Revoke session on logout.

[danielballan]

Closes #602

In main, logging out with the Python client discards the relevant tokens, but it leaves the session open. Anyone holding a copy of the refresh token (somehow) can refresh the session and continue to use it, as long as they do so within the refresh token lifetime (days or weeks).

Now, logging out first revokes the session, such that it can not be refreshed again, and then discards the tokens. A new unit test verifies that the old refresh token cannot be reused after logout.

[dylanmcreynolds]

Just one little picky bit...

[padraic-shafer]

Would it make sense to return 409 for this case also? Session might exist, but it belongs to a different user.

tiled/tiled/server/authentication.py

Lines 931 to 936 in cfb4cf3

	if principal.uuid != session.principal.uuid:
	# TODO Add a scope for doing this for other users.
	raise HTTPException(
	404,
	detail="Sessions does not exist or requester has insufficient permissions",
	)

[danielballan]

I think 404 is right in this case. The user is providing an ID, and this follows the principle, "If this isn't yours, you're now allowed to know whether or not it exists."

[padraic-shafer]

I think 404 is right in this case. The user is providing an ID, and this follows the principle, "If this isn't yours, you're now allowed to know whether or not it exists."

Oh, right. That make sense.

[padraic-shafer]

This looks great. A couple of minor questions in the review.

[padraic-shafer]

In SQLAlchemy, is Session.add() an "upsert" operation -- it will perform INSERT or UPDATE as needed?

[danielballan]

https://docs.sqlalchemy.org/en/20/orm/session_basics.html#adding-new-or-existing-items

[danielballan]

(As usual with SQLAlchemy, the documentation is sprawling and specific things can be hard to find.)

[padraic-shafer]

This might be a moot point because it's already removed for the schema, but wanted to point out here the deprecated keyword as a possibility.

Suggested change

	@base_authentication_router.post("/logout", include_in_schema=False)
	@base_authentication_router.post("/logout", include_in_schema=False, deprecated=True)

[danielballan]

Moot but good to know about!