From 73ad8e4eb566fe682107fa7e50ef624591199e99 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 15 Sep 2026 02:16:39 +0200 Subject: feat(hub): session lifetime is an admin setting, and a browser signs out when idle Browser idle sign-out (media playback counts as activity; not the desktop app), refresh idle window and maximum session length, in hours. Sign-out now revokes on the hub, and the profile has "sign out everywhere". Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01XuNrwLf5EFWCMHzfoEvnpm --- packages/meshbay-hub/tests/test_unauthenticated_surface.py | 1 + 1 file changed, 1 insertion(+) (limited to 'packages/meshbay-hub/tests/test_unauthenticated_surface.py') diff --git a/packages/meshbay-hub/tests/test_unauthenticated_surface.py b/packages/meshbay-hub/tests/test_unauthenticated_surface.py index 2c9541a..f2da42b 100644 --- a/packages/meshbay-hub/tests/test_unauthenticated_surface.py +++ b/packages/meshbay-hub/tests/test_unauthenticated_surface.py @@ -35,6 +35,7 @@ PUBLIC = { ("POST", "/v1/users/login"): "obtains a session — per-IP limit, per-name lockout", ("POST", "/v1/users/auth"): "device sign-in — Ed25519 signature over a fresh timestamp", ("POST", "/v1/users/token/refresh"): "the refresh token is the credential", + ("POST", "/v1/users/logout"): "the refresh token is the credential; it can only revoke", ("POST", "/v1/users/verify-email"): "the e-mailed code is the credential, attempts capped", ("POST", "/v1/users/password/reset-request"): "captcha, per-IP and per-account limits", ("POST", "/v1/users/password/reset"): "the e-mailed code is the credential, attempts capped", -- cgit v1.2.3