From 73ad8e4eb566fe682107fa7e50ef624591199e99 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Tue, 15 Sep 2026 02:16:39 +0200
Subject: feat(hub): session lifetime is an admin setting, and a browser signs
 out when idle

Browser idle sign-out (media playback counts as activity; not the desktop app),
refresh idle window and maximum session length, in hours. Sign-out now revokes
on the hub, and the profile has "sign out everywhere".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XuNrwLf5EFWCMHzfoEvnpm
---
 docs/MESHBAY_DESIGN.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'docs/MESHBAY_DESIGN.md')

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index ca5ba8e..4cac3ac 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -1779,6 +1779,21 @@ Registration is gated by a CAPTCHA whenever one is configured — **unconditiona
 not only when some other field is absent, or the real client's ordinary request
 skips it. The desktop client renders the widget too.
 
+**Sessions end three ways, all admin settings in hours** (`session.*`, §7.4):
+
+- **A browser signs itself out** after `browser_idle_hours` with no input and no
+  `<video>`/`<audio>` playing. The page measures it, because the hub cannot: it
+  hears a renewal from any open tab, attended or not, and nothing while a film
+  plays. The last-active time is shared by the browser's tabs and survives the
+  browser being closed. **The desktop application is exempt** — its owner's
+  machine, which signs back in with its device key, also after a renewal fails.
+- **A refresh token unused for `refresh_idle_hours` stops renewing**, never below
+  the access token's life plus an hour, and **no session renews past
+  `max_hours`** after its sign-in.
+- **Signing out revokes the refresh token on the hub**, not only in the browser,
+  and **"sign out everywhere"** revokes every one the account holds. Access tokens
+  already issued run out on their own.
+
 **Passphrase sign-in locks per username.** After `login.max_failures` wrong
 passphrases (§7.4) the name is refused with `429 account_locked` and a
 `Retry-After` for `login.lockout_minutes`, without the passphrase being checked.
-- 
cgit v1.2.3