@bongos/core 1.19.791 → 1.19.792

package/src/bongos/db.js

@@ -664,32 +664,41 @@ async function reactivateBuilder({ builderId, actorBuilderId }) {
 // Sessions (auth tokens)
 // -------------------------------------------------------------------------
 //
-// V3.R38 / task #259 — short-lived sessions with refresh-on-use.
+// V3.R38 / task #259 — short-lived sessions with refresh-on-use (1h).
 // V3.R90 / task #400 (2026-05-29) — TTL widened from 1h to 24h.
+// ADR 0294 / task 1003956 (2026-09-16) — CLI sessions lose their expiry entirely.
 //
-//   * Every NEW session (CLI or web) defaults to a 24-hour TTL. The caller may
-//     still pass an explicit expiresAt to override (web flow uses 30 days for
-//     the cookie's max-age, but the SERVER-SIDE row still uses 24h + roll-on-use
-//     so a logged-out browser tab in someone's history can't be replayed weeks
-//     later).
-//   * Every successful lookupSession bumps BOTH last_used_at AND expires_at to
-//     NOW() + 24h. This is the "refresh-on-use" half: an actively-used session
-//     stays valid; an idle session expires after 24h. The bump is fire-and-
-//     forget — it's an optimization for the next request, not a precondition
-//     for THIS request, so we don't add request latency by awaiting it.
-//   * Migration 035 backfilled all pre-existing rows with a 24h grace runway
-//     so deploying the V3.R38 change didn't kick the supervisor / mid-flow
-//     builders. With the V3.R90 TTL = 24h, the refresh window matches that
-//     grace formula exactly — no further migration needed.
-//   * The 1h value originally backstopped C7 (rank-change-near-instant), but
-//     setBuilderRank already calls revokeAllSessionsForBuilder on every
-//     demotion (see below), so the TTL is no longer load-bearing for C7. Its
-//     remaining job is idle-session hygiene under C9 (security baseline).
-//     24h still kills idle sessions overnight; an active builder no longer
-//     gets kicked out over lunch.
-
-// Session TTL on refresh / creation, in milliseconds. Centralized so the
-// migration's grace formula, the test suite, and the code agree on one number.
+// The arc is one long argument the idle timer kept losing. 1h kicked builders
+// out over lunch; 24h kicked them out over a weekend. Each round shortened the
+// nuisance without touching the threat, because the timer never bounded a leaked
+// token in the first place — refresh-on-use means the thief's own traffic keeps
+// it alive, and only the legitimate holder, who steps away, is ever signed out.
+// So the expiry is gone from CLI sessions rather than widened a third time.
+//
+//   * A NEW session whose caller names no expiry gets NONE — expires_at NULL,
+//     which lookupSession treats as never-expires. Every such caller is
+//     source='cli'. The WEB flow passes an explicit 30 days and is unchanged.
+//   * Every successful lookupSession bumps last_used_at, and rolls expires_at
+//     forward to NOW()+24h ONLY for a row that already has one. A NULL stays
+//     NULL — otherwise the first request after sign-in would mint the very
+//     timeout this removed. The bump is fire-and-forget: an optimization for the
+//     next request, not a precondition for THIS one, so it isn't awaited.
+//   * Migration core_243 cleared expires_at on live source='cli' rows, so the
+//     change reached sessions that already existed instead of making every
+//     builder re-auth one last time. (Migration 035 had backfilled a 24h grace
+//     in the other direction, for the same reason: don't sign out the session
+//     deploying the migration.)
+//   * Nothing here is load-bearing for C7 (rank-change-near-instant):
+//     setBuilderRank calls revokeAllSessionsForBuilder on every demotion (see
+//     below) and requireBuilder denies a deactivated builder on the hot path, so
+//     authority drift is closed by revocation, not by waiting out a clock.
+//   * The remedy for a leaked bearer is the own-scoped revoke of ADR 0206 —
+//     GET/POST /me/sessions, and "Sign out everywhere" in the hall — which kills
+//     it now rather than within a day. That is why the timer is affordable to
+//     lose: the thing it was nominally for has a faster answer that already ships.
+
+// The roll-forward window for a session that HAS an expiry, in milliseconds.
+// Centralized so the test suite and the code agree on one number.
 
