switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

Feat v0.6.9 cookie fix roadmap #44

Merged
xcaliber merged 3 commits from feat/v0.6.9-cookie-fix-roadmap into main 2026-04-01 09:41:59 +00:00
Conversation 0 Commits 3 Files Changed 20 +866 -42

3 Commits

Author SHA1 Message Date
Jeffrey Smith
e8695dfd14 Bump v0.6.9; update changelog and roadmap
Some checks failed
CI/CD / detect-changes (pull_request) Successful in 25s
Details
CI/CD / test-frontend (pull_request) Successful in 29s
Details
CI/CD / test-go-pg (pull_request) Failing after 2m58s
Details
CI/CD / test-sqlite (pull_request) Successful in 3m27s
Details
CI/CD / build-and-deploy (pull_request) Has been skipped
Details 
- VERSION → 0.6.9
- CHANGELOG: add v0.6.8 (cookie fix) and v0.6.9 (session lifetime config)
- ROADMAP-UI: mark v0.6.9 as shipped

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-01 09:41:22 +00:00
Jeffrey Smith
03c7bbed99 Feat v0.6.9 session lifetime config 
- Admin-configurable session TTLs (access: 5m–60m, refresh: 1h–90d)
  stored in global_settings under "session" key
- "Keep me logged in" checkbox on login form; unchecked caps refresh
  token at 24h, checked uses full admin-configured TTL
- generateTokens() reads config instead of hardcoded 15m/7d; expires_in
  and refresh_expires_in in JSON response reflect actual TTLs
- Cookie max-age tracks chosen refresh lifetime (not hardcoded 604800)
- Optional idle timeout: admin toggle + configurable duration; server
  rejects refresh if last_activity_at exceeds threshold
- Client SDK activity ping (POST /auth/activity, debounced 1/min)
- Admin Settings > Session section with dropdowns for all three knobs
- 7 new unit tests for duration parsing, clamping, and defaults

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-01 09:35:43 +00:00
Jeffrey Smith
a675d0440d Fix session cookie max-age bug; add UI hardening roadmap 
Cookie max-age was 900s (15 min, matching access token) but refresh
token lives 7 days — users got bounced to login after 15 min idle
because the Go SSR middleware rejected the expired cookie before JS
could refresh. Now cookie max-age = 604800s (7 days) on both the
client (auth.js) and server (auth.go OIDC callback).

Go page-auth middleware accepts expired-but-signed JWTs via new
parseJWTIgnoringExpiry() so the page shell renders and the Preact SDK
can refresh client-side. API middleware still validates expiry strictly.
6 new middleware tests cover strict/lenient/tampered/garbage cases.

VERSION bumped to 0.6.8 (rebrand was already shipped but file missed).
ROADMAP-UI.md added with 7 milestones (v0.6.9–v0.6.15).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-01 09:12:43 +00:00