Fix dashboard session expiry and restart continuity #75

Merged

severus-snape merged 2 commits from fix/dashboard-session-continuity into main

2026-11-09 11:59:57 +00:00

severus-snape commented

2026-11-09 10:17:08 +00:00

Collaborator

Purpose

Fix unexpected dashboard logouts at the fixed one-hour boundary and after regular backend restart, without allowing polling/SSE to keep idle sessions alive.

Changes

Persist only opaque token hashes, audience and expiry in existing private identity/account.json. Existing stores migrate on write; old memory-only sessions require one fresh login.
Add explicit same-origin POST /api/auth/renew, refreshing secure cookie and server expiry. Auth reads do not renew.
Serialize durable session mutations and credential commits; confirm logout only after persistence. Credential changes still revoke every session, including unchanged account saves.
Drain writes through foreground admission. Stop fences the old identity; restart restores unexpired sessions.

Verification

40/40 Identity and Dashboard API tests passed, including plugin activation/restart, file permissions/hash-only storage, logout/account revocation, failure recovery, explicit expiry, renewal cookie and CSRF.
Independent read-only review of both backend/frontend changes: no remaining P0/P1. Prior P1 credential-save/renew race fixed and deterministic regression added.
diff --check clean.

Dependencies and delivery

Backend independently deployable/backward compatible. Companion WebUI branch fix/dashboard-session-renewal enables interaction-driven renewal; deploy backend first. No Core change. No live deployment or merges performed. Requires normal checks/review, then GitOps image update and live verification. Main review tool was scoped to clean Core cwd; independent subagent review covered actual plugin changes.

Limits

Existing memory-only sessions cannot be recovered. Configured lifetimes below frontend one-minute renewal cadence can still expire during use (documented). Full authenticated TLS browser renewal/cookie/logout E2E remains P2 coverage follow-up; endpoint cookie tests, real-browser trusted-interaction test and VM idle/throttle tests cover the components.

## Purpose Fix unexpected dashboard logouts at the fixed one-hour boundary and after regular backend restart, without allowing polling/SSE to keep idle sessions alive. ## Changes - Persist only opaque token hashes, audience and expiry in existing private identity/account.json. Existing stores migrate on write; old memory-only sessions require one fresh login. - Add explicit same-origin POST /api/auth/renew, refreshing secure cookie and server expiry. Auth reads do not renew. - Serialize durable session mutations and credential commits; confirm logout only after persistence. Credential changes still revoke every session, including unchanged account saves. - Drain writes through foreground admission. Stop fences the old identity; restart restores unexpired sessions. ## Verification - 40/40 Identity and Dashboard API tests passed, including plugin activation/restart, file permissions/hash-only storage, logout/account revocation, failure recovery, explicit expiry, renewal cookie and CSRF. - Independent read-only review of both backend/frontend changes: no remaining P0/P1. Prior P1 credential-save/renew race fixed and deterministic regression added. - diff --check clean. ## Dependencies and delivery Backend independently deployable/backward compatible. Companion WebUI branch fix/dashboard-session-renewal enables interaction-driven renewal; deploy backend first. No Core change. No live deployment or merges performed. Requires normal checks/review, then GitOps image update and live verification. Main review tool was scoped to clean Core cwd; independent subagent review covered actual plugin changes. ## Limits Existing memory-only sessions cannot be recovered. Configured lifetimes below frontend one-minute renewal cadence can still expire during use (documented). Full authenticated TLS browser renewal/cookie/logout E2E remains P2 coverage follow-up; endpoint cookie tests, real-browser trusted-interaction test and VM idle/throttle tests cover the components.

severus-snape added 1 commit

2026-11-09 10:17:08 +00:00

fix(identity): persist and explicitly renew dashboard sessions

plugins-ci / compatibility (push) Failing after 1m45s

Details

126e438264

severus-snape added 1 commit

2026-11-09 10:31:51 +00:00

Merge remote-tracking branch 'origin/main' into fix/dashboard-session-continuity

plugins-ci / compatibility (push) Successful in 1m57s

Details

bfe8d7944a