IMHO this should be listed in the upgrading guide so people have a chance to learn about this changed behavior.

IMHO this should be listed in the upgrading guide so people have a chance to learn about this changed behavior.

I'm not entirely sure we should move on with this - looking at the code, the general assumption of implementations for this method is that only regular sessions are to be removed.

We should perhaps keep it that way and introduce a removeAllUserSessions - problem is how to do that without breaking API compatibility. The provider has no equivalent method for removing all offline sessions, which prevents me from adding a default removeAllUserSessions impl that would simply call the existing removeUserSessions and the missing removeOfflineUserSessions(RealmModel realm).

Also, there's no method to retrieve all offline sessions of a realm (only by client or user), so I can't even have a naive default impl for this removeAllUserSessions that would call the removeUserSessions and then iterate over all offline sessions removing them one by one.

So bottom line is that I haven't found a good way to introduce a default method for removing all sessions without breaking API compatibility.

So bottom line is that I haven't found a good way to introduce a default method for removing all sessions without breaking API compatibility.

I don't think we need to worry about backward compatibility in this case. Effectively, sessions are invalidated already we are just making sure they are removed despite their type (offline vs online).

But still, a note in release notes make sense.

I've sent another PR with a slightly different strategy - #34449

It should preserve the API compatibility and it also the semantics of the existing removeUserSessions(RealmModel realm) method in UserSessionProvider