login: a login given a lifetime of its own ends its session's record with it

Ending a session records it in the document until the login's end
(login_exp), so every token of the session, refreshed or handed over, is
refused until none can live any longer. A login may ask a lifetime of
its own (POST /auth/login with lifetime): its session ends with that
token (session_exp), as a refresh never goes past it. Its login_exp is
now that end too, so ending its session records it as long as one of its
tokens can live, not for the node's whole session lifetime. A token
refreshed with a lifetime (one handed to another member's dashboard)
keeps the login's end.

0 files changed, 0 insertions, 0 deletions