From 47703c11097e480db2f8ca093d5ffb4eee0a169b Mon Sep 17 00:00:00 2001
From: Jake Dallimore <jake@moodle.com>
Date: Mon, 15 May 2023 09:48:43 +0800
Subject: [PATCH] MDL-78219 auth_lti: force empty session before launch user
 creation

If an existing session is active at the time of launch, that user id
appears in the user_created log, incorrectly (it should be system/0).
This patch makes sure that any existing session is terminated before
creation of a new user during launches.
---
 auth/lti/auth.php | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/auth/lti/auth.php b/auth/lti/auth.php
index c5fb73ebb03..d68f3eb1b77 100644
--- a/auth/lti/auth.php
+++ b/auth/lti/auth.php
@@ -247,6 +247,10 @@ class auth_plugin_lti extends \auth_plugin_base {
                         "'{$launchdata['iss']}'. The migration claim could not be validated. A new account will be created.");
                 }
             }
+            // At the point of the creation, to ensure the user_created event correctly reflects the creating user of '0' (the user
+            // performing the action), ensure any active session is terminated and an empty session initialised.
+            $this->empty_session();
+
             $user = $this->create_new_account($launchdata, $launchdata['iss']);
             $this->update_user_account($user, $launchdata, $launchdata['iss']);
             return \core_user::get_user($user->id);
@@ -301,6 +305,17 @@ class auth_plugin_lti extends \auth_plugin_base {
         return $binduser;
     }
 
+    /**
+     * If there's an existing session, inits an empty session.
+     *
+     * @return void
+     */
+    protected function empty_session(): void {
+        if (isloggedin()) {
+            \core\session\manager::init_empty_session();
+        }
+    }
+
     /**
      * Check whether a provisioning mode is valid or not.
      *