Deprecate SessionManager::delete()

Problem/Motivation

SessionManager::delete() is the only remaining method which is directly accessing the database. The code should be extracted into a separate service so that modules wishing to swap out the session storage backend do not need to override SessionManager anymore.

Steps to reproduce

Proposed resolution

• Deprecate SessionManager::delete()
• Reassign the responsibility to remove all sessions of a user to a new UserSessionRepository service.

The SessionManager::delete() method previously was guarded by the WriteSafeSessionHandler. That session handler proxy has the responsibility to prevent writing a session record in unsafe conditions. In core it is used when AccountSwitcher temporarily substitutes the current user with a different one. If something triggers a session write during that time window, write safe session handler prevents the session record from being updated with the id of the temporary user.

On the other hand, UserSessionRepository::deleteAll() (the replacement for SessionManager::delete()) isn't necessarily targeting the current session. In some cases it is even used to delete all sessions of a different user. This is, e.g., the case in Drupal\user\Entity\User::postSave() where all sessions are removed of a user being blocked.

For this reason UserSessionRepository::deleteAll() is neither guarded by the WriteSafeSessionHandler nor by a CLI check.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet