Fix/unable to logout

[GigaGiorgadze]

this is follow up to previous pull request

Issue description

AuthenticateSession middleware sets password hash in session after request is sent but uses user from request, this results password hash not being removed from the session after loggout.
this does not cause user to be counted as authenticated but in case user tries to log in with different user following request will return 401 because passwords do not match.

how to replicate

i created two repositories for this, to replicate all u have to do is configure them locally according to readme. back and front. after installing this you you should go in frontend and click buttons in following order: "login gmail", "fetch me", "logout", "login redberry", "fetch me". this last request from frontend will fail without this fix. here is video:

simplescreenrecorder-2024-04-06_14.48.30.mp4

why it does not break any existing features

all previous tests are passing and all i changed was place of getting user, meaning i changed getting user from request to getting them from auth() guard which is up to date after log out.

tests

i added one test case in FrontendRequestsAreStatefulTest which verifies that password_hash_web is removed if user was logged out during that request and is set if user was not logged out during that request.

without fix implemented this line fails:

$this->getJson('/sanctum/api/logout', [
            'origin' => config('app.url'),
        ])->assertOk()->assertSee('logged out')->assertSessionMissing('password_hash_web');

[taylorotwell]

@GigaGiorgadze Why are you using the global auth helper if you already have an AuthFactory instance injected into the middleware? Please mark as ready for review when you want me to look again.

[GigaGiorgadze]

@GigaGiorgadze Why are you using the global auth helper if you already have an AuthFactory instance injected into the middleware? Please mark as ready for review when you want me to look again.

@taylorotwell no reason besides the fact that i did not notice 😓. i changed to using injected auth factory, so i will reopen, let me know if anything else seems off ^^

[taylorotwell]

Sanctum can be configured to attempt to use an array of guards to authenticate users. How do you know the first guard in the list is the one that actually was used and is the one that has the user?

[GigaGiorgadze]

good point 👀. i did not give it much thought since it was like that before. i rewrote it to getting first guard that user is authenticated with.