Function revoke_refresh_tokens 

pub async fn revoke_refresh_tokens<Repo: Repository>(
    repo: &Repo,
    tenant: &TenantId,
    user_id: &str,
) -> Result<(), OperationOutcomeError>

Deletes every refresh token issued to user_id in tenant, in every project.

A password reset is how a compromised account is recovered, and a refresh token issued before it would otherwise let whoever holds it keep minting access tokens for up to twelve hours after the password changed.