Squid/ClusterCanvas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Show a login notice when a session ends due to idle timeout.

Browse Source 
Return a distinct session_idle error from the API and reload to /login with a clear signed-out message.
This commit is contained in:
Squid
2026-07-18 20:50:52 +02:00
parent c90a47c3ea
commit e3793f380c
9 changed files with 353 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
service/internal/api/middleware.go
+6 -1
View File
@@ -2,6 +2,7 @@ package api
import (
"context"
"errors"
"net/http"
"strings"
@@ -76,7 +77,11 @@ func (app *App) withMiddleware(next http.Handler) http.Handler {
security := effectiveSecurity(settingsPayload.Security)
session, err := app.Sessions.LookupValidSession(writer, request, security)
if err != nil {
writeJSON(writer, http.StatusUnauthorized, apiErrorResponse{Error: "authentication required"})
errorMessage := "authentication required"
if errors.Is(err, auth.ErrSessionIdle) {
errorMessage = "session_idle"
}
writeJSON(writer, http.StatusUnauthorized, apiErrorResponse{Error: errorMessage})
return
}
service/internal/api/middleware_idle_test.go
+83
View File
@@ -0,0 +1,83 @@
package api
import (
"encoding/json"
"net/http"
"net/http/httptest"
"testing"
"time"
"codeberg.org/SquidSE/ClusterCanvas/service/internal/auth"
"codeberg.org/SquidSE/ClusterCanvas/service/internal/settings"
)
func TestMiddlewareReturnsSessionIdle(t *testing.T) {
configDir := t.TempDir()
cookie := seedCompletedSetup(t, configDir)
keyBytes := make([]byte, 32)
for index := range keyBytes {
keyBytes[index] = byte(index + 1)
}
store, err := settings.LoadSessions(configDir, keyBytes)
if err != nil {
t.Fatalf("LoadSessions: %v", err)
}
if len(store.Sessions) != 1 {
t.Fatalf("expected 1 session, got %d", len(store.Sessions))
}
store.Sessions[0].LastSeenAt = time.Now().UTC().Add(-31 * time.Minute)
if err := settings.SaveSessions(configDir, store, keyBytes); err != nil {
t.Fatalf("SaveSessions: %v", err)
}
router := NewRouter(configDir)
request := withSession(httptest.NewRequest(http.MethodGet, "/api/v1/status", nil), cookie)
recorder := httptest.NewRecorder()
router.ServeHTTP(recorder, request)
if recorder.Code != http.StatusUnauthorized {
t.Fatalf("expected status %d, got %d body=%s", http.StatusUnauthorized, recorder.Code, recorder.Body.String())
}
var payload apiErrorResponse
if err := json.NewDecoder(recorder.Body).Decode(&payload); err != nil {
t.Fatalf("decode response: %v", err)
}
if payload.Error != "session_idle" {
t.Fatalf("expected session_idle, got %q", payload.Error)
}
cleared := false
for _, setCookie := range recorder.Result().Cookies() {
if setCookie.Name == auth.SessionCookieName && setCookie.MaxAge < 0 {
cleared = true
}
}
if !cleared {
t.Fatal("expected session cookie to be cleared")
}
}
func TestMiddlewareReturnsAuthenticationRequiredWithoutCookie(t *testing.T) {
configDir := t.TempDir()
_ = seedCompletedSetup(t, configDir)
router := NewRouter(configDir)
request := httptest.NewRequest(http.MethodGet, "/api/v1/status", nil)
recorder := httptest.NewRecorder()
router.ServeHTTP(recorder, request)
if recorder.Code != http.StatusUnauthorized {
t.Fatalf("expected status %d, got %d body=%s", http.StatusUnauthorized, recorder.Code, recorder.Body.String())
}
var payload apiErrorResponse
if err := json.NewDecoder(recorder.Body).Decode(&payload); err != nil {
t.Fatalf("decode response: %v", err)
}
if payload.Error != "authentication required" {
t.Fatalf("expected authentication required, got %q", payload.Error)
}
}
service/internal/auth/session.go
+9 -1
View File
@@ -20,7 +20,10 @@ const (
sessionRotateAfter = time.Hour
)
var ErrSessionNotFound = errors.New("session not found")
var (
ErrSessionNotFound = errors.New("session not found")
ErrSessionIdle = errors.New("session idle")
)
// SessionManager persists sessions in sessions.enc and sets hardened cookies.
