fix(consent): use GetLoginSession in logout handlers to handle remember=false sessions

[waterWang]

Fixes #3132

Problem

When a user logs in with remember: false, the login session is persisted in hydra_oauth2_authentication_session (with remember = FALSE), but the logout handler uses GetRememberedLoginSession which has a WHERE remember = TRUE filter. This causes two issues:

1. RP-initiated logout with id_token_hint: issueLogoutVerifier at line 942 calls GetRememberedLoginSession(hintSid), gets ErrNotFound, and silently redirects to post_logout_redirect_uri without any front-/back-channel logout — even though the ID token hint contains a valid sid that identifies the session.

2. Admin headless logout: HandleHeadlessLogout at line 1099 calls GetRememberedLoginSession(sid), gets ErrNotFound, and returns a silent 204 no-op — even though the session row exists.

Solution

Add a new GetLoginSession method to the LoginManager interface and its SQL persistence implementation — identical to GetRememberedLoginSession but without the WHERE remember = TRUE filter. Use it at the two logout call sites above.

The filtered variant (GetRememberedLoginSession) is kept for the cookie-based SSO lookup at line 103, where remember=false sessions should indeed not enable SSO skip.

Changes

1. consent/manager.go: Add GetLoginSession(ctx, id) to the LoginManager interface
2. persistence/sql/persister_consent.go: Implement GetLoginSession (same as GetRememberedLoginSession minus the WHERE remember = TRUE filter)
3. consent/strategy_default.go:
   • issueLogoutVerifier (line 942): use GetLoginSession instead of GetRememberedLoginSession
   • HandleHeadlessLogout (line 1099): use GetLoginSession instead of GetRememberedLoginSession
   • Line 103 (cookie SSO): unchanged, still uses GetRememberedLoginSession

Root cause analysis credit

Detailed analysis by @fkammer in the issue comments confirmed the fix is minimal — no schema changes, no API changes needed.

Summary by CodeRabbit

• Bug Fixes
  • RP-initiated and headless logout now work for sessions that were not remembered.
  • Login sessions can be retrieved reliably by session ID, including appropriate handling when a session is missing.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

📝 Walkthrough

Walkthrough

The login manager and SQL persister now support lookup of any login session by ID. RP-initiated and headless logout use this lookup instead of requiring a remembered session.

Changes

Logout session lookup

Layer / File(s)	Summary
Session lookup contract and persistence consent/manager.go, persistence/sql/persister_consent.go	The LoginManager interface and SQL persister now provide GetLoginSession, with network-scoped lookup and database error handling.
Logout strategy integration consent/strategy_default.go	RP-initiated and headless logout now retrieve sessions with GetLoginSession.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: aeneasr

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the logout-handler fix and the affected remember=false sessions.
Description check	✅ Passed	The description explains the bug, reproduction context, solution, affected call sites, and linked issue; the unchecked checklist is non-critical.
Linked Issues check	✅ Passed	The changes satisfy issue #3132 by locating non-remembered sessions for id_token_hint logout while preserving remembered-session SSO lookup.
Out of Scope Changes check	✅ Passed	The interface, persistence, and logout-handler changes directly support the linked logout-session lookup objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

persistence/sql/persister_consent.go (1)

243-255: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Add regression coverage for non-remembered sessions.

Line [248] intentionally removes the remember = TRUE predicate. Add coverage that persists a remember = false session, verifies GetLoginSession returns it, and confirms the RP-initiated and headless logout paths use it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@persistence/sql/persister_consent.go` around lines 243 - 255, Add regression
tests around Persister.GetLoginSession that persist a session with remember set
to false and verify it is returned successfully. Extend coverage for both
RP-initiated and headless logout flows to confirm they retrieve and use this
non-remembered session, while preserving existing remembered-session behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@persistence/sql/persister_consent.go`:
- Around line 243-255: Add regression tests around Persister.GetLoginSession
that persist a session with remember set to false and verify it is returned
successfully. Extend coverage for both RP-initiated and headless logout flows to
confirm they retrieve and use this non-remembered session, while preserving
existing remembered-session behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e975ad0b-60c7-495b-8766-5176734b67c5

📥 Commits

Reviewing files that changed from the base of the PR and between 4174065 and 06d9c55.

📒 Files selected for processing (3)

• consent/manager.go
• consent/strategy_default.go
• persistence/sql/persister_consent.go