LightningNodeConnect.clear(options?: ClearOptions) only clears credential state — it
calls _authCoordinator.clearSession() and, if options.persisted === true,
_strategyManager.clearAll(). It never calls into _wasmManager in any branch, so the
live WASM connection (and the underlying wasmClientIsConnected/wasmClientInvokeRPC
state) stays fully alive after clear() returns.
Tearing down the connection requires the separate disconnect() method
(WasmManager.disconnect() removes the unload listener and calls
wasmClientDisconnect()), and the README's "Clearing Credentials" section already
acknowledges the gap in practice by recommending a full window.location.reload() after
clear() to guarantee a clean state, rather than documenting clear() + disconnect()
as the two calls a full logout requires.
The problem is discoverability, not just documentation. An integrator building a logout
flow has no signal from the method name, the ClearOptions type, or TypeScript itself
that clear() is credential-only — "clear" reads as the complete logout action. Skipping
disconnect() leaves the app in a state where credentials are gone but the WASM client is
still connected and could still be invoked via any RPC method that doesn't check auth
state client-side, until eventually cleaned up by an unload event the app may not even
trigger (e.g. an SPA route change with no full page reload).
Proposing one of:
- Have
clear() also call the equivalent of disconnect() by default (with an opt-out
for callers who genuinely want credentials cleared but the socket kept alive), or
- Add an explicit
disconnect: boolean field to ClearOptions so a full logout is one
call (clear({ persisted: true, disconnect: true })) instead of two separately-named,
easy-to-forget methods.
Happy to send a PR for either direction once the preferred approach is confirmed — opening
this first since it changes default behavior of a widely-used public method, which felt
worth discussing before code.
LightningNodeConnect.clear(options?: ClearOptions)only clears credential state — itcalls
_authCoordinator.clearSession()and, ifoptions.persisted === true,_strategyManager.clearAll(). It never calls into_wasmManagerin any branch, so thelive WASM connection (and the underlying
wasmClientIsConnected/wasmClientInvokeRPCstate) stays fully alive after
clear()returns.Tearing down the connection requires the separate
disconnect()method(
WasmManager.disconnect()removes theunloadlistener and callswasmClientDisconnect()), and the README's "Clearing Credentials" section alreadyacknowledges the gap in practice by recommending a full
window.location.reload()afterclear()to guarantee a clean state, rather than documentingclear()+disconnect()as the two calls a full logout requires.
The problem is discoverability, not just documentation. An integrator building a logout
flow has no signal from the method name, the
ClearOptionstype, or TypeScript itselfthat
clear()is credential-only — "clear" reads as the complete logout action. Skippingdisconnect()leaves the app in a state where credentials are gone but the WASM client isstill connected and could still be invoked via any RPC method that doesn't check auth
state client-side, until eventually cleaned up by an
unloadevent the app may not eventrigger (e.g. an SPA route change with no full page reload).
Proposing one of:
clear()also call the equivalent ofdisconnect()by default (with an opt-outfor callers who genuinely want credentials cleared but the socket kept alive), or
disconnect: booleanfield toClearOptionsso a full logout is onecall (
clear({ persisted: true, disconnect: true })) instead of two separately-named,easy-to-forget methods.
Happy to send a PR for either direction once the preferred approach is confirmed — opening
this first since it changes default behavior of a widely-used public method, which felt
worth discussing before code.