Check unusable device on user_auth plugin

[AlexVelezLl]

Summary

• Check unusable device on user_auth plugin.
• Move deprovision command logic to be a utils module so it can be reused in the command and in an async task.
• Clear the job store when deprovisioning the device.
• Fixes several places in the soud sync process that were relying on FacilityUsers.objects.get to support soft-deleted and hard-deleted syncs.

Grabacion.de.pantalla.2025-10-01.a.la.s.1.19.22.p.m.mov

References

Closes #13397

Notes

• When a soft-deleted or hard-deleted user is synced to the LOD device, the session is not yet removed, so it won't be logged out automatically. This will be fixed in http://github.com/learningequality/kolibri/pull/13757

[github-actions]

Build Artifacts

Asset type	Download link
PEX file	kolibri-0.19.0b0.dev0_git.53.g2e70e0c4.pex
Windows Installer (EXE)	kolibri-0.19.0b0.dev0+git.53.g2e70e0c4-windows-setup-unsigned.exe
Debian Package	kolibri_0.19.0b0.dev0+git.53.g2e70e0c4-0ubuntu1_all.deb
Mac Installer (DMG)	kolibri-0.19.0b0.dev0+git.53.g2e70e0c4.dmg
Android Package (APK)	kolibri-0.19.0b0.dev0+git.53.g2e70e0c4-0.1.6-debug.apk
Raspberry Pi Image	kolibri-pi-image-0.19.0b0.dev0+git.53.g2e70e0c4.zip
TAR file	kolibri-0.19.0b0.dev0+git.53.g2e70e0c4.tar.gz
WHL file	kolibri-0.19.0b0.dev0+git.53.g2e70e0c4-py2.py3-none-any.whl

[nucleogenesis]

Just one question - I'll tag in @pcenov to confirm the fix.

[nucleogenesis]

When the browser redirects here is there a chance we'd end up cancelling/clobbering the async function call through page navigation? This initially stuck out to me because you call an async function synchronously which seems less problematic above, but here I wonder if we might miss out on clearing the tasks if these run synchronously

[AlexVelezLl]

It shouldn't; we are not setting an abort controller on page navigation, therefore, the request won't be aborted. What we are not doing here is not caring about the API response and whether it was successful or not. But in theory, in this case, if the clear tasks fail, it is not enough reason to stop the user workflow. So, awaiting the clear tasks to finish would make sense here if we want to set up a retry logic until the tasks are actually cleared, but we haven't done this in any other place.

[pcenov]

LGTM, implemented as specified above but in order to fully test it I will need #13757 implemented.
At this point I can confirm that if the superuser is removed on the server, then once this gets synced to the device, if I sign out and attempt to sign in I am seeing the message informing me that the device is unusable.
If I restore the user and restart the app I can sign in again as the same superuser and see my previous interactions and progress made restored.
If I remove a normal learner account and sign out once this has been synced to the device, then the account is no longer listed at the sign in page. It can also be restored, and the progress made by the learner is preserved.

[rtibbles]

Seems like all comments have been addressed and what can be manually QAed is checking out. I am going to merge this, so I can rebase #13757 on top for fuller QA testing (and finalization of that PR).