---
phase: "07.1"
slug: security-session-revocation-on-privilege-change
status: complete
nyquist_compliant: true
wave_0_complete: false
created: 2026-06-05
---

# Phase 07.1 — Validation Strategy

> Per-phase validation contract for session-revocation on privilege change.

---

## Test Infrastructure

| Property | Value |
|----------|-------|
| **Framework (backend)** | pytest 7.x + pytest-asyncio |
| **Config file (backend)** | `backend/pytest.ini` |
| **Framework (frontend)** | Vitest + @vue/test-utils |
| **Config file (frontend)** | `frontend/vitest.config.js` |
| **Backend quick run** | `cd backend && python3 -m pytest tests/test_auth_api.py -k "revokes_other_sessions" -v` |
| **Backend full suite** | `cd backend && python3 -m pytest -x -q --ignore=tests/test_extractor.py` |
| **Frontend quick run** | `cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js src/components/auth/__tests__/TotpEnrollment.test.js --reporter=verbose` |
| **Frontend full suite** | `cd frontend && npx vitest run --reporter=verbose` |
| **Estimated runtime** | ~5 s backend · ~10 s frontend |

---

## Sampling Rate

- **After every task commit:** Run backend quick run + frontend quick run
- **After every plan wave:** Run full backend + frontend suites
- **Before `/gsd:verify-work`:** Both full suites must be green
- **Max feedback latency:** ~15 seconds

---

## Per-Task Verification Map

| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
| 07.1-01-01 | 01 | 1 | CR-01 | T-7.1-01 | `skip_token_hash` excludes current session from revocation | integration | `cd backend && python3 -m pytest tests/test_auth_api.py -k "test_change_password_revokes_other_sessions" -v` | ✅ | ✅ green |
| 07.1-01-02 | 01 | 1 | CR-02 | T-7.1-01 | `enable_totp` revokes other sessions, keeps current alive | integration | `cd backend && python3 -m pytest tests/test_auth_api.py -k "test_enable_totp_revokes_other_sessions" -v` | ✅ | ✅ green |
| 07.1-01-03 | 01 | 1 | CR-03 | T-7.1-01 | `disable_totp` revokes other sessions, keeps current alive | integration | `cd backend && python3 -m pytest tests/test_auth_api.py -k "test_disable_totp_revokes_other_sessions" -v` | ✅ | ✅ green |
| 07.1-02-01 | 02 | 2 | CR-01 | T-7.1-04 | SettingsAccountTab shows toast when `changePassword` returns `sessions_revoked > 0` | unit | `cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js --reporter=verbose` | ✅ | ✅ green |
| 07.1-02-02 | 02 | 2 | CR-03 | T-7.1-04 | SettingsAccountTab shows toast when `disableTotp` returns `sessions_revoked > 0` | unit | `cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js --reporter=verbose` | ✅ | ✅ green |
| 07.1-02-03 | 02 | 2 | CR-02 | T-7.1-04 | TotpEnrollment shows inline alert when `enable_totp` returns `sessions_revoked > 0` | unit | `cd frontend && npx vitest run src/components/auth/__tests__/TotpEnrollment.test.js --reporter=verbose` | ✅ | ✅ green |

*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*

---

## Wave 0 Requirements

Existing infrastructure covers all phase requirements. No Wave 0 installs needed.

---

## Manual-Only Verifications

All phase behaviors have automated verification.

---

## Validation Audit 2026-06-05

| Metric | Count |
|--------|-------|
| Gaps found | 3 |
| Resolved | 3 |
| Escalated | 0 |

Auditor: gsd-nyquist-auditor — 5 new Vitest tests added (+3 positive, +2 negative), all green. Backend suite previously green (3 passing integration tests). No regressions.

---

## Validation Sign-Off

- [x] All tasks have `<automated>` verify
- [x] Sampling continuity: no 3 consecutive tasks without automated verify
- [x] Wave 0 covers all MISSING references (N/A — infra pre-existing)
- [x] No watch-mode flags
- [x] Feedback latency < 15s
- [x] `nyquist_compliant: true` set in frontmatter

**Approval:** approved 2026-06-05