mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-15 07:30:46 +08:00
oliver
0e6de055a9
Users were asked to sign in again every ~30 minutes, even while active. Session lifetime - Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued, so the cookie vanished 30 min after login. Re-issue it on use (throttled by slidingInterval). - Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so the idle TTL never slid. assertPrincipalLive now reports activity and slides the session and the account's bridges (throttled). - New setting sessionIdleTimeoutHours (Settings page + config). Default 0 = no automatic sign-out; only a manual sign-out ends a session, so conversations and night-time cron are never cut off. 0.5-168 enables an idle timeout with the 7-day cap. The TTL is read live. - Stores support long TTLs: the absolute cap follows the TTL, older 7-day sessions are lifted on activity, and expiry timers re-arm instead of overflowing setTimeout (~24.8 days). UAC token check - Every 2 hours (and 1 min after start) each QR session's token is checked against icenterapi. A rejected token is only flagged, never a sign-out. Network errors, 5xx and bad JSON keep the previous verdict (the old 6h check revoked all of an account's sessions on any failure, including outages). - GET /uds-auth/session-status (non-sliding) returns alive + tokenValid. The client probes it every minute and on focus: a gone session signs the UI out with a notice; a rejected token opens a refresh QR once. - Scanning in refresh mode writes the new token into every live session of the account and the skill credential cache in place: no new session, no reload. Other accounts are rejected (token_refresh_emp_mismatch). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
107 lines
3.2 KiB
JavaScript
107 lines
3.2 KiB
JavaScript
/**
|
|
* Auth session store — opaque sessionId + random bearer.
|
|
* empNo is an attribute / secondary index, never the auth credential.
|
|
*/
|
|
export class SessionStore {
|
|
/**
|
|
* Create a verified session.
|
|
* @param {object} userData
|
|
* @param {number} ttlSeconds
|
|
* @returns {Promise<{ sessionId: string, bearer: string, record: object }>}
|
|
*/
|
|
async create(userData, ttlSeconds) {
|
|
throw new Error('SessionStore#create must be implemented')
|
|
}
|
|
|
|
/** Lookup by bearer token (proof of possession). */
|
|
async getByBearer(bearer) {
|
|
throw new Error('SessionStore#getByBearer must be implemented')
|
|
}
|
|
|
|
/** Sync lookup for WS upgrade paths. */
|
|
getByBearerSync(bearer) {
|
|
throw new Error('SessionStore#getByBearerSync must be implemented')
|
|
}
|
|
|
|
async getBySessionId(sessionId) {
|
|
throw new Error('SessionStore#getBySessionId must be implemented')
|
|
}
|
|
|
|
/** Return active UDS sessions and their upstream token for periodic validation. */
|
|
async listUdsSessionsForValidation() {
|
|
throw new Error('SessionStore#listUdsSessionsForValidation must be implemented')
|
|
}
|
|
|
|
async touch(sessionId, ttlSeconds) {
|
|
throw new Error('SessionStore#touch must be implemented')
|
|
}
|
|
|
|
/** Merge fields into a live session's userData (e.g. a refreshed UAC token). */
|
|
async updateUserData(sessionId, patch) {
|
|
throw new Error('SessionStore#updateUserData must be implemented')
|
|
}
|
|
|
|
async revokeSession(sessionId) {
|
|
throw new Error('SessionStore#revokeSession must be implemented')
|
|
}
|
|
|
|
async revokeBearer(bearer) {
|
|
throw new Error('SessionStore#revokeBearer must be implemented')
|
|
}
|
|
|
|
/** Revoke all devices for an empNo. */
|
|
async revokeEmpNo(empNo) {
|
|
throw new Error('SessionStore#revokeEmpNo must be implemented')
|
|
}
|
|
|
|
/** Profile cache only — never proves authentication. */
|
|
async setProfile(empNo, profile) {
|
|
throw new Error('SessionStore#setProfile must be implemented')
|
|
}
|
|
|
|
async getProfile(empNo) {
|
|
throw new Error('SessionStore#getProfile must be implemented')
|
|
}
|
|
|
|
async clear() {
|
|
throw new Error('SessionStore#clear must be implemented')
|
|
}
|
|
|
|
// --- legacy compat shims (empNo-keyed) — prefer create/getByBearer ---
|
|
|
|
/** @deprecated use getByBearer */
|
|
async get(empNo) {
|
|
throw new Error('SessionStore#get must be implemented')
|
|
}
|
|
|
|
/** @deprecated use create */
|
|
async setex(empNo, seconds, userData) {
|
|
throw new Error('SessionStore#setex must be implemented')
|
|
}
|
|
|
|
/** @deprecated use revokeEmpNo */
|
|
async delete(empNo) {
|
|
throw new Error('SessionStore#delete must be implemented')
|
|
}
|
|
|
|
async has(empNo) {
|
|
throw new Error('SessionStore#has must be implemented')
|
|
}
|
|
|
|
async keys() {
|
|
throw new Error('SessionStore#keys must be implemented')
|
|
}
|
|
}
|
|
|
|
export const SESSION_COOKIE = 'UDS_SESSION'
|
|
export const SESSION_HEADER = 'x-uds-session'
|
|
/** Absolute session lifetime; idle expiry (cookieMaxAge) slides within it. */
|
|
export const SESSION_ABSOLUTE_MAX_SECONDS = 7 * 24 * 60 * 60
|
|
|
|
/**
|
|
* Absolute lifetime for a session with this idle TTL. A TTL above 7 days means
|
|
* "no automatic sign-out" (sessionIdleTimeoutHours = 0), so the cap follows the TTL.
|
|
*/
|
|
export function absoluteCapSeconds(ttlSeconds) {
|
|
return Math.max(SESSION_ABSOLUTE_MAX_SECONDS, Number(ttlSeconds) || 0)
|
|
}
|