feat: Add two-factor authentication via TOTP

Adds TOTP setup with QR code, login challenge, recovery codes and
trusted devices that let a browser skip the second factor for 30
days. Admins can reset another user's second factor by confirming
with their own password.

server/api/helpers/sessions/invalidate-all-for-user.js

@@ -0,0 +1,44 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+module.exports = {
+  inputs: {
+    userId: {
+      type: 'string',
+      required: true,
+    },
+    exceptSessionId: {
+      type: 'string',
+      allowNull: true,
+    },
+  },
+
+  async fn(inputs) {
+    const criteria = {
+      userId: inputs.userId,
+      deletedAt: null,
+    };
+    if (inputs.exceptSessionId) {
+      criteria.id = { '!=': inputs.exceptSessionId };
+    }
+
+    const sessions = await Session.find(criteria);
+    if (sessions.length === 0) {
+      return;
+    }
+
+    await Session.update(criteria).set({
+      deletedAt: new Date().toISOString(),
+    });
+
+    sessions.forEach((session) => {
+      if (session.accessToken) {
+        const roomName = `@accessToken:${session.accessToken}`;
+        sails.sockets.broadcast(roomName, 'logout');
+        sails.sockets.leaveAll(roomName);
+      }
+    });
+  },
+};