element-hq / element-hq/element-x-android

Properly handle "external" sign out.

Open
#1,154 0 comments 1 reaction 1 assignee Claimed by @bmarty View on GitHub
A-Session Lifecycle O-Occasional S-Minor T-Enhancement
Dominant language
Kotlin
Stars
2.4k
Forks
624
Avg merge
1d 14h
Merged PRs (30d)
149

Description

When the session is deleted by another device, or by the OIDC session manager, the access token becomes invalid, and the SDK calls the `didReceiveAuthError` function.
Currently, when this occurs, the application simply erase all the data related to the session and display the first screen to the user.

When this occurs, the application should display a screen explaining why the session is no more valid, and give a way to recover.

- If `isSoftLogout` is set to `false` (classical session deletion), all the session data must be deleted immediately (for security reason), and this new screen could give a way to sign in again (using the same homeserver or not), or to cancel to go back to the first displayed screen (like after a fresh install)
- If `isSoftLogout` is set to `true`, it mean that the session is not fully deleted on the homeserver, but the user has to enter their credentials again to be able to use this session again. The screen must offer to option: sign in again, or cancel. When cancel is chosen, all the session data can be deleted and the first screen of the app is displayed.

For information, this is the screens we have on Element Android:

|Signed Out|Soft Logout (from [this PR](https://github.com/vector-im/element-android/pull/5398))|
|-|-|
|image|image|

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.