Andrey Antukh d6e82f44a6

✨ Enforce absolute maximum session duration (#11447) ...

Session tokens now carry an :exp claim anchored to created-at (not
modified-at), so activity cannot extend the session beyond the
absolute maximum (default 30 days, configurable via
PENPOT_AUTH_TOKEN_COOKIE_MAX_AGE_ABSOLUTE). The existing token
verification already rejects expired tokens, so enforcement is
automatic. Also extends the GC task to purge expired
http_session_v2 rows, which were previously never cleaned up.

Closes #11444

AI-assisted-by: longcat-2.0

2026-09-09 11:45:28 +02:00

..

backend_tests

✨ Enforce absolute maximum session duration (#11447)

2026-09-09 11:45:28 +02:00

e2e

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00