Enable "logoutSessionsOnSensitiveChanges" for LB 2.x projects

[bajtos]

Description

• test cleanup: extract bootSandboxWithOptions()
• Modify "empty-server" template to enable
  "logoutSessionsOnSensitiveChanges" for projects using on LoopBack 2.x

Related issues

• Access token invalidation should be disabled by default in 2.x loopback#3068
• requires Add app setting logoutSessionsOnSensitiveChanges [2.x] loopback#3109 to be landed and released first

Checklist

• New tests added or existing tests modified to cover all changes
• Code conforms with the style
  guide

[bajtos]

@slnode test please

[superkhau]

expect(list).to.be.empty;

[bajtos]

https://github.com/moll/js-must#beware-of-libraries-that-assert-on-property-access

I could add dirty-chai and use .to.be.empty(), but I feel it's not worth the effort now.

[bajtos]

@slnode test please

[priyavivek1]

@bajtos : i have loopback 2.22.1 in my app. still i m getting the warnign message.

"The user model "User" is attached to an application that does not specify
whether other sessions should be invalidated when a password or
an email has changed. Session invalidation is important for security
reasons as it allows users to recover from various account breach
situations.

We recommend turning this feature on by setting
"logoutSessionsOnSensitiveChanges" to true in
server/config.json (unless you have implemented your own solution
for token invalidation).

We also recommend enabling "injectOptionsFromRemoteContext" in
User's settings (typically via common/models/*.json file).
This setting is required for the invalidation algorithm to keep
the current session valid"

Its was not coming a week back. but i was try publishing lopback 2.36.0 to our private repo. Seems some dependency carrying this message, Any idea??

[bajtos]

@priyavivek1 please run npm ls in your project and look for loopback instances in the output. You may want to run npm update on your local machine first (or rm -rf node_modules && npm install), to ensure you have the latest version of all your project dependencies as configured/allowed by package.json