switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

Bump v0.6.9; update changelog and roadmap
Some checks failed
CI/CD / detect-changes (pull_request) Successful in 25s
Details
CI/CD / test-frontend (pull_request) Successful in 29s
Details
CI/CD / test-go-pg (pull_request) Failing after 2m58s
Details
CI/CD / test-sqlite (pull_request) Successful in 3m27s
Details
CI/CD / build-and-deploy (pull_request) Has been skipped
Details

Browse Source 
- VERSION → 0.6.9
- CHANGELOG: add v0.6.8 (cookie fix) and v0.6.9 (session lifetime config)
- ROADMAP-UI: mark v0.6.9 as shipped

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jeffrey Smith
2026-04-01 09:41:22 +00:00
parent 03c7bbed99
commit e8695dfd14
3 changed files with 61 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
ROADMAP-UI.md
View File

@@ -40,20 +40,10 @@
## Roadmap
### v0.6.9 — Session Lifetime Config
### v0.6.9 — Session Lifetime Config ✅
Make session duration admin-configurable and expose "keep me logged in" in the
login UI. The cookie max-age bug is already fixed (v0.6.8 shipped with 15-min
cookie vs 7-day refresh token; now both are 7 days, and the Go SSR middleware
accepts expired-but-signed JWTs so JS can refresh client-side).
| Step | Description |
|------|-------------|
| Admin session settings | Add `session.access_token_ttl` (default `15m`) and `session.refresh_token_ttl` (default `7d`) to the admin settings surface. Stored in the `settings` table, read by `generateTokens()`. Both values clamp to a sane range (access: 5m–60m, refresh: 1h–90d). |
| "Keep me logged in" checkbox | Login form gets an opt-in checkbox. When checked, the refresh token gets the full `refresh_token_ttl`. When unchecked, refresh token lifetime = `24h` (session-length). The cookie max-age tracks whichever lifetime was chosen. |
| Token generation uses config | `handlers/auth.go generateTokens()` reads TTLs from config instead of hardcoded `15 * time.Minute` / `7 * 24 * time.Hour`. The `expires_in` field in the JSON response reflects the actual access TTL so the client schedules refresh correctly. |
| Idle timeout (optional) | If the admin enables idle timeout (default: off), the server checks `last_activity_at` on the refresh-token row. If the gap exceeds `session.idle_timeout` (e.g. `2h`), the refresh is rejected. The client SDK pings `/api/v1/auth/activity` on user interaction (debounced, max once per minute). |
| Validation | Test matrix: default config, short access (5m), long refresh (30d), keep-me-logged-in on/off, idle timeout on/off. Background tab for >access TTL then navigate — should not redirect to login. |
Shipped. Admin-configurable TTLs, "keep me logged in" checkbox, idle timeout,
config-driven `generateTokens()`, 7 new tests. See CHANGELOG.md for details.
### v0.6.10 — Viewport Foundation
@@ -132,7 +122,7 @@ Make the UI machine-auditable so Claude Code can run an automated survey.
## Sequencing Rationale
```
v0.6.9 Session Lifetime Config ← Cookie bug fix already shipped; make TTLs configurable
v0.6.9 Session Lifetime Config ✅ SHIPPED
↓
v0.6.10 Viewport Foundation ← Everything depends on correct containment
↓