feat(core): tag isCurrent on account api sessions response#8729
Open
Conversation
COMPARE TO
|
| Name | Diff |
|---|---|
| packages/core/src/middleware/koa-auth/koa-oidc-auth.test.ts | 📈 +638 Bytes |
| packages/core/src/middleware/koa-auth/koa-oidc-auth.ts | 📈 +30 Bytes |
| packages/core/src/middleware/koa-auth/types.ts | 📈 +206 Bytes |
| packages/core/src/routes/account/sessions.ts | 📈 +275 Bytes |
| packages/integration-tests/src/api/my-account.ts | 📈 +14 Bytes |
| packages/integration-tests/src/helpers/session.ts | 📈 +13 Bytes |
| packages/integration-tests/src/tests/api/account/session.test.ts | 📈 +3.19 KB |
| packages/schemas/src/types/user-sessions.ts | 📈 +988 Bytes |
simeng-li
force-pushed
the
simeng-log-13304-p12-add-iscurrent-flag-dev-feature-gated-to-get-apimy
branch
from
aa91368 to
afb3420
Compare
wangsijie
reviewed
Apr 28, 2026
Contributor
wangsijie
left a comment
wangsijie
left a comment
There was a problem hiding this comment.
🤖 PR Review
This PR adds an isCurrent marker to account-session listings behind the dev-features flag and covers the account API path with targeted tests.
- 🔒 Security: clean
- 🏗️ Architecture: 0 high, 2 medium
- 👨💻 Engineering: clean
Verdict:
simeng-li
force-pushed
the
simeng-log-13304-p12-add-iscurrent-flag-dev-feature-gated-to-get-apimy
branch
from
afb3420 to
6db8b94
Compare
simeng-li
requested review from
a team,
charIeszhao and
darcyYe
and removed request for
a team
simeng-li
force-pushed
the
simeng-log-13304-p12-add-iscurrent-flag-dev-feature-gated-to-get-apimy
branch
from
6db8b94 to
84c88ef
Compare
simeng-li
force-pushed
the
simeng-log-13303-p11-plumb-sessionuid-through-koaoidcauth-into-ctxauth
branch
from
8306cbf to
10f30ed
Compare
4 tasks
wangsijie
reviewed
Apr 28, 2026
Contributor
wangsijie
left a comment
wangsijie
left a comment
There was a problem hiding this comment.
🤖 PR Review
Adds an account-API-only isCurrent flag for session listings behind the dev-features guard, with tests covering the flagged session-selection behavior.
- 🔒 Security: clean
- 🏗️ Architecture: clean
- 👨💻 Engineering: 0 high, 1 medium
Verdict:
Behind `EnvSet.values.isDevFeaturesEnabled`, tag the entry in the GET /api/my-account/sessions response whose `payload.uid` matches the caller's `ctx.auth.sessionUid` with `isCurrent: true`. Other entries get `isCurrent: false`. The flag is omitted entirely when dev features are off, so production responses stay byte-identical to today. `isCurrent` is account-API-specific. To keep that scoping in the type contract, the schema introduces a separate `accountUserExtendedSessionGuard` (extends `userExtendedSessionGuard`) plus `getAccountUserSessionsResponseGuard`. The shared `userExtendedSessionGuard` and the admin-user routes that depend on it are unchanged. The session library is also unchanged — the `isCurrent` mapping lives entirely in the Account API route handler where the dev-feature gate and the per-route response shape belong. Tests: - Integration tests in `tests/api/account/session.test.ts` cover the caller-session-tagged case for single sign-in, multi-session, and revoke-then-list. Wrapped with `devFeatureTest.it` so they only run when `DEV_FEATURES_ENABLED=true`. A separate cleanup PR will remove the dev-feature guard once the feature ships to production. Public docs (P1.4) wait for that. Refs LOG-13304
simeng-li
force-pushed
the
simeng-log-13303-p11-plumb-sessionuid-through-koaoidcauth-into-ctxauth
branch
from
10f30ed to
52f33ba
Compare
simeng-li
force-pushed
the
simeng-log-13304-p12-add-iscurrent-flag-dev-feature-gated-to-get-apimy
branch
from
84c88ef to
18d4d34
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Behind
EnvSet.values.isDevFeaturesEnabled, tag the entry in theGET /api/my-account/sessionsresponse whosepayload.uidmatches the caller'sctx.auth.sessionUid(plumbed by #8728) withisCurrent: true. Other entries getisCurrent: false. The field is optional inuserExtendedSessionGuard; when the flag is off the property is omitted entirely, so production responses stay byte-identical to today.What changed
userExtendedSessionGuard(@logto/schemas) gains an optionalisCurrent?: boolean.findUserActiveSessionsWithExtensionsaccepts a new optionalcurrentSessionUid?: stringand stamps the flag only whenEnvSet.values.isDevFeaturesEnabled./api/my-account/sessions) passesctx.auth.sessionUidto the library.Expected result
isCurrent: trueon the calling session,falseon others.Reviewer notes
Testing
Unit tests, integration tests
Checklist