fix(uds-auth): keep sessions until manual sign-out; refresh expired UAC tokens by QR (0.3.20)

Users were asked to sign in again every ~30 minutes, even while active.

Session lifetime
- Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued,
  so the cookie vanished 30 min after login. Re-issue it on use (throttled
  by slidingInterval).
- Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so
  the idle TTL never slid. assertPrincipalLive now reports activity and
  slides the session and the account's bridges (throttled).
- New setting sessionIdleTimeoutHours (Settings page + config). Default 0 =
  no automatic sign-out; only a manual sign-out ends a session, so
  conversations and night-time cron are never cut off. 0.5-168 enables an
  idle timeout with the 7-day cap. The TTL is read live.
- Stores support long TTLs: the absolute cap follows the TTL, older 7-day
  sessions are lifted on activity, and expiry timers re-arm instead of
  overflowing setTimeout (~24.8 days).

UAC token check
- Every 2 hours (and 1 min after start) each QR session's token is checked
  against icenterapi. A rejected token is only flagged, never a sign-out.
  Network errors, 5xx and bad JSON keep the previous verdict (the old 6h
  check revoked all of an account's sessions on any failure, including
  outages).
- GET /uds-auth/session-status (non-sliding) returns alive + tokenValid.
  The client probes it every minute and on focus: a gone session signs the
  UI out with a notice; a rejected token opens a refresh QR once.
- Scanning in refresh mode writes the new token into every live session of
  the account and the skill credential cache in place: no new session, no
  reload. Other accounts are rejected (token_refresh_emp_mismatch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/session/memory-store.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
 import { readFile } from 'node:fs/promises'
-import { SessionStore, SESSION_ABSOLUTE_MAX_SECONDS } from './store.js'
+import { SessionStore, absoluteCapSeconds } from './store.js'
 import { atomicWriteJson } from '../utils/atomic-write.js'
 import { loadOrCreateSecretKey, sealSecret, openSecret } from '../utils/secret-box.js'
 
@@ -26,6 +26,9 @@ function safeEqualHex(a, b) {
  * Persistence (opts.file + opts.dataDir): bearer hashes and expiry in clear,
  * userData (may carry the UAC token) sealed with the plugin AES-GCM key.
  */
+/** Longest delay setTimeout honors (2^31 - 1 ms). */
+const MAX_TIMER_MS = 2_147_483_647
+
 export class MemoryStore extends SessionStore {
   /**
    * @param {{ file?: string, dataDir?: string, logger?: any }} [opts]
@@ -178,10 +181,16 @@ export class MemoryStore extends SessionStore {
       this._timers.delete(sessionId)
     }
     if (!ttlSeconds || ttlSeconds <= 0) return
+    // setTimeout fires immediately past ~24.8 days; long TTLs re-arm in chunks.
+    const delay = Math.min(ttlSeconds * 1000, MAX_TIMER_MS)
     const timer = setTimeout(() => {
+      this._timers.delete(sessionId)
       const row = this._sessions.get(sessionId)
-      if (row) this._removeRecord(sessionId, row)
-    }, ttlSeconds * 1000)
+      if (!row) return
+      const left = row.expiresAt - Date.now()
+      if (left > 0) this._scheduleExpiry(sessionId, Math.ceil(left / 1000))
+      else this._removeRecord(sessionId, row)
+    }, delay)
     // Do not keep the process alive solely for session TTLs (tests / short-lived hosts).
     if (typeof timer.unref === 'function') timer.unref()
     this._timers.set(sessionId, timer)
@@ -210,7 +219,7 @@ export class MemoryStore extends SessionStore {
     const ttl = Math.max(60, Number(ttlSeconds) || 1800)
     // Idle TTL slides via touch(); absolute lifetime is a fixed 7 days. (Was min(ttl, 7d),
     // which capped every session at its 30-min idle TTL and made sliding a no-op.)
-    const absoluteCap = SESSION_ABSOLUTE_MAX_SECONDS
+    const absoluteCap = absoluteCapSeconds(ttl)
     const record = {
       sessionId,
       bearerHash,
@@ -305,6 +314,10 @@ export class MemoryStore extends SessionStore {
     const row = this._purgeExpired(String(sessionId || ''))
     if (!row) return null
     const ttl = Math.max(60, Number(ttlSeconds) || 1800)
+    // "No auto sign-out" TTLs also lift the cap of sessions minted under the 7-day default.
+    if (absoluteCapSeconds(ttl) > absoluteCapSeconds(0)) {
+      row.absoluteExpiresAt = Math.max(row.absoluteExpiresAt || 0, Date.now() + ttl * 1000)
+    }
     const absLeft = row.absoluteExpiresAt
       ? Math.max(0, Math.floor((row.absoluteExpiresAt - Date.now()) / 1000))
       : ttl
@@ -323,6 +336,14 @@ export class MemoryStore extends SessionStore {
     return this._publicRecord(row)
   }
 
