Use the reviewed session contract
Driver App session management has two related but distinct workflows:
- Sessions lists and deletes current or other account sessions when the account uses the multi-session strategy.
- logout checks active orders, requests server logout, then coordinates local session, order and storage cleanup.
Neither workflow is atomic. A visible list, primary API success, local auth change or signed-out screen does not prove complete token, push, availability, log, job, socket, provider or storage cleanup.
Availability
The Sessions route is registered in authenticated navigation and opened from Profile. Accounts using the multi-session strategy can load dated session rows and current markers. Other strategy state shows an activation control instead of a list.
Prerequisites
- Authenticated self scope and current session-strategy state.
- Explicit distinction among current, other and all sessions.
- Destructive confirmation for individual and bulk deletion.
- Complete local/server/provider cleanup plan when current session is deleted.
- Active-order guard and order-owner recovery before logout.
- Synthetic session IDs/dates/tokens only in tests and documentation.
Responsibility boundaries
| Boundary | Responsibility | Limit |
|---|---|---|
| Sessions UI | Show loading/list/empty/activation, current marker and confirmations. | Presentation order is not server sort/currentness. |
| Sessions controller | List sessions, optionally sort, delete one/all/others and update local list. | Primary response and local session effects can diverge. |
| Current-session deletion | Remove row server-side then request local logout. | Local logout is not awaited in reviewed deletion handler. |
| Other-session deletion | Remove returned row from local list after primary success. | Remote device/token/provider cleanup unproven. |
| Bulk delete | Delete current+all or preserve current based on explicit input. | Confirmation closes before async handler settles. |
| Activation path | Reuse bulk contract preserving current, then locally switch strategy metadata. | Activation is not proven by button or local metadata. |
| Logout | Client active-order read, API logout, local session/order/storage cleanup. | Guard failures and cleanup can partially settle. |
| API | Enforce self/admin session access and server-side logout/order guards. | Running artifact relation remains unconfirmed. |
Inputs and result
| Input/action | Client result | Failure/partial boundary |
|---|---|---|
| Multi-session strategy | Authenticated list request, optional date sort. | App supplies no explicit sort; UI reverses the array in render and mutates presentation order. |
| Legacy/non-list strategy | Empty local list plus activation message/control. | Activation request/result and local strategy switch separate. |
| Delete other session | Confirmation, API delete, remove row locally. | Remote session/provider cleanup unproven. |
| Delete current session | API delete, remove row, request local logout. | Logout not awaited; navigation/storage can race. |
| Delete all sessions | Bulk API delete, empty list, request local logout. | Per-session/provider cleanup and local state separate. |
| Delete all except current | Bulk API delete, retain current rows locally. | Remote-session cleanup not proven; activation can reuse current token metadata. |
| logout | Active-order guard then server/local cleanup. | Guard exception can continue; broad storage clear is not awaited. |
Security and privacy
- Never expose session IDs, tokens, socket IDs, device data or exact timestamps in public artifacts.
- Require self/admin authorization on every list/delete operation.
- Treat current-session deletion and logout as security-sensitive destructive workflows with complete receipts and rollback/recovery.
- Bind late list/delete/logout responses to current account/session generation.
- Do not infer remote-session closure from a row disappearing locally.
Limits and failure states
| State | Meaning | Maintainer response |
|---|---|---|
| Loading/error | Session list/action unsettled. | No repeat/destructive action. |
| Empty list | Current response has no displayable sessions. | Not proof no remote token/session exists. |
| Current marker | API row marked current. | Verify server/session generation before deletion. |
| Row removed locally | Primary delete reported success. | Remote provider/token cleanup unproven. |
| Signed-out UI | Local auth changed. | Server/storage/push/socket cleanup unproven. |
| Sort order changes | UI reversed/mutated list during render. | Do not use order as security/currentness evidence. |
| Activation-looking state | Local strategy changed after primary response. | Server feature/current session semantics unproven. |
| Logout guard error | Active-order check failed. | Can ambiguously continue; stop and reconcile. |
Troubleshooting
Use synthetic sessions and intercepted API/session/order/storage/socket/provider adapters. Never delete a real session or logout to test. Diagnose list result, sort/presentation, primary delete, local session change, storage cleanup and provider/token cleanup as separate ledgers.
Re-review whenever session strategy, list sort, current marker, individual/bulk delete, activation, active-order guard, logout, local storage or provider cleanup changes.
Related guides: Manage sessions · Sign out · Delete account · Authenticated bootstrap · Notifications contract · Offline actions