How can I programmaticaly submit the user edit form in Drupal 8?

Question

I need to create a logout button in my app, and I do not know how to revoke simple_oauth tokens programmatically, but I have noticed if the user saves their profile form (form_id: "user_form") in Drupal, it revokes the user's access token.

So I'm wondering if there is a way to programmatically submit the form so I can do so in a logout endpoint for my app.

That is, unless someone can point me to the specific code that revokes a user's access token when the user edit form is saved, so I can fire that hook more directly.

Because the oauth2_token table does not reference the associated user (auth_user_id is always zero), I don't know how to look up a token by UID for the purpose of revoking the token. Thus, even though it seems like a hack, the only thing I can think to do is to try to submit the user edit form programmatically.

UPDATE: I was wrong about "auth_user_id is always zero". See my answer below.

Answer 1

I was mistaken when I said "auth_user_id" is always zero. It isn't. It contains the user's ID, as you would expect. That makes this task fairly simple. Here is the function for my logout endpoint:

public function logout($name = NULL) {

    if ($name) {
      $user = user_load_by_name($name);
      if ($user) {
        $uid = $user->id();

        $msg = 'User ' . $name . ' (uid: ' . $uid . ') logged out of app.';
        \Drupal::logger('orb_common')->notice($msg);

        // Not sure if it would be a better practice to set the status to zero, or delete.  In this example I delete the row.     
        $query = \Drupal::database()->delete('oauth2_token');
        $query->condition('auth_user_id', $uid);
        $query->execute();
      }
    }

    $response['data'] = [];
    $response['method'] = 'POST';

    return new JsonResponse($response);
  }

In my routing file I have...

orb_common.orb_common_logout:
  path: '/orb_common/logout/{name}'
  defaults:
    _controller: '\Drupal\orb_common\Controller\CommonController::logout'
    _title: 'Logout'
  requirements:
    _permission: 'edit activity entities'

The JsonResponse at the end of my logout function presumably isn't important in this case. The main thing is to pass a UID or username to Drupal in the URL of the endpoint, and then delete/update the relevant row in the oauth2_token table. At least, that is working in my app.

Answer 2

Logging the user out through Drupal itself should revoke the user's access token.

Try invoking UserController::logout.

Answer 3

You dont need to submit the form programmatically, all you need to do is to call user_logout() in your logout API endpoint. This should invalidate all the session tokens.

FYI you should check the Drupal 8 REST API docs, there is a core endpoint for logging out current user. Check this URL below,

https://www.drupal.org/docs/8/core/modules/rest/javascript-and-drupal-8-restful-web-services