feat(session): add session removal endpoint and refactor session management

- Implement new `/sessionMgr/remove` endpoint for superusers to remove sessions
- Refactor session and token management to use sessionTokenMap for better tracking
- Update session cleanup logic to handle both tokens and sessions
- Add documentation for new API endpoint in docs/api.md
- Modify logout handler to use new session removal approach

userAct.go

@@ -28,6 +28,10 @@ type RemoveUserRequest struct {
 	TargetUserID int `json:"targetUserID"`
 }
 
+type RemoveSessionRequest struct {
+	SessionID string `json:"sessionID"`
+}
+
 func RegisterHandler(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
@@ -195,7 +199,23 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := RemoveSession(userID, r.Header.Get("X-Token")); err != nil {
+	sessionTokenMux.RLock()
+	sessionID := ""
+	for sid, token := range sessionTokenMap {
+		if token == r.Header.Get("X-Token") {
+			sessionID = sid
+			break
+		}
+	}
+	sessionTokenMux.RUnlock()
+
+	if sessionID == "" {
+		SendErrorResponse(w, http.StatusNotFound, "Session not found for token")
+		postLog.Warning(fmt.Sprintf("[LogoutHandler] Session not found for token from user [%d]%s", userID, GetUsernameByID(userID)))
+		return
+	}
+
+	if err := RemoveSession(sessionID); err != nil {
 		SendErrorResponse(w, http.StatusInternalServerError, "Failed to logout")
 		postLog.Error(fmt.Sprintf("[LogoutHandler] Failed to logout user [%d]%s: %v", userID, GetUsernameByID(userID), err))
 		return
@@ -205,6 +225,63 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
 	postLog.Info(fmt.Sprintf("[LogoutHandler] User [%d]%s Logout successful", userID, GetUsernameByID(userID)))
 }
 
+func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+		postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid request method: %s", r.Method))
+		return
+	}
+
+	if !ValidateTimeStamp(r.Header) {
+		SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
+		postLog.Warning("[RemoveSessionHandler] Invalid or missing X-Timestamp in header")
+		return
+	}
+
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		SendErrorResponse(w, http.StatusBadRequest, "Failed to read request body")
+		postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Failed to read request body: %v", err))
+		return
+	}
+	defer r.Body.Close()
+
+	var req RemoveSessionRequest
+	if err := json.Unmarshal(body, &req); err != nil {
+		SendErrorResponse(w, http.StatusBadRequest, "Invalid request format")
+		postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid request format: %v", err))
+		return
+	}
+
+	if req.SessionID == "" {
+		SendErrorResponse(w, http.StatusBadRequest, "SessionID is required")
+		postLog.Warning("[RemoveSessionHandler] SessionID is empty")
+		return
+	}
+
+	userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
+	if err != nil {
+		SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
+		postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid or missing token: %v", err))
+		return
+	}
+
+	if err := CheckPermission(userID, "superuser"); err != nil {
+		SendErrorResponse(w, http.StatusForbidden, "Permission denied")
+		postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Permission denied for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
+		return
+	}
+
+	if err := RemoveSession(req.SessionID); err != nil {
+		SendErrorResponse(w, http.StatusInternalServerError, fmt.Sprintf("Failed to remove session: %v", err))
+		postLog.Error(fmt.Sprintf("[RemoveSessionHandler] Failed to remove session %s: %v", req.SessionID, err))
+		return
+	}
+
+	postLog.Info(fmt.Sprintf("[RemoveSessionHandler] User [%d]%s removed session %s", userID, GetUsernameByID(userID), req.SessionID))
+	SendSuccessResponse(w, "Session removed successfully", nil)
+}
+
 func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")