From d12ccc782d8e6eab46eb6e0976b747dca1013b36 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 12:25:09 +0000 Subject: access: ending a single session Logging out of the dashboard (`DELETE /auth/session`) only cleared the cookie: the session's tokens stayed taken until they expired, by every node. Ending them took `POST /auth/logout`, which ends all of a user's sessions. Now `DELETE /auth/session` ends the session of the token it comes with (the cookie, or a bearer token): where the swarm has a registry, it is recorded as `_continuum/sessions//` (`registry::session_path`), its value until when the session would have lasted, and every node refuses the session's tokens once the change reaches it (`token::Refused::Ended`): the page's own, its narrow tokens, and one handed to another member's dashboard, all refreshed from it and keeping its ID. The rules take the entry from the user itself or one who manages users, as a logout. A remake's snapshot leaves out entries past that time, a user's map where none is left: their tokens are expired anyway. Without a registry the document can't record it: the node ending it refuses the session's tokens itself (`AppState::ended_sessions`, until it restarts), others take them until they expire, as a logout there is refused. --- src/state/mod.rs | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'src/state/mod.rs') diff --git a/src/state/mod.rs b/src/state/mod.rs index 26910b6..a2da643 100644 --- a/src/state/mod.rs +++ b/src/state/mod.rs @@ -156,6 +156,11 @@ pub(crate) struct AppState { pub(crate) screening: Arc>, /// The challenges logins by key used, until they expire (`access::challenge`). pub(crate) challenges: Arc>, + /// Sessions ended on this node in a swarm without a registry, where they can't be + /// recorded in the document: by session ID, until when each would have lasted + /// (`api::login::end_session`). This node refuses their tokens; others take them + /// until they expire, and so does this one after a restart. + pub(crate) ended_sessions: Arc>>, pub(crate) token_lifetime: Duration, pub(crate) session_lifetime: Duration, /// How long a challenge to log in by key is valid, and how many logins by key a user -- cgit v1.3.1