!487 · krz/gitbay

.gitbay/wiki/Architecture/05-Identity-and-Access.org +2 −1

 | SSH user key       | user's public key                               | fingerprint and public blob      | =full=, =git=, or =runner=                 | optional =--ttl=, refused at auth | =keys remove= (own keys); closes its connections |
 | Deploy key         | public key                                      | same table, scope =deploy:<repo>:ro/rw= | one repository, read or read-write  | optional =--ttl=, refused at auth | =repo deploy-key remove= (repo admin); closes its connections |
 | API token          | =gb_= + 32 random bytes hex                     | SHA-256 hash                     | =read= (default) or =full=; with an expiry, no credential-minting command | optional =--ttl=              | =token revoke [--created]=          |
-| Web session        | 32 random bytes hex, cookie =gitbay_session=    | SHA-256 hash                     | full account                               | 7 days, no sliding renewal    | logout, =web sessions revoke=       |
+| Web session        | 32 random bytes hex, cookie =gitbay_session=    | SHA-256 hash                     | full account                               | 12 h idle, 7 days absolute    | logout, =web sessions revoke=       |
 | Login link         | 32 random bytes hex in a URL                    | SHA-256 hash, single use         | creates a web session                      | 15 min (mail), 5 min (SSH)    | consumed on use                     |
 | Email verification | 32 random bytes hex                             | SHA-256 hash, single use         | verifies one address for one account       | 24 h                          | consumed on use                     |
 | Invite             | random code                                     | SHA-256 hash, single use         | one registration for one email             | as issued                     | consumed on use                     |
 Generation and hashing: =internal/store/sessions.go= (=NewToken=,
 =HashToken=, =crypto/rand=). Cookie attributes: =HttpOnly=,
 =SameSite=Lax=, =Secure= unless TLS is off, =MaxAge= 7 days
+(the session itself also ends after 12 hours idle)
 (=internal/httpd/accounts.go=). Token scope values are
 constrained by a database =CHECK= as well as the command
 (=internal/store/migrations/0004_api_tokens.up.sql=).

.gitbay/wiki/Architecture/09-Controls.org +1 −1

	@@ -23,7 +23,7 @@ chapter names of OWASP ASVS 4.0 where one fits.
23	\| Brute-force limit on SSH auth \| in place \| 10 failures a minute per IP (=internal/sshd/ratelimit.go=) \|	23	\| Brute-force limit on SSH auth \| in place \| 10 failures a minute per IP (=internal/sshd/ratelimit.go=) \|
24	\| Account enumeration resistance at login \| in place \| uniform response (=internal/control/loginlink.go=) \|	24	\| Account enumeration resistance at login \| in place \| uniform response (=internal/control/loginlink.go=) \|
25	\| Session cookie flags \| in place \| HttpOnly, SameSite=Lax, Secure with TLS (=internal/httpd/accounts.go=) \|	25	\| Session cookie flags \| in place \| HttpOnly, SameSite=Lax, Secure with TLS (=internal/httpd/accounts.go=) \|
26	\| Session lifetime \| partial \| 7 days absolute, no idle timeout (#276) \|	26	\| Session lifetime \| in place \| 12 hours idle, 7 days absolute (=internal/store/sessions.go=) \|
27	\| Credential expiry \| in place \| optional =--ttl= on API tokens, SSH and deploy keys; checked at auth and per exec \|	27	\| Credential expiry \| in place \| optional =--ttl= on API tokens, SSH and deploy keys; checked at auth and per exec \|
28	\| Revocation takes effect immediately \| in place \| removing a key or disabling an account closes its connections; every exec re-reads its key (=internal/sshd/sshd.go=) \|	28	\| Revocation takes effect immediately \| in place \| removing a key or disabling an account closes its connections; every exec re-reads its key (=internal/sshd/sshd.go=) \|
29	\| Delegation bounded by the delegating credential \| partial \| expiring tokens refused on =MintsCredential= commands; credentials record their creating token (=internal/control/control.go=); a web session can still mint credentials that outlive it (#297) \|	29	\| Delegation bounded by the delegating credential \| partial \| expiring tokens refused on =MintsCredential= commands; credentials record their creating token (=internal/control/control.go=); a web session can still mint credentials that outlive it (#297) \|

