Device Registry, Sessions & Remote Logout

Model each signed-in installation as a device session: an ID, platform, app version, last seen, push token, and the refresh-token family it owns. This enables "signed-in devices" UI, remote logout (revoke the family + delete the push token), logout everywhere after a password change, per-device rate limits and targeted push. On sign-out, the app must call the server to revoke tokens and unregister its push token — otherwise the next user on a shared device can receive the previous user's notifications.

Device lifecycle

CREATE TABLE device_sessions (
  id            uuid PRIMARY KEY,
  user_id       bigint NOT NULL REFERENCES users(id),
  platform      text   NOT NULL CHECK (platform IN ('ios','android')),
  app_version   text   NOT NULL,
  push_token    text   UNIQUE,              -- one owner per token
  token_family  uuid   NOT NULL,
  last_seen_at  timestamptz NOT NULL DEFAULT now(),
  revoked_at    timestamptz
);

@router.delete("/v1/me/devices/{device_id}")
async def remote_logout(device_id: UUID, user=Depends(current_user)):
    device = await devices.get_owned(user.id, device_id)       # authorization: own devices only
    await tokens.revoke_family(device.token_family)
    await devices.update(device.id, revoked_at=utcnow(), push_token=None)
    return Response(status_code=204)

Common pitfalls

• Push tokens not unlinked on logout (notifications leak to the next user).
• No way to revoke a single device.
• Local data left on the device after sign-out.

Key points

• One session record per installation
• Logout revokes tokens and push registration
• Logout-everywhere after credential changes

Further reading: OWASP Session Management Cheat Sheet