feat(auth): make automatic logout an opt-in per-user setting (#1536)

* feat(auth): make automatic logout an opt-in per-user setting

Session timeouts (30 min idle / 12 h absolute on hosted) now apply only
to users who enable "Automatic logout" in Settings > Security. Default
is off: sessions live for the full Supabase refresh-token lifetime, the
behavior from before the 2026-07 session hardening.

- user_preferences.auto_logout (migration, default false), toggled via
  the extended /api/user/preferences route
- The opt-in is snapshotted into the signed timeout cookie at mint, so
  enforcement stays DB-read-free per request; the preferences route
  clears the cookie on change so a toggle takes effect immediately
- Pre-toggle cookies are authentic-but-stale: re-minted preserving
  their timers, never routed down the tamper path, so the rollout does
  not log anyone out
- NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true enforces timeouts for
  every user regardless of preference (emergency lever, also plumbed
  through the Docker image); self-hosted stays disabled by default

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): resolve PR #1536 review findings

- Replace the spread upsert in /api/user/preferences with one literal
  payload per field: the phantom-column schema guard cannot resolve
  spread payloads (Unit tests 3/4 ceiling failure)
- Map the preferences 500 through getErrorMessage so the user-facing
  text is Swedish (CodeRabbit)
- fetchAutoLogoutPreference now returns null on a FAILED read instead
  of a fail-open false: callers skip minting so an unknown preference
  is never persisted into the year-long signed cookie, and the next
  request retries; failures log at error level, distinct from the
  normal opt-out path (compliance swarm GDPR Art.32(1)(b) / ISO A.8.5)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(auth): write multi-field preference updates as one atomic upsert

A request carrying both hide_assistant_fab and auto_logout previously
issued two sequential writes, so a failure of the second returned 500
after half the request had persisted (CodeRabbit, PR #1536). One
literal upsert per accepted field combination keeps the write atomic
and stays resolvable for the phantom-column schema guard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

app/api/user/preferences/__tests__/route.test.ts

@@ -21,7 +21,9 @@ function unauthed() {
   })
 }
 
-function authedForGet(row: { hide_assistant_fab: boolean } | null) {
+function authedForGet(
+  row: { hide_assistant_fab?: boolean; auto_logout?: boolean } | null,
+) {
   const maybeSingle = vi.fn().mockResolvedValue({ data: row, error: null })
   const supabase = {
     from: vi.fn(() => ({
@@ -56,19 +58,19 @@ describe('GET /api/user/preferences', () => {
     expect(res.status).toBe(401)
   })
 
-  it('returns the stored preference', async () => {
-    authedForGet({ hide_assistant_fab: true })
+  it('returns the stored preferences', async () => {
+    authedForGet({ hide_assistant_fab: true, auto_logout: true })
     const res = await GET()
     const { status, body } = await parseJsonResponse<{ data: unknown }>(res)
     expect(status).toBe(200)
-    expect(body.data).toEqual({ hide_assistant_fab: true })
+    expect(body.data).toEqual({ hide_assistant_fab: true, auto_logout: true })
   })
 
   it('defaults to false when no preferences row exists', async () => {
     authedForGet(null)
     const res = await GET()
     const { body } = await parseJsonResponse<{ data: unknown }>(res)
-    expect(body.data).toEqual({ hide_assistant_fab: false })
+    expect(body.data).toEqual({ hide_assistant_fab: false, auto_logout: false })
   })
 })
 
@@ -103,6 +105,48 @@ describe('PATCH /api/user/preferences', () => {
     )
   })
 
+  it('writes a multi-field request as one atomic upsert', async () => {
+    const { upsert } = authedForPatch()
+    const res = await PATCH(
+      patchRequest({ hide_assistant_fab: true, auto_logout: false })
+    )
+    expect(res.status).toBe(200)
+    expect(upsert).toHaveBeenCalledTimes(1)
+    expect(upsert).toHaveBeenCalledWith(
+      { user_id: 'user-1', hide_assistant_fab: true, auto_logout: false },
+      { onConflict: 'user_id' }
+    )
+  })
+
+  it('rejects an empty body with 400', async () => {
+    authedForPatch()
+    const res = await PATCH(patchRequest({}))
+    expect(res.status).toBe(400)
+  })
+
+  it('upserts auto_logout and resets the session timeout cookie', async () => {
+    const { upsert } = authedForPatch()
+    const res = await PATCH(patchRequest({ auto_logout: true }))
+    const { status, body } = await parseJsonResponse<{ data: unknown }>(res)
+    expect(status).toBe(200)
+    expect(body.data).toEqual({ auto_logout: true })
+    expect(upsert).toHaveBeenCalledWith(
+      { user_id: 'user-1', auto_logout: true },
+      { onConflict: 'user_id' }
+    )
+    // The signed timeout cookie caches the opt-in; a change must clear it so
+    // the middleware re-mints with the new preference on the next request.
+    const setCookie = res.headers.get('set-cookie') ?? ''
+    expect(setCookie).toContain('gnubok-session-timeout=;')
+  })
+
+  it('does not touch the session timeout cookie for unrelated preferences', async () => {
+    authedForPatch()
+    const res = await PATCH(patchRequest({ hide_assistant_fab: true }))
+    expect(res.status).toBe(200)
+    expect(res.headers.get('set-cookie')).toBeNull()
+  })
+
   it('returns 500 when the upsert fails', async () => {
     authedForPatch({ message: 'boom' })
     const res = await PATCH(patchRequest({ hide_assistant_fab: false }))

