Make reads read-only, leaving one writer of the *** TTL

RefactorSecurityService
Shipped
August 10, 2026 at 6:43 PM UTC
Author
Kamo
Commit
7a6c109

The expiration on the Redis record IS the session: when it lapses the member is signed out. Reading a session no longer touches it. Only genuine interaction extends it, through the client activity tracker calling session extend — which this service now owns as the single implementation. getSession stops sliding entirely. updateSession carries the REMAINING ttl forward instead of resetting to full, so re-baking rights cannot hand a member a fresh timeout. getSessionIdFromCookie resolves the OTK request attribute first, so a BFF proxying on the member's behalf can reach session extend at all — without that, the one sanctioned renewal path was unreachable through the proxy. Deletes the X-Kamo-Idle-Ms apparatus. It existed to tell services WHEN to renew; with nothing renewing on read it has no consumer, and leaving it would imply renewal still happens somewhere. SessionTtlWriteRatchetTest fails the build if any file writes a TTL against the session key again. It resolves the `redisKey = SESSION_PREFIX + id` shape specifically — a grep for expire() on lines mentioning *** matches none of the five services that had this bug, which is why the earlier sweep missed four of them.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing