Have InvalidateUser take a transaction

auth.go

@@ -337,7 +337,7 @@ func AuthSignout(app *App) func(c echo.Context) error {
  return c.JSONBlob(http.StatusUnauthorized, invalidCredentialsBlob)
  }
 
- err = app.InvalidateUser(&user)
+ err = app.InvalidateUser(app.DB, &user)
  if err != nil {
  return err
  }
@@ -365,7 +365,7 @@ func AuthInvalidate(app *App) func(c echo.Context) error {
  return c.JSONBlob(http.StatusUnauthorized, invalidAccessTokenBlob)
  }
 
- err := app.InvalidateUser(&client.User)
+ err := app.InvalidateUser(app.DB, &client.User)
  if err != nil {
  return err
  }

common.go

@@ -455,16 +455,16 @@ func StripQueryParam(urlString string, param string) (string, error) {
  return parsedURL.String(), nil
 }
 
-func (app *App) InvalidateUser(user *User) error {
- result := app.DB.Model(Client{}).Where("user_uuid = ?", user.UUID).Update("version", gorm.Expr("version + ?", 1))
+func (app *App) InvalidateUser(db *gorm.DB, user *User) error {
+ result := db.Model(Client{}).Where("user_uuid = ?", user.UUID).Update("version", gorm.Expr("version + ?", 1))
  return result.Error
 }
 
 func (app *App) SetIsLocked(db *gorm.DB, user *User, isLocked bool) error {
  user.IsLocked = isLocked
  if isLocked {
  user.BrowserToken = MakeNullString(nil)
- err := app.InvalidateUser(user)
+ err := app.InvalidateUser(db, user)
  if err != nil {
  return err
  }

front_test.go

@@ -1195,6 +1195,9 @@ func (ts *TestSuite) testAdmin(t *testing.T) {
  otherUsername := "adminOther"
  otherBrowserTokenCookie := ts.CreateTestUser(ts.Server, otherUsername)
 
+ anotherUsername := "adminAnother"
+ _ = ts.CreateTestUser(ts.Server, anotherUsername)
+
  // Make `username` an admin
  var user User
  result := ts.App.DB.First(&user, "username = ?", username)
@@ -1214,12 +1217,14 @@ func (ts *TestSuite) testAdmin(t *testing.T) {
  assert.Equal(t, returnURL, rec.Header().Get("Location"))
  }
 
- // Make `otherUsername` an admin and lock their account
+ // Make `otherUsername` and `anotherUsername` admins and lock their accounts
  form := url.Values{}
  form.Set("returnUrl", returnURL)
  form.Set("admin-"+username, "on")
  form.Set("admin-"+otherUsername, "on")
  form.Set("locked-"+otherUsername, "on")
+ form.Set("admin-"+anotherUsername, "on")
+ form.Set("locked-"+anotherUsername, "on")
  rec := ts.PostForm(t, ts.Server, "/drasl/admin/update-users", form, []http.Cookie{*browserTokenCookie}, nil)
 
  assert.Equal(t, http.StatusSeeOther, rec.Code)