Dentolize · Clear Push Tokens on Company Logout Walkthrough
On this page1. Settings → Security tab2. Confirming the action3. What happens on confirm

Walkthrough

The fix lives entirely behind an action that already existed, so the tour is short: this is where "Logout All Users" lives, and what happens when an owner clicks it. Nothing on screen has changed — the difference is what happens on the server afterward, which is covered in the feature breakdown.

1. Settings → Security tab

Only a user with the "Do All" (owner-level) permission sees this button. It sits at the bottom of Settings → Account → Security, below Two-Factor Authentication.

The Security settings tab, showing the
The Security settings tab, showing the "Logout All Users" button at the bottom in red

2. Confirming the action

Clicking the button opens a confirmation popover — this is a destructive, company-wide action, so it's guarded by an explicit "Yes."

Confirmation popover asking
Confirmation popover asking "Logout All Users" with Yes/No options

3. What happens on confirm

Once confirmed, the server (as of this PR):

  1. Looks up every staff user in the clinic's company.
  2. Deletes their active sessions (web and mobile) from Redis, so any signed-in

device is immediately booted to the login screen.

  1. New in this PR: clears the pushNotifications token list for every one

of those users, so none of their devices keep receiving push alerts after being logged out.

  1. Removes the matching UserSession records from the database.

The owner who triggered it is redirected to /auth/login, same as before — this fix doesn't change anything the owner sees.

The mobile app (clinic-mobile) exposes the same action from the More menu, calling the identical logoutOutAllUsers mutation — there is no separate mobile-only screenshot because the fix is server-side and behaves identically regardless of which client triggered it.