The GitHub Actions job "CI" on rocketmq-dashboard.git/fix/yy-session-idle has failed. Run started by GitHub user yyqdbngt (triggered by yyqdbngt).
Head commit for run: a58f090741c87fdd1d3f348136d52a47a9db0959 / yyqdbngt <[email protected]> feat(auth): enforce a session idle timeout on bearer tokens A session token stayed valid until its absolute expiry (24 hours by default) no matter how long it went unused. last_seen_at was tracked, refreshed and shown as stale after 15 unused minutes, but a stale session stayed fully authenticated, so a token leaked out of an abandoned browser was a working credential for up to a day. Add studio.auth.session-idle-timeout-minutes (default 30, 0 opts out). databaseUserForToken now revokes and rejects a session whose last use is older than the window, the five-minute cleanup revokes idle rows so the active-session views stay truthful even when the abandoned token is never presented again, and the in-memory mode tracks last-seen per token and enforces the same window. Values below 10 minutes resolve to 10, above the five-minute last-seen write throttle, so an active session can never be idled out by its own throttled writes; out-of-range values fall back to the default; sessions written before last_seen_at existed keep the absolute deadline as their only deadline, and the absolute timeout is unchanged. Tests: AuthServiceIdleTimeoutTest covers rejection plus revocation, the in-window session and its last-seen refresh, the write throttle, the 0 opt-out, the minimum resolution, NULL last_seen_at, the scheduled revocation with the absolute delete, and both in-memory paths. Report URL: https://github.com/apache/rocketmq-dashboard/actions/runs/36960078815 With regards, GitHub Actions via GitBox
