fix: only disconnect the current session on logout

Other sessions of the same user are left alive.

Author: darrachequesne

server/src/auth/logout.js

@@ -1,17 +1,22 @@
-import { logger, userRoom } from "../util.js";
+import { logger, sessionRoom } from "../util.js";
 
 export function logout({ app, io }) {
   app.post("/logout", (req, res, next) => {
+    const sessionId = req.session.id;
     const userId = req.user.id;
 
     req.logout((err) => {
       if (err) {
         return next(err);
       }
 
-      logger.info("user [%s] has logged out", userId);
+      logger.info(
+        "user [%s] has logged out from session [%s]",
+        userId,
+        sessionId,
+      );
 
-      io.in(userRoom(userId)).disconnectSockets();
+      io.in(sessionRoom(sessionId)).disconnectSockets();
 
       res.status(204).end();
     });

server/src/index.js

@@ -18,7 +18,13 @@ import { getUser } from "./user/get.js";
 import { initAuth } from "./auth/index.js";
 import { reachUser } from "./user/reach.js";
 import { searchUsers } from "./user/search.js";
-import { channelRoom, userRoom, userStateRoom, logger } from "./util.js";
+import {
+  channelRoom,
+  userRoom,
+  userStateRoom,
+  logger,
+  sessionRoom,
+} from "./util.js";
 
 const CLEANUP_ZOMBIE_USERS_INTERVAL_IN_MS = 60_000;
 
@@ -88,6 +94,7 @@ function initEventHandlers({ io, db, config }) {
     });
 
     socket.join(userRoom(socket.userId));
+    socket.join(sessionRoom(socket.request.session.id));
 
     next();
   });

server/src/util.js

@@ -42,6 +42,10 @@ export function userRoom(userId) {
   return `user:${userId}`;
 }
 
+export function sessionRoom(sessionId) {
+  return `session:${sessionId}`;
+}
+
 export function userStateRoom(userId) {
   return `user_state:${userId}`;
 }