fix: Device logout not redirecting to login page (#38616)

juliajforesti · web-flow · commit 11e1c51f0867 · 2026-02-13T22:19:08.000Z
diff --git a/.changeset/fuzzy-pumpkins-remember.md b/.changeset/fuzzy-pumpkins-remember.md
@@ -0,0 +1,7 @@
+---
+'@rocket.chat/core-services': patch
+'@rocket.chat/ddp-client': patch
+'@rocket.chat/meteor': patch
+---
+
+Fixes device management logout not redirecting to login page.
diff --git a/apps/meteor/client/components/deviceManagement/DeviceManagementTable/DeviceManagementTable.tsx b/apps/meteor/client/components/deviceManagement/DeviceManagementTable/DeviceManagementTable.tsx
@@ -57,7 +57,7 @@ const DeviceManagementTable = <T extends DeviceManagementSession | DeviceManagem
 	return (
 		<>
 			{data?.sessions.length === 0 && isSuccess && <GenericNoResults />}
-			<GenericTable>
+			<GenericTable aria-label={t('Devices')}>
 				{data?.sessions && data.sessions.length > 0 && headers && <GenericTableHeader>{headers}</GenericTableHeader>}
 				<GenericTableBody>
 					{isPending && <GenericTableLoadingTable headerCells={headers.filter(Boolean).length} />}
diff --git a/apps/meteor/client/views/account/deviceManagement/DeviceManagementAccountTable/DeviceManagementAccountRow.tsx b/apps/meteor/client/views/account/deviceManagement/DeviceManagementAccountTable/DeviceManagementAccountRow.tsx
@@ -24,7 +24,7 @@ const DeviceManagementAccountRow = ({ _id, deviceName, deviceType = 'browser', d
 	const handleDeviceLogout = useDeviceLogout(_id, '/v1/sessions/logout.me');
 
 	return (
-		<GenericTableRow key={_id}>
+		<GenericTableRow key={_id} aria-label={_id}>
 			<GenericTableCell>
 				<Box display='flex' alignItems='center'>
 					<DeviceIcon deviceType={deviceType} />
diff --git a/apps/meteor/client/views/admin/deviceManagement/DeviceManagementAdminTable/DeviceManagementAdminRow.tsx b/apps/meteor/client/views/admin/deviceManagement/DeviceManagementAdminTable/DeviceManagementAdminRow.tsx
@@ -66,7 +66,7 @@ const DeviceManagementAdminRow = ({
 	];
 
 	return (
-		<GenericTableRow key={_id} onKeyDown={handleKeyDown} onClick={handleClick} tabIndex={0} action>
+		<GenericTableRow key={_id} onKeyDown={handleKeyDown} onClick={handleClick} tabIndex={0} action aria-label={_id}>
 			<GenericTableCell>
 				<Box display='flex' alignItems='center'>
 					<DeviceIcon deviceType={deviceType} />
diff --git a/apps/meteor/client/views/root/hooks/loggedIn/useForceLogout.ts b/apps/meteor/client/views/root/hooks/loggedIn/useForceLogout.ts
@@ -1,4 +1,5 @@
 import { useStream, useSessionDispatch } from '@rocket.chat/ui-contexts';
+import { Meteor } from 'meteor/meteor';
 import { useEffect } from 'react';
 
 export const useForceLogout = (userId: string) => {
@@ -8,7 +9,13 @@ export const useForceLogout = (userId: string) => {
 	useEffect(() => {
 		setForceLogout(false);
 
-		const unsubscribe = getNotifyUserStream(`${userId}/force_logout`, () => {
+		const unsubscribe = getNotifyUserStream(`${userId}/force_logout`, (sessionId) => {
+			const currentSessionId = Meteor.connection._lastSessionId;
+
+			if (sessionId === currentSessionId) {
+				window.location.reload();
+			}
+
 			setForceLogout(true);
 		});
 
diff --git a/apps/meteor/definition/externals/meteor/meteor.d.ts b/apps/meteor/definition/externals/meteor/meteor.d.ts
@@ -115,6 +115,7 @@ declare module 'meteor/meteor' {
 					},
 				]
 			): SubscriptionHandle;
+			_lastSessionId: string;
 		}
 
 		const connection: IMeteorConnection;
diff --git a/apps/meteor/ee/server/api/sessions.ts b/apps/meteor/ee/server/api/sessions.ts
@@ -136,6 +136,8 @@ API.v1.addRoute(
 				return API.v1.notFound('Session not found');
 			}
 
