Fix severe session data loss during user possession/unpossession

src/PossessionManager.php

@@ -96,8 +96,7 @@ protected function logoutAndDestroySession ( $guard = null ): void
 		Auth::logout();
 	 }
 
-	 Session::invalidate();
+	 Session::regenerate();
 	 Session::regenerateToken();
-	 Session::flush();
   }
 }

tests/SessionDataTest.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace Verseles\Possession\Tests;
+
+use Illuminate\Foundation\Auth\User as Authenticatable;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Session;
+use Verseles\Possession\Facades\Possession;
+use Verseles\Possession\Traits\ImpersonatesUsers;
+
+class SessionDataUserStub extends Authenticatable
+{
+    use ImpersonatesUsers;
+
+    protected $guarded = [];
+    protected $table = 'users';
+
+    public function canPossess(): bool
+    {
+        return true;
+    }
+}
+
+class SessionDataTest extends TestCase
+{
+    protected function getEnvironmentSetUp($app)
+    {
+        $app['config']->set('possession.user_model', SessionDataUserStub::class);
+        $app['config']->set('possession.admin_guard', 'web');
+        $app['config']->set('possession.session_keys.original_user', 'possession_original_user');
+        $app['config']->set('possession.session_keys.impersonation_guard', 'possession_impersonation_guard');
+
+        // Need to define the provider explicitly as it defaults to standard User class
+        $app['config']->set('auth.providers.users.model', SessionDataUserStub::class);
+
+        $app['db']->connection()->getSchemaBuilder()->create('users', function ($table) {
+            $table->increments('id');
+            $table->string('name');
+            $table->string('email');
+            $table->string('password');
+            $table->timestamps();
+        });
+    }
+
+    public function test_it_retains_session_data_when_possessing_and_unpossessing()
+    {
+        $admin = SessionDataUserStub::create(['name' => 'Admin', 'email' => 'admin@example.com', 'password' => 'password']);
+        $user1 = SessionDataUserStub::create(['name' => 'User 1', 'email' => 'user1@example.com', 'password' => 'password']);
+
+        Auth::login($admin);
+        Session::put('my_custom_data', 'foo');
+        $initialSessionId = Session::getId();
+        $initialToken = Session::token();
+
+        Possession::possess($user1);
+
+        $this->assertEquals('foo', Session::get('my_custom_data'));
+        $this->assertNotEquals($initialSessionId, Session::getId());
+        $this->assertNotEquals($initialToken, Session::token());
+
+        $possessedSessionId = Session::getId();
+        $possessedToken = Session::token();
+
+        Possession::unpossess();
+
+        $this->assertEquals('foo', Session::get('my_custom_data'));
+        $this->assertNotEquals($possessedSessionId, Session::getId());
+        $this->assertNotEquals($possessedToken, Session::token());
+    }
+}