From 97ae0ccf8eb0c0082d3989086f6c8258cd685625 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 12 Nov 2026 02:06:36 +0000 Subject: login: a login given a lifetime of its own ends its session's record with it Ending a session records it in the document until the login's end (login_exp), so every token of the session, refreshed or handed over, is refused until none can live any longer. A login may ask a lifetime of its own (POST /auth/login with lifetime): its session ends with that token (session_exp), as a refresh never goes past it. Its login_exp is now that end too, so ending its session records it as long as one of its tokens can live, not for the node's whole session lifetime. A token refreshed with a lifetime (one handed to another member's dashboard) keeps the login's end. --- src/api/login.rs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/api') diff --git a/src/api/login.rs b/src/api/login.rs index 1c8aa44..c5cbe8d 100644 --- a/src/api/login.rs +++ b/src/api/login.rs @@ -262,6 +262,7 @@ fn new_login( let exp = now .saturating_add(lifetime_ms(state, lifetime)) .min(session_exp); + let session_exp = ended_with(session_exp, exp, lifetime); Claims { v: 1, swarm, @@ -271,7 +272,7 @@ fn new_login( iat: now, exp, session: token::new_session(), - session_exp: ended_with(session_exp, exp, lifetime), + session_exp, login_exp: session_exp, limit, } -- cgit v1.3.1