Overview

What this PR does

When an account owner uses Logout All Users to force-sign-out every staff member in a clinic, Dentolize now also wipes every staff member's saved push notification tokens for that clinic. Previously it only killed their sessions.

This is a small, backend-only bug fix: 5 lines added to one file (packages/server/src/resolvers/mutations/authMutations.js). There is no new button, screen, or setting — the existing "Logout All Users" action now does one more thing behind the scenes.

The problem it fixes

Dentolize sends real-time alerts (new appointment, invoice created, task assigned, treasury transfer, and more) to staff phones as push notifications. Each staff member's phone registers a push token, which is stored on their User record and stays there independent of whether they're logged in.

"Logout All Users" is the company-wide panic button — an owner uses it when they want every device signed out of the clinic account right now (e.g. after staff turnover, a lost/shared device, or a suspected account compromise). Before this fix, that button ended every session but left every push token in place. So a phone that had just been forcibly logged out kept getting appointment reminders, invoice alerts, and task notifications from the clinic — even though nobody could open the app and see what they were about.

The fix

The logoutOutAllUsers mutation now clears the pushNotifications array for every user in the company in the same operation that kills their sessions, so no device is left listening after a company-wide logout. See the Feature breakdown page for the exact code path.

Scope

• Affects: the logoutOutAllUsers GraphQL mutation only — triggered from

clinic-web (Settings → Security tab) and the clinic-mobile "More" menu.

• Does not affect: individual/self logout (that already cleaned up its own

device's token), and does not touch patient-portal push tokens (patients have a separate pushNotifications field that this change doesn't touch).

• Unreleased: this fix has not shipped to customers yet. All screenshots

and descriptions below are from the pre-release sandbox build.