[FIX] Clear push token on save user password

apps/meteor/server/models/raw/PushToken.ts

@@ -23,4 +23,10 @@ export class PushTokenRaw extends BaseRaw<IPushToken> implements IPushTokenModel
 			authToken: { $nin: tokens },
 		});
 	}
+
+	removeAllByUserId(userId: string): Promise<DeleteResult> {
+		return this.deleteMany({
+			userId,
+		});
+	}
 }

apps/meteor/server/services/meteor/service.ts

@@ -104,19 +104,20 @@ if (disableOplog) {
 	// Re-implement meteor's reactivity that uses observe to disconnect sessions when the token
 	// associated was removed
 	processOnChange = (diff: Record<string, any>, id: string): void => {
+		if (!diff || !('services.resume.loginTokens' in diff)) {
+			return;
+		}
 		const loginTokens: undefined | { hashedToken: string }[] = diff['services.resume.loginTokens'];
-		if (loginTokens) {
-			const tokens = loginTokens.map(({ hashedToken }) => hashedToken);
-
-			const cbs = userCallbacks.get(id);
-			if (cbs) {
-				[...cbs]
-					.filter(({ hashedToken }) => !tokens.includes(hashedToken))
-					.forEach((item) => {
-						item.callbacks.removed(id);
-						cbs.delete(item);
-					});
-			}
+		const tokens = loginTokens?.map(({ hashedToken }) => hashedToken);
+
+		const cbs = userCallbacks.get(id);
+		if (cbs) {
+			[...cbs]
+				.filter(({ hashedToken }) => tokens === undefined || !tokens.includes(hashedToken))
+				.forEach((item) => {
+					item.callbacks.removed(id);
+					cbs.delete(item);
+				});
 		}
 	};
 }

apps/meteor/server/services/push/service.ts

@@ -10,14 +10,18 @@ export class PushService extends ServiceClassInternal implements IPushService {
 		super();
 
 		this.onEvent('watch.users', async ({ id, diff }) => {
-			if (diff && 'services.resume.loginTokens' in diff) {
-				const tokens = diff['services.resume.loginTokens'].map(({ hashedToken }: { hashedToken: string }) => hashedToken);
-				this.cleanUpUserTokens(id, tokens);
+			if (!diff || !('services.resume.loginTokens' in diff)) {
+				return;
+			}
+			if (diff['services.resume.loginTokens'] === undefined) {
+				await PushToken.removeAllByUserId(id);
+				return;
+			}
+			const loginTokens = Array.isArray(diff['services.resume.loginTokens']) ? diff['services.resume.loginTokens'] : [];
+			const tokens = loginTokens.map(({ hashedToken }: { hashedToken: string }) => hashedToken);
+			if (tokens.length > 0) {
+				await PushToken.removeByUserIdExceptTokens(id, tokens);
 			}
 		});
 	}
-
-	private async cleanUpUserTokens(userId: string, tokens: string[]): Promise<void> {
-		await PushToken.removeByUserIdExceptTokens(userId, tokens);
-	}
 }

apps/meteor/tests/end-to-end/api/01-users.js

@@ -92,8 +92,8 @@ describe('[Users]', function () {
 		before((done) => clearCustomFields(done));
 		after((done) => clearCustomFields(done));
 
-		it('should create a new user', (done) => {
-			request
+		it('should create a new user', async () => {
+			await request
 				.post(api('users.create'))
 				.set(credentials)
 				.send({
@@ -120,8 +120,16 @@ describe('[Users]', function () {
 
 					targetUser._id = res.body.user._id;
 					targetUser.username = res.body.user.username;
+				});
+
+			await request
+				.post(api('login'))
+				.send({
+					user: apiUsername,
+					password,
 				})
-				.end(done);
+				.expect('Content-Type', 'application/json')
+				.expect(200);
 		});
 
 		it('should create a new user with custom fields', (done) => {

packages/model-typings/src/models/IPushTokenModel.ts

@@ -5,4 +5,6 @@ import type { IBaseModel } from './IBaseModel';
 
 export interface IPushTokenModel extends IBaseModel<IPushToken> {
 	removeByUserIdExceptTokens(userId: string, tokens: string[]): Promise<DeleteResult>;
+
+	removeAllByUserId(userId: string): Promise<DeleteResult>;
 }