fix: emit event session logout before update local data

Author: ad-momo

modules/session_guard/guard.ts

@@ -467,14 +467,6 @@ export class SessionGuard<
       }
     }
 
-    /**
-     * Update local state
-     */
-    this.user = undefined
-    this.viaRemember = false
-    this.isAuthenticated = false
-    this.isLoggedOut = true
-
     /**
      * Notify the user has been logged out
      */
@@ -484,6 +476,14 @@ export class SessionGuard<
       user: this.user || null,
       sessionId: session.sessionId,
     })
+
+    /**
+     * Update local state
+     */
+    this.user = undefined
+    this.viaRemember = false
+    this.isAuthenticated = false
+    this.isLoggedOut = true
   }
 
   /**

tests/session/guard/logout.spec.ts

@@ -24,6 +24,7 @@ test.group('Session guard | logout', () => {
   test('delete user session and remember me cookie', async ({ assert }) => {
     const ctx = new HttpContextFactory().create()
     const emitter = createEmitter<SessionGuardEvents<SessionFakeUser>>()
+    const events = emitter.fake()
     const userProvider = new SessionFakeUserProvider()
 
     const guard = new SessionGuard(
@@ -54,11 +55,15 @@ test.group('Session guard | logout', () => {
     const responseCookies = parseCookies(ctx.response.getHeader('set-cookie') as string)
     assert.deepEqual(responseCookies.remember_web.expires, new Date(0))
     assert.deepEqual(responseCookies.remember_web.maxAge, -1)
+
+    events.assertEmittedCount('session_auth:logged_out', 1)
+    assert.equal(events.find('session_auth:logged_out')!.data.user, user!.getOriginal())
   })
 
   test('delete remember me token using user provider', async ({ assert }) => {
     const ctx = new HttpContextFactory().create()
     const emitter = createEmitter<SessionGuardEvents<SessionFakeUser>>()
+    const events = emitter.fake()
     const userProvider = new SessionFakeUserWithTokensProvider()
 
     const guard = new SessionGuard(
@@ -99,13 +104,17 @@ test.group('Session guard | logout', () => {
     assert.deepEqual(responseCookies.remember_web.maxAge, -1)
 
     assert.lengthOf(userProvider.tokens, 0)
+
+    events.assertEmittedCount('session_auth:logged_out', 1)
+    assert.equal(events.find('session_auth:logged_out')!.data.user, user!.getOriginal())
   })
 
   test('do not delete token with storage when no user was authenticated in first place', async ({
     assert,
   }) => {
     const ctx = new HttpContextFactory().create()
     const emitter = createEmitter<SessionGuardEvents<SessionFakeUser>>()
+    const events = emitter.fake()
     const userProvider = new SessionFakeUserWithTokensProvider()
 
     const guard = new SessionGuard(
@@ -145,5 +154,8 @@ test.group('Session guard | logout', () => {
     assert.deepEqual(responseCookies.remember_web.maxAge, -1)
 
     assert.lengthOf(userProvider.tokens, 1)
+
+    events.assertEmittedCount('session_auth:logged_out', 1)
+    assert.isNull(events.find('session_auth:logged_out')!.data.user)
   })
 })