Do not clear application session data on logout

Closes #34.

CHANGELOG.md

@@ -3,6 +3,7 @@
 
 ## HEAD
 
+* Do not clear application session data on logout.
 * Use 'email' type for email input fields.
 * Document how to log out.
 

README.md

@@ -246,6 +246,31 @@ Send a DELETE request to `quo_vadis.logout_path`.  For example:
 button_to 'Log out', quo_vadis.logout_path, method: :delete
 ```
 
+Note you are responsible for removing any application session data you want removed.  To do so, subclass `QuoVadis::SessionsController` and override the `destroy` method:
+
+````ruby
+# app/controllers/custom_sessions_controller.rb
+class CustomSessionsController < QuoVadis::SessionsController
+  def destroy
+    reset_session
+    super
+  end
+end
+```
+
+Add a route:
+
+```ruby
+# config/routes.rb
+delete 'logout', to: 'custom_sessions#destroy'
+```
+
+And then point your log out button at your custom action:
+
+```ruby
+button_to 'Log out', main_app.logout_path, method: :delete
+```
+
 
 ### Two-factor authentication (2FA) or Two-step verification (2SV)
 

lib/quo_vadis/controller.rb

@@ -190,7 +190,7 @@ def lifetime_expires_at(browser_session)
       def logout
         session&.destroy
         clear_session_id
-        reset_session
+        prevent_rails_session_fixation
         controller.instance_variable_set :@authenticated_model, nil
       end
 

test/dummy/app/controllers/articles_controller.rb

@@ -6,6 +6,7 @@ def index
   end
 
   def secret
+    session[:foo] = 'bar'
   end
 
   def also_secret

test/integration/sessions_test.rb

@@ -69,6 +69,22 @@ class SessionsTest < IntegrationTest
   end
 
 
+  test 'non-authentication session data is not removed on logout' do
+    desktop = login
+    session_id = desktop.session.id
+
+    desktop.get secret_articles_path
+    assert_equal 'bar', desktop.session[:foo]
+
+    desktop.delete quo_vadis.logout_path
+    refute desktop.controller.logged_in?
+
+    desktop.get articles_path
+    assert_equal 'bar', desktop.session[:foo]
+    refute_equal session_id, desktop.session.id
+  end
+
+
   private
 
   # starts a new rails session and logs in