+			await api.broadcast('user.forceLogout', sessionObj.userId, sessionId);
+
 			await Promise.all([
 				Users.unsetOneLoginToken(this.userId, sessionObj.loginToken),
 				Sessions.logoutByloginTokenAndUserId({ loginToken: sessionObj.loginToken, userId: this.userId }),
@@ -239,7 +241,7 @@ API.v1.addRoute(
 				return API.v1.notFound('Session not found');
 			}
 
-			await api.broadcast('user.forceLogout', sessionObj.userId);
+			await api.broadcast('user.forceLogout', sessionObj.userId, sessionId);
 
 			await Promise.all([
 				Users.unsetOneLoginToken(sessionObj.userId, sessionObj.loginToken),
diff --git a/apps/meteor/server/modules/listeners/listeners.module.ts b/apps/meteor/server/modules/listeners/listeners.module.ts
@@ -46,8 +46,8 @@ export class ListenersModule {
 			});
 		});
 
-		service.onEvent('user.forceLogout', (uid) => {
-			notifications.notifyUserInThisInstance(uid, 'force_logout');
+		service.onEvent('user.forceLogout', (uid: string, sessionId?: string) => {
+			notifications.notifyUserInThisInstance(uid, 'force_logout', sessionId);
 		});
 
 		service.onEvent('notify.ephemeralMessage', (uid, rid, message) => {
diff --git a/apps/meteor/tests/e2e/account-manage-devices.spec.ts b/apps/meteor/tests/e2e/account-manage-devices.spec.ts
@@ -0,0 +1,69 @@
+import type { Page } from 'playwright-core';
+
+import { IS_EE } from './config/constants';
+import { createAuxContext } from './fixtures/createAuxContext';
+import injectInitialData from './fixtures/inject-initial-data';
+import { Users } from './fixtures/userStates';
+import { Registration } from './page-objects';
+import { AccountManageDevices } from './page-objects/account.manage-devices';
+import { test, expect } from './utils/test';
+
+test.describe('Account Manage Devices Page', () => {
+	test.skip(!IS_EE);
+	test.use({ storageState: Users.user1.state });
+
+	let page: Page;
+	let accountDevices: AccountManageDevices;
+	let loginPage: Registration;
+
+	test.beforeEach(async ({ browser }) => {
+		({ page } = await createAuxContext(browser, Users.user1));
+		accountDevices = new AccountManageDevices(page);
+		loginPage = new Registration(page);
+		await page.goto('/account/manage-devices');
+	});
+
+	test.afterEach(async () => {
+		await page.close();
+		await injectInitialData();
+	});
+
+	test('should show Manage Devices page', async () => {
+		await expect(accountDevices.devicesPageContent).toBeVisible();
+	});
+
+	test('should logout current device and redirect to login page', async () => {
+		await accountDevices.table.orderByLastLogin();
+
+		const deviceId = await accountDevices.getNthDeviceId(1);
+		await accountDevices.logoutDeviceById(deviceId);
+		await expect(loginPage.loginForm).toBeVisible();
+	});
+
+	test('should logout other device successfully', async ({ browser }) => {
+		const context2 = await browser.newContext({ storageState: { cookies: [], origins: [] } });
+		const page2 = await context2.newPage();
+		const loginPage2 = new Registration(page2);
+		const accountDevices2 = new AccountManageDevices(page2);
+
+		await test.step('should login same user in another session', async () => {
+			await page2.goto('/account/manage-devices');
+			await loginPage2.username.type('user1');
+			await loginPage2.inputPassword.type('password');
+			await loginPage2.btnLogin.click();
+
+			await expect(accountDevices2.devicesPageContent).toBeVisible();
+		});
+
+		await test.step('should logout device 1 from session 2', async () => {
+			await accountDevices2.table.orderByLastLogin();
+			const device1Id = await accountDevices2.getNthDeviceId(2);
+			await accountDevices2.logoutDeviceById(device1Id);
+			await loginPage.loginForm.waitFor();
+			await expect(loginPage.loginForm).toBeVisible();
+			await expect(accountDevices2.table.getDeviceRowById(device1Id)).not.toBeVisible();
+		});
+
+		await context2.close();
+	});
+});
diff --git a/apps/meteor/tests/e2e/admin-device-management.spec.ts b/apps/meteor/tests/e2e/admin-device-management.spec.ts
@@ -0,0 +1,73 @@
+import type { Page } from 'playwright-core';
+
+import { IS_EE } from './config/constants';
+import { createAuxContext } from './fixtures/createAuxContext';
+import injectInitialData from './fixtures/inject-initial-data';
+import { Users } from './fixtures/userStates';
+import { Registration } from './page-objects';
+import { AdminDeviceManagement } from './page-objects/admin-device-management';
+import { test, expect } from './utils/test';
+
+test.describe('Admin Device Management Page', () => {
+	test.skip(!IS_EE);
+	test.use({ storageState: Users.admin.state });
+
+	let page: Page;
+	let adminDeviceManagement: AdminDeviceManagement;
+	let loginPage: Registration;
+
+	test.beforeEach(async ({ browser }) => {
+		({ page } = await createAuxContext(browser, Users.admin));
+		adminDeviceManagement = new AdminDeviceManagement(page);
+		loginPage = new Registration(page);
+		await page.goto('/admin/device-management');
+	});
+
+	test.afterEach(async () => {
+		await page.close();
+		await injectInitialData();
+	});
+
+	test('should show Device management page', async () => {
+		await expect(adminDeviceManagement.adminPageContent).toBeVisible();
+	});
+
+	test('should logout current device and redirect to login page', async () => {
