Merge pull request #4021 from lchaglla/preserveAccessTokens

Add a flag to preserve access tokens on email/password change

common/models/user.js

@@ -1385,6 +1385,8 @@ module.exports = function(User) {
 
     if (!newEmail && !newPassword) return next();
 
+    if (ctx.options.preserveAccessTokens) return next();
+
     var userIdsToExpire = ctx.hookState.originalUserData.filter(function(u) {
       return (newEmail && u.email !== newEmail) ||
         (newPassword && u.password !== newPassword);

test/user.test.js

@@ -2755,6 +2755,17 @@ describe('User', function() {
       ], done);
     });
 
+    it('keeps sessions sessions when preserveAccessTokens is passed in options', function(done) {
+      user.updateAttributes(
+        {email: 'invalidateAccessTokens@example.com'},
+        {preserveAccessTokens: true},
+        function(err, userInstance) {
+          if (err) return done(err);
+          assertPreservedTokens(done);
+        }
+      );
+    });
+
     it('preserves other users\' sessions if their email is  untouched', function(done) {
       var user1, user2, user3;
       async.series([