Function revoke_all_for_user 

pub async fn revoke_all_for_user<S: StorageAdapter>(
    storage: &S,
    user_object_id: &str,
) -> Result<u64, ParseError>

Delete every session belonging to a user. Returns how many.

This is what a password change needs. revokeSessionOnPasswordReset defaults to true (Options/Definitions.js:584-589) and the destroy it performs is exactly this query, keyed on the user pointer with nothing else (RestWrite.js:1192-1204).

Implemented ahead of any route that reaches it, on purpose. The alternative is that DELETE /sessions/:objectId grows its own one-row delete and the password-change path grows a second, similar one later, and the two then diverge. One function, two callers.