stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Stop Web Push when a device session expires #553

New Issue
Closed
opened 2026-08-11 07:50:17 +00:00 by timmy · 0 comments
timmy commented 2026-08-11 07:50:17 +00:00
Owner
Copy Link

Problem

Durable Web Push subscriptions continue receiving generic unread-work notifications after their associated device session has expired or crossed its idle deadline. Explicit sign-out and revocation clean up subscriptions, but background expiry currently does not gate dispatch.

User value

Lost and unattended devices stop learning that account activity exists as soon as dashboard access is no longer authorized, while active devices retain exactly-once delivery.

Acceptance criteria

  • Active device sessions continue receiving deduplicated pushes.
  • Expired, idle-locked, and revoked sessions receive no push and stale subscriptions are removed.
  • Session-registry failures fail closed without deleting subscriptions, allowing retry.
  • One invalid subscription does not block an active device.
  • Focused tests and full suite pass.

Non-duplication evidence

Issues #549 and #551 added Web Push and multi-worker delivery fencing; neither authorizes dispatch against absolute/idle session validity. Historical issue titles and recent commits contain no equivalent lifecycle gate.

## Problem Durable Web Push subscriptions continue receiving generic unread-work notifications after their associated device session has expired or crossed its idle deadline. Explicit sign-out and revocation clean up subscriptions, but background expiry currently does not gate dispatch. ## User value Lost and unattended devices stop learning that account activity exists as soon as dashboard access is no longer authorized, while active devices retain exactly-once delivery. ## Acceptance criteria - Active device sessions continue receiving deduplicated pushes. - Expired, idle-locked, and revoked sessions receive no push and stale subscriptions are removed. - Session-registry failures fail closed without deleting subscriptions, allowing retry. - One invalid subscription does not block an active device. - Focused tests and full suite pass. ## Non-duplication evidence Issues #549 and #551 added Web Push and multi-worker delivery fencing; neither authorizes dispatch against absolute/idle session validity. Historical issue titles and recent commits contain no equivalent lifecycle gate.
timmy self-assigned this 2026-08-11 07:50:17 +00:00
timmy closed this issue 2026-08-11 07:57:06 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#553
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?