From 75c592dbc051d3e2c5aaa3095f9449405ff5ce54 Mon Sep 17 00:00:00 2001 From: Leo Vasanko Date: Thu, 29 Jan 2026 22:44:22 +0000 Subject: [PATCH] Log proper action for delete_session depending on what function it performs: logout, delete_session (user's own) or admin:delete_session. --- paskia/db/operations.py | 8 +++++--- paskia/fastapi/admin.py | 2 +- paskia/fastapi/api.py | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/paskia/db/operations.py b/paskia/db/operations.py index ef940e1..02cbf16 100644 --- a/paskia/db/operations.py +++ b/paskia/db/operations.py @@ -517,16 +517,18 @@ def set_session_host(key: str, host: str, *, ctx: SessionContext | None = None) update_session(key, host=host, ctx=ctx) -def delete_session(key: str, *, ctx: SessionContext | None = None) -> None: +def delete_session( + key: str, *, ctx: SessionContext | None = None, action: str = "delete_session" +) -> None: """Delete a session. The acting user should be logged via ctx. - For user logout, pass ctx of the user's session. + For user logout, pass ctx of the user's session and action="logout". For admin terminating a session, pass admin's ctx. """ if key not in _db.sessions: raise ValueError("Session not found") - with _db.transaction("delete_session", ctx): + with _db.transaction(action, ctx): del _db.sessions[key] diff --git a/paskia/fastapi/admin.py b/paskia/fastapi/admin.py index 6e54fe6..c86781a 100644 --- a/paskia/fastapi/admin.py +++ b/paskia/fastapi/admin.py @@ -706,7 +706,7 @@ async def admin_delete_user_session( if not target_session or target_session.user_uuid != user_uuid: raise HTTPException(status_code=404, detail="Session not found") - db.delete_session(session_id, ctx=ctx) + db.delete_session(session_id, ctx=ctx, action="admin:delete_session") # Check if admin terminated their own session current_terminated = session_id == auth diff --git a/paskia/fastapi/api.py b/paskia/fastapi/api.py index 44aa314..9ebd3a1 100644 --- a/paskia/fastapi/api.py +++ b/paskia/fastapi/api.py @@ -252,7 +252,7 @@ async def api_logout(request: Request, response: Response, auth=AUTH_COOKIE): if not ctx: return {"message": "Already logged out"} with suppress(Exception): - db.delete_session(auth, ctx=ctx) + db.delete_session(auth, ctx=ctx, action="logout") session.clear_session_cookie(response) return {"message": "Logged out successfully"}