Harden auth with revocable sessions, cookies, and single-login default.

Issue short-lived access JWTs backed by AuthSession rows, HttpOnly cookies with refresh rotation, idle timeout, session management UI, WebCRT ownership caps, and optional Redis login rate limits; new logins revoke other sessions by default.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-08-06 14:13:37 +08:00
parent ba33ab5c4f
commit 20c2fcd496
34 changed files with 1462 additions and 149 deletions

View file

@ -6,12 +6,14 @@ from .webcrt_session_registry import (
_webcrt_creds_ready,
active_session_count,
close_session,
close_sessions_for_user,
create_session,
detach_session,
find_ssh_session_for_ne,
get_session,
list_sessions,
mark_attached,
session_access_allowed,
wait_session_ready,
)
@ -20,11 +22,13 @@ __all__ = [
"_webcrt_creds_ready",
"active_session_count",
"close_session",
"close_sessions_for_user",
"create_session",
"detach_session",
"find_ssh_session_for_ne",
"get_session",
"list_sessions",
"mark_attached",
"session_access_allowed",
"wait_session_ready",
]