type SessionManager struct {
@@ -108,6 +111,7 @@ func (manager *SessionManager) LookupValidSession(
lifetime := time.Duration(security.SessionLifetimeHours) * time.Hour
var found *settings.SessionRecord
idleMatched := false
remaining := make([]settings.SessionRecord, 0, len(store.Sessions))
for index := range store.Sessions {
session := store.Sessions[index]
@@ -116,6 +120,7 @@ func (manager *SessionManager) LookupValidSession(
}
if session.ID == cookie.Value {
if now.Sub(session.LastSeenAt) > idleLimit {
idleMatched = true
continue
}
copySession := session
@@ -129,6 +134,9 @@ func (manager *SessionManager) LookupValidSession(
store.Sessions = remaining
_ = settings.SaveSessions(manager.configDir, store, manager.key)
clearSessionCookie(writer)
if idleMatched {
return settings.SessionRecord{}, ErrSessionIdle
}
return settings.SessionRecord{}, ErrSessionNotFound
}
service/internal/auth/session_test.go
+91
View File
@@ -0,0 +1,91 @@
package auth
import (
"errors"
"net/http"
"net/http/httptest"
"testing"
"time"
"codeberg.org/SquidSE/ClusterCanvas/service/internal/settings"
)
func TestLookupValidSessionReturnsIdle(t *testing.T) {
configDir := t.TempDir()
key := testSessionKey()
manager := NewSessionManager(configDir, key)
security := settings.DefaultSecuritySettings()
security.IdleTimeoutMinutes = 5
createRec := httptest.NewRecorder()
record, err := manager.CreateSession(createRec, "user-1", security)
if err != nil {
t.Fatalf("CreateSession: %v", err)
}
store, err := settings.LoadSessions(configDir, key)
if err != nil {
t.Fatalf("LoadSessions: %v", err)
}
if len(store.Sessions) != 1 {
t.Fatalf("expected 1 session, got %d", len(store.Sessions))
}
store.Sessions[0].LastSeenAt = time.Now().UTC().Add(-6 * time.Minute)
if err := settings.SaveSessions(configDir, store, key); err != nil {
t.Fatalf("SaveSessions: %v", err)
}
request := httptest.NewRequest(http.MethodGet, "/api/v1/status", nil)
request.AddCookie(&http.Cookie{Name: SessionCookieName, Value: record.ID})
lookupRec := httptest.NewRecorder()
_, err = manager.LookupValidSession(lookupRec, request, security)
if !errors.Is(err, ErrSessionIdle) {
t.Fatalf("expected ErrSessionIdle, got %v", err)
}
store, err = settings.LoadSessionsOrEmpty(configDir, key)
if err != nil {
t.Fatalf("LoadSessionsOrEmpty: %v", err)
}
if len(store.Sessions) != 0 {
t.Fatalf("expected idle session removed, got %#v", store.Sessions)
}
}
func TestLookupValidSessionMissingCookie(t *testing.T) {
configDir := t.TempDir()
manager := NewSessionManager(configDir, testSessionKey())
security := settings.DefaultSecuritySettings()
request := httptest.NewRequest(http.MethodGet, "/api/v1/status", nil)
lookupRec := httptest.NewRecorder()
_, err := manager.LookupValidSession(lookupRec, request, security)
if !errors.Is(err, ErrSessionNotFound) {
t.Fatalf("expected ErrSessionNotFound, got %v", err)
}
}
func TestLookupValidSessionUnknownCookie(t *testing.T) {
configDir := t.TempDir()
manager := NewSessionManager(configDir, testSessionKey())
security := settings.DefaultSecuritySettings()
request := httptest.NewRequest(http.MethodGet, "/api/v1/status", nil)
request.AddCookie(&http.Cookie{Name: SessionCookieName, Value: "unknown-session"})
lookupRec := httptest.NewRecorder()
_, err := manager.LookupValidSession(lookupRec, request, security)
if !errors.Is(err, ErrSessionNotFound) {
t.Fatalf("expected ErrSessionNotFound, got %v", err)
}
}
func testSessionKey() []byte {
key := make([]byte, 32)
for index := range key {
key[index] = byte(index + 3)
}
return key
}
webui/src/App.css
+6
View File
@@ -1065,6 +1065,12 @@
font-size: 0.9rem;
}
.wizard-notice {
margin: 0 0 0.85rem;
color: var(--ctp-subtext0);
font-size: 0.9rem;
}
.wizard-rules {
font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
resize: vertical;
webui/src/LoginPage.test.tsx
+31
View File
@@ -0,0 +1,31 @@
import { render, screen } from '@testing-library/react'
import { afterEach, describe, expect, it, vi } from 'vitest'
import { LoginPage } from './LoginPage'
describe('LoginPage', () => {
afterEach(() => {
window.history.replaceState(null, '', '/login')
vi.restoreAllMocks()
})
it('shows an idle signed-out notice from the query string', () => {
window.history.replaceState(null, '', '/login?reason=idle')
render(<LoginPage onLoggedIn={vi.fn()} />)
expect(
screen.getByText(
/You have been signed out because your idle time limit was reached/i,
),
).toBeInTheDocument()
expect(window.location.search).toBe('')
})
it('does not show an idle notice without the query reason', () => {
window.history.replaceState(null, '', '/login')
render(<LoginPage onLoggedIn={vi.fn()} />)
expect(screen.queryByRole('status')).not.toBeInTheDocument()
})
})
webui/src/LoginPage.tsx
+25
View File
@@ -1,15 +1,34 @@
import { useState, type FormEvent } from 'react'
import { login } from './api/client'
const IDLE_SIGNED_OUT_MESSAGE =
'You have been signed out because your idle time limit was reached.'
