feat(auth): make automatic logout an opt-in per-user setting (#1536)
* feat(auth): make automatic logout an opt-in per-user setting Session timeouts (30 min idle / 12 h absolute on hosted) now apply only to users who enable "Automatic logout" in Settings > Security. Default is off: sessions live for the full Supabase refresh-token lifetime, the behavior from before the 2026-07 session hardening. - user_preferences.auto_logout (migration, default false), toggled via the extended /api/user/preferences route - The opt-in is snapshotted into the signed timeout cookie at mint, so enforcement stays DB-read-free per request; the preferences route clears the cookie on change so a toggle takes effect immediately - Pre-toggle cookies are authentic-but-stale: re-minted preserving their timers, never routed down the tamper path, so the rollout does not log anyone out - NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true enforces timeouts for every user regardless of preference (emergency lever, also plumbed through the Docker image); self-hosted stays disabled by default Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(auth): resolve PR #1536 review findings - Replace the spread upsert in /api/user/preferences with one literal payload per field: the phantom-column schema guard cannot resolve spread payloads (Unit tests 3/4 ceiling failure) - Map the preferences 500 through getErrorMessage so the user-facing text is Swedish (CodeRabbit) - fetchAutoLogoutPreference now returns null on a FAILED read instead of a fail-open false: callers skip minting so an unknown preference is never persisted into the year-long signed cookie, and the next request retries; failures log at error level, distinct from the normal opt-out path (compliance swarm GDPR Art.32(1)(b) / ISO A.8.5) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(auth): write multi-field preference updates as one atomic upsert A request carrying both hide_assistant_fab and auto_logout previously issued two sequential writes, so a failure of the second returned 500 after half the request had persisted (CodeRabbit, PR #1536). One literal upsert per accepted field combination keeps the write atomic and stays resolvable for the phantom-column schema guard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Fable 5
Claude Fable 5
parent
2e2a64dd0a
commit
11995b1b0c
@@ -26,12 +26,24 @@ vi.mock('next/headers', () => ({
|
||||
|
||||
import { GET, POST } from '../route'
|
||||
|
||||
const preference = { autoLogout: false, error: null as unknown }
|
||||
|
||||
const supabase = {
|
||||
auth: {
|
||||
getClaims: vi.fn(async () => ({
|
||||
data: { claims: { session_id: 'session-1' } },
|
||||
})),
|
||||
},
|
||||
from: vi.fn(() => ({
|
||||
select: vi.fn(() => ({
|
||||
eq: vi.fn(() => ({
|
||||
maybeSingle: vi.fn(async () => ({
|
||||
data: preference.error ? null : { auto_logout: preference.autoLogout },
|
||||
error: preference.error,
|
||||
})),
|
||||
})),
|
||||
})),
|
||||
})),
|
||||
}
|
||||
|
||||
describe('session heartbeat route', () => {
|
||||
@@ -47,18 +59,23 @@ describe('session heartbeat route', () => {
|
||||
error: null,
|
||||
})
|
||||
mocks.cookieValue = undefined
|
||||
preference.autoLogout = false
|
||||
preference.error = null
|
||||
})
|
||||
|
||||
async function setState(args?: {
|
||||
startedAt?: number
|
||||
lastActivityAt?: number
|
||||
sessionId?: string
|
||||
autoLogout?: boolean
|
||||
}) {
|
||||
const state = {
|
||||
...createSessionTimeoutState({
|
||||
userId: 'user-1',
|
||||
sessionId: args?.sessionId ?? 'session-1',
|
||||
method: 'password',
|
||||
// Default the opt-in to true: most cases here exercise enforcement.
|
||||
autoLogout: args?.autoLogout ?? true,
|
||||
now: args?.startedAt ?? Date.now(),
|
||||
}),
|
||||
...(args?.lastActivityAt === undefined
|
||||
@@ -127,6 +144,67 @@ describe('session heartbeat route', () => {
|
||||
})
|
||||
})
|
||||
|
||||
it('reports enabled: false and never expires an opted-out session', async () => {
|
||||
const now = Date.now()
|
||||
// Times that would be long expired if enforcement applied.
