- Add unit test for when case when the cookie doesn't match the db.

- Move code into User.signout method to further encapsulate the code.

app/main/views/sign_out.py

@@ -1,5 +1,5 @@
-from flask import redirect, session, url_for
-from flask_login import current_user, logout_user
+from flask import redirect, url_for
+from flask_login import current_user
 
 from app.main import main
 
@@ -7,6 +7,4 @@ from app.main import main
 @main.route('/sign-out', methods=(['GET']))
 def sign_out():
     current_user.sign_out()
-    session.clear()
-    logout_user()
     return redirect(url_for('main.index'))

app/models/user.py

@@ -1,5 +1,5 @@
 from flask import abort, current_app, request, session
-from flask_login import AnonymousUserMixin, UserMixin, login_user
+from flask_login import AnonymousUserMixin, UserMixin, login_user, logout_user
 from notifications_python_client.errors import HTTPError
 from notifications_utils.timezones import utc_string_to_aware_gmt_datetime
 from werkzeug.utils import cached_property
@@ -155,6 +155,8 @@ class User(JSONModel, UserMixin):
 
     def sign_out(self):
         # Update the db so the server also knows the user is logged out.
+        session.clear()
+        logout_user()
         return self.update(current_session_id=None)
 
     @property

tests/app/main/views/test_sign_in.py

@@ -61,6 +61,7 @@ def test_doesnt_redirect_to_sign_in_if_no_session_info(
 
 @pytest.mark.parametrize('db_sess_id, cookie_sess_id', [
     (None, None),
+    (None, uuid.UUID(int=1)),  # BAD - cookie doesn't match db
     (uuid.UUID(int=1), None),  # BAD - has used other browsers before but this is a brand new browser with no cookie
     (uuid.UUID(int=1), uuid.UUID(int=2)),  # BAD - this person has just signed in on a different browser
 ])