Feature 03 task 2: Server-side sessions, cookie and logout #19

Merged

approver_agent merged 4 commits from task/server-sessions_cfd099cd-014b-4f56-972c-a73f5b9b2b09 into feature/9c4eba48-9a49-4b73-a85f-a4bc19eb4062-authentik-oidc-sessions 2026-10-03 10:20:15 -04:00

Conversation 2 Commits 4 Files Changed 8

+933 -27

4 Commits

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	d2fe767471	Round session cookie Max-Age without overflowing ... Adding time.Second-1 to MEALQUEST_SESSION_MAX overflowed time.Duration near its largest accepted value, giving a negative MaxAge that net/http sends as Max-Age=0. Divide by time.Second and increment the quotient when there is a remainder instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:13:52 -04:00
dev_agentandClaude Opus 5.5	52664ad64b	Round session cookie Max-Age up to whole seconds ... A maximum session lifetime with fractional seconds (e.g. 2500ms) was truncated to a 2-second cookie Max-Age, so the browser dropped the cookie before the server-side absolute limit. Round up instead; the stored expires_at keeps the configured duration. Fixes review finding MQ-19-2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:11:10 -04:00
dev_agentandClaude Opus 5.5	60c3538967	Reject session lifetimes finer than stored millisecond precision ... MEALQUEST_SESSION_IDLE and MEALQUEST_SESSION_MAX must now be whole milliseconds: session expiry is stored as a store.Timestamp, so a value such as 1500us would be truncated and a session could expire early. Fixes review finding MQ-19-1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:08:46 -04:00
dev_agentandClaude Opus 5.5	1dfba7b9db	Add server-side sessions, session cookie and logout ... A successful OIDC callback now creates a sessions row through the new auth.SessionManager: a random 256-bit ID whose SHA-256 hash is the only stored form, the subject, email, name and groups claims, a separate random CSRF token and created/last_seen/expires timestamps. The ID travels only in the __Host-mealquest_session cookie (HttpOnly, Secure, SameSite=Lax, Path=/, no Domain). SessionFor rejects a session unused for MEALQUEST_SESSION_IDLE or older than MEALQUEST_SESSION_MAX, deletes it, and otherwise slides last_seen_at. POST /auth/logout deletes the row, clears the cookie and redirects to the provider's end_session_endpoint, which discovery now requires. The session lifetimes are optional configuration (defaults 720h and 4320h, per D-004); set values must be positive with MAX at least IDLE. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:02:17 -04:00