+		const deviceId = await adminDeviceManagement.getUsersDeviceId('rocketchat.internal.admin.test');
+		await adminDeviceManagement.logoutDeviceById(deviceId);
+		await expect(loginPage.loginForm).toBeVisible();
+	});
+
+	test('should logout current device from device info tab and redirect to login page', async () => {
+		const deviceId = await adminDeviceManagement.getUsersDeviceId('rocketchat.internal.admin.test');
+		await adminDeviceManagement.searchUserDevice('rocketchat.internal.admin.test');
+		await adminDeviceManagement.table.getDeviceRowById(deviceId).click();
+
+		await expect(adminDeviceManagement.deviceInfo.getDeviceInfoId(deviceId)).toBeVisible();
+		await adminDeviceManagement.deviceInfo.btnLogoutDevice.click();
+		await adminDeviceManagement.logoutModal.confirmLogout();
+		await expect(loginPage.loginForm).toBeVisible();
+	});
+
+	test('should logout other device successfully', async ({ browser }) => {
+		const user2Page = await browser.newPage({ storageState: Users.user2.state });
+		const loginPage2 = new Registration(user2Page);
+		await user2Page.goto('/');
+		await expect(user2Page.getByRole('main')).toBeVisible();
+
+		const user2DeviceId = await adminDeviceManagement.getUsersDeviceId('user2');
+
+		await test.step('should logout user2 and redirect to login page', async () => {
+			await adminDeviceManagement.logoutDeviceById(user2DeviceId);
+			await loginPage2.loginForm.waitFor();
+			await expect(loginPage2.loginForm).toBeVisible();
+		});
+
+		await test.step('should no longer show user2 device in admin device management page', async () => {
+			await adminDeviceManagement.searchUserDevice('user2');
+			await expect(adminDeviceManagement.table.getDeviceRowById(user2DeviceId)).not.toBeVisible();
+		});
+
+		await user2Page.close();
+	});
+});
diff --git a/apps/meteor/tests/e2e/page-objects/account.manage-devices.ts b/apps/meteor/tests/e2e/page-objects/account.manage-devices.ts
@@ -0,0 +1,33 @@
+import type { Locator, Page } from 'playwright-core';
+
+import { Account } from './account';
+import { ConfirmLogoutModal, DevicesTable } from './fragments';
+
+export class AccountManageDevices extends Account {
+	readonly logoutModal: ConfirmLogoutModal;
+
+	readonly table: DevicesTable;
+
+	constructor(page: Page) {
+		super(page);
+		this.logoutModal = new ConfirmLogoutModal(page.getByRole('dialog', { name: 'Log out device' }));
+		this.table = new DevicesTable(page);
+	}
+
+	get devicesPageContent(): Locator {
+		return this.page.getByRole('main').filter({ has: this.page.getByRole('heading', { name: 'Manage Devices' }) });
+	}
+
+	async getNthDeviceId(nth: number): Promise<string> {
+		const deviceId = await this.devicesPageContent.getByRole('row').nth(nth).getAttribute('aria-label');
+		if (!deviceId) {
+			throw new Error(`Device ID not found for the device ${nth}`);
+		}
+		return deviceId || '';
+	}
+
+	async logoutDeviceById(deviceId: string) {
+		await this.table.getDeviceRowById(deviceId).getByRole('button', { name: 'Logout' }).click();
+		await this.logoutModal.confirmLogout();
+	}
+}
diff --git a/apps/meteor/tests/e2e/page-objects/admin-device-management.ts b/apps/meteor/tests/e2e/page-objects/admin-device-management.ts
@@ -0,0 +1,54 @@
+import type { Locator, Page } from '@playwright/test';
+
+import { Admin } from './admin';
+import { MenuOptions, DevicesTable } from './fragments';
+import { DeviceInfoFlexTab } from './fragments/device-info-flextab';
+import { ConfirmLogoutModal } from './fragments/modals';
+
+export class AdminDeviceManagement extends Admin {
+	readonly deviceInfo: DeviceInfoFlexTab;
+
+	readonly deviceRowMenu: MenuOptions;
+
+	readonly table: DevicesTable;
+
+	readonly logoutModal: ConfirmLogoutModal;
+
+	constructor(page: Page) {
+		super(page);
+		this.deviceInfo = new DeviceInfoFlexTab(page.getByRole('dialog', { name: 'Device Info' }));
+		this.deviceRowMenu = new MenuOptions(page);
+		this.table = new DevicesTable(page);
+		this.logoutModal = new ConfirmLogoutModal(page.getByRole('dialog', { name: 'Log out device' }));
+	}
+
+	get adminPageContent(): Locator {
+		return this.page.getByRole('main').filter({ has: this.page.getByRole('heading', { name: 'Device management' }) });
+	}
+
+	async searchUserDevice(user: string): Promise<void> {
+		await this.adminPageContent.getByRole('textbox', { name: 'Search devices or users' }).fill(user);
+	}
+
+	async getUsersDeviceId(username: string): Promise<string> {
+		await this.searchUserDevice(username);
+		const deviceId = await this.adminPageContent
+			.getByRole('row')
+			.filter({ has: this.page.getByRole('cell', { name: username }) })
+			.first()
+			.getAttribute('aria-label');
+
+		return deviceId || '';
+	}
+
+	async openDeviceOptionsById(deviceId: string) {
+		const row = this.table.getDeviceRowById(deviceId);
+		await row.getByRole('button', { name: 'Options' }).click();
+	}
+
+	async logoutDeviceById(deviceId: string) {
+		await this.openDeviceOptionsById(deviceId);
+		await this.deviceRowMenu.getMenuItem('Log out device').click();
+		await this.logoutModal.confirmLogout();
+	}
+}
diff --git a/apps/meteor/tests/e2e/page-objects/auth.ts b/apps/meteor/tests/e2e/page-objects/auth.ts
@@ -25,6 +25,10 @@ export class Registration extends Main {
 		super(page.getByRole('main'));
 	}
 
