Should there be an interface for identifying the current session?

[fdr]

When handling expiry of sessions upon user credential change, someone noted it would be nice if the current session doing the change was not terminated. To implement it, a small amount of duplicated code from Rodauth's internals seemed the most concise way to do it:

ubicloud/ubicloud#1226

But, it's slightly unsatisfying. Did we miss a trick? Is there an interface somewhere?

[jeremyevans]

No, there isn't a current API for this, but I agree one would be useful. We generally avoid modifying existing configuration methods, so adding one like remove_all_active_sessions_except_current seems best. I'd be open to a configuration method to enable hooks for removing other active sessions on change to login/password. We should also consider how to handle reset password and unlock account (probably just remove all if autologin is not enabled, and remove all except current if autologin is enabled).

[fdr]

I don't have a strong opinion, is the idea you'd clean up our code by packaging it all as one thing? Seems neat, although at some point we will probably want to implement a session lister/manager and knowing the current session might be useful, coupling the exclusion of the current session into the removal code would not offer flexibility to this case.

.... you could offer both, too, sparing extra code for projects that want to implement things that way.

[jeremyevans]

Something like remove_all_active_sessions_except_for(session_id) would be fine, and implementing remove_all_active_sessions_except_current in using it. Not sure when I'd have time to work on this, so if you could submit a pull request for it, that would certainly speed things up.

[jeremyevans]

I implemented this in d2ec93b

[fdr]

One of these days...one of us will get to this kind of thing first. Thank you. For what it's worth, I'll be spending some time discussing Roda at a Ruby San Francisco meetup soon.

[jeremyevans]

Awesome. I hope it goes well.

[enescakir]

Hi @jeremyevans, thanks for adding remove_all_active_sessions_except_current helper. I invoked this helper in the after_reset_password, after_change_password, and after_verify_login_change methods to expire sessions when the user changes their credentials. However, I observed another issue. Since the user isn't logged in during after_reset_password, the session_value is empty. As active_sessions_ds relies on session_value, no active sessions are cleared due to its emptiness.
https://github.com/jeremyevans/rodauth/blob/master/lib/rodauth/features/active_sessions.rb#L201

account_id has a value even when the user isn't logged in. What are your thoughts on using account_id instead of session_value in the active_sessions_ds? What's the contextual difference between account_id and session_value?

[jeremyevans]

session_value is the id of the logged in user. account_id is the id of the user related to the request. Since Rodauth deals with requests both for logged in users and for not-logged in users, there is a difference.

In this case, it should be safe to fallback to account_id if session_value is not set:

diff --git a/lib/rodauth/features/active_sessions.rb b/lib/rodauth/features/active_sessions.rb
index eb051a8..49ed05d 100644
--- a/lib/rodauth/features/active_sessions.rb
+++ b/lib/rodauth/features/active_sessions.rb
@@ -198,7 +198,7 @@ module Rodauth
 
     def active_sessions_ds
       db[active_sessions_table].
-        where(active_sessions_account_id_column=>session_value)
+        where(active_sessions_account_id_column=>session_value||account_id)
     end
 
     def use_date_arithmetic?

That passes specs. Any chance you could submit a PR that adds a spec that fails without it?

[enescakir]

I submitted a PR for it: #401. I wrote a spec that's similar to our use-case. I'm unsure if I can write a more compact test.

It fails without fallback: https://github.com/enescakir/rodauth/actions/runs/8457858204
It passes with fallback: https://github.com/enescakir/rodauth/actions/runs/8457870302