thunderbird_accounts.authentication.sessions

Keycloak session handling for the security settings views.

Functions

current_session_id(request)	The Keycloak session id behind the request's own sign-in, read from its access token.
mark_current_session(request, sessions)	Modify sessions list to mark current one with is_current key
revoke_connected_app_access(request, ...)	Disconnect an app on every device.
sign_out_keycloak_session(request, ...)	Sign out one Keycloak session, flushing the Django session too when it is the current one.

thunderbird_accounts.authentication.sessions.current_session_id(request: Request) → str | None

The Keycloak session id behind the request’s own sign-in, read from its access token.

thunderbird_accounts.authentication.sessions.mark_current_session(request: Request, sessions: list[dict]) → list[dict]

Modify sessions list to mark current one with is_current key

thunderbird_accounts.authentication.sessions.sign_out_keycloak_session(request: Request, keycloak_client: KeycloakAccountClient, user_access_token: str, session_id: str) → bool

Sign out one Keycloak session, flushing the Django session too when it is the current one.

Returns whether the current session was signed out. Ids outside Keycloak’s alphabet are rejected before they are interpolated into the Account API path.

thunderbird_accounts.authentication.sessions.revoke_connected_app_access(request: Request, keycloak_client: KeycloakAccountClient, user_access_token: str, client_id: str) → bool

Disconnect an app on every device.

Revoking the client’s consent drops its offline tokens but leaves any browser sign-in the app came from alive, and that sign-in can hand the app a new offline token without showing a login form. Every Keycloak session that holds a client session for the app is therefore signed out as well. Returns whether the request’s own session was among them; the caller’s Django session is flushed in that case.