+	get loginForm(): Locator {
+		return this.page.getByRole('form', { name: 'Login', exact: true });
+	}
+
 	get btnSendInstructions(): Locator {
 		return this.page.locator('role=button[name="Send instructions"]');
 	}
diff --git a/apps/meteor/tests/e2e/page-objects/fragments/device-info-flextab.ts b/apps/meteor/tests/e2e/page-objects/fragments/device-info-flextab.ts
@@ -0,0 +1,17 @@
+import type { Locator } from '@playwright/test';
+
+import { FlexTab } from './flextab';
+
+export class DeviceInfoFlexTab extends FlexTab {
+	constructor(locator: Locator) {
+		super(locator);
+	}
+
+	get btnLogoutDevice(): Locator {
+		return this.root.getByRole('button', { name: 'Log out device' });
+	}
+
+	getDeviceInfoId(deviceId: string): Locator {
+		return this.root.getByText(deviceId, { exact: true });
+	}
+}
diff --git a/apps/meteor/tests/e2e/page-objects/fragments/index.ts b/apps/meteor/tests/e2e/page-objects/fragments/index.ts
@@ -10,5 +10,6 @@ export * from './modals';
 export * from './toast-messages';
 export * from './export-messages-tab';
 export * from './menu';
+export * from './table';
 export * from './toolbar';
 export * from './composer';
diff --git a/apps/meteor/tests/e2e/page-objects/fragments/modals/confirm-logout-modal.ts b/apps/meteor/tests/e2e/page-objects/fragments/modals/confirm-logout-modal.ts
@@ -0,0 +1,12 @@
+import { Modal } from './modal';
+
+export class ConfirmLogoutModal extends Modal {
+	get btnLogout() {
+		return this.root.getByRole('button', { name: 'Log out device' });
+	}
+
+	async confirmLogout() {
+		await this.btnLogout.click();
+		await this.waitForDismissal();
+	}
+}
diff --git a/apps/meteor/tests/e2e/page-objects/fragments/modals/index.ts b/apps/meteor/tests/e2e/page-objects/fragments/modals/index.ts
@@ -1,5 +1,6 @@
 export * from './apps-modal';
 export * from './confirm-delete-modal';
+export * from './confirm-logout-modal';
 export * from './create-new-modal';
 export * from './disable-room-encryption-modal';
 export * from './edit-status-modal';
diff --git a/apps/meteor/tests/e2e/page-objects/fragments/table.ts b/apps/meteor/tests/e2e/page-objects/fragments/table.ts
diff --git a/packages/core-services/src/events/Events.ts b/packages/core-services/src/events/Events.ts
diff --git a/packages/ddp-client/src/types/streams.ts b/packages/ddp-client/src/types/streams.ts