.gitbay/wiki/Architecture/10-Known-Gaps.org −1

	@@ -19,7 +19,6 @@ what the 2026-09-27 review found; remove a row when its issue closes.
19	\| #273 \| Data at rest \| CI secrets, webhook secrets and mirror tokens are stored in clear in SQLite \| high \|	19	\| #273 \| Data at rest \| CI secrets, webhook secrets and mirror tokens are stored in clear in SQLite \| high \|
20	\| #274 \| Backups \| The local backup archive is not encrypted \| medium \|	20	\| #274 \| Backups \| The local backup archive is not encrypted \| medium \|
21	\| #275 \| Audit \| Refused writes are not audited; the audit table is writable by the daemon user \| medium \|	21	\| #275 \| Audit \| Refused writes are not audited; the audit table is writable by the daemon user \| medium \|
22	\| #276 \| Sessions \| Web sessions last 7 days with no idle timeout \| low \|
23	\| #278 \| Login links \| =web login= over SSH skips the login-link rate limit \| low \|	22	\| #278 \| Login links \| =web login= over SSH skips the login-link rate limit \| low \|
24	\| #279 \| SSRF \| Mirror URLs are checked when saved, not when git connects \| medium \|	23	\| #279 \| SSRF \| Mirror URLs are checked when saved, not when git connects \| medium \|
25	\| #280 \| Mail \| STARTTLS only when the relay offers it \| medium \|	24	\| #280 \| Mail \| STARTTLS only when the relay offers it \| medium \|

.gitbay/wiki/Users.org +4 −3

	@@ -682,9 +682,10 @@ and deletes through the commands above.
682		682
683	* Browser sessions	683	* Browser sessions
684		684
685	=gitbay web login= mints a one-time URL; the session it opens lasts	685	=gitbay web login= mints a one-time URL; the session it opens ends
686	seven days. =gitbay web sessions list= shows each of yours by a short	686	after twelve hours without a request, and after seven days in any case.
687	id with its creation and expiry, and =gitbay web sessions revoke <id>=	687	=gitbay web sessions list= shows each of yours by a short id with its
		688	creation, expiry and last use, and =gitbay web sessions revoke <id>=
688	or =--all= ends them from the terminal, which is where a lost laptop is	689	or =--all= ends them from the terminal, which is where a lost laptop is
689	handled.	690	handled.
690		691

CHANGELOG.org +5 −1

 * Unreleased
-Credentials: revocation, delegation and expiry (#256, #257, #277).
+Credentials and sessions: revocation, delegation, expiry and an idle
+timeout (#256, #257, #276, #277).
 *Upgrade note.* =token create= makes a =read= token unless given
 =--scope full=. A script that mints a token and then writes with it
   =EXPIRES= columns, after the label (#277).
 - =token list= at a terminal shows a future expiry as a time, not
   "just now" (#286).
+- Browser sessions end after twelve hours without a request, and after
+  seven days as before. Sessions open at upgrade get a fresh twelve
+  hours. =web sessions list= shows when each was last used (#276).
 * v1.36.0 — 2026-09-23

internal/control/web.go +2 −2

	@@ -40,7 +40,7 @@ func runWebSessionsList(c *Ctx, args []string) int {
40	return c.fail(protocol.ExitFailure, "%v", err)	40	return c.fail(protocol.ExitFailure, "%v", err)
41	}	41	}
42	return c.emit(sessions, func(w io.Writer) {	42	return c.emit(sessions, func(w io.Writer) {
43	tb := c.table(w, "ID", "SINCE", "UNTIL")	43	tb := c.table(w, "ID", "SINCE", "UNTIL", "USED")
44	for _, s := range sessions {	44	for _, s := range sessions {
45	since, until := s.CreatedAt, s.ExpiresAt	45	since, until := s.CreatedAt, s.ExpiresAt
46	if c.Term.Cols == 0 {	46	if c.Term.Cols == 0 {
	@@ -48,7 +48,7 @@ func runWebSessionsList(c *Ctx, args []string) int {
48	} else {	48	} else {
49	since, until = relAge(since, termNow()), relAge(until, termNow())	49	since, until = relAge(since, termNow()), relAge(until, termNow())
50	}	50	}
51	tb.row(cRef(s.ID), cText("since "+since), cText("until "+until))	51	tb.row(cRef(s.ID), cText("since "+since), cText("until "+until), cText(c.usedText(s.LastUsedAt)))
52	}	52	}
53	tb.flush()	53	tb.flush()
54	})	54	})

internal/httpd/accounts.go +2

 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
+	// Seven days is the cap; the store ends it sooner after
+	// store.WebSessionIdle without a request.
 	if err := s.st.CreateWebSession(sessHash, userID, 7*24*time.Hour); err != nil {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return

