|
|
03c7bbed99
|
Feat v0.6.9 session lifetime config
- Admin-configurable session TTLs (access: 5m–60m, refresh: 1h–90d)
stored in global_settings under "session" key
- "Keep me logged in" checkbox on login form; unchecked caps refresh
token at 24h, checked uses full admin-configured TTL
- generateTokens() reads config instead of hardcoded 15m/7d; expires_in
and refresh_expires_in in JSON response reflect actual TTLs
- Cookie max-age tracks chosen refresh lifetime (not hardcoded 604800)
- Optional idle timeout: admin toggle + configurable duration; server
rejects refresh if last_activity_at exceeds threshold
- Client SDK activity ping (POST /auth/activity, debounced 1/min)
- Admin Settings > Session section with dropdowns for all three knobs
- 7 new unit tests for duration parsing, clamping, and defaults
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
2026-04-01 09:35:43 +00:00 |
|
