stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Lock cached dashboard after the confirmed idle deadline #523

New Issue
Closed
opened 2026-08-10 23:50:20 +00:00 by timmy · 0 comments
timmy commented 2026-08-10 23:50:20 +00:00
Owner
Copy Link

Problem

The server enforces the 15-minute inactivity timeout, but the installed PWA persists only the eight-hour absolute expiry. During an outage or cold offline launch, the service worker can therefore expose the cached private dashboard after the server-side idle deadline.

User flow

Publish the server-confirmed idle deadline with session metadata and successful activity heartbeats. Persist both deadlines in the browser and service worker. At the idle deadline, lock without deleting drafts/outboxes; at absolute expiry, retain the existing destructive purge. A failed heartbeat must never extend either deadline.

Acceptance tests

  • Authenticated session status returns a non-cacheable idle_expires_at without extending activity; anonymous status discloses no lease.
  • A successful activity heartbeat republishes the confirmed idle deadline; failed/offline heartbeats do not extend it.
  • Active pages lock exactly once at idle expiry without clearing private browser data.
  • Offline navigation before idle expiry serves the cached shell. At/after idle expiry it returns a non-cacheable idle lock response and preserves drafts/outboxes/caches.
  • Absolute expiry still purges private browser data and caches.

Evidence / non-duplication

src/main.py session status exposes only expires_at; frontend/session.js and frontend/service-worker.js schedule/check only that value. Historical issue #463 added server-side idle validation, and #399 added absolute offline expiry, but neither enforces the shorter idle boundary offline. No open/closed issue title or recent commit implements an offline idle lease.

## Problem The server enforces the 15-minute inactivity timeout, but the installed PWA persists only the eight-hour absolute expiry. During an outage or cold offline launch, the service worker can therefore expose the cached private dashboard after the server-side idle deadline. ## User flow Publish the server-confirmed idle deadline with session metadata and successful activity heartbeats. Persist both deadlines in the browser and service worker. At the idle deadline, lock without deleting drafts/outboxes; at absolute expiry, retain the existing destructive purge. A failed heartbeat must never extend either deadline. ## Acceptance tests - Authenticated session status returns a non-cacheable `idle_expires_at` without extending activity; anonymous status discloses no lease. - A successful activity heartbeat republishes the confirmed idle deadline; failed/offline heartbeats do not extend it. - Active pages lock exactly once at idle expiry without clearing private browser data. - Offline navigation before idle expiry serves the cached shell. At/after idle expiry it returns a non-cacheable idle lock response and preserves drafts/outboxes/caches. - Absolute expiry still purges private browser data and caches. ## Evidence / non-duplication `src/main.py` session status exposes only `expires_at`; `frontend/session.js` and `frontend/service-worker.js` schedule/check only that value. Historical issue #463 added server-side idle validation, and #399 added absolute offline expiry, but neither enforces the shorter idle boundary offline. No open/closed issue title or recent commit implements an offline idle lease.
timmy self-assigned this 2026-08-10 23:50:20 +00:00
timmy closed this issue 2026-08-11 00:02:40 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#523
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?