Forget remembered browsers after RISC password reset (LG-3120)

app/services/device_tracking/forget_all_browsers.rb

@@ -2,9 +2,9 @@ module DeviceTracking
   class ForgetAllBrowsers
     attr_reader :user, :remember_device_revoked_at
 
-    def initialize(user, remember_device_revoked_at: Time.zone.now)
+    def initialize(user, remember_device_revoked_at: nil)
       @user = user
-      @remember_device_revoked_at = remember_device_revoked_at
+      @remember_device_revoked_at = remember_device_revoked_at || Time.zone.now
     end
 
     def call

app/services/reset_user_password.rb

@@ -1,22 +1,31 @@
 class ResetUserPassword
-  def initialize(user:)
+  def initialize(user:, remember_device_revoked_at: nil)
     @user = user
+    @remember_device_revoked_at = remember_device_revoked_at
   end
 
   def call
     reset_user_password
+    forget_all_browsers
     log_event
     notify_user
   end
 
   private
 
-  attr_reader :user
+  attr_reader :user, :remember_device_revoked_at
 
   def reset_user_password
     user.update!(password: SecureRandom.hex(8))
   end
 
+  def forget_all_browsers
+    DeviceTracking::ForgetAllBrowsers.new(
+      user,
+      remember_device_revoked_at: remember_device_revoked_at,
+    ).call
+  end
+
   def log_event
     UserEventCreator.new(current_user: user).
       create_out_of_band_user_event(:password_invalidated)

spec/services/reset_user_password_spec.rb

@@ -1,8 +1,11 @@
 require 'rails_helper'
 
 RSpec.describe ResetUserPassword do
-  subject(:reset_user_password) { ResetUserPassword.new(user: user) }
-  let(:user) { create(:user, :with_multiple_emails) }
+  subject(:reset_user_password) do
+    ResetUserPassword.new(user: user, remember_device_revoked_at: now)
+  end
+  let(:user) { create(:user, :with_multiple_emails, encrypted_password_digest: 30.days.from_now) }
+  let(:now) { Time.zone.now }
 
   describe '#call' do
     subject(:call) { reset_user_password.call }
@@ -23,5 +26,10 @@
       mails = ActionMailer::Base.deliveries.last(2)
       expect(mails.map(&:to).flatten).to match_array(user.email_addresses.map(&:email))
     end
+
+    it 'clears all remembered browsers by updating the remember_device_revoked_at timestamp' do
+      expect { call }.
+        to(change { user.reload.remember_device_revoked_at.to_i }.to(now.to_i))
+    end
   end
 end