Enforce Single Session for all users

[PaulGoldschmidt]

Problem

Currently, a user can be logged in on multiple devices, yet MHC is not suited for multi-device-data-collection. Thus, need to enforce that only one device is active.

Solution

From my point of view a small function that loggs a user session into the firebase database and removes old session tokens from the database is the right approach here, happy to take other ideas into consideration @PSchmiedmayer @pauljohanneskraft.
Do we need to archive the old user sessions for some reason?

Additional context

cc @lukaskollmer

Code of Conduct

• I agree to follow this project's Code of Conduct and Contributing Guidelines

[PSchmiedmayer]

@PaulGoldschmidt: Is there a good way to actually revoke a token for a signed in device in a way that it signs them out in Firebase?

[PaulGoldschmidt]

From my research, this should be possible (there are methods stated in the firebase docs to revoke refresh tokens), although we would need additional permissions for the functions that deal with the management of the refresh tokens that are exchanged for JWT tokens.

[PSchmiedmayer]

Sounds fair, probably not the highest priority now but good to solve in the near future. Would be good to see how one could implement this in a nice way.

[PaulGoldschmidt]

Would implement this next week after closing #46 👀

[PSchmiedmayer]

Sounds good 🚀

[lukaskollmer]

we'd potentially also need some kind of mechanism for the app to handle this, since we'd need to unenroll the local study enrollment. though if the logout happens in a way that the regular SpeziFirebase events are triggered, this should not be a problem

[PaulGoldschmidt]

Also we need a path to be in the local emulator multi-user resistant / skip the deletion of the tokens entirely