This repository has been archived on 2026-04-03. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Jeffrey Smith a675d0440d Fix session cookie max-age bug; add UI hardening roadmap ...

Cookie max-age was 900s (15 min, matching access token) but refresh
token lives 7 days — users got bounced to login after 15 min idle
because the Go SSR middleware rejected the expired cookie before JS
could refresh. Now cookie max-age = 604800s (7 days) on both the
client (auth.js) and server (auth.go OIDC callback).

Go page-auth middleware accepts expired-but-signed JWTs via new
parseJWTIgnoringExpiry() so the page shell renders and the Preact SDK
can refresh client-side. API middleware still validates expiry strictly.
6 new middleware tests cover strict/lenient/tampered/garbage cases.

VERSION bumped to 0.6.8 (rebrand was already shipped but file missed).
ROADMAP-UI.md added with 7 milestones (v0.6.9–v0.6.15).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-01 09:12:43 +00:00

..

admin.go

Feat rebrand armature (#43)

2026-03-31 23:25:37 +00:00

auth_test.go

Fix session cookie max-age bug; add UI hardening roadmap

2026-04-01 09:12:43 +00:00

auth.go

Fix session cookie max-age bug; add UI hardening roadmap

2026-04-01 09:12:43 +00:00

errors.go

[BACKEND] Initialize Go backend structure and dependencies (#23)

2026-02-15 22:50:06 +00:00

logging.go

Changeset 0.33.0 (#207)

2026-03-19 21:37:32 +00:00

page_auth.go

Fix session cookie max-age bug; add UI hardening roadmap

2026-04-01 09:12:43 +00:00

permissions.go

Feat rebrand armature (#43)

2026-03-31 23:25:37 +00:00

prometheus.go

Feat rebrand armature (#43)

2026-03-31 23:25:37 +00:00

ratelimit.go

Feat rebrand armature (#43)

2026-03-31 23:25:37 +00:00

request_id.go

Changeset 0.33.0 (#207)

2026-03-19 21:37:32 +00:00

team.go

Feat rebrand armature (#43)

2026-03-31 23:25:37 +00:00

validate.go

Changeset 0.28.4 (#190)

2026-03-14 19:36:33 +00:00