Harden auth with revocable sessions, cookies, and single-login default.

Issue short-lived access JWTs backed by AuthSession rows, HttpOnly cookies with refresh rotation, idle timeout, session management UI, WebCRT ownership caps, and optional Redis login rate limits; new logins revoke other sessions by default.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-08-06 14:13:37 +08:00
parent ba33ab5c4f
commit 20c2fcd496
34 changed files with 1462 additions and 149 deletions

View file

@ -8,7 +8,7 @@ from .alarms import (
ImportErrorRow,
ImportJob,
)
from .auth import ApiToken, AppUser, AuditLog
from .auth import ApiToken, AppUser, AuditLog, AuthSession
from .config_sync import (
ConfigSyncCycle,
ConfigSyncPolicy,
@ -93,6 +93,7 @@ __all__ = [
"AppUser",
"AuditLog",
"ApiToken",
"AuthSession",
"ConfigSyncPolicy",
"ConfigSyncCycle",
"ConfigSyncTask",