Delete User and Logout that user from all Devices-CodePudding

I wanted to implement a feature in my app. Where an Admin can delete the user. So basically the delete is working fine but somehow i cannot logout the logged in user. Let me explain it more briefly, Suppose there is a User A which is currently using my app and the admin decided to remove that user from the app so they can't no longer access the features of the app. To remove the user i can call an API and delete that user but if i completely delete the user it loses all the access to the API's call coz user with the certain ID isn't available anymore and the app breaks coz the API call will fail for that deleted User. So I was wondering is there anyway to logout the user after admin deletes it.

The Frontend is on ReactJs and Backend is on NodeJs. And i am using JWT for authentication. Any help will be appreciated and if this question isn't clear enough please let me know so i can explain it more.

CodePudding user response：

In backend in every protected route you should verify the token and token should contain user id or email using that you will verify the token. After deleting the user throw error with no user found and in frontend make sure if there are the error no user found then it will delete the JWT token.

CodePudding user response：

What comes into my mind is to put a middleware between your requests and server. By doing so, instead of trying to log out from all devices, we will not allow any action if user does not exist; in this very example, we will prevent the user to delete a place and toast a message on the front end. I will share an example of that, but you need to tweak the code according to your needs.

Http Error Model

class HttpError extends Error {
    constructor(message, errorCode) {
        super(message);
        this.code = errorCode;
    }
}

module.exports = HttpError;

Middleware

const HttpError = require('../models/http-error');

module.exports = (req, res, next) => {
    try {
        // Check user if exists
        User.findById(req.userData.userId).exec(function (error, user) {
          if (error) {
              throw new Error('Authentication failed!');
          }
          else {
              return next();
          }
        });
    }
    catch (error) {
        return next(new HttpError('Authentication failed!', 403));
    }
};

Route

const express = require('express');

const router = express.Router();

const checkAuth = require('../middleware/check-auth');

router.use(checkAuth);

// Put after any routes that you want the user to be logged in

router.delete('/:placeId', placesControllers.deletePlace); //e.x.
...

module.exports = router;

E.x. controller (with MongoDB)

const deletePlace = async (req, res, next) => {
    const placeId = req.params.placeId;

    let foundPlace;

    try {
        foundPlace = await Place.findById(placeId).populate('userId').exec();
    }
    catch (error) {
        return next(new HttpError('Could not find the place, please try again', 500));
    }

    // Delete place

    res.status(200).json({message: 'Deleted place'});
};

FRONT END PART

import toastr from 'toastr';

....

try {
    const response = await fetch(url, {method, body, headers});

    const data = await response.json();

    if (!response.ok) {
        throw new Error(data.message);
    }
}
catch(error) {
    // handle the error, user not found
    console.log(error.message);
    toastr.error(error.message, 'Error', {
        closeButton: true,
        positionClass: 'toast-top-right',
        timeOut: 2000,
        extendedTimeOut: 1,
    });
}