mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-25 03:42:06 +00:00
xarmian
33e49434ed
Two root causes behind users being logged out: - UA session binding was unconditional and fatal — any User-Agent change (browser/WebView update, DevTools device emulation, mobile rebuild) silently de-authenticated the session. Now log-only across all three enforcement sites (TokenAuth, SessionAuth, and the validateSessionCookie helper used by CLI-auth/account/session-check routes), mirroring the default IP-change handling. (BUG-1815) - Sessions had a fixed absolute TTL with no refresh on activity, so even an active user hit the cliff at 7d (web) / 30d (CLI). Adds sliding renewal: RenewSessionIfStale extends expires_at when past the half-window threshold, capped at created_at + 90d (SessionMaxLifetime), CAS-guarded and only reported when RowsAffected confirms the write. The middleware re-issues the session + CSRF cookies on renewal. New renew_ttl_seconds column (sqlite + pg migrations); legacy rows (0) keep their fixed expiry. (TASK-1816) Reviewed by Codex (clean). Tests: store + server suites pass.
7 lines
470 B
SQL
7 lines
470 B
SQL
-- Sliding-session renewal: remember each session's renewal window so the auth
|
|
-- middleware can extend expires_at on activity without re-deriving the TTL from
|
|
-- device_info (which doesn't reliably encode web vs CLI lifetimes).
|
|
-- 0 means "no sliding renewal" — legacy rows created before this migration keep
|
|
-- their fixed expiry and naturally age out; new sessions store their TTL here.
|
|
ALTER TABLE sessions ADD COLUMN renew_ttl_seconds INTEGER NOT NULL DEFAULT 0;
|