feat: add magic link force login config

[warcooft]

Description

This feature provides config for developers so that the behavior when checking user sessions in the startLogin function can be easily controlled. So the user does not need to log out to assign a new user session.

We also set the default value in that configuration to false to preserve the previous behavior

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[kenjis]

This seems to invalidate the following security check.
So I think this is a security hole.

[warcooft]

should we delete the old session and then continue its state safely?

[kenjis]

LogicException means, "your code has a bug, so please fix it".
So I never accept a flag to disable LogicException.
This PR seems to be wrong implementation.

First of all, why a logged in user uses magic link login?

[warcooft]

I submit a magicLink request using the incognito browser, then the magicLink sends an email to my my gmail in main browser. when opened it will cause a LogicException because in my main browser I am already logged in.

[warcooft]

But this scenario rarely happens in real cases. this case often occurs when development involves switching accounts with specific roles.

[kenjis]

I submit a magicLink request using the incognito browser, then the magicLink sends an email to my my gmail in main browser. when opened it will cause a LogicException because in my main browser I am already logged in.

This could happen rarely.
In this case, the CodeIgniter\Shield\Exceptions\LogicException should not happen.
But I don't think you should be logged out automatically and logged in with the magic link.
Because this scenario is not a normal use case.
Showing the message with "you are already logged in as ..." is better?

[kenjis]

this case often occurs when development involves switching accounts with specific roles.

Shield does not have a feature to switch accounts.
When you are logged in, if you navigate to login or login/magic-link, you will be redirected.

[warcooft]

I submit a magicLink request using the incognito browser, then the magicLink sends an email to my my gmail in main browser. when opened it will cause a LogicException because in my main browser I am already logged in.

This could happen rarely. In this case, the CodeIgniter\Shield\Exceptions\LogicException should not happen. But I don't think you should be logged out automatically and logged in with the magic link. Because this scenario is not a normal use case. Showing the message with "you are already logged in as ..." is better?

I agree instead of displaying exception/whoops page.