 // SESSION_TTL_MS — carved to ./db-kernel (ADR 0102); imported + re-exported above.
 

package/src/bongos/routes/auth.js

@@ -1049,7 +1049,8 @@ module.exports = function buildAuthRouter() {
         // audit_log distinguishes portal-reissue from Device Flow tokens.
         source: 'cli',
         userAgent: req.headers['user-agent'] ?? null,
-        // expiresAt: null → createSession applies SESSION_TTL_MS (24h after V3.R90).
+        // expiresAt: null → NO expiry: a CLI bearer lasts until revoked (ADR 0294).
+        // The builder kills it from this same Settings page, under Active sessions.
         expiresAt: null,
       });
       res.json({
@@ -1189,7 +1190,7 @@ module.exports = function buildAuthRouter() {
         token,
         source: 'cli', // 003_pms.sql CHECK; the app is a CLI-class bearer client
         userAgent: `devbox-app pair (${req.headers['user-agent'] ?? 'unknown'})`,
-        expiresAt: null, // createSession applies the 24h refresh-on-use TTL
+        expiresAt: null, // no expiry — a CLI bearer lasts until revoked (ADR 0294)
       });
       const out = pairStore.approve((req.body || {}).pair_code, {
         token,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.791'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.792'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_session_expiry_db.mjs

