[PR #7047] [MERGED] Fix logout push identifiers and send logout before clearing devices #12769

New Issue

GiteaMirror · 2026-04-20T15:59:20-05:00

GiteaMirror commented

2026-04-20 15:59:20 -05:00

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/7047
Author: @qaz741wsd856
Created: 4/1/2026
Status: ✅ Merged
Merged: 4/5/2026
Merged by: @dani-garcia

Base: main ← Head: fix-logout-push

📝 Commits (4)

235c4ca Fix logout push identifiers and send logout before clearing devices
1b174b9 Merge branch 'main' into fix-logout-push
17bb86d Refactor logout function parameters
295a454 Fix parameters in logout notification functions

📊 Changes

4 files changed (+15 additions, -14 deletions)

View changed files

📝 src/api/admin.rs (+2 -1)
📝 src/api/core/accounts.rs (+5 -4)
📝 src/api/notifications.rs (+4 -3)
📝 src/api/push.rs (+4 -6)

📄 Description

This fixes two issues in the logout push flow.

push_logout() currently sends the acting device UUID in both deviceId and identifier. That does not match the other push entry points, where deviceId is the push UUID and identifier is the device UUID.
post_sstamp() and disable_user() delete all devices before calling send_logout(). Since check_user_has_push_device() filter was introduced in #3578, those flows will always skip the push because the device lookup returns false after the delete.

This patch:

passes the acting Device through send_logout() into push_logout()
sends logout pushes with deviceId = device.push_uuid and identifier = device.uuid
moves Device::delete_all_by_user() in post_sstamp() and disable_user() to after logout sending
leaves deauth_user() unchanged, because it already sends the logout notification before deleting devices

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/7047 **Author:** [@qaz741wsd856](https://github.com/qaz741wsd856) **Created:** 4/1/2026 **Status:** ✅ Merged **Merged:** 4/5/2026 **Merged by:** [@dani-garcia](https://github.com/dani-garcia) **Base:** `main` ← **Head:** `fix-logout-push` --- ### 📝 Commits (4) - [`235c4ca`](https://github.com/dani-garcia/vaultwarden/commit/235c4ca0dcd6e0d7af7485b204046ee0fca484f4) Fix logout push identifiers and send logout before clearing devices - [`1b174b9`](https://github.com/dani-garcia/vaultwarden/commit/1b174b9b406273d57bf320fd5bd2dd1d6f7f6c59) Merge branch 'main' into fix-logout-push - [`17bb86d`](https://github.com/dani-garcia/vaultwarden/commit/17bb86dbbc42aeb6d4ce8576d33e21ea6b6407df) Refactor logout function parameters - [`295a454`](https://github.com/dani-garcia/vaultwarden/commit/295a45462b74587db502f103b4d72f36be289c0d) Fix parameters in logout notification functions ### 📊 Changes **4 files changed** (+15 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `src/api/admin.rs` (+2 -1) 📝 `src/api/core/accounts.rs` (+5 -4) 📝 `src/api/notifications.rs` (+4 -3) 📝 `src/api/push.rs` (+4 -6) </details> ### 📄 Description This fixes two issues in the logout push flow. 1. `push_logout()` currently sends the acting device UUID in both `deviceId` and `identifier`. That does not match the other push entry points, where `deviceId` is the push UUID and `identifier` is the device UUID. 2. `post_sstamp()` and `disable_user()` delete all devices **before** calling `send_logout()`. Since `check_user_has_push_device()` filter was introduced in #3578, those flows will always skip the push because the device lookup returns `false` after the delete. This patch: - passes the acting `Device` through `send_logout()` into `push_logout()` - sends logout pushes with `deviceId = device.push_uuid` and `identifier = device.uuid` - moves `Device::delete_all_by_user()` in `post_sstamp()` and `disable_user()` to after logout sending - leaves `deauth_user()` unchanged, because it already sends the logout notification before deleting devices --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-20 15:59:21 -05:00

GiteaMirror closed this issue

2026-04-20 15:59:23 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#12769