mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-14 20:35:56 +08:00
oliver
0e6de055a9
Users were asked to sign in again every ~30 minutes, even while active. Session lifetime - Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued, so the cookie vanished 30 min after login. Re-issue it on use (throttled by slidingInterval). - Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so the idle TTL never slid. assertPrincipalLive now reports activity and slides the session and the account's bridges (throttled). - New setting sessionIdleTimeoutHours (Settings page + config). Default 0 = no automatic sign-out; only a manual sign-out ends a session, so conversations and night-time cron are never cut off. 0.5-168 enables an idle timeout with the 7-day cap. The TTL is read live. - Stores support long TTLs: the absolute cap follows the TTL, older 7-day sessions are lifted on activity, and expiry timers re-arm instead of overflowing setTimeout (~24.8 days). UAC token check - Every 2 hours (and 1 min after start) each QR session's token is checked against icenterapi. A rejected token is only flagged, never a sign-out. Network errors, 5xx and bad JSON keep the previous verdict (the old 6h check revoked all of an account's sessions on any failure, including outages). - GET /uds-auth/session-status (non-sliding) returns alive + tokenValid. The client probes it every minute and on focus: a gone session signs the UI out with a notice; a rejected token opens a refresh QR once. - Scanning in refresh mode writes the new token into every live session of the account and the skill credential cache in place: no new session, no reload. Other accounts are rejected (token_refresh_emp_mismatch). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
22 lines
1.2 KiB
YAML
22 lines
1.2 KiB
YAML
# uds-auth defaults — trusted single-instance (not strong multi-tenant)
|
||
uacBaseUrl: https://uac.zte.com.cn
|
||
userSearchUrl: https://icenterapi.zte.com.cn/zte-km-icenter-addresearch/user/plain/docs/search
|
||
loginSystemCode: '100000455558'
|
||
originSystemCode: ''
|
||
workspaceRoot: ''
|
||
# Explicit first super_admin when roles.json is empty (also: UDS_AUTH_INITIAL_ADMIN)
|
||
initialAdminEmpNo: ''
|
||
# When roles already exist, auto-register unknown UAC users as role=user
|
||
allowOpenRegistration: true
|
||
# Raw /agent-credentials token response (loopback) — off by default; prefer outbound + task capability
|
||
allowRawAgentToken: false
|
||
retainSkillCredentialsOnLogout: true
|
||
skillCredentialTtlSeconds: 604800
|
||
# Login session idle timeout in hours: 0 = never sign out automatically (manual sign-out only);
|
||
# 0.5–168 = sign out after that long idle (slides while in use, 7-day absolute cap)
|
||
sessionIdleTimeoutHours: 0
|
||
outboundAllowedHosts: icenterapi.zte.com.cn,icentermsg.dt.zte.com.cn
|
||
# Optional exact Host allowlist for /uds-auth writes; empty = Origin must match Host only
|
||
trustedHosts: ''
|
||
# Emergency fallback account is enabled by default: administrator / Admin@123.
|
||
# Change or disable it from Settings after signing in.
|