db.models`
- Appended 3 new `@pytest.mark.asyncio` tests:
  - `test_change_password_revokes_other_sessions`: inserts a second RefreshToken, calls change-password, asserts `sessions_revoked >= 1` and the row is revoked
  - `test_enable_totp_revokes_other_sessions`: same pattern for totp/enable (mocks `verify_totp` and `store_backup_codes`)
  - `test_disable_totp_revokes_other_sessions`: same pattern for DELETE /api/auth/totp

### frontend/src/components/settings/SettingsAccountTab.vue
- Added `sessionRevokedToast = ref(false)`
- Added a fixed top-right toast (same visual pattern as SettingsView OAuth toast)
- `changePassword()`: captures API response, shows toast for 5s when `sessions_revoked > 0`
- `disableTotp()`: captures API response, shows toast for 5s when `sessions_revoked > 0`

### frontend/src/components/auth/TotpEnrollment.vue
- Added `sessionRevokedToast = ref(false)`
- Added an inline (non-fixed) alert block at the top of the component template
- `confirmEnrollment()`: checks `data.sessions_revoked > 0` and shows the inline alert for 5s

## Verification

```
pytest tests/test_auth_api.py -k "revokes_other_sessions" -v   → 3 PASSED
pytest -q --ignore=tests/test_extractor.py                     → 373 passed, 0 failed
npm run build (frontend)                                        → exits 0
grep -c "sessions_revoked" SettingsAccountTab.vue              → 2
grep -c "sessions_revoked" TotpEnrollment.vue                  → 1
```