eagraiclainne/app

Watch

Fork 0

fix: sessions that end when you end them (#112) #138

Merged

nalum merged 4 commits from fix/sessions into main

2026-08-18 16:42:41 +00:00

nalum commented

2026-08-18 11:48:49 +00:00

Owner

PR 1 of the #137 stack. Closes #112.

Four commits:

feat(auth): bind session tokens to their refresh chain — ADR-0033. Session JWTs minted alongside a refresh chain carry a sid claim. The auth interceptor refuses the token once the chain has no live record, through a new nil-tolerated Config.LookupChain seam. Revoking a session now ends that device's access on its next request, not at token expiry.
feat(user): mark the current session and hide idle-dead chains — Session.current (proto, additive) marks the chain the request rode. ListSessions skips chains already past the 90-day idle window: they can never exchange again, so listing them as signed-in devices was a lie. This is where the phantom session pile-up came from.
fix(web) — the switch panel sent every PIN-set profile to the PIN pad even with no parked chain on the device, so the pad always failed into the password form and read as "my PIN doesn't work". It now routes to the password directly with honest copy. The sessions card shows a "This device" chip, and revoking the current session signs out cleanly on the spot.
fix(android) — the same two fixes ported: parked-before-PIN routing on the switch sheet, current marker + clean sign-out in the sessions card.

Verified against the live deploy: sid present in the minted token, current: true on the calling chain, and a still-unexpired access token gets 401 on the very next request after its chain is revoked. make check, the hermetic integration suite, and the Android unit tests all pass.

🤖 Generated with Claude Code

PR 1 of the #137 stack. Closes #112. Four commits: 1. **feat(auth): bind session tokens to their refresh chain** — ADR-0033. Session JWTs minted alongside a refresh chain carry a `sid` claim. The auth interceptor refuses the token once the chain has no live record, through a new nil-tolerated `Config.LookupChain` seam. Revoking a session now ends that device's access on its next request, not at token expiry. 2. **feat(user): mark the current session and hide idle-dead chains** — `Session.current` (proto, additive) marks the chain the request rode. `ListSessions` skips chains already past the 90-day idle window: they can never exchange again, so listing them as signed-in devices was a lie. This is where the phantom session pile-up came from. 3. **fix(web)** — the switch panel sent every PIN-set profile to the PIN pad even with no parked chain on the device, so the pad always failed into the password form and read as "my PIN doesn't work". It now routes to the password directly with honest copy. The sessions card shows a "This device" chip, and revoking the current session signs out cleanly on the spot. 4. **fix(android)** — the same two fixes ported: parked-before-PIN routing on the switch sheet, current marker + clean sign-out in the sessions card. Verified against the live deploy: `sid` present in the minted token, `current: true` on the calling chain, and a still-unexpired access token gets 401 on the very next request after its chain is revoked. `make check`, the hermetic integration suite, and the Android unit tests all pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

nalum added 4 commits

2026-08-18 11:48:49 +00:00

feat(auth): bind session tokens to their refresh chain cdbb5d7e91

Revoking a device session (RevokeSession, delete-all, logout) only
killed the refresh chain — the access JWT stayed valid until its
expiry, so 'signing a device out' did not actually end its session
(issue #112). Session tokens minted alongside a chain now carry a sid
claim naming the chain, and the auth interceptor refuses the token as
soon as the chain has no live record. The chain lookup is a Config
seam like LookupSubject, nil-tolerated so session-only tests need no
wiring; sid-less tokens (pre-change, or logins that did not remember
the device) behave exactly as before. ADR-0033 records the decision.

feat(user): mark the current session and hide idle-dead chains 7971ae91f3

The settings session list showed every unrevoked chain with no hint of
which one is this device (issue #112): abandoned chains (a cleared
browser, a reinstalled app) sat listed for the full 90-day idle window
because idle expiry is only enforced when a token is presented, and the
member could not tell a phantom from the session they are using right
now. ListSessions now skips chains already past the idle window — they
can never exchange again, so listing them as signed-in devices was a
lie — and marks the requester's own chain via the sid claim (ADR-0033)
so clients can say 'this device'.

fix(web): honest session list and PIN routing on the switch panel 8dd93b8091

Two client halves of issue #112. The switch panel sent every PIN-set
profile to the PIN pad even when this device holds no parked chain for
them, so the pad always failed into the password form — reading as
'my PIN doesn't work'. It now routes straight to the password with the
honest notice, and the pad is reserved for profiles the device can
actually switch to. The sessions card marks the server's current
session as 'This device', and revoking it signs out cleanly on the
spot instead of leaving the page to die on its next request.

fix(android): honest session list and PIN routing on the switch sheet

check / commits (pull_request) Successful in 6s

Details

check / web (pull_request) Successful in 1m39s

Details

check / go (pull_request) Successful in 2m46s

Details

check / report (pull_request) Successful in 4s

Details

android / build (pull_request) Successful in 5m11s

Details

android / report (pull_request) Successful in 3s

Details

check / report (push) Has been cancelled

Details

check / web (push) Has been cancelled

Details

tag / tag (push) Has been cancelled

Details

check / go (push) Has been cancelled

Details

check / commits (push) Has been cancelled

Details

android / report (push) Has been cancelled

Details

android / build (push) Has been cancelled

Details

892c7b55bc

The Android half of issue #112, mirroring the web fix: the switch
sheet routed PIN-set profiles to the pad even when no parked chain
exists on this device (the pad then always failed into the password
form), the session list carried no 'this device' marker, and revoking
the current session left the app to die on its next request instead
of signing out cleanly.

nalum referenced this pull request

2026-08-18 11:49:04 +00:00

Order of work for the open backlog (#107–#136) #137

forgejo-actions commented

2026-08-18 11:51:39 +00:00

Test report

Suite	Tests	Result	Skipped
Unit	1370	✅ pass	1
Integration	85	✅ pass	—

Coverage: 28.2%

_{Updated by the check workflow · commit 892c7b55bc}

## Test report | Suite | Tests | Result | Skipped | | --- | --: | --- | --: | | Unit | 1370 | ✅ pass | 1 | | Integration | 85 | ✅ pass | — | **Coverage:** 28.2% <sub>Updated by the check workflow · commit 892c7b55bc5640ac3ad0f4af242c76544a43eeb5</sub>

forgejo-actions commented

2026-08-18 11:54:05 +00:00

Android test report

Suite	Tests	Result	Skipped
Unit (debug)	31	✅ pass	0

Coverage: 2.4% of lines

_{Updated by the android workflow · commit 892c7b55bc}

## Android test report | Suite | Tests | Result | Skipped | | --- | --: | --- | --: | | Unit (debug) | 31 | ✅ pass | 0 | **Coverage:** 2.4% of lines <sub>Updated by the android workflow · commit 892c7b55bc5640ac3ad0f4af242c76544a43eeb5</sub>

nalum referenced this pull request

2026-08-18 11:59:19 +00:00

ci(release): sign the image so podman can verify it #139

nalum merged commit 892c7b55bc into main

2026-08-18 16:42:41 +00:00

nalum deleted branch fix/sessions

2026-08-18 16:42:41 +00:00

nalum referenced this pull request

2026-08-18 16:47:30 +00:00

Order of work for the open backlog (#107–#136) #137