internal/store/migrations/0062_web_session_idle.down.sql added +3

@@ -0,0 +1,3 @@
	1	UPDATE web_sessions SET expires_at = absolute_expires_at;
	2	ALTER TABLE web_sessions DROP COLUMN last_used_at;
	3	ALTER TABLE web_sessions DROP COLUMN absolute_expires_at;

internal/store/migrations/0062_web_session_idle.up.sql added +8

@@ -0,0 +1,8 @@
	1	-- expires_at slides forward on use, never past absolute_expires_at.
	2	-- Sessions open now keep their cap and get a full idle window from here.
	3	ALTER TABLE web_sessions ADD COLUMN absolute_expires_at TEXT;
	4	ALTER TABLE web_sessions ADD COLUMN last_used_at TEXT;
	5	UPDATE web_sessions SET
	6	absolute_expires_at = expires_at,
	7	last_used_at = strftime('%Y-%m-%dT%H:%M:%fZ','now'),
	8	expires_at = min(expires_at, strftime('%Y-%m-%dT%H:%M:%fZ','now','+12 hours'));

internal/store/sessions.go +25 −9

 	return userID, err
 }
+// WebSessionIdle is how long a browser session lasts without a request.
+// Each use moves its expiry this far ahead, never past the cap it was
+// created with. Migration 0062 repeats the value for sessions it
+// converts.
+const WebSessionIdle = 12 * time.Hour
+// CreateWebSession stores a session that lapses after WebSessionIdle
+// without use, and after ttl regardless.
 func (s *Store) CreateWebSession(hash string, userID int64, ttl time.Duration) error {
+	now := time.Now()
 	_, err := s.DB.Exec(
-		"INSERT INTO web_sessions (token_hash, user_id, expires_at) VALUES (?, ?, ?)",
+		"INSERT INTO web_sessions (token_hash, user_id, expires_at, absolute_expires_at, last_used_at) VALUES (?, ?, ?, ?, ?)",
-		hash, userID, fmtTime(time.Now().Add(ttl)))
+		hash, userID, fmtTime(now.Add(min(ttl, WebSessionIdle))), fmtTime(now.Add(ttl)), fmtTime(now))
 	return err
 }
-// WebSessionUser resolves a session cookie hash to its user.
+// WebSessionUser resolves a session cookie hash to its user and renews
+// the session's idle expiry. A session is written at most once a
+// minute, so a burst of requests costs one UPDATE.
 func (s *Store) WebSessionUser(hash string) (User, error) {
+	now := time.Now()
 	var userID int64
 	err := s.DB.QueryRow(
 		"SELECT user_id FROM web_sessions WHERE token_hash = ? AND expires_at > ?",
-		hash, fmtTime(time.Now())).Scan(&userID)
+		hash, fmtTime(now)).Scan(&userID)
 	if errors.Is(err, sql.ErrNoRows) {
 		return User{}, ErrNotFound
 	}
 	if err != nil {
 		return User{}, err
 	}
+	s.DB.Exec(`UPDATE web_sessions SET last_used_at = ?, expires_at = min(absolute_expires_at, ?)
+		WHERE token_hash = ? AND last_used_at < ?`,
+		fmtTime(now), fmtTime(now.Add(WebSessionIdle)), hash, fmtTime(now.Add(-time.Minute)))
 	return s.UserByID(userID)
 }
 // twelve hex digits of the stored token hash: enough to name it, and a
 // hash of the cookie rather than the cookie.
 type WebSession struct {
-	ID        string `json:"id"`
+	ID         string `json:"id"`
-	CreatedAt string `json:"created_at"`
+	CreatedAt  string `json:"created_at"`
-	ExpiresAt string `json:"expires_at"`
+	ExpiresAt  string `json:"expires_at"`
+	LastUsedAt string `json:"last_used_at"`
 }
 // ListWebSessions lists the user's unexpired browser sessions, newest first.
 func (s *Store) ListWebSessions(userID int64) ([]WebSession, error) {
-	rows, err := s.DB.Query(`SELECT substr(token_hash, 1, 12), created_at, expires_at
+	rows, err := s.DB.Query(`SELECT substr(token_hash, 1, 12), created_at, expires_at, COALESCE(last_used_at, created_at)
 		FROM web_sessions WHERE user_id = ? AND expires_at > ? ORDER BY created_at DESC`,
 		userID, fmtTime(time.Now()))
 	if err != nil {
 	var out []WebSession
 	for rows.Next() {
 		var ws WebSession
-		if err := rows.Scan(&ws.ID, &ws.CreatedAt, &ws.ExpiresAt); err != nil {
+		if err := rows.Scan(&ws.ID, &ws.CreatedAt, &ws.ExpiresAt, &ws.LastUsedAt); err != nil {
 			return nil, err
 		}
 		out = append(out, ws)

