[pcbeingused333]

CLA

• I have signed the Stream CLA (required).
• The code changes follow best practices
• Code changes are tested (add some information if not applicable)

Description of the pull request

revoke_users_token builds a partial update for each user with map, but discards the resulting array and passes an empty updates array to update_users_partial. As a result, both revoke_users_token and its single-user wrapper revoke_user_token send users: [], so no tokens are actually revoked.

Assign the mapped updates to updates so the PATCH request includes every requested user.

Testing

New offline spec spec/revoke_tokens_spec.rb (HTTP mocked, no API key needed) checks the PATCH payload for multiple users with a DateTime, one user with a string timestamp, and an empty list. On master the two non-empty cases fail because the payload is users: []; with the fix all three pass.

This change and its regression tests were prepared with OpenAI Codex.

---

Note

Medium Risk
Touches token revocation (auth-related), but the change is a minimal bug fix with new regression specs and no API surface change.

Overview
Fixes revoke_users_token (and the single-user revoke_user_token wrapper) so user token revocation actually reaches the API. Previously the method built per-user partial updates with map but left updates empty, so update_users_partial always sent users: [] and no tokens were revoked.

The change assigns the mapped array to updates, each entry setting revoke_tokens_issued_before after timestamp normalization.

Adds spec/revoke_tokens_spec.rb with mocked HTTP coverage for multi-user DateTime input, single-user string timestamps, and the empty user list case.

^{Reviewed by Cursor Bugbot for commit 60bf634. Bugbot is set up for automated code reviews on this repo. Configure here.}