type LoginPageProps = {
onLoggedIn: (username: string) => void
}
function readIdleSignedOutMessage(): string | null {
if (typeof window === 'undefined') {
return null
}
const params = new URLSearchParams(window.location.search)
if (params.get('reason') !== 'idle') {
return null
}
params.delete('reason')
const nextSearch = params.toString()
const nextUrl = `${window.location.pathname}${nextSearch ? `?${nextSearch}` : ''}${window.location.hash}`
window.history.replaceState(null, '', nextUrl)
return IDLE_SIGNED_OUT_MESSAGE
}
export function LoginPage({ onLoggedIn }: LoginPageProps) {
const [username, setUsername] = useState('Admin')
const [password, setPassword] = useState('')
const [totpCode, setTotpCode] = useState('')
const [errorMessage, setErrorMessage] = useState<string | null>(null)
const [idleMessage] = useState<string | null>(() => readIdleSignedOutMessage())
const [isSubmitting, setIsSubmitting] = useState(false)
async function handleSubmit(event: FormEvent) {
@@ -35,6 +54,12 @@ export function LoginPage({ onLoggedIn }: LoginPageProps) {
Use the administrator account created during setup.
</p>
{idleMessage ? (
<p className="wizard-notice" role="status">
{idleMessage}
</p>
) : null}
{errorMessage ? (
<p className="wizard-error" role="alert">
{errorMessage}
webui/src/api/client.test.ts
+69
View File
@@ -14,6 +14,7 @@ import {
fetchStatus,
fetchUsers,
getApiBaseUrl,
login,
patchAction,
saveNetwork,
saveSecurity,
@@ -716,3 +717,71 @@ describe('actions API', () => {
)
})
})
describe('session idle redirect', () => {
afterEach(() => {
vi.restoreAllMocks()
})
it('reloads to login when an authenticated call returns session_idle', async () => {
const assign = vi.fn()
vi.stubGlobal('location', {
pathname: '/configuration/security',
assign,
})
const fetchMock = vi.fn().mockResolvedValue({
ok: false,
status: 401,
clone: () => ({
json: async () => ({ error: 'session_idle' }),
}),
json: async () => ({ error: 'session_idle' }),
})
await expect(fetchStatus(fetchMock)).rejects.toThrow()
expect(assign).toHaveBeenCalledWith('/login?reason=idle')
})
it('does not redirect on login 401', async () => {
const assign = vi.fn()
vi.stubGlobal('location', {
pathname: '/login',
assign,
})
const fetchMock = vi.fn().mockResolvedValue({
ok: false,
status: 401,
clone: () => ({
json: async () => ({ error: 'invalid credentials' }),
}),
json: async () => ({ error: 'invalid credentials' }),
})
await expect(login('Admin', 'wrong', '', fetchMock)).rejects.toThrow(
'invalid credentials',
)
expect(assign).not.toHaveBeenCalled()
})
it('does not redirect for generic authentication required', async () => {
const assign = vi.fn()
vi.stubGlobal('location', {
pathname: '/',
assign,
})
const fetchMock = vi.fn().mockResolvedValue({
ok: false,
status: 401,
clone: () => ({
json: async () => ({ error: 'authentication required' }),
}),
json: async () => ({ error: 'authentication required' }),
})
await expect(fetchStatus(fetchMock)).rejects.toThrow()
expect(assign).not.toHaveBeenCalled()
})
})
webui/src/api/client.ts
+33 -1
View File
@@ -154,6 +154,36 @@ async function readErrorMessage(response: Response): Promise<string> {
return `request failed: ${response.status}`
}
const SESSION_IDLE_ERROR = 'session_idle'
const IDLE_LOGIN_PATH = '/login?reason=idle'
function shouldRedirectOnSessionIdle(path: string): boolean {
if (path === '/api/v1/auth/login') {
return false
}
if (typeof window === 'undefined') {
return false
}
return window.location.pathname !== '/login'
}
async function redirectIfSessionIdle(
response: Response,
path: string,
): Promise<void> {
if (response.status !== 401 || !shouldRedirectOnSessionIdle(path)) {
return
}
try {
const payload = (await response.clone().json()) as { error?: string }
if (payload.error === SESSION_IDLE_ERROR) {
window.location.assign(IDLE_LOGIN_PATH)
}
} catch {
// ignore non-JSON bodies
}
}
async function apiFetch(
path: string,
init: RequestInit = {},
@@ -163,11 +193,13 @@ async function apiFetch(
if (init.body && !headers.has('Content-Type')) {
headers.set('Content-Type', 'application/json')
}
return fetchImpl(`${getApiBaseUrl()}${path}`, {
const response = await fetchImpl(`${getApiBaseUrl()}${path}`, {
...init,
headers,
credentials: 'include',
})
await redirectIfSessionIdle(response, path)
return response
}
export async function fetchHealth(