internal/store/sessions_test.go +73

	@@ -1,6 +1,7 @@
1	package store	1	package store
2		2
3	import (	3	import (
		4	"database/sql"
4	"testing"	5	"testing"
5	"time"	6	"time"
6	)	7	)
	@@ -44,3 +45,75 @@ func TestCountLoginTokensSince(t *testing.T) {
44	t.Fatalf("other account count = %d, %v; want 0", n, err)	45	t.Fatalf("other account count = %d, %v; want 0", n, err)
45	}	46	}
46	}	47	}
		48
		49	func sessionFixture(t testing.T) (Store, int64) {
		50	t.Helper()
		51	s := open(t)
		52	if err := s.MigrateUp(); err != nil {
		53	t.Fatal(err)
		54	}
		55	uid, err := s.CreateUser("cmc", false)
		56	if err != nil {
		57	t.Fatal(err)
		58	}
		59	return s, uid
		60	}
		61
		62	func sessionTimes(t testing.T, s Store, hash string) (expires, absolute time.Time) {
		63	t.Helper()
		64	var e, a string
		65	if err := s.DB.QueryRow("SELECT expires_at, absolute_expires_at FROM web_sessions WHERE token_hash = ?", hash).Scan(&e, &a); err != nil {
		66	t.Fatal(err)
		67	}
		68	return parseTime(sql.NullString{String: e, Valid: true}), parseTime(sql.NullString{String: a, Valid: true})
		69	}
		70
		71	func TestWebSessionIdleExpiry(t *testing.T) {
		72	s, uid := sessionFixture(t)
		73	if err := s.CreateWebSession("h", uid, 724time.Hour); err != nil {
		74	t.Fatal(err)
		75	}
		76	exp, abs := sessionTimes(t, s, "h")
		77	if d := time.Until(exp); d < WebSessionIdle-time.Minute \|\| d > WebSessionIdle {
		78	t.Fatalf("a new session expires in %s, want %s", d, WebSessionIdle)
		79	}
		80	if d := time.Until(abs); d < 724time.Hour-time.Minute {
		81	t.Fatalf("absolute cap in %s", d)
		82	}
		83	// Idle past the window: gone.
		84	old := fmtTime(time.Now().Add(-time.Second))
		85	s.DB.Exec("UPDATE web_sessions SET expires_at = ? WHERE token_hash = 'h'", old)
		86	if _, err := s.WebSessionUser("h"); err != ErrNotFound {
		87	t.Fatalf("idle session: %v", err)
		88	}
		89	}
		90
		91	func TestWebSessionRenewsUpToTheCap(t *testing.T) {
		92	s, uid := sessionFixture(t)
		93	if err := s.CreateWebSession("h", uid, 724time.Hour); err != nil {
		94	t.Fatal(err)
		95	}
		96	// Last used two minutes ago, one minute left: a request renews it.
		97	s.DB.Exec("UPDATE web_sessions SET last_used_at = ?, expires_at = ? WHERE token_hash = 'h'",
		98	fmtTime(time.Now().Add(-2*time.Minute)), fmtTime(time.Now().Add(time.Minute)))
		99	if _, err := s.WebSessionUser("h"); err != nil {
		100	t.Fatal(err)
		101	}
		102	if exp, _ := sessionTimes(t, s, "h"); time.Until(exp) < WebSessionIdle-time.Minute {
		103	t.Fatalf("not renewed: expires in %s", time.Until(exp))
		104	}
		105	// Near the cap, renewal stops at it.
		106	capAt := time.Now().Add(time.Hour)
		107	s.DB.Exec("UPDATE web_sessions SET last_used_at = ?, absolute_expires_at = ? WHERE token_hash = 'h'",
		108	fmtTime(time.Now().Add(-2*time.Minute)), fmtTime(capAt))
		109	if _, err := s.WebSessionUser("h"); err != nil {
		110	t.Fatal(err)
		111	}
		112	if exp, _ := sessionTimes(t, s, "h"); exp.After(capAt) {
		113	t.Fatalf("renewed past the cap: %s > %s", exp, capAt)
		114	}
		115	list, err := s.ListWebSessions(uid)
		116	if err != nil \|\| len(list) != 1 \|\| list[0].LastUsedAt == "" {
		117	t.Fatalf("list: %+v %v", list, err)
		118	}
		119	}

web: idle timeout for browser sessions !487