[mikepitre]

Summary

In the prebuilt UserProfile > Security > Active devices list, "Sign out of this device" revoked the session, but the device stayed in the list until you left and reopened Security.

Each row had its own DeviceViewModel. After a successful revoke it called Clerk.user?.activeSessions() and discarded the result, while the list itself lives in UserProfileSecurityViewModel. Two related problems:

• Every row shared one DeviceViewModel, because viewModel() was called without a key.
• The section passed onError = {}, so a failed sign-out showed nothing.

Sign-out now lives in UserProfileSecurityViewModel, which owns the list:

• Success: the revoked session is removed from the list in place, with no reload spinner.
• Failure: the list is unchanged, and the error appears in the screen's existing snackbar.

The row and section take an onSignOut callback, and DeviceViewModel and its test are deleted. That test only asserted the row's own Success state, which is why it passed while the list stayed stale.

Testing

• New UserProfileSecurityViewModelTest cases:
  • Sign-out success removes the revoked session from the listed sessions.
  • Sign-out failure keeps the list and reports the error.
• ./gradlew :source:ui:testDebugUnitTest :source:ui:spotlessCheck :source:ui:detekt passes (504 tests).

Verified on an emulator

The Active devices list only renders with #1002, and sign-out only succeeds with #997. So I verified with this branch merged locally with both: workbench on a clean API 36 emulator, test instance amusing-barnacle-26, the test user with six active sessions. "Sign out of this device" on the second row returned 200, and that row disappeared immediately, while the screen stayed on Security. Recording follows in a comment.

This PR doesn't depend on either one to merge, since it only changes where the list is updated.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added the ability to sign out individual devices from the security settings. Successfully signed-out devices are removed from the displayed session list.
• Bug Fixes
  • Sign-out errors are now reported through the security settings’ error handling, while failed sign-outs leave the device list unchanged.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: clerk/clerk-android/.coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: b9a79c33-eb2d-4537-b114-3ef9ec93ca54

📥 Commits

Reviewing files that changed from the base of the PR and between c58b14e and 41a3c71.

📒 Files selected for processing (7)

• source/ui/src/main/java/com/clerk/ui/userprofile/security/UserProfileSecurityView.kt
• source/ui/src/main/java/com/clerk/ui/userprofile/security/UserProfileSecurityViewModel.kt
• source/ui/src/main/java/com/clerk/ui/userprofile/security/device/DeviceViewModel.kt
• source/ui/src/main/java/com/clerk/ui/userprofile/security/device/UserProfileDeviceRow.kt
• source/ui/src/main/java/com/clerk/ui/userprofile/security/device/UserProfileDeviceSection.kt
• source/ui/src/test/java/com/clerk/ui/userprofile/security/UserProfileSecurityViewModelTest.kt
• source/ui/src/test/java/com/clerk/ui/userprofile/security/device/DeviceViewModelTest.kt

💤 Files with no reviewable changes (2)

• source/ui/src/main/java/com/clerk/ui/userprofile/security/device/DeviceViewModel.kt
• source/ui/src/test/java/com/clerk/ui/userprofile/security/device/DeviceViewModelTest.kt

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Walkthrough

Device sign-out now uses a callback from the device row to UserProfileSecurityViewModel. The view model revokes the selected session, removes it from a successful session list, and reports revocation errors.

Changes

Device-session sign-out

Layer / File(s)	Summary
Session revocation and state handling source/ui/src/main/java/com/clerk/ui/userprofile/security/UserProfileSecurityViewModel.kt, source/ui/src/main/java/com/clerk/ui/userprofile/security/device/DeviceViewModel.kt, source/ui/src/test/java/com/clerk/ui/userprofile/security/UserProfileSecurityViewModelTest.kt, source/ui/src/test/java/com/clerk/ui/userprofile/security/device/DeviceViewModelTest.kt	UserProfileSecurityViewModel now revokes a selected session, removes it from the session list when the state is successful, and reports errors through the callback. Tests cover successful and failed revocation. The former DeviceViewModel and its tests are removed.
Device-row sign-out callback source/ui/src/main/java/com/clerk/ui/userprofile/security/UserProfileSecurityView.kt, source/ui/src/main/java/com/clerk/ui/userprofile/security/device/UserProfileDeviceSection.kt, source/ui/src/main/java/com/clerk/ui/userprofile/security/device/UserProfileDeviceRow.kt	The security view passes the sign-out callback through the devices section to each row. A row invokes it with its session when sign-out is selected.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: swolfand

Merge Risk: ⚪ Minimal · up to 41a3c

Device sign-out now removes the session from the list on success and reports errors on failure. No merge-blocking risk was identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: removing a signed-out device from the list.
Description check	✅ Passed	The description explains why the change is needed, describes the implementation, documents testing, and reports emulator verification. It does not use the template headings and does not include the sc…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[mikepitre]

Emulator recording

Workbench on a clean Pixel (API 36) emulator, this branch merged locally with #1002 and #997. Path: UserButton > Security > Active devices.

Before the tap, the list had six devices. "Sign out of this device" on the second row (10:57 AM) returned 200 from /v1/me/sessions/{id}/revoke, and the row disappeared at once, while the screen stayed on Security. The app logged no crash.

devices-refresh-fixed.mp4

On main plus the same two PRs, the revoked device stayed listed until Security was reopened. I observed that during the #997 verification, and the recording is on that PR.

[swolfand]

Moving sign-out into the screen's ViewModel is the right ownership, and the tests check the list the user sees. Non-blocking: if a reload is still in flight when a revoke finishes, the state is Loading, so the removal is skipped and the revoked row can come back until the next reload. Keeping the revoked ids in a set and filtering them in loadSessions would close that. LGTM.