krz/gitbay

web: idle timeout for browser sessions !487

merged merged by cmc on 2026-09-28 21:49 UTC · krz/gitbay:session-idle into main

Discussion

cmc

Browser sessions lapse when idle.

  • Migration 0062: web_sessions.absolute_expires_at and last_used_at. Existing sessions keep their current expiry as the absolute cap and get at most 12 hours from the migration.
  • expires_at slides to 12 hours after the last request (store.WebSessionIdle), never past the 7-day absolute cap; the renewal is written at most once a minute. An idle session is refused on read, and the retention sweep removes it as before.
  • web sessions list shows last use (USED column, --json field).
  • Users and Architecture pages; #276 leaves Known-Gaps; CHANGELOG.

Stacked on !486 (key-expiry).

Closes #276