- Ya
- 10 Agosti 2026, 18:43 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 7a6c109
The expiration on the Redis record IS the session: when it lapses the member is signed out. Reading a session no longer touches it. Only genuine interaction extends it, through the client activity tracker calling session extend — which this service now owns as the single implementation. getSession stops sliding entirely. updateSession carries the REMAINING ttl forward instead of resetting to full, so re-baking rights cannot hand a member a fresh timeout. getSessionIdFromCookie resolves the OTK request attribute first, so a BFF proxying on the member's behalf can reach session extend at all — without that, the one sanctioned renewal path was unreachable through the proxy. Deletes the X-Kamo-Idle-Ms apparatus. It existed to tell services WHEN to renew; with nothing renewing on read it has no consumer, and leaving it would imply renewal still happens somewhere. SessionTtlWriteRatchetTest fails the build if any file writes a TTL against the session key again. It resolves the `redisKey = SESSION_PREFIX + id` shape specifically — a grep for expire() on lines mentioning *** matches none of the five services that had this bug, which is why the earlier sweep missed four of them.