Logout with hooks outside of logout route

[sterlzbd]

I was wondering if there was a standard way to logout an account that includes the before_logout and after_logout hooks from the logout plugin (mostly so that the code in active sessions will run and remove the active session from the DB). Currently I'm doing it manually with a new method that calls all the hooks in a transaction just like in the logout plugin route

def logout_with_hooks
  db.transaction do
    before_logout
    logout
    after_logout
  end
end

Is this a good way to do this? I thought there would be a logout method on InternalRequest that would run all the hooks just like the route but I didn't see it there.

[jeremyevans]

InternalRequest doesn't have a logout method, because in general, logout is designed to clear the session, and the session is stored client-side (at least in most applications).

I wouldn't have a problem adding some active_sessions methods to the internal request feature, such as remove_all_active_sessions. Is that what you are trying to do in your code?

[sterlzbd]

Basically yes except currently just with remove_current_session.

[jeremyevans]

The issue with calling remove_current_session via an internal request is you would have to specify which session is current. It's doable, but fairly clunky. If you are calling this from a logged in account, is there a reason you wouldn't just call remove_current_session directly, maybe followed by clear_session? Are there some other logout hooks you are trying to execute?

[sterlzbd]

There are the audit logging hooks but I'm not sure if we actually want to log these particular logouts.

We have a few places where we were calling logout outside of a user hitting the logout url and I want to remove their active sessions in those cases. My thinking was basically that, like calling login('password') adds an active session, calling logout would remove it. Do you think that it would make since to make active_sessions behave that way instead of it removing the active session in the before_logout hook?

[jeremyevans]

I don't want to change the default behavior of logout. First, logout is overridable by the user, and regardless of whether logout has been overridden, the logout process should result in the removal of the current active session. In general, interaction between Rodauth features happens via hooks.

You can certainly keep doing what you are doing, or you can call remove_current_session directly.

[sterlzbd]

That makes sense. Thanks for your help!