@@ -0,0 +1,183 @@
+// tests/auth_session_expiry_db.mjs — ADR 0294, task 1003956 (real DB).
+//
+// The DB-free sibling (auth_session_ttl.mjs) pins the CONSTANT, createSession's
+// choice of value against a stub pool, and the TEXT of the refresh statement and
+// the migration. That last part is the weak half, and the grader on this task was
+// right to say so — though not for the reason first assumed. Most edits to the
+// guard's WORDING do break its regex, so the sibling is tighter than it looks.
+// What a regex cannot see is whether Postgres ACCEPTS the statement at all.
+//
+// Measured, by deleting the CASE's `END` and running both files: the sibling
+// reported 20 passed, 0 failed on SQL that fails to parse — SQL that would throw
+// on every authenticated request in production. This file caught it.
+//
+// Worth knowing WHICH assertions caught it, because it is not the obvious one.
+// The refresh is fire-and-forget with a `.catch()`, so a broken UPDATE fails
+// SILENTLY: expires_at stays NULL and the never-expires assertion still passes.
+// What failed was `last_used_at` never moving and the web row never rolling. Those
+// two are not padding — on this statement they are the only live smoke alarm.
+//
+// So this file proves what only a real transaction engine can:
+//
+//   1. A CLI session is CREATED with no expiry, and a web session's explicit
+//      30 days survives untouched — the two halves of the default change.
+//   2. THE REGRESSION GUARD EXECUTES — after a real lookupSession, a CLI row's
+//      expires_at is still NULL. Without the CASE this is where the timeout
+//      comes back, on the first request after sign-in.
+//   3. A web row's expiry STILL rolls forward, so the guard narrowed the write
+//      to NULL rows rather than disabling refresh-on-use for everyone.
+//   4. Expiry is still HONOURED where present, and revocation still wins — the
+//      two things a "sessions never expire" change could plausibly have broken.
+//   5. THE MIGRATION, run for real: it clears a pre-existing CLI expiry, leaves
+//      web and revoked rows alone, and is idempotent.
+//   6. The point of the whole task — a session idle far past 24h authenticates.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in
+// run-unit-tests.js's INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/auth_session_expiry_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIGRATION = join(here, '..', 'migrations', 'core_243_cli_sessions_never_expire.sql');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`auth_session_expiry_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// An isolated schema, so this never touches a real builders/builder_sessions.
+const SCHEMA = `ttl_probe_${process.pid}`;
+await pool.query(`CREATE SCHEMA ${SCHEMA}`);
+await pool.query(`SET search_path TO ${SCHEMA}`);
+await pool.query(`
+  CREATE TABLE builders (id bigserial PRIMARY KEY, github_id text, github_login text,
+    display_name text, avatar_url text, total_credits int DEFAULT 0, rank text DEFAULT 'archon',
+    status text DEFAULT 'active', system_role text, anthropic_user_id text);
+  CREATE TABLE builder_sessions (id bigserial PRIMARY KEY, builder_id bigint REFERENCES builders(id),
+    token text UNIQUE, source text, user_agent text, created_at timestamptz DEFAULT now(),
+    last_used_at timestamptz DEFAULT now(), expires_at timestamptz, revoked_at timestamptz);
+  INSERT INTO builders (github_login) VALUES ('probe');
+`);
+
+// Run the REAL kernel against this schema: stub ./pool in the require cache so
+// db-kernel binds our client, exactly as the production code binds the singleton.
+const client = await pool.connect();
+await client.query(`SET search_path TO ${SCHEMA}`);
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: client } };
+const kernel = require('../src/bongos/db-kernel.js');
+
+let passed = 0, failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+const row = async (sql, p) => (await client.query(sql, p)).rows[0];
+// refresh-on-use is fire-and-forget: let the UPDATE land before reading it back.
+const settle = () => new Promise((r) => setTimeout(r, 300));
+
+const thirtyDays = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+
+await t('a CLI session is created with NO expiry', async () => {
+  const s = await kernel.createSession({ builderId: '1', token: 'cli-tok', source: 'cli', userAgent: 'probe', expiresAt: null });
+  assert.equal(s.expires_at, null);
+});
+
+await t("a web session's explicit 30-day expiry is stored as given", async () => {
+  const s = await kernel.createSession({ builderId: '1', token: 'web-tok', source: 'web', userAgent: 'probe', expiresAt: thirtyDays });
+  assert.equal(s.expires_at.getTime(), thirtyDays.getTime());
+});
+
+await t('lookupSession resolves a CLI bearer to its builder', async () => {
+  const got = await kernel.lookupSession('cli-tok');
+  assert.equal(got && got.github_login, 'probe');
+});
+
+// THE GUARD. This is the assertion the source-matching sibling cannot make.
+await t('after a real use, a CLI session STILL has no expiry (the CASE guard)', async () => {
+  await kernel.lookupSession('cli-tok');
+  await settle();
+  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token='cli-tok'`)).expires_at, null);
+});
+
+await t('refresh-on-use still bumps last_used_at on that same row', async () => {
+  const before = (await row(`SELECT last_used_at FROM builder_sessions WHERE token='cli-tok'`)).last_used_at;
+  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '1 hour' WHERE token='cli-tok'`);
+  await kernel.lookupSession('cli-tok');
+  await settle();
+  const after = (await row(`SELECT last_used_at FROM builder_sessions WHERE token='cli-tok'`)).last_used_at;
+  assert.ok(after > new Date(Date.now() - 60_000), `last_used_at did not move: ${after} (was ${before})`);
+});
+
+await t('a web session still rolls its expiry forward (refresh-on-use intact)', async () => {
+  await kernel.lookupSession('web-tok');
+  await settle();
+  const got = (await row(`SELECT expires_at FROM builder_sessions WHERE token='web-tok'`)).expires_at;
+  assert.ok(got !== null && got < thirtyDays, `expected a rolled-forward date below 30d, got ${got}`);
+});
+
+await t('an expired session is still REFUSED (expiry honoured where present)', async () => {
+  await client.query(`INSERT INTO builder_sessions (builder_id, token, source, expires_at)
+                      VALUES (1,'dead-tok','web', now() - interval '1 hour')`);
+  assert.equal(await kernel.lookupSession('dead-tok'), null);
+});
+
+await t('a revoked CLI session is still REFUSED', async () => {
+  await client.query(`INSERT INTO builder_sessions (builder_id, token, source, revoked_at)
+                      VALUES (1,'revoked-tok','cli', now())`);
+  assert.equal(await kernel.lookupSession('revoked-tok'), null);
+});
+
+// The migration, against rows shaped like the ones live instances actually hold.
+const migrationSql = readFileSync(MIGRATION, 'utf8');
+await client.query(`INSERT INTO builder_sessions (builder_id, token, source, expires_at) VALUES
+  (1,'old-cli','cli', now() + interval '24 hours'),
+  (1,'old-web','web', now() + interval '30 days'),
+  (1,'old-revoked','cli', now() + interval '24 hours')`);
+await client.query(`UPDATE builder_sessions SET revoked_at = now() WHERE token='old-revoked'`);
+await client.query(migrationSql);
+
+await t('core_243 clears a pre-existing CLI expiry', async () => {
+  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-cli'`)).expires_at, null);
+});
+
+await t('core_243 leaves a WEB row dated — the source filter is its safety property', async () => {
+  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-web'`)).expires_at, null);
+});
+
+await t('core_243 leaves a revoked row alone (it is the audit trail)', async () => {
+  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-revoked'`)).expires_at, null);
+});
+
+await t('core_243 is idempotent — a re-run changes nothing', async () => {
+  await client.query(migrationSql);
+  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-cli'`)).expires_at, null);
+  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-web'`)).expires_at, null);
+});
+
+// The whole point of the task, stated as a test.
+await t('a CLI session idle for 21 DAYS still authenticates', async () => {
+  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '21 days' WHERE token='cli-tok'`);
+  assert.notEqual(await kernel.lookupSession('cli-tok'), null);
+});
+
+await client.query(`SET search_path TO public`);
+client.release();
+await pool.query(`DROP SCHEMA ${SCHEMA} CASCADE`);
+await pool.end();
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/auth_session_ttl.mjs