Original file line number	Diff line number	Diff line change
`@@ -115,6 +115,7 @@ declare module 'meteor/meteor' {`
`115`	`115`	`},`
`116`	`116`	`]`
`117`	`117`	`): SubscriptionHandle;`
	`118`	`+ _lastSessionId: string;`
`118`	`119`	`}`
`119`	`120`
`120`	`121`	`const connection: IMeteorConnection;`
Original file line number	Diff line number	Diff line change
`@@ -136,6 +136,8 @@ API.v1.addRoute(`
`136`	`136`	`return API.v1.notFound('Session not found');`
`137`	`137`	`}`
`138`	`138`
	`139`	`+ await api.broadcast('user.forceLogout', sessionObj.userId, sessionId);`
	`140`	`+`
`139`	`141`	`await Promise.all([`
`140`	`142`	`Users.unsetOneLoginToken(this.userId, sessionObj.loginToken),`
`141`	`143`	`Sessions.logoutByloginTokenAndUserId({ loginToken: sessionObj.loginToken, userId: this.userId }),`
`@@ -239,7 +241,7 @@ API.v1.addRoute(`
`239`	`241`	`return API.v1.notFound('Session not found');`
`240`	`242`	`}`
`241`	`243`
`242`		`- await api.broadcast('user.forceLogout', sessionObj.userId);`
	`244`	`+ await api.broadcast('user.forceLogout', sessionObj.userId, sessionId);`
`243`	`245`
`244`	`246`	`await Promise.all([`
`245`	`247`	`Users.unsetOneLoginToken(sessionObj.userId, sessionObj.loginToken),`