feat(auth): make automatic logout an opt-in per-user setting (#1536)

* feat(auth): make automatic logout an opt-in per-user setting Session timeouts (30 min idle / 12 h absolute on hosted) now apply only to users who enable "Automatic logout" in Settings > Security. Default is off: sessions live for the full Supabase refresh-token lifetime, the behavior from before the 2026-07 session hardening. - user_preferences.auto_logout (migration, default false), toggled via the extended /api/user/preferences route - The opt-in is snapshotted into the signed timeout cookie at mint, so enforcement stays DB-read-free per request; the preferences route clears the cookie on change so a toggle takes effect immediately - Pre-toggle cookies are authentic-but-stale: re-minted preserving their timers, never routed down the tamper path, so the rollout does not log anyone out - NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true enforces timeouts for every user regardless of preference (emergency lever, also plumbed through the Docker image); self-hosted stays disabled by default Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(auth): resolve PR #1536 review findings - Replace the spread upsert in /api/user/preferences with one literal payload per field: the phantom-column schema guard cannot resolve spread payloads (Unit tests 3/4 ceiling failure) - Map the preferences 500 through getErrorMessage so the user-facing text is Swedish (CodeRabbit) - fetchAutoLogoutPreference now returns null on a FAILED read instead of a fail-open false: callers skip minting so an unknown preference is never persisted into the year-long signed cookie, and the next request retries; failures log at error level, distinct from the normal opt-out path (compliance swarm GDPR Art.32(1)(b) / ISO A.8.5) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(auth): write multi-field preference updates as one atomic upsert A request carrying both hide_assistant_fab and auto_logout previously issued two sequential writes, so a failure of the second returned 500 after half the request had persisted (CodeRabbit, PR #1536). One literal upsert per accepted field combination keeps the write atomic and stays resolvable for the phantom-column schema guard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-12 16:45:41 +02:00
parent 2e2a64dd0a
commit 11995b1b0c
19 changed files with 702 additions and 59 deletions
@@ -27,6 +27,9 @@ const state = vi.hoisted(() => ({
    error: unknown
  },
  signOut: vi.fn(async () => ({ error: null })),
+  // Row returned for user_preferences reads (the auto_logout mint lookup).
+  userPreferences: null as null | { auto_logout: boolean },
+  userPreferencesError: null as unknown,
 }))

 vi.mock('@supabase/ssr', () => ({
@@ -46,13 +49,20 @@ vi.mock('@supabase/ssr', () => ({
      },
    },
    rpc: vi.fn(async () => state.company),
-    from: vi.fn(() => {
+    from: vi.fn((table: string) => {
      const chain: Record<string, unknown> = {}
      const self = new Proxy(chain, {
        get: (_t, prop) => {
          if (prop === 'then') return undefined
          if (prop === 'maybeSingle' || prop === 'single') {
-            return async () => ({ data: null, error: null })
+            return async () => ({
+              data:
+                table === 'user_preferences' && !state.userPreferencesError
+                  ? state.userPreferences
+                  : null,
+              error:
+                table === 'user_preferences' ? state.userPreferencesError : null,
+            })
          }
          return () => self
        },
@@ -102,6 +112,8 @@ describe('updateSession redirect destinations', () => {
      data: [{ company_id: 'company-1', locale: 'sv', used_fallback: false }],
      error: null,
    }
+    state.userPreferences = null
+    state.userPreferencesError = null
    delete process.env.NEXT_PUBLIC_REQUIRE_MFA
    delete process.env.NEXT_PUBLIC_SELF_HOSTED
    process.env.SESSION_TIMEOUT_SECRET = 'middleware-test-secret'
@@ -139,18 +151,26 @@ describe('updateSession redirect destinations', () => {
      method?: 'password' | 'bankid'
      userId?: string
      sessionId?: string | null
+      autoLogout?: boolean
+      legacy?: boolean
    }) {
      const stateValue = {
        ...createSessionTimeoutState({
          userId: args?.userId ?? 'user-1',
          sessionId: args?.sessionId === undefined ? 'session-1' : args.sessionId,
          method: args?.method ?? 'password',
+          // Default the opt-in to true: these tests exercise enforcement.
+          autoLogout: args?.autoLogout ?? true,
          now: args?.startedAt ?? Date.now(),
        }),
        ...(args?.lastActivityAt === undefined
          ? {}
          : { lastActivityAt: args.lastActivityAt }),
      }
+      if (args?.legacy) {
+        // Pre-toggle cookies carry no auto_logout snapshot.
+        delete (stateValue as { autoLogout?: boolean }).autoLogout
+      }
      const signed = await signSessionTimeoutState(stateValue)
      if (!signed) throw new Error('test signing secret missing')
      return signed
@@ -233,6 +253,77 @@ describe('updateSession redirect destinations', () => {
      expect((await run('/api/v1/companies/c1/invoices', { headers })).status).toBe(200)
    })

