Skip to content

Conversation

@michaelstingl
Copy link
Contributor

@michaelstingl michaelstingl commented Jul 8, 2025

Description

This PR integrates OAuth2/OIDC logout functionality into the bookmark deletion flow. When users delete a bookmark (or "log out" in branded builds), the app now properly logs out from the identity provider before removing local data.

Changes

  • Modified OCBookmarkManager+Management.swift to call deauthenticateConnection during bookmark deletion
  • Logout happens asynchronously before vault erasure
  • Refactored vault erasure logic into separate method performVaultErasure
  • Deletion proceeds even if logout fails (user-friendly approach)

Related Issue

Currently no issue exists for this feature. This addresses the inconsistency where iOS app users remained logged in at the IdP level after removing bookmarks.

Motivation and Context

Users expect that removing an account from the app also logs them out from the server. The current behavior only removes local data, leaving active sessions on the identity provider. This PR brings the iOS app in line with the web client's logout behavior.

How Has This Been Tested?

  • Tested bookmark deletion with ownCloud 10 (OAuth2)
  • Tested bookmark deletion with oCIS (OIDC)
  • Tested deletion when offline (should still succeed)
  • Verified no sessions remain at IdP after deletion
  • Tested with external OIDC providers (Keycloak, etc.)

Screenshots (if appropriate):

N/A - Uses existing deletion UI

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • Added an issue with details about all relevant changes in the iOS documentation repository.
  • I have read the CONTRIBUTING document.
  • I have added tests to cover my changes.
  • All new and existing tests passed.
  • Added changelog files for the fixed issues in folder changelog/unreleased

michaelstingl and others added 4 commits July 8, 2025 22:12
- Call deauthenticateConnection before erasing vault when deleting bookmarks
- Ensures proper logout at IdP level (token revocation/OIDC end session)
- Maintains user-friendly behavior: deletion proceeds even if logout fails
- Update SDK submodule to include logout support

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant