access: an ended session recorded until the login's end

Review 4, F7: `DELETE /auth/session` recorded the session as ended until the
`session_exp` of the token it came with. A token handed to another member's dashboard
has its `session_exp` cut to its own end (five minutes), and so has the session that
dashboard keeps with it: logging out there recorded an end minutes away, the next
remake's snapshot left it out, and the original browser's tokens of the same session,
refreshable for days, were taken again.

A token now keeps the login's end as it logged in (`Claims::login_exp`), which no
refresh changes, and an ended session is recorded until then (or the token's
`session_exp`, if later, as for a token from before the field).

1 files changed, 9 insertions, 1 deletions

diff --git a/src/access/token.rs b/src/access/token.rs
index ae1546c..a9fc270 100644
--- a/src/access/token.rs
+++ b/src/access/token.rs
@@ -46,8 +46,15 @@ pub(crate) struct Claims {
     pub(crate) exp: u64,
     /// The login it comes from, kept by refreshed tokens (16 hex digits).
     pub(crate) session: String,
-    /// Until when it may be refreshed (Unix ms): the login's end.
+    /// Until when it may be refreshed (Unix ms): the login's end, or sooner for one that
+    /// was given a lifetime of its own (it ends its session with it).
     pub(crate) session_exp: u64,
+    /// The login's end (Unix ms), as it logged in: what no refresh changes, a token cut
+    /// short included. An ended session is recorded until then (`registry::session_path`),
+    /// so it covers every token of the session, wherever it ends. 0 in a token from
+    /// before it was kept: `session_exp` then.
+    #[serde(default)]
+    pub(crate) login_exp: u64,
     /// Less than the user may do: only what these allow too.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub(crate) limit: Option<Vec<Capability>>,
@@ -206,6 +213,7 @@ mod tests {
             exp: 2_000,
             session: new_session(),
             session_exp: 10_000,
+            login_exp: 10_000,
             limit: None,
         }
     }