Renew dashboard sessions on trusted user interaction #12

Merged

severus-snape merged 1 commit from fix/dashboard-session-renewal into main

2026-11-09 11:59:59 +00:00

severus-snape commented

2026-11-09 10:17:09 +00:00

Collaborator

Purpose

Keep actively used dashboard sessions alive without extending idle sessions through polling/SSE.

Changes

Trusted pointer/key/wheel interaction in visible page explicitly calls POST /api/auth/renew, throttled to once per minute.
No periodic renewal; no automatic productive request retry or forced login from a renewal error.
Disable renewal around logout. Keep existing cookie custody, server expiry and credential revocation.
Document backend compatibility and first-upgrade re-login.

Verification

npm run build passed; npm test 6/6 passed.
Both existing Playwright browser suites passed. Basic browser fixture now verifies real trusted interaction triggers one renewal, startup does not, subsequent input is throttled.
VM regression verifies hidden/synthetic events and elapsed time do not renew.
Independent review of both repos: no open P0/P1. Full authenticated TLS cookie renewal/logout browser E2E remains P2 coverage follow-up; backend HTTP tests cover secure cookie refresh and revocation.

Real dependency

Requires companion Plugins session-continuity change for actual renewal/restart persistence (backend branch fix/dashboard-session-continuity). Install backend first; older backends retain previous expiry behavior and safely reject renewals. No deployment or merge performed; normal review/checks and GitOps image update required, then live verification.

## Purpose Keep actively used dashboard sessions alive without extending idle sessions through polling/SSE. ## Changes - Trusted pointer/key/wheel interaction in visible page explicitly calls POST /api/auth/renew, throttled to once per minute. - No periodic renewal; no automatic productive request retry or forced login from a renewal error. - Disable renewal around logout. Keep existing cookie custody, server expiry and credential revocation. - Document backend compatibility and first-upgrade re-login. ## Verification - npm run build passed; npm test 6/6 passed. - Both existing Playwright browser suites passed. Basic browser fixture now verifies real trusted interaction triggers one renewal, startup does not, subsequent input is throttled. - VM regression verifies hidden/synthetic events and elapsed time do not renew. - Independent review of both repos: no open P0/P1. Full authenticated TLS cookie renewal/logout browser E2E remains P2 coverage follow-up; backend HTTP tests cover secure cookie refresh and revocation. ## Real dependency Requires companion Plugins session-continuity change for actual renewal/restart persistence (backend branch fix/dashboard-session-continuity). Install backend first; older backends retain previous expiry behavior and safely reject renewals. No deployment or merge performed; normal review/checks and GitOps image update required, then live verification.

severus-snape added 1 commit

2026-11-09 10:17:09 +00:00

fix(auth): renew idle sessions on trusted visible interaction

dashboard-ci / check (push) Successful in 35s

Details

c9bd97fbbe

severus-snape merged commit 35b3742e68 into main

2026-11-09 11:59:59 +00:00

severus-snape referenced this pull request from a commit

2026-11-09 11:59:59 +00:00

Merge pull request 'Renew dashboard sessions on trusted user interaction' (#12) from fix/dashboard-session-renewal into main