{"action":"opened","issue":{"url":"https://api.github.com/repos/j-schumann/vrok-lib/issues/3","repository_url":"https://api.github.com/repos/j-schumann/vrok-lib","labels_url":"https://api.github.com/repos/j-schumann/vrok-lib/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/j-schumann/vrok-lib/issues/3/comments","events_url":"https://api.github.com/repos/j-schumann/vrok-lib/issues/3/events","html_url":"https://github.com/j-schumann/vrok-lib/issues/3","id":142091798,"number":3,"title":"new features for authToken","user":{"login":"j-schumann","id":114239,"avatar_url":"https://avatars.githubusercontent.com/u/114239?v=3","gravatar_id":"","url":"https://api.github.com/users/j-schumann","html_url":"https://github.com/j-schumann","followers_url":"https://api.github.com/users/j-schumann/followers","following_url":"https://api.github.com/users/j-schumann/following{/other_user}","gists_url":"https://api.github.com/users/j-schumann/gists{/gist_id}","starred_url":"https://api.github.com/users/j-schumann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/j-schumann/subscriptions","organizations_url":"https://api.github.com/users/j-schumann/orgs","repos_url":"https://api.github.com/users/j-schumann/repos","events_url":"https://api.github.com/users/j-schumann/events{/privacy}","received_events_url":"https://api.github.com/users/j-schumann/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-19T19:03:56Z","updated_at":"2016-03-19T19:03:56Z","closed_at":null,"body":"Currently, if the login-by-cookie feature is enabled the cookie is checked on every page hit onBootstrap.\r\nWrite a custom AuthService or extend Storage\\Doctrine that when no identity is stored in the session triggers an event the userManager can listen to or directly trigger the cookie check.\r\n\r\nAlso add a new property to User like \"sessionsInvalid\" that can be set to a timestamp.\r\nWhen a login occurs (via password or cookie) the login time is stored in the session.\r\nWhen using UserManager::logout() with $global = true is called \"sessionsInvalid\" is that to the current timestamp, all sessions with a login time prior this value are now invalid.\r\nVrok\\Authentication\\Storage\\Doctrine should check \"sessionsInvalid\" before returning the user stored in the session, thus allowing to logout the user on any devices, not only by deleting his loginKeys but also killing active sessions. When the user logs in \"sessionsInvalid\" is kept, this way the user can relogin on one device while other sessions will still be killed on the next page hit.\r\n\r\n"}}