diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index ca5ba8e..4cac3ac 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1779,6 +1779,21 @@ Registration is gated by a CAPTCHA whenever one is configured — **unconditiona not only when some other field is absent, or the real client's ordinary request skips it. The desktop client renders the widget too. +**Sessions end three ways, all admin settings in hours** (`session.*`, §7.4): + +- **A browser signs itself out** after `browser_idle_hours` with no input and no + `<video>`/`<audio>` playing. The page measures it, because the hub cannot: it + hears a renewal from any open tab, attended or not, and nothing while a film + plays. The last-active time is shared by the browser's tabs and survives the + browser being closed. **The desktop application is exempt** — its owner's + machine, which signs back in with its device key, also after a renewal fails. +- **A refresh token unused for `refresh_idle_hours` stops renewing**, never below + the access token's life plus an hour, and **no session renews past + `max_hours`** after its sign-in. +- **Signing out revokes the refresh token on the hub**, not only in the browser, + and **"sign out everywhere"** revokes every one the account holds. Access tokens + already issued run out on their own. + **Passphrase sign-in locks per username.** After `login.max_failures` wrong passphrases (§7.4) the name is refused with `429 account_locked` and a `Retry-After` for `login.lockout_minutes`, without the passphrase being checked. |