hz/step3
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't show the session-expiry warning to actively-used sessions

Browse Source 
The warning was purely a token-expiry countdown with no concept of
user activity, so it interrupted people who had been clicking through
questions the whole time. AuthState now tracks real input activity
globally and silently refreshes the session in the background when
the user has interacted recently, only surfacing the "Stay logged in?"
dialog for sessions that are genuinely idle. A failed background
refresh still surfaces the dialog rather than silently logging the
user out.
This commit is contained in:
hz
2026-07-22 22:52:38 -05:00
parent 9f62444a63
commit f17797becc
3 changed files with 36 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/auth_session_test.gd
+21
View File
@@ -14,6 +14,7 @@ func _run() -> void:
await process_frame
_test_expiration_parsing()
_test_warning_and_expiration()
_test_active_user_silently_refreshes_instead_of_warning()
_test_refresh_preserves_identity()
_test_refresh_in_flight_has_expiry_grace()
_test_stale_responses_cannot_restore_or_end_session()
@@ -40,6 +41,7 @@ func _test_warning_and_expiration() -> void:
auth.session_warning.connect(warning_callback)
auth.session_expired.connect(expiration_callback)
auth.set_session("tester", "warning-token", "refresh-token", "USER", str(Time.get_unix_time_from_system() + 90.0))
auth.last_activity_unix = Time.get_unix_time_from_system() - 3600.0
auth._evaluate_expiry()
_assert(int(observed["warning_seconds"]) > 0 and int(observed["warning_seconds"]) <= 90, "session should warn inside the two-minute renewal window")
auth.expiration_unix = Time.get_unix_time_from_system() - 1.0
@@ -49,6 +51,25 @@ func _test_warning_and_expiration() -> void:
auth.session_expired.disconnect(expiration_callback)
func _test_active_user_silently_refreshes_instead_of_warning() -> void:
var observed := {"warning_seconds": -1}
var warning_callback := func(seconds: int): observed["warning_seconds"] = seconds
auth.session_warning.connect(warning_callback)
# Point at a local, always-refused port so the real refresh attempt this triggers fails
# fast and never touches the real network - the point of this test is that
# request_session_refresh() gets called at all, not that it succeeds.
auth.auth_base_url = "http://127.0.0.1:1"
auth.set_session("tester", "active-token", "refresh-token", "USER", str(Time.get_unix_time_from_system() + 90.0))
auth.last_activity_unix = Time.get_unix_time_from_system()
auth._evaluate_expiry()
_assert(int(observed["warning_seconds"]) == -1 and not auth.warning_active, "an actively-used session should not show the expiry warning")
_assert(auth.refresh_in_progress, "an actively-used session nearing expiry should silently attempt a refresh instead of warning")
auth.session_warning.disconnect(warning_callback)
auth.refresh_in_progress = false
auth.auth_base_url = auth.DEFAULT_AUTH_BASE_URL
auth.clear_session()
func _test_refresh_preserves_identity() -> void:
var observed := {"refreshed": false}
var refreshed_callback := func(): observed["refreshed"] = true