Kyle Pope 1ebc41b9d7 L-03: Session 7-day sliding window with 30-day hard ceiling ...

Reduce session expiry from 30 days to 7 days of inactivity while
preserving a 30-day absolute token lifetime for itsdangerous:

- SESSION_MAX_AGE_DAYS=7: sliding window for DB expires_at + cookie
- SESSION_TOKEN_HARD_CEILING_DAYS=30: itsdangerous max_age (prevents
  rejecting renewed tokens whose creation timestamp exceeds 7 days)
- get_current_user: silently extends expires_at and re-issues cookie
  when >1 day has elapsed since last renewal
- Active users never notice; 7 days of inactivity forces re-login;
  30-day absolute ceiling forces re-login regardless of activity

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-27 15:45:15 +08:00

..

audit.py

Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)

2026-02-26 19:06:25 +08:00

auth.py

L-03: Session 7-day sliding window with 30-day hard ceiling

2026-02-27 15:45:15 +08:00

ntfy_templates.py

Implement Track C: NTFY push notification integration

2026-02-25 04:04:23 +08:00

ntfy.py

Fix QA review findings: update docs and comments

2026-02-26 02:42:59 +08:00

recurrence.py

Fix QA findings: firstDay reactivity, state revert, helper extraction

2026-02-22 02:02:15 +08:00

totp.py

Implement Stage 6 Track B: TOTP MFA (pyotp, Fernet-encrypted secrets, backup codes)

2026-02-25 04:18:05 +08:00