diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-15 02:16:39 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-15 02:21:01 +0200 |
| commit | 73ad8e4eb566fe682107fa7e50ef624591199e99 (patch) | |
| tree | ff0017d014d46d8835487c080dca55c6def7fd6b /docs | |
| parent | bdefcd025604f2c3009fe5e0cc01213c2ba62a6a (diff) | |
| download | meshbay-73ad8e4eb566fe682107fa7e50ef624591199e99.tar.gz | |
feat(hub): session lifetime is an admin setting, and a browser signs out when idle
Browser idle sign-out (media playback counts as activity; not the desktop app),
refresh idle window and maximum session length, in hours. Sign-out now revokes
on the hub, and the profile has "sign out everywhere".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XuNrwLf5EFWCMHzfoEvnpm
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index ca5ba8e..4cac3ac 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1779,6 +1779,21 @@ Registration is gated by a CAPTCHA whenever one is configured — **unconditiona not only when some other field is absent, or the real client's ordinary request skips it. The desktop client renders the widget too. +**Sessions end three ways, all admin settings in hours** (`session.*`, §7.4): + +- **A browser signs itself out** after `browser_idle_hours` with no input and no + `<video>`/`<audio>` playing. The page measures it, because the hub cannot: it + hears a renewal from any open tab, attended or not, and nothing while a film + plays. The last-active time is shared by the browser's tabs and survives the + browser being closed. **The desktop application is exempt** — its owner's + machine, which signs back in with its device key, also after a renewal fails. +- **A refresh token unused for `refresh_idle_hours` stops renewing**, never below + the access token's life plus an hour, and **no session renews past + `max_hours`** after its sign-in. +- **Signing out revokes the refresh token on the hub**, not only in the browser, + and **"sign out everywhere"** revokes every one the account holds. Access tokens + already issued run out on their own. + **Passphrase sign-in locks per username.** After `login.max_failures` wrong passphrases (§7.4) the name is refused with `429 account_locked` and a `Retry-After` for `login.lockout_minutes`, without the passphrase being checked. |