# `Macaw.Auth.Ash.AnnounceRevocation`
[🔗](https://github.com/dcoai/macaw_auth_ash/blob/v0.3.2/lib/macaw/auth/ash/announce_revocation.ex#L1)

Tells open pages of the tokens an update action revoked:
`Macaw.Auth.Ash.TokenResource` puts it on AshAuthentication's
`revoke_all_stored_for_subject`.

That action is how log-out-everywhere (and a password change with
`apply_on_password_change?`) revokes a user's tokens: a bulk update run
without notifications, so `Macaw.Auth.Ash.Notifier` never hears of it.
This change adds an after-action hook, which Ash runs for a single
update and for each record of an atomic or streamed bulk one alike, and
which hands the revoked rows to `Macaw.Auth.Ash.Notifier.announce/2`.

The hook runs inside the action's transaction, when the data layer has
one: a page could be told just before the revocation commits. Being told
early only sends a page to sign in sooner; a revocation that then rolled
back leaves the session valid, and signing in again recovers it.

---

*Consult [api-reference.md](api-reference.md) for complete listing*