|
||||
await setState({
|
||||
startedAt: now - 120_000,
|
||||
lastActivityAt: now - 120_000,
|
||||
autoLogout: false,
|
||||
})
|
||||
|
||||
const response = await GET()
|
||||
|
||||
expect(response.status).toBe(200)
|
||||
await expect(response.json()).resolves.toMatchObject({
|
||||
data: { enabled: false },
|
||||
})
|
||||
})
|
||||
|
||||
it('upgrades a pre-toggle cookie in place, keeping its timers', async () => {
|
||||
preference.autoLogout = true
|
||||
const startedAt = Date.now() - 5_000
|
||||
const legacy: Record<string, unknown> = {
|
||||
...createSessionTimeoutState({
|
||||
userId: 'user-1',
|
||||
sessionId: 'session-1',
|
||||
method: 'password',
|
||||
autoLogout: true,
|
||||
now: startedAt,
|
||||
}),
|
||||
}
|
||||
delete legacy.autoLogout
|
||||
mocks.cookieValue =
|
||||
(await signSessionTimeoutState(
|
||||
legacy as Parameters<typeof signSessionTimeoutState>[0],
|
||||
)) ?? undefined
|
||||
|
||||
const response = await GET()
|
||||
|
||||
expect(response.status).toBe(200)
|
||||
const upgraded = response.cookies.get(SESSION_TIMEOUT_COOKIE)?.value
|
||||
expect(upgraded).toBeTruthy()
|
||||
await expect(verifySessionTimeoutState(upgraded)).resolves.toMatchObject({
|
||||
startedAt,
|
||||
autoLogout: true,
|
||||
})
|
||||
})
|
||||
|
||||
it('answers without persisting a snapshot when the preference read fails', async () => {
|
||||
preference.error = { message: 'connection reset' }
|
||||
const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
|
||||
|
||||
const response = await GET()
|
||||
|
||||
expect(response.status).toBe(200)
|
||||
await expect(response.json()).resolves.toMatchObject({
|
||||
data: { enabled: false },
|
||||
})
|
||||
// No cookie: the unknown preference must not be baked into a snapshot.
|
||||
expect(response.cookies.get(SESSION_TIMEOUT_COOKIE)).toBeUndefined()
|
||||
errorSpy.mockRestore()
|
||||
})
|
||||
|
||||
it('passes through the existing authentication error', async () => {
|
||||
mocks.requireAuth.mockResolvedValue({
|
||||
user: null,
|
||||
|
||||
@@ -5,8 +5,10 @@ import { requireAuth } from '@/lib/auth/require-auth'
|
||||
import {
|
||||
createSessionTimeoutState,
|
||||
evaluateSessionTimeout,
|
||||
fetchAutoLogoutPreference,
|
||||
getSessionTimeoutConfig,
|
||||
sessionStateMatchesUser,
|
||||
sessionStateNeedsRemint,
|
||||
sessionTimeoutCookieOptions,
|
||||
signSessionTimeoutState,
|
||||
toSessionTimeoutClientState,
|
||||
@@ -71,28 +73,40 @@ async function heartbeat(updateActivity: boolean): Promise<NextResponse> {
|
||||
const state = await verifySessionTimeoutState(encodedState)
|
||||
const sessionId = await getSessionId(auth.supabase)
|
||||
|
||||
if (!state || !sessionStateMatchesUser(state, auth.user.id, sessionId)) {
|
||||
// Mirror middleware initialization: a missing or session-mismatched
|
||||
// cookie means the timeout state has not been established for this
|
||||
// session yet, not that the session expired.
|
||||
const stateMatches =
|
||||
state !== null && sessionStateMatchesUser(state, auth.user.id, sessionId)
|
||||
|
||||
if (!state || !stateMatches || sessionStateNeedsRemint(state)) {
|
||||
// Mirror middleware initialization: a missing, session-mismatched, or
|
||||
// pre-toggle cookie means the timeout state has not been established
|
||||
// for this session yet, not that the session expired.
|
||||
const hintedMethod = cookieStore.get(SESSION_AUTH_METHOD_HINT_COOKIE)?.value
|
||||
const freshState = createSessionTimeoutState({
|
||||
userId: auth.user.id,
|
||||
sessionId,
|
||||
method: isSessionAuthMethod(hintedMethod) ? hintedMethod : 'password',
|
||||
now,
|
||||
})
|
||||
const autoLogout = await fetchAutoLogoutPreference(auth.supabase, auth.user.id)
|
||||
const freshState = state && stateMatches
|
||||
? { ...state, autoLogout: autoLogout ?? false }
|
||||
: createSessionTimeoutState({
|
||||
userId: auth.user.id,
|
||||
sessionId,
|
||||
method: isSessionAuthMethod(hintedMethod) ? hintedMethod : 'password',
|
||||
autoLogout: autoLogout ?? false,
|
||||
now,
|
||||
})
|
||||
const response = NextResponse.json({
|
||||
data: toSessionTimeoutClientState(freshState, config, now),
|
||||
})
|
||||
response.headers.set('Cache-Control', 'no-store')
|
||||
const signedFresh = await signSessionTimeoutState(freshState)
|
||||
if (signedFresh) {
|
||||
response.cookies.set(
|
||||
SESSION_TIMEOUT_COOKIE,
|
||||
signedFresh,
|
||||
sessionTimeoutCookieOptions(),
|
||||
)
|
||||
// Unknown preference (failed read): answer this poll without persisting
|
||||
// a fail-open snapshot; the next resync retries the read (mirrors the
|
||||
// middleware).
|
||||
if (autoLogout !== null) {
|
||||
const signedFresh = await signSessionTimeoutState(freshState)
|
||||
if (signedFresh) {
|
||||
response.cookies.set(
|
||||
SESSION_TIMEOUT_COOKIE,
|
||||
signedFresh,
|
||||
sessionTimeoutCookieOptions(),
|
||||
)
|
||||
}
|
||||
}
|
||||
return response
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user