@@ -19,15 +19,30 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const db = require('../src/bongos/db.js');
 
 let passed = 0;
 let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+// Cases are queued rather than run inline so an ASYNC one (the createSession
+// checks below hit a stubbed pool through an async function) is actually awaited.
+// Running those inline would report PASS before the assertion resolved, and a
+// rejection would surface as an unhandled rejection instead of a FAIL.
+const queue = [];
+function t(name, fn) { queue.push({ name, fn }); }
+// Section headers queue too, so they still print ABOVE the cases they introduce
+// instead of all bunching at the top once execution is deferred.
+function section(label) { queue.push({ label }); }
+async function runQueue() {
+  for (const item of queue) {
+    if (item.label) { console.log(item.label); continue; }
+    const { name, fn } = item;
+    try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+    catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+  }
+  queue.length = 0;
 }
 
 // ---------------------------------------------------------------------------
@@ -103,7 +118,7 @@ function isDemotion(oldRank, newRank) {
   return newIdx > oldIdx;
 }
 
-console.log('\ndemotion-detection (revoke-all hook in setBuilderRank):');
+section('\ndemotion-detection (revoke-all hook in setBuilderRank):');
 
 t('archon → metic is a demotion (revoke triggers)', () => {
   assert.equal(isDemotion('archon', 'metic'), true);
@@ -135,21 +150,119 @@ t('an unknown rank string does not crash and returns false', () => {
 });
 
 // ---------------------------------------------------------------------------
-// 3. TTL constant (criterion C9: idle-session hygiene)
+// 3. No expiry on a CLI session (ADR 0294)
 // ---------------------------------------------------------------------------
-// V3.R90 / #400: widened from 1h to 24h. Refresh-on-use is unchanged, so an
-// actively-used session is still indefinite — the constant only governs how
-// long an idle session lives. 1h kicked builders out over lunch; 24h still
-// kills idle sessions overnight. C7 (rank-change-near-instant) is unaffected
-// because demotion calls revokeAllSessionsForBuilder synchronously.
+// The TTL was argued three times — 1h (V3.R38/#259), 24h (V3.R90/#400), then
+// gone (ADR 0294 / task 1003956). The first two rounds moved the number; the
+// third removed the mechanism, because refresh-on-use meant the timer only ever
+// fired on a session gone QUIET — the legitimate holder stepping away — while a
+// leaked token's own traffic kept it alive. What is asserted here is the shape
+// that replaced it, and the two ways it could silently come back.
+//
+// createSession is exercised against a STUB POOL rather than a live Postgres, in
+// keeping with this file's no-real-PG stance: the claim under test is which
+// value reaches the INSERT, which is a pure function of the argument. The pool
+// module is stubbed in the require cache before db-kernel is loaded fresh, since
+// db-kernel binds `pool` once at module load.
 
