Allow expired accounts to logout (#7443)

This commit is contained in:
Andrew Morgan 2020-05-14 16:32:49 +01:00 committed by GitHub
parent 4734a7bbe4
commit 225c165087
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 140 additions and 22 deletions

View file

@ -34,10 +34,10 @@ class LogoutRestServlet(RestServlet):
return 200, {}
async def on_POST(self, request):
requester = await self.auth.get_user_by_req(request)
requester = await self.auth.get_user_by_req(request, allow_expired=True)
if requester.device_id is None:
# the acccess token wasn't associated with a device.
# The access token wasn't associated with a device.
# Just delete the access token
access_token = self.auth.get_access_token_from_request(request)
await self._auth_handler.delete_access_token(access_token)
@ -62,7 +62,7 @@ class LogoutAllRestServlet(RestServlet):
return 200, {}
async def on_POST(self, request):
requester = await self.auth.get_user_by_req(request)
requester = await self.auth.get_user_by_req(request, allow_expired=True)
user_id = requester.user.to_string()
# first delete all of the user's devices