We need to implement an administrative feature that allows authorized admin staff to revoke a user’s Personal Access Token (PAT) in cases where it has been reported or detected as publicly leaked.

When a PAT is revoked by an admin:

• The system should immediately invalidate the token to prevent further use.
• An automated email notification should be sent to the affected user, informing them that their PAT was revoked and advising them to generate a new one.

Use Case

This feature would help us respond quickly to security incidents, ensuring compromised tokens cannot be used maliciously while keeping users informed of the action taken.

Acceptance Criteria

• Admins can revoke PATs for specific users via the admin panel.
• Revoked tokens are immediately invalidated.
• Users receive an automated email notification upon revocation.
• All actions are logged for auditing purposes.