Logout existing sessions after an auth config change

[Func86]

Closes #18443.

[Chocobo1]

@Func86
I think the current state of the PR is the wrong approach.

You should invoke logoutAllSessions() in if (hasKey(u"web_ui_username"_s)) and if (hasKey(u"web_ui_password"_s)) in appcontroller.cpp. And in if (const QString username = webUIUsername(); isValidWebUIUsername(username)) & if (const QString password = webUIPassword(); isValidWebUIPassword(password)) in optionsdialog.cpp
And you should not bother to check the previous value, just invoke logoutAllSessions() within the if block.

UPDATE, disregard the above. It should be done in WebUI::configure() instead. This is where the server updates the configuration.

[glassez]

UPDATE, disregard the above. It should be done in WebUI::configure() instead. This is where the server updates the configuration.

The same as currently. WebUI will have to store the previous username/password values to detect that they have changed.

[Chocobo1]

The same as currently. WebUI will have to store the previous username/password values to detect that they have changed.

I think the following should work:

1. add a new signal Preferences::webCredentialsChanged()
2. the new signal will be emitted when the webui username updated or password hash updated. (no need to compare to the old value, just emit the signal)
3. WebApplication will connect to the signal and remove all sessions when receiving the signal.

[glassez]

I think the following should work:

1. add a new signal Preferences::webCredentialsChanged()
2. the new signal will be emitted when the webui username updated or password hash updated. (no need to compare to the old value, just emit the signal)
3. WebApplication will connect to the signal and remove all sessions when receiving the signal.

It could do the job.

Closes #18443.

It also mentions some other settings besides the username and password, changing which should lead to the termination of sessions.

How about it?

[Func86]

It also mentions some other settings besides the username and password, changing which should lead to the termination of sessions.

How about it?

Done.

[Chocobo1]

Suggested change

	if (m_credentialsChanged)
	emit webCredentialsChanged();
	if (m_credentialsChanged)
	{
	emit webCredentialsChanged();
	m_credentialsChanged = false;
	}

[Chocobo1]

Do you still need the changes in isessionmanager.h after applying the above suggestions?

[Func86]

Do you still need the changes in isessionmanager.h after applying the above suggestions?

What? The change in isessionmanager.h is for terminating sessions which bypassed authentication when the bypass is disabled or changed to possibly stricter than before.

[Chocobo1]

The change in isessionmanager.h is for terminating sessions which bypassed authentication when the bypass is disabled or changed to possibly stricter than before.

Why not just remove all sessions unconditionally when the option changed?

[Func86]

I think it would be surprising for users with authenticated sessions to find they are logged out after changing these options.

By the way, we may want to disallow unauthenticated sessions to change the username/password.

[Chocobo1]

The change in isessionmanager.h is for terminating sessions which bypassed authentication when the bypass is disabled or changed to possibly stricter than before.

Why not just remove all sessions unconditionally when the option changed?