- Shipped
- August 10, 2026 at 6:44 PM UTC
- Author
- kamo
- Commit
- 136a31b
/api/user-info wrote the session TTL straight to Redis, bypassing every service-side rule — and useUserInfo polls it every five minutes forever, so that one line kept every session alive overnight on its own. It was found by tracing live Redis traffic, not by reading the code: MONITOR showed this pod issuing `expire ***... 1800` seconds after SecurityService had correctly decoderd to renew the same key. Now: reading who you are is not interaction, so the route makes no TTL write and reports the REAL remaining time instead of assuming a fresh timeout. /api/session/extend stops writing Redis directly and relays to SecurityService, leaving a single implementation of renewal platform-wide. The extend route still plants the *** cookie — the universe/ksem EventSources have no other auth carrier. Deletes the X-Kamo-Idle-Ms plumbing: with nothing renewing on read it has no consumer. sessionTtlWriteRatchet.test.ts fails the build if any route writes a session TTL again; logout is sanctioned because setex(key, 1, '{}') destroys a session rather than renewing it. Design: ****************