Portal: Mitarbeiter-Login gesperrt (Hinweis aufs Ticketsystem), alte Mitarbeiter-Sitzungen enden

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/support/appwriteMock.js

@@ -21,6 +21,7 @@ export async function startAppwriteMock({ schema = {} } = {}) {
   const userCalls = []
   let lastLocale = null
   let failUserLookups = false
+  let sessionDeletes = 0
 
   // Wie Appwrite (Validator UID): 'unique()' ist erlaubt, sonst [A-Za-z0-9][A-Za-z0-9._-]{0,35}
   const validDocumentId = (id) => id === 'unique()' || (typeof id === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,35}$/.test(id))
@@ -117,6 +118,13 @@ export async function startAppwriteMock({ schema = {} } = {}) {
       const project = req.headers['x-appwrite-project'] || 'x'
       return [201, { $id: `s-${user.$id}`, userId: user.$id }, { 'Set-Cookie': `a_session_${project}=${secret}; path=/; httponly` }]
     }
+    // Abmelden der eben erzeugten Sitzung (Portal-Login lehnt Mitarbeiter ab)
+    if (url.pathname === '/v1/account/sessions/current' && req.method === 'DELETE') {
+      const match = String(req.headers.cookie || '').match(/a_session_[^=]+=([^;]+)/)
+      if (!match || !sessions.delete(decodeURIComponent(match[1]))) return [401, { message: 'Unauthorized', code: 401, type: 'general_unauthorized_scope' }]
+      sessionDeletes += 1
+      return [204, null]
+    }
     if (url.pathname === '/v1/account/mfa/challenges') {
       const session = sessionOf(req)
       if (!session) return [401, { message: 'Unauthorized', code: 401, type: 'general_unauthorized_scope' }]
@@ -256,6 +264,8 @@ export async function startAppwriteMock({ schema = {} } = {}) {
     lastOtp: (userId) => [...challenges.values()].filter((c) => c.userId === userId).at(-1)?.otp || null,
     expireChallenges: () => challenges.forEach((c) => (c.expired = true)),
     mailsSent: (userId) => mails.get(userId) || 0,
+    /** Zahl der beendeten Appwrite-Sitzungen (DELETE /account/sessions/current) */
+    sessionDeletes: () => sessionDeletes,
     lastLocale: () => lastLocale,
     /** GET /v1/users/:id scheitert (503), bis wieder false gesetzt wird */
     failUserLookups: (on) => (failUserLookups = Boolean(on)),