Admin/Selfservice session management

[zepatrik]

Is your feature request related to a problem? Please describe.

There are a few things we need for session management. See also #615

Describe the solution you'd like

Selfservice:

• List all my sessions
• View one of my sessions
• Revoke one of my sessions

Admin:

• List an identity's sessions
• View an identity's sessions
• Delete one or all identity's sessions

[aeneasr]

Is your feature request related to a problem? Please describe.

We need a couple of endpoints to allow us to manage an identity's session.

Describe the solution you'd like

• we need a global sessions API that allows us to list all sessions (with pagination!) GET /sessions at the admin endpoint.
• we must be able to get a specific session GET /sessions/<id> and also delete/revoke a session DELETE /sessions/<id>
• We should be able to see an identity's sessions (again at the admin endpoint) GET /identities/<id>/sessions

Additional context

These endpoints are needed to display and manage user sessions in the Ory Console.

[danthegoodman1]

Would love to see this soon. Once this is in I think I will feel comfortable switching to Ory!

[danthegoodman1]

Is your feature request related to a problem? Please describe.

We need a couple of endpoints to allow us to manage an identity's session.

Describe the solution you'd like

• we need a global sessions API that allows us to list all sessions (with pagination!) GET /sessions at the admin endpoint.
• we must be able to get a specific session GET /sessions/<id> and also delete/revoke a session DELETE /sessions/<id>
• We should be able to see an identity's sessions (again at the admin endpoint) GET /identities/<id>/sessions

Additional context

These endpoints are needed to display and manage user sessions in the Ory Console.

It would also be nice if there was an endpoint to handle deleting all sessions for a single identity, rather than having to list them all then delete one by one, to serve as a "log out everywhere". Maybe DELETE /identities/<id>/sessions?

@aeneasr @Benehiko

[zepatrik]

Self-service API Design Proposal

With the route we have the "problem" that we can't use /sessions/:id because that conflicts with the existing /sessions/whoami. IMO it makes a lot of sense to distinguish between the current session and all other sessions. Therefore I propose to use /sessions/others/:id as the base path.

1. List other sessions:

// swagger:parameters publicListOtherSessions
// nolint:deadcode,unused
type publicListOtherSessions struct {
	x.PaginationParams
}

// swagger:model publicListOtherSessionsResponse
// nolint:deadcode,unused
type publicListOtherSessionsResponse struct {
	// List of all other sessions.
	//
	// in: body
	Sessions []*Session `json:"sessions"`
}

// swagger:route GET /sessions/others v0alpha2 publicListOtherSessions
//
// This endpoints returns all other active sessions that belong to the logged-in user.
// The current session can be retrieved by calling the `/sessions/whoami` endpoint.
//
// This endpoint is useful for:
//
// - Displaying all other sessions that belong to the logged-in user
//
//     Schemes: http, https
//
//     Responses:
//       200: publicListOtherSessionsResponse
//       400: jsonError
//       401: jsonError
//       404: jsonError
//       500: jsonError

2. Revoke other sessions:

// swagger:model publicRevokeMySessionsResponse
type revokeMySessionsResponse struct {
	NumberRevokedSessions int `json:"number_revoked_sessions"`
}

// swagger:route DELETE /sessions/others v0alpha2 publicRevokeOtherSessions
//
// Calling this endpoint invalidates all except the current session that belong to the logged-in user.
// Session data are not deleted.
//
// This endpoint is useful for:
//
// - To forcefully logout the current user from all other devices and sessions
//
//     Schemes: http, https
//
//     Responses:
//       204: publicRevokeMySessionsResponse
//       400: jsonError
//       401: jsonError
//       404: jsonError
//       500: jsonError

3. Revoke specific other session will be similar to revoking all, except that it has the path /sessions/others/:id and only revokes the specified one (which has to differ from the current session).

Revoking the current session is equal to the logout functionality and therefore not part of this API.

Deletion of sessions is also not part of this API. Instead, old sessions are kept for auditing until they will be eventually cleaned (same problem as expired flows). Self-service only ever works with active sessions.