I have an app that uses JWT tokens for user authorization. Now, I need to be capable of deactivating users (users won't be allowed to use the system but still exist in the database), but as a requirement for that, I need to know if the user is not logged in. Is there some kind of best practice for handling this kind of scenario?
Example: admin gets a list of users -> admin selects one user to deactivate -> the server checks if the user to be deactivated is not logged in -> if it is, don't deactivate and return an error to admin, else, deactivate and return success to admin.
The way I thought about doing this was using a smaller expiration time for the token (to be refreshed) and store the last one generated in the user's table so that I can check (with the expiration) if there has been a recent user activity.
Update: Every time a user logs in a new token is generated. There is a logout option, it blacklists the user's token so that it can't be used again.