docs: reorder & testing

backend/internal/user/sanction.go

@@ -77,14 +77,13 @@ func (s *Service) ApplySanction(ctx context.Context, input ApplySanctionInput) (
 
 	flipPermanent := input.SanctionCode == SanctionCodePermanentBlock
 	if err := s.deps.Store.ApplySanctionTx(ctx, sanctionInsert{
-		UserID: input.UserID,
-		SanctionCode: input.SanctionCode,
-		Scope: input.Scope,
-		ReasonCode: input.ReasonCode,
-		ActorType: input.Actor.Type,
-		ActorID: input.Actor.ID,
-		AppliedAt: now,
-		ExpiresAt: expiresAt,
+		UserID:        input.UserID,
+		SanctionCode:  input.SanctionCode,
+		Scope:         input.Scope,
+		ReasonCode:    input.ReasonCode,
+		Actor:         input.Actor,
+		AppliedAt:     now,
+		ExpiresAt:     expiresAt,
 		FlipPermanent: flipPermanent,
 	}); err != nil {
 		if errors.Is(err, ErrAccountNotFound) {
@@ -94,7 +93,7 @@ func (s *Service) ApplySanction(ctx context.Context, input ApplySanctionInput) (
 	}
 
 	if flipPermanent {
-		if err := s.cascadePermanentBlock(ctx, input.UserID); err != nil {
+		if err := s.cascadePermanentBlock(ctx, input.UserID, input.Actor, input.ReasonCode); err != nil {
 			s.deps.Logger.Warn("permanent-block cascade returned error",
 				zap.String("user_id", input.UserID.String()),
 				zap.Error(err),
@@ -117,10 +116,15 @@ func validateSanctionCode(code string) error {
 // lobby on-user-blocked hook. Both calls are best-effort — they run
 // after the database commit and only join errors for the caller to
 // log.
-func (s *Service) cascadePermanentBlock(ctx context.Context, userID uuid.UUID) error {
+func (s *Service) cascadePermanentBlock(ctx context.Context, userID uuid.UUID, actor ActorRef, reasonCode string) error {
 	var joined error
 	if s.deps.SessionRevoker != nil {
-		if err := s.deps.SessionRevoker.RevokeAllForUser(ctx, userID); err != nil {
+		revokeActor := SessionRevokeActor{
+			Kind:   SessionRevokeActorAdminSanction,
+			ID:     actor.ID,
+			Reason: SanctionCodePermanentBlock + ":" + reasonCode,
+		}
+		if err := s.deps.SessionRevoker.RevokeAllForUser(ctx, userID, revokeActor); err != nil {
 			joined = errors.Join(joined, fmt.Errorf("session revoke: %w", err))
 		}
 	}