stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Expire offline private work with operator sessions #399

New Issue
Closed
opened 2026-08-09 11:50:44 +00:00 by rockachopa · 0 comments
rockachopa commented 2026-08-09 11:50:44 +00:00
Member
Copy Link

Problem

The dashboard retains private offline snapshots, drafts, outboxes, and a cached authenticated shell beyond the eight-hour operator session. A cold offline launch can therefore render issue bodies, comments, review diffs, and drafts after server authorization has expired.

Vertical slice

Expose the signed session expiry to the browser, persist an offline authorization lease, and refuse/purge private offline work once that lease expires. Preserve existing offline behavior while the lease is valid. Normal online session expiry must purge before redirecting, matching explicit sign-out and remote-revocation safety.

Acceptance tests

  • Authenticated session metadata includes the absolute expiry and remains non-cacheable; unauthenticated requests disclose no lease.
  • Before expiry, saved My Work/details remain available during an outage.
  • At/after expiry, private hydration is blocked and Stackchain local/session storage, IndexedDB outboxes, and dashboard caches are purged before redirect/lock handling.
  • A normal expired-session 401 purges before redirecting to the session-expired login route.
  • Existing sign-out, remote revocation, and valid offline flows remain green.

Evidence: frontend/offline-work.js, frontend/dashboard.js, and frontend/service-worker.js retain/serve private work for up to seven days, while src/dashboard_auth.py sessions default to eight hours and frontend/session.js currently preserves private data on ordinary expiry. No open/closed issue title or recent commit implements an expiry-bound offline authorization lease.

## Problem The dashboard retains private offline snapshots, drafts, outboxes, and a cached authenticated shell beyond the eight-hour operator session. A cold offline launch can therefore render issue bodies, comments, review diffs, and drafts after server authorization has expired. ## Vertical slice Expose the signed session expiry to the browser, persist an offline authorization lease, and refuse/purge private offline work once that lease expires. Preserve existing offline behavior while the lease is valid. Normal online session expiry must purge before redirecting, matching explicit sign-out and remote-revocation safety. ## Acceptance tests - Authenticated session metadata includes the absolute expiry and remains non-cacheable; unauthenticated requests disclose no lease. - Before expiry, saved My Work/details remain available during an outage. - At/after expiry, private hydration is blocked and Stackchain local/session storage, IndexedDB outboxes, and dashboard caches are purged before redirect/lock handling. - A normal expired-session 401 purges before redirecting to the session-expired login route. - Existing sign-out, remote revocation, and valid offline flows remain green. Evidence: `frontend/offline-work.js`, `frontend/dashboard.js`, and `frontend/service-worker.js` retain/serve private work for up to seven days, while `src/dashboard_auth.py` sessions default to eight hours and `frontend/session.js` currently preserves private data on ordinary expiry. No open/closed issue title or recent commit implements an expiry-bound offline authorization lease.
timmy was assigned by rockachopa 2026-08-09 11:50:44 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#399
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?