-console.log('\nSESSION_TTL_MS constant:');
+section('\nSESSION_TTL_MS constant:');
 
 t('SESSION_TTL_MS is exactly 24 hours (86,400,000 ms)', () => {
   assert.equal(db.SESSION_TTL_MS, 24 * 60 * 60 * 1000);
 });
 
+section('\ncreateSession expiry default (ADR 0294):');
+
+// Load db-kernel over a stub pool that records the parameters it is handed.
+const poolPath = require.resolve('../src/bongos/pool.js');
+const kernelPath = require.resolve('../src/bongos/db-kernel.js');
+const realPool = require.cache[poolPath];
+const realKernel = require.cache[kernelPath];
+const calls = [];
+require.cache[poolPath] = {
+  id: poolPath, filename: poolPath, loaded: true, exports: {
+    pool: { query: async (text, params) => { calls.push({ text, params }); return { rows: [{ id: '1' }] }; } },
+  },
+};
+delete require.cache[kernelPath];
+const kernel = require('../src/bongos/db-kernel.js');
+
+// expires_at is the 5th INSERT parameter — see createSession's VALUES list.
+async function expiryFor(expiresAt) {
+  calls.length = 0;
+  await kernel.createSession({ builderId: '1', token: 't', source: 'cli', userAgent: null, expiresAt });
+  return calls[0].params[4];
+}
+
+t('a CLI session named with NO expiry is stored with expires_at NULL', async () => {
+  assert.equal(await expiryFor(null), null);
+});
+
+t('an OMITTED expiresAt is also stored as NULL, not a 24h default', async () => {
+  assert.equal(await expiryFor(undefined), null);
+});
+
+t('an EXPLICIT expiry is preserved verbatim — the web flow keeps its 30 days', async () => {
+  const thirtyDays = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+  assert.equal((await expiryFor(thirtyDays)).getTime(), thirtyDays.getTime());
+});
+
+section('\nrefresh-on-use must not re-mint an expiry (ADR 0294):');
+
+// THE REGRESSION THIS GUARDS. lookupSession rolls expires_at forward on every
+// authenticated request. Without the NULL guard, the FIRST request after sign-in
+// would write now()+24h onto a never-expires row and restore the whole timeout —
+// silently, with createSession still looking correct. Asserted over the source
+// because the behaviour lives in SQL the stub pool never executes.
+const kernelSrc = readFileSync(new URL('../src/bongos/db-kernel.js', import.meta.url), 'utf8');
+const refreshSql = kernelSrc.slice(
+  kernelSrc.indexOf('UPDATE builder_sessions'),
+  kernelSrc.indexOf('[row.session_id, SESSION_TTL_MS]')
+);
+
+t("refresh-on-use leaves a NULL expires_at NULL", () => {
+  assert.ok(refreshSql.includes('UPDATE builder_sessions'), 'refresh statement not found');
+  assert.match(refreshSql, /CASE\s*\n?\s*WHEN expires_at IS NULL THEN NULL/);
+});
+
+t('refresh-on-use still bumps last_used_at (the own-sessions list reads it)', () => {
+  assert.match(refreshSql, /last_used_at = now\(\)/);
+});
+
+section('\nmigration core_243 scope:');
+
+// The migration clears expires_at on rows that already exist. Its source filter
+// is the entire safety property: lookupSession only rolls an expiry it can
+// already SEE, so a web row cleared here would stay cleared forever — an
+// immortality nobody decided on, and unrecoverable by normal use.
+//
+// Comment lines are STRIPPED before matching. This file's header explains the
+// source filter at length, so asserting over the raw text would let the prose
+// satisfy a check the statement no longer meets — verified by deleting the WHERE
+// clause and watching the revoked_at assertion still pass.
+const migrationSql = readFileSync(
+  new URL('../migrations/core_243_cli_sessions_never_expire.sql', import.meta.url), 'utf8'
+)
+  .split('\n')
+  .filter((line) => !line.trim().startsWith('--'))
+  .join('\n');
+
+t("core_243 only clears CLI rows", () => {
+  assert.match(migrationSql, /SET expires_at = NULL/);
+  assert.match(migrationSql, /WHERE source = 'cli'/);
+});
+
+t('core_243 leaves revoked rows alone (they are the audit trail)', () => {
+  assert.match(migrationSql, /revoked_at IS NULL/);
+});
+
 // ---------------------------------------------------------------------------
 
+await runQueue();
+
+// Put the real modules back so anything importing this file after it is unaffected.
+if (realPool) require.cache[poolPath] = realPool; else delete require.cache[poolPath];
+if (realKernel) require.cache[kernelPath] = realKernel; else delete require.cache[kernelPath];
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);