* feat(auth): make automatic logout an opt-in per-user setting
Session timeouts (30 min idle / 12 h absolute on hosted) now apply only
to users who enable "Automatic logout" in Settings > Security. Default
is off: sessions live for the full Supabase refresh-token lifetime, the
behavior from before the 2026-07 session hardening.
- user_preferences.auto_logout (migration, default false), toggled via
the extended /api/user/preferences route
- The opt-in is snapshotted into the signed timeout cookie at mint, so
enforcement stays DB-read-free per request; the preferences route
clears the cookie on change so a toggle takes effect immediately
- Pre-toggle cookies are authentic-but-stale: re-minted preserving
their timers, never routed down the tamper path, so the rollout does
not log anyone out
- NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true enforces timeouts for
every user regardless of preference (emergency lever, also plumbed
through the Docker image); self-hosted stays disabled by default
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(auth): resolve PR #1536 review findings
- Replace the spread upsert in /api/user/preferences with one literal
payload per field: the phantom-column schema guard cannot resolve
spread payloads (Unit tests 3/4 ceiling failure)
- Map the preferences 500 through getErrorMessage so the user-facing
text is Swedish (CodeRabbit)
- fetchAutoLogoutPreference now returns null on a FAILED read instead
of a fail-open false: callers skip minting so an unknown preference
is never persisted into the year-long signed cookie, and the next
request retries; failures log at error level, distinct from the
normal opt-out path (compliance swarm GDPR Art.32(1)(b) / ISO A.8.5)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(auth): write multi-field preference updates as one atomic upsert
A request carrying both hide_assistant_fab and auto_logout previously
issued two sequential writes, so a failure of the second returned 500
after half the request had persisted (CodeRabbit, PR #1536). One
literal upsert per accepted field combination keeps the write atomic
and stays resolvable for the phantom-column schema guard.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Mattsson
11995b1b0c