Account lifecycle

a, err := theauth.New(theauth.Config{
    // ...your existing config
    AccountState:    true,
    AccountDeletion: &theauth.AccountDeletionConfig{RecentAuthMaxAge: 10 * time.Minute},
    SessionPolicy:   &theauth.SessionPolicy{MaxConcurrentSessions: 5, Overflow: theauth.SessionEvictOldest},
    TrustedDevices:  &theauth.TrustedDevicesConfig{TTL: 30 * 24 * time.Hour},
})

// Flag an account so the next sign-in has to be preceded by a reset.
err := a.SetMustChangePassword(ctx, userID, true)

// Or reset the password as an admin and require the user to choose a new one.
err = a.ResetPasswordAdmin(ctx, "ada@example.com", tempPassword, theauth.RequirePasswordChange())

err := a.DisableUser(ctx, userID) // sign-in returns CodeAccountDisabled
err = a.EnableUser(ctx, userID)   // lifts the block

err = a.DeleteUser(ctx, userID)   // removes the user and everything that hangs off it

SessionPolicy: &theauth.SessionPolicy{
    MaxConcurrentSessions: 3,
    Overflow:              theauth.SessionReject, // or SessionEvictOldest (default)
}

devices, err := a.ListTrustedDevices(ctx, userID)
err = a.RevokeTrustedDevice(ctx, userID, devices[0].ID)
n, err := a.RevokeTrustedDevices(ctx, userID) // returns how many it removed

tok, err := a.GetProviderToken(ctx, userID, "google")
if err != nil {
    switch {
    case errors.Is(err, theauth.ErrProviderNotLinked):
        // the user never linked this provider
    case errors.Is(err, theauth.ErrProviderGrantRevoked):
        // the provider rejected the refresh token, send the user through consent again
    case errors.Is(err, theauth.ErrProviderRefreshUnsupported):
        // this provider cannot refresh, the stored token may simply be stale
    }
    return err
}
req.Header.Set("Authorization", "Bearer "+tok.AccessToken)