+    it('mints the cookie with the auto_logout opt-out default for new sessions', async () => {
+      const response = await run('/settings/tax')
+
+      expect(response.status).toBe(200)
+      const encoded = response.cookies.get(SESSION_TIMEOUT_COOKIE)?.value
+      await expect(verifySessionTimeoutState(encoded)).resolves.toMatchObject({
+        autoLogout: false,
+      })
+    })
+
+    it('snapshots an opted-in preference at mint time', async () => {
+      state.userPreferences = { auto_logout: true }
+
+      const response = await run('/settings/tax')
+
+      const encoded = response.cookies.get(SESSION_TIMEOUT_COOKIE)?.value
+      await expect(verifySessionTimeoutState(encoded)).resolves.toMatchObject({
+        autoLogout: true,
+      })
+    })
+
+    it('persists no snapshot when the preference read fails', async () => {
+      state.userPreferencesError = { message: 'connection reset' }
+      const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+      const response = await run('/settings/tax')
+
+      // Unknown preference: nothing minted, nobody logged out; the next
+      // request retries the read.
+      expect(response.status).toBe(200)
+      expect(response.cookies.get(SESSION_TIMEOUT_COOKIE)).toBeUndefined()
+      expect(state.signOut).not.toHaveBeenCalled()
+      errorSpy.mockRestore()
+    })
+
+    it('never logs out a session that has not opted in', async () => {
+      const now = Date.now()
+      // Far past both limits: without the opt-in the session must survive.
+      const encoded = await signedCookie({
+        startedAt: now - 600_000,
+        lastActivityAt: now - 600_000,
+        autoLogout: false,
+      })
+
+      const response = await run('/reports/vat', {
+        headers: { cookie: `${SESSION_TIMEOUT_COOKIE}=${encoded}` },
+      })
+
+      expect(response.status).toBe(200)
+      expect(state.signOut).not.toHaveBeenCalled()
+    })
+
+    it('upgrades a pre-toggle cookie in place instead of treating it as forged', async () => {
+      state.userPreferences = { auto_logout: true }
+      const startedAt = Date.now() - 5_000
+      const encoded = await signedCookie({ startedAt, legacy: true })
+
+      const response = await run('/settings/tax', {
+        headers: { cookie: `${SESSION_TIMEOUT_COOKIE}=${encoded}` },
+      })
+
+      expect(response.status).toBe(200)
+      expect(state.signOut).not.toHaveBeenCalled()
+      const upgraded = response.cookies.get(SESSION_TIMEOUT_COOKIE)?.value
+      // Timers survive the upgrade: only the opt-in snapshot is added.
+      await expect(verifySessionTimeoutState(upgraded)).resolves.toMatchObject({
+        startedAt,
+        autoLogout: true,
+      })
+    })
+
    it('starts a new timeout window when the Supabase session changes', async () => {
      const encoded = await signedCookie({ sessionId: 'old-session' })

@@ -9,8 +9,10 @@ import {
  apiRequestSkipsSessionTimeout,
  createSessionTimeoutState,
  evaluateSessionTimeout,
+  fetchAutoLogoutPreference,
  getSessionTimeoutConfig,
  sessionStateMatchesUser,
+  sessionStateNeedsRemint,
  sessionTimeoutClearCookieOptions,
  sessionTimeoutCookieOptions,
  signSessionTimeoutState,
@@ -103,9 +105,14 @@ export async function updateSession(request: NextRequest) {
      )
    }

+    const stateMatches =
+      verifiedState !== null &&
+      sessionStateMatchesUser(verifiedState, user.id, sessionId)
+
    if (
      !verifiedState ||
-      !sessionStateMatchesUser(verifiedState, user.id, sessionId)
+      !stateMatches ||
+      sessionStateNeedsRemint(verifiedState)
    ) {
      const hintedMethod = request.cookies.get(
        SESSION_AUTH_METHOD_HINT_COOKIE,
@@ -113,21 +120,32 @@ export async function updateSession(request: NextRequest) {
      const method = isSessionAuthMethod(hintedMethod)
        ? hintedMethod
        : 'password'
-      const state = createSessionTimeoutState({
-        userId: user.id,
-        sessionId,
-        method,
-      })
-      const signedState = await signSessionTimeoutState(state)
+      const autoLogout = await fetchAutoLogoutPreference(supabase, user.id)

-      if (signedState) {
-        request.cookies.set(SESSION_TIMEOUT_COOKIE, signedState)
-        supabaseResponse.cookies.set(
-          SESSION_TIMEOUT_COOKIE,
-          signedState,
-          sessionTimeoutCookieOptions(),
-        )
-        clearAuthMethodHint(request, supabaseResponse)
+      // Unknown preference (failed read): mint nothing, so no fail-open
+      // snapshot gets persisted; the next request retries the read.
+      if (autoLogout !== null) {
+        // A matching pre-toggle cookie keeps its timers: upgrading the shape
+        // must not restart the absolute window.
+        const state = verifiedState && stateMatches
+          ? { ...verifiedState, autoLogout }
+          : createSessionTimeoutState({
+              userId: user.id,
+              sessionId,
+              method,
+              autoLogout,
+            })
+        const signedState = await signSessionTimeoutState(state)
+
+        if (signedState) {
+          request.cookies.set(SESSION_TIMEOUT_COOKIE, signedState)
+          supabaseResponse.cookies.set(
+            SESSION_TIMEOUT_COOKIE,
+            signedState,
+            sessionTimeoutCookieOptions(),
+          )
+          clearAuthMethodHint(request, supabaseResponse)
+        }
      }
    } else {
      const timeoutReason = evaluateSessionTimeout(