2 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	766eef04c5	test: the user model and session refresh carry time_zone (milestone 490) ... Run 8736: test_user_model_fields listed the columns without time_zone, and the session-refresh fixture's users had no time_zone attribute. The refresh test now also asserts a zone set on the Account page reaches the session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 08:00:32 -04:00
bvandeusenandClaude Opus 5.5	7a3f7869fe	feat(auth): sessions end when they should; logins are throttled; Secure behind HTTPS (#5035) ... #5035 "Sessions: lifetime applied, role and is_active re-read per request, logout is a POST, failed logins throttled". - steward/core/proxy.py: trusted_value / is_https / client_ip read X-Forwarded-Proto and -For only as far as the trusted proxy hops (Settings → General, default 1, 0 = trust none). - The session cookie is Secure, and HSTS is sent, only on requests that arrived over HTTPS by that rule; plain-HTTP and LAN use are unchanged and nothing redirects. - A login lasts Settings → General's session lifetime from when it began (session.permanent + a login_at stamp checked every request — the cookie's own age slides on every response). A deleted or deactivated user is logged out on their next request; a role change applies at once. - Logout is a POST (a form in the sidebar); GET /logout is gone. - Failed logins pause an address after login.max_failures within login.lockout_minutes (Settings → General; defaults 5 in 15 min), keyed by address so nobody can lock a user out by name. Failures are audited as auth.login_failed with the address. - to_access_cfg projects the new settings into app.config at startup and on save, beside the existing projections. - Integration tests seed real users and a login_at, since every request now re-reads the session's user. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 11:02:27 -04:00