Feat v0.6.9 cookie fix roadmap #44

Merged

xcaliber merged 3 commits from feat/v0.6.9-cookie-fix-roadmap into main 2026-04-01 09:41:59 +00:00

Conversation 0 Commits 3 Files Changed 20 +866 -42

xcaliber commented 2026-04-01 09:41:54 +00:00

Owner

Copy Link

No description provided.

xcaliber added 3 commits 2026-04-01 09:41:55 +00:00

Fix session cookie max-age bug; add UI hardening roadmap ... a675d0440d

Cookie max-age was 900s (15 min, matching access token) but refresh
token lives 7 days — users got bounced to login after 15 min idle
because the Go SSR middleware rejected the expired cookie before JS
could refresh. Now cookie max-age = 604800s (7 days) on both the
client (auth.js) and server (auth.go OIDC callback).

Go page-auth middleware accepts expired-but-signed JWTs via new
parseJWTIgnoringExpiry() so the page shell renders and the Preact SDK
can refresh client-side. API middleware still validates expiry strictly.
6 new middleware tests cover strict/lenient/tampered/garbage cases.

VERSION bumped to 0.6.8 (rebrand was already shipped but file missed).
ROADMAP-UI.md added with 7 milestones (v0.6.9–v0.6.15).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Feat v0.6.9 session lifetime config ... 03c7bbed99

- Admin-configurable session TTLs (access: 5m–60m, refresh: 1h–90d)
  stored in global_settings under "session" key
- "Keep me logged in" checkbox on login form; unchecked caps refresh
  token at 24h, checked uses full admin-configured TTL
- generateTokens() reads config instead of hardcoded 15m/7d; expires_in
  and refresh_expires_in in JSON response reflect actual TTLs
- Cookie max-age tracks chosen refresh lifetime (not hardcoded 604800)
- Optional idle timeout: admin toggle + configurable duration; server
  rejects refresh if last_activity_at exceeds threshold
- Client SDK activity ping (POST /auth/activity, debounced 1/min)
- Admin Settings > Session section with dropdowns for all three knobs
- 7 new unit tests for duration parsing, clamping, and defaults

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Bump v0.6.9; update changelog and roadmap ... e8695dfd14

- VERSION → 0.6.9
- CHANGELOG: add v0.6.8 (cookie fix) and v0.6.9 (session lifetime config)
- ROADMAP-UI: mark v0.6.9 as shipped

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

xcaliber merged commit 617d81e7d4 into main 2026-04-01 09:41:59 +00:00

xcaliber deleted branch feat/v0.6.9-cookie-fix-roadmap 2026-04-01 09:41:59 +00:00

xcaliber referenced this issue from a commit 2026-04-01 09:42:01 +00:00

Feat v0.6.9 cookie fix roadmap (#44)

This repo is archived. You cannot comment on pull requests.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Assignees

Clear assignees

xcaliber

No Assignees

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: switchboard/core#44