Ask for authentication before removing 'Device & Sessions'

[javielico]

Describe the solution you'd like
As user
I want to make sure that when I remove a device or session from my NextCloud account I'm prompted to authenticate with my password
So that if my account is compromised no one can remove access without the original password

Additional context
I think this feature could help prevent users that leave their account open in a shared device from other users de-authenticating them from their devices and therefore loosing access.

[joshtrichards]

To implement this I believe changes are required in two spots:

Add a confirmPassword() call here:

server/apps/settings/src/store/authtoken.ts

Lines 104 to 110 in 7395211

	async deleteToken(token: IToken) {
	logger.debug('Deleting app token', { token })
	this.tokens = this.tokens.filter(({ id }) => id !== token.id)
	try {
	await axios.delete(`${BASE_URL}/${token.id}`)

It can be modeled after the one used for wipeToken():

server/apps/settings/src/store/authtoken.ts

Lines 126 to 137 in 7395211

	async wipeToken(token: IToken) {
	logger.debug('Wiping app token', { token })
	try {
	await confirmPassword()
	if (!(await confirm())) {
	logger.debug('Wipe aborted by user')
	return
	}
	await axios.post(`${BASE_URL}/wipe/${token.id}`)

And in the controller the @PasswordConfirmationRequired (docs) annotation added. I believe here:

server/apps/settings/lib/Controller/AuthSettingsController.php

Lines 171 to 178 in 7395211

	/**
	* @NoAdminRequired
	* @NoSubAdminRequired
	*
	* @param int $id
	* @return array|JSONResponse
	*/
	public function destroy($id) {

Similar to here:

server/apps/settings/lib/Controller/AuthSettingsController.php

Lines 278 to 288 in 7395211

	/**
	* @NoAdminRequired
	* @NoSubAdminRequired
	* @PasswordConfirmationRequired
	*
	* @param int $id
	* @return JSONResponse
	* @throws InvalidTokenException
	* @throws ExpiredTokenException
	*/
	public function wipe(int $id): JSONResponse {

It might be a good idea to add it to the update() / updateToken() too since I believe Allow filesystem access flows through there to prevent disabling that on an existing session/token.

[XxTysweezyxX]

I'd like to work on this issue if possible