Granular Killswitches — Beyond Revoke-All

"Revoke All" is the nuclear option. For lesser incidents — a borrowed phone, a friend who logged into your app to test something, a session you're suspicious of — finer-grained controls hurt less.

1. Revoke one session

The admin sessions page lists every active session: token (truncated), IP, created, expires. Each row has its own delete button.

2. Revoke by IP

If you suspect a specific IP, revoke its sessions and blacklist it in one operation.

3. Tighten lockout during incident

If you're under active brute force, drop the retry limit from 5 to 2 with one update. Restore later.

4. Disable local IP bypass temporarily

If the attacker might be on your LAN (kid's friend, suspicious house guest, compromised IoT), removing the local bypass forces them through the PIN gate too.

Code

Revoke one session by token prefix·python

@app.post("/admin/security/sessions/{token_prefix}/delete")
async def delete_session(request: Request, token_prefix: str):
    require_admin(request)
    db.execute(
        "DELETE FROM security_sessions WHERE substr(token, 1, 8) = ?",
        (token_prefix,)
    )
    db.commit()
    return RedirectResponse("/admin/security", status_code=302)

Kill all sessions for one IP and blacklist it·python

@app.post("/admin/security/ip/{ip}/kill")
async def kill_ip(request: Request, ip: str):
    require_admin(request)
    db.execute("DELETE FROM security_sessions WHERE ip = ?", (ip,))
    db.execute("""
      INSERT OR REPLACE INTO security_blacklist(ip, reason, blocked_at)
      VALUES (?, 'manual_admin_block', ?)
    """, (ip, now()))
    db.commit()
    return {"killed_sessions_for": ip}

Incident mode — tighter retry limit·python

@app.post("/admin/security/incident-mode")
async def incident_mode(request: Request, on: bool = Form(...)):
    require_admin(request)
    new_max = 2 if on else 5
    db.execute("UPDATE security_config SET max_retry = ?", (new_max,))
    db.commit()
    return {"max_retry": new_max}

Exercise

Add the three granular endpoints (revoke one session, kill IP, incident mode) and a row of small buttons next to each session in the admin table. Test the IP-kill path with a curl from another machine: confirm sessions for that IP go away AND the IP appears in blacklist with reason='manual_admin_block'.