From ed11bc64dc59d5cbaafe4f2f507c4f801fd9412e Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Wed, 4 Nov 2026 20:14:08 +0100
Subject: [PATCH] Task/remove auth devices on access token rotation (#8392)

* Remove auth devices on access token rotation

* Update changelog
---
 CHANGELOG.md                               | 1 +
 apps/api/src/services/user/user.service.ts | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8a615bacbf..93b19d8b9d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Improved the content of the pricing page
+- Disabled the biometric authentication on all devices when generating a new _Security Token_
 - Improved the language localization for German (`de`)
 
 ### Fixed
diff --git a/apps/api/src/services/user/user.service.ts b/apps/api/src/services/user/user.service.ts
index b566332f40..b3d7ea89bb 100644
--- a/apps/api/src/services/user/user.service.ts
+++ b/apps/api/src/services/user/user.service.ts
@@ -708,6 +708,8 @@ export class UserService {
       userId
     });
 
+    await this.prismaService.authDevice.deleteMany({ where: { userId } });
+
     await this.prismaService.user.update({
       data: { accessToken: hashedAccessToken },
       where: { id: userId }