Kristian WindandClaude Opus 5
4276892590
`last_seen_at` has been written on every request since sessions existed —
throttled to once a minute, deliberately, so a list could one day say
"denne enhed, lige nu" — and nothing has ever read it. The store even had
ListSessions. What was missing was two routes and a panel.
GET /auth/sessions lists them, most recently used first, with the current
one marked so nobody has to work out which row is the browser they are
reading it in. DELETE /auth/sessions/{id} ends one. Ending the current
session is allowed and is simply logging out: refusing it would be a rule
with no reason behind it, and somebody clearing every device wants this
one gone too.
Both are behind requireSession rather than the ambient auth, the same as
the API tokens. A leaked token that could list its owner's devices and end
their sessions turns a theft into a lockout.
The delete is scoped in the statement rather than checked and then run.
An id read in one step and deleted in the next is a window, and the whole
reason somebody is on this screen is that they think another person is in
their account.
The device names are a handful of substring tests, not a parsing library.
The question this answers is "is one of these me?", and for that a wrong
guess between two Chromium forks costs nothing while a dependency that has
to be kept current costs something every year. Order is the whole
correctness of it: an iPhone's user agent says Mac OS X, Edge says Chrome,
and Chrome says Safari. The raw string is sent alongside and sits in the
row's title, so anything the summary gets wrong is still visible — and
something that is not a browser at all shows its own name rather than
"Ukendt", because a CalDAV client is a real session.
Times are relative. The question is "was that me, just now?", and an
absolute timestamp makes the reader do the subtraction; past a week it
switches to a date, because "for 23 dage siden" is a number nobody can
place.
The smoke test signs in a second time in a second browser context, ends
that session from the first, and checks the other browser is really signed
out — and that this one is not.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
33 lines
1.2 KiB
JavaScript
33 lines
1.2 KiB
JavaScript
import { test as setup, expect } from '@playwright/test';
|
|
|
|
/**
|
|
* Creates the first account and saves the session for every other test.
|
|
*
|
|
* This is also the sign-in smoke test: if the bootstrap form, the session cookie
|
|
* or the app shell is broken, nothing below runs and the failure names this file.
|
|
*/
|
|
|
|
import { USER } from './user.js';
|
|
|
|
const AUTH_FILE = 'e2e/.auth/user.json';
|
|
|
|
setup('opret den første konto og log ind', async ({ page }) => {
|
|
await page.goto('/');
|
|
|
|
await expect(page.getByText('Opret den første konto')).toBeVisible();
|
|
|
|
// Regexes, not exact strings: the password label carries a hint beside it, so
|
|
// its accessible name is the label plus that sentence.
|
|
await page.getByLabel(/Navn/).fill(USER.name);
|
|
await page.getByLabel(/E-mail/).fill(USER.email);
|
|
await page.getByLabel(/Adgangskode/).fill(USER.password);
|
|
await page.getByRole('button', { name: 'Opret konto' }).click();
|
|
|
|
// The shell, not just a redirect: a 200 that renders nothing would pass a
|
|
// URL assertion and fail a person.
|
|
await expect(page.getByRole('navigation', { name: 'Hovedmenu' })).toBeVisible();
|
|
await expect(page.getByRole('heading', { name: 'I dag' })).toBeVisible();
|
|
|
|
await page.context().storageState({ path: AUTH_FILE });
|
|
});
|