mirror of
https://github.com/penpot/penpot.git
synced 2026-10-31 06:50:33 +00:00
53008ea794
The management method mints a real `http_session_v2` of the owner of a running job, so a worker renders as the user through the auth surfaces that already exist (cookies for render.html and assets, Bearer for the RPC). It refuses anything the login would not accept: an unknown job, a job that is not running, a job without owner, and an owner profile that is inactive, blocked or deleted. Every call mints a fresh session, so worker retries never wait on one a settle may have closed, and the token carries the short `:exp` of the new `:job-session-ttl` config (default 1h): a worker that dies without settling leaves nothing usable for long, and the sessions idle GC sweeps the row. The token minting moves to a public `generate-token` in app.http.session, with an explicit `:exp`, and the login path delegates to it unchanged. AI-assisted-by: glm-5.3-flash