+  async updateUserData(sessionId, patch) {
+    const row = this._purgeExpired(String(sessionId || ''))
+    if (!row) return null
+    row.userData = { ...row.userData, ...patch }
+    this._scheduleSave()
+    return this._publicRecord(row)
+  }
+
   async revokeSession(sessionId) {
     const row = this._sessions.get(String(sessionId || ''))
     if (!row) return false

uds-auth/lib/session/redis-store.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto'
-import { SessionStore, SESSION_ABSOLUTE_MAX_SECONDS } from './store.js'
+import { SessionStore, absoluteCapSeconds } from './store.js'
 
 function hashBearer(bearer) {
   return createHash('sha256').update(String(bearer)).digest('hex')
@@ -48,7 +48,7 @@ export class RedisStore extends SessionStore {
       userData: { ...userData },
       createdAt: now,
       expiresAt: now + ttl * 1000,
-      absoluteExpiresAt: now + SESSION_ABSOLUTE_MAX_SECONDS * 1000,
+      absoluteExpiresAt: now + absoluteCapSeconds(ttl) * 1000,
     }
     const payload = JSON.stringify(record)
     await this._client.setEx(this._sessKey(sessionId), ttl, payload)
@@ -120,6 +120,9 @@ export class RedisStore extends SessionStore {
     const row = await this._load(sessionId)
     if (!row) return null
     const ttl = Math.max(60, Number(ttlSeconds) || 1800)
+    if (absoluteCapSeconds(ttl) > absoluteCapSeconds(0)) {
+      row.absoluteExpiresAt = Math.max(row.absoluteExpiresAt || 0, Date.now() + ttl * 1000)
+    }
     const absLeft = row.absoluteExpiresAt
       ? Math.max(0, Math.floor((row.absoluteExpiresAt - Date.now()) / 1000))
       : ttl
@@ -135,6 +138,16 @@ export class RedisStore extends SessionStore {
     return this._public(row)
   }
 
+  async updateUserData(sessionId, patch) {
+    const row = await this._load(sessionId)
+    if (!row) return null
+    const left = Math.floor((Number(row.expiresAt) - Date.now()) / 1000)
+    if (left <= 0) return null
+    row.userData = { ...row.userData, ...patch }
+    await this._client.setEx(this._sessKey(sessionId), left, JSON.stringify(row))
+    return this._public(row)
+  }
+
   async revokeSession(sessionId) {
     const row = await this._load(sessionId)
     if (!row) {

uds-auth/lib/session/store.js

@@ -36,6 +36,11 @@ export class SessionStore {
     throw new Error('SessionStore#touch must be implemented')
   }
 
+  /** Merge fields into a live session's userData (e.g. a refreshed UAC token). */
+  async updateUserData(sessionId, patch) {
+    throw new Error('SessionStore#updateUserData must be implemented')
+  }
+
   async revokeSession(sessionId) {
     throw new Error('SessionStore#revokeSession must be implemented')
   }
@@ -92,3 +97,11 @@ export const SESSION_COOKIE = 'UDS_SESSION'
 export const SESSION_HEADER = 'x-uds-session'
 /** Absolute session lifetime; idle expiry (cookieMaxAge) slides within it. */
 export const SESSION_ABSOLUTE_MAX_SECONDS = 7 * 24 * 60 * 60
+
+/**
+ * Absolute lifetime for a session with this idle TTL. A TTL above 7 days means
+ * "no automatic sign-out" (sessionIdleTimeoutHours = 0), so the cap follows the TTL.
+ */
+export function absoluteCapSeconds(ttlSeconds) {
+  return Math.max(SESSION_ABSOLUTE_MAX_SECONDS, Number(ttlSeconds) || 0)
+}