How to delete session for specific user in cakePHP3? - php

Question

What I need to achieve is to have the possiblility for administrator to remove session of given user to force relogin. This can come in handy when for example user permissions changes. How to bind session and user together so other user can access that data?
I am using database session store so removing record from the database would result in force relogin. Also authentication is based on Auth component.
Here is some of my related config:
$this->loadComponent('Auth', [
'loginAction' => [
'controller' => 'Auth',
'action' => 'login'
],
'loginRedirect' => "/home",
'logoutRedirect' => [
'controller' => 'Auth',
'action' => 'login'
],
'authError' => "You have no permissions to access resource ${url}. Contact system administrator.",
'storage' => 'Session',
'authenticate' => [
'Form' => [
'userModel' => 'User',
'finder' => 'user',
'fields' => ['username' => 'name', 'password' => 'password']
]
],
'authorize' => ["Controller"]
]);
And session storage:
'Session' => [
'defaults' => 'database',
]
Below I have marked where would i place database update code. Unfortunetly after login execution, session gets "revalidated" so the ID changes. All in all, changes made in login action are not visible after redirect.
Login action:
public function login()
{
$form = new LoginForm();
if ($this->request->is('post')) {
if ($form->validate($this->request->data)) {
$user = $this->Auth->identify();
if ($user) {
$this->Auth->setUser($user);
// here would be good place to update the database
return $this->redirect($this->Auth->redirectUrl());
} else {
$this->Flash->error("Invalid security credentials provided");
}
} else {
$this->Flash->error("Invalid login form");
}
}
$this->set('loginForm', $form);
}

Answer 1

#ndm Thanks for valuable comments and pinpoints.
Thank to #ndm's comments I have found (most probably) viable solution. I had to inject some code into session data save process. To do that, I have used custom SessionHandler and PHP's Cloasure in role of callback.
class UserSession extends DatabaseSession
{
public $callback;
public function write($id, $data)
{
$result = parent::write($id, $data);
if ($this->callback) {
call_user_func($this->callback,$id);
}
return $result;
}
}
and the login action
$user = $this->Auth->identify();
if ($user) {
$this->Auth->setUser($user);
/** #var UserTable $model */
$model = $this->loadModel("User");
$handler = $this->Session->engine();
/** #var UserSession $handler */
$handler->callback = function ($id) use ($model, $user) {
$model->updateSession($id, $user['id']);
};
return $this->redirect($this->Auth->redirectUrl());
}
This way, the session row in the DB is updated AFTER session data is flushed into the DB.
Now I can query all sessions for given user, and delete them if needed forcing relogin for that user. Callback is called only once upon user login, whitch was as well my goal in matter of optimalization and avoidance of UPDATE query db during every http request (because that would be the solution as well, but I wanted to avoid that)