app/api/user/preferences/route.ts

@@ -1,6 +1,9 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { requireAuth } from '@/lib/auth/require-auth'
+import { getErrorMessage } from '@/lib/errors/get-error-message'
+import { sessionTimeoutClearCookieOptions } from '@/lib/auth/session-timeout'
+import { SESSION_TIMEOUT_COOKIE } from '@/lib/auth/session-timeout-shared'
 
 // User-level UI preferences (not company-scoped), stored on user_preferences.
 // Mirrors the /api/user/locale pattern: requireAuth directly because these
@@ -8,9 +11,13 @@ import { requireAuth } from '@/lib/auth/require-auth'
 
 const BodySchema = z
   .object({
-    hide_assistant_fab: z.boolean(),
+    hide_assistant_fab: z.boolean().optional(),
+    auto_logout: z.boolean().optional(),
   })
   .strict()
+  .refine((value) => Object.keys(value).length > 0, {
+    message: 'At least one preference is required',
+  })
 
 export async function GET() {
   const { user, supabase, error } = await requireAuth()
@@ -18,12 +25,15 @@ export async function GET() {
 
   const { data } = await supabase
     .from('user_preferences')
-    .select('hide_assistant_fab')
+    .select('hide_assistant_fab, auto_logout')
     .eq('user_id', user.id)
     .maybeSingle()
 
   return NextResponse.json({
-    data: { hide_assistant_fab: data?.hide_assistant_fab ?? false },
+    data: {
+      hide_assistant_fab: data?.hide_assistant_fab ?? false,
+      auto_logout: data?.auto_logout ?? false,
+    },
   })
 }
 
@@ -43,16 +53,56 @@ export async function PATCH(request: Request) {
     return NextResponse.json({ error: 'Invalid preferences' }, { status: 400 })
   }
 
-  const { error: upsertError } = await supabase
-    .from('user_preferences')
-    .upsert(
-      { user_id: user.id, hide_assistant_fab: parsed.data.hide_assistant_fab },
-      { onConflict: 'user_id' }
-    )
+  const { hide_assistant_fab, auto_logout } = parsed.data
 
-  if (upsertError) {
-    return NextResponse.json({ error: 'Could not save preference' }, { status: 500 })
+  // One literal upsert per accepted field combination: the phantom-column
+  // schema guard cannot resolve spread payloads, and a single write keeps a
+  // multi-field request atomic.
+  let upsertError: unknown = null
+  if (hide_assistant_fab !== undefined && auto_logout !== undefined) {
+    const { error } = await supabase
+      .from('user_preferences')
+      .upsert(
+        { user_id: user.id, hide_assistant_fab, auto_logout },
+        { onConflict: 'user_id' },
+      )
+    upsertError = error
+  } else if (hide_assistant_fab !== undefined) {
+    const { error } = await supabase
+      .from('user_preferences')
+      .upsert({ user_id: user.id, hide_assistant_fab }, { onConflict: 'user_id' })
+    upsertError = error
+  } else if (auto_logout !== undefined) {
+    const { error } = await supabase
+      .from('user_preferences')
+      .upsert({ user_id: user.id, auto_logout }, { onConflict: 'user_id' })
+    upsertError = error
   }
 
-  return NextResponse.json({ data: parsed.data })
+  if (upsertError) {
+    return NextResponse.json(
+      {
+        error: getErrorMessage(upsertError, {
+          context: 'settings',
+          statusCode: 500,
+        }),
+      },
+      { status: 500 },
+    )
+  }
+
+  const response = NextResponse.json({ data: parsed.data })
+
+  if (parsed.data.auto_logout !== undefined) {
+    // The middleware caches the opt-in inside the signed timeout cookie.
+    // Clearing it forces a re-mint on the next request, so the change takes
+    // effect immediately instead of at the next login.
+    response.cookies.set(
+      SESSION_TIMEOUT_COOKIE,
+      '',
+      sessionTimeoutClearCookieOptions(),
+    